hxxps://dafvz5743x4yg[.]cloudfront[.]net/SignCloudPC[.]exe

Analysis

user interaction
yes
max time kernel
139s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://dafvz5743x4yg.cloudfront.net/SignCloudPC.exe
Sample260522-mrtfpshs2j

Score

8^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	4216	chrome.exe

Manipulates Digital Signatures 1 TTPs 55 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.3!6\Name = "NetscapeRevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.3!6\Name = "NetscapeRevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.12!6\Name = "NetscapeSSLServerName"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.10!6\Name = "SpcSpAgencyInfo"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.27!6\Name = "SpcFinancialCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.3!6\Name = "NetscapeRevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.1!6\Name = "NetscapeCertType"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.2!6\Name = "NetscapeBaseURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.4!6\Name = "NetscapeCARevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.1!6\Name = "NetscapeCertType"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.2!6\Name = "NetscapeBaseURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.10!6\Name = "SpcSpAgencyInfo"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.1!6\Name = "NetscapeCertType"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.7!6\Name = "NetscapeCertRenewalURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.1!6\Name = "NetscapeCertType"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.12!6\Name = "NetscapeSSLServerName"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.26!6\Name = "SpcMinimalCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.4!6\Name = "NetscapeCARevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.13!6\Name = "NetscapeComment"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.26!6\Name = "SpcMinimalCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.8!6\Name = "NetscapeCAPolicyURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.12!6\Name = "NetscapeSSLServerName"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.26!6\Name = "SpcMinimalCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.7!6\Name = "NetscapeCertRenewalURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.13!6\Name = "NetscapeComment"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.7!6\Name = "NetscapeCertRenewalURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.8!6\Name = "NetscapeCAPolicyURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.2!6\Name = "NetscapeBaseURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.12!6\Name = "NetscapeSSLServerName"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.8!6\Name = "NetscapeCAPolicyURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.10!6\Name = "SpcSpAgencyInfo"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.7!6\Name = "NetscapeCertRenewalURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.10!6\Name = "SpcSpAgencyInfo"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.27!6\Name = "SpcFinancialCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.2!6\Name = "NetscapeBaseURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.8!6\Name = "NetscapeCAPolicyURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.27!6\Name = "SpcFinancialCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.27!6\Name = "SpcFinancialCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.26!6\Name = "SpcMinimalCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.3!6\Name = "NetscapeRevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.12!6\Name = "NetscapeSSLServerName"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.7!6\Name = "NetscapeCertRenewalURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.13!6\Name = "NetscapeComment"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.4!6\Name = "NetscapeCARevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.13!6\Name = "NetscapeComment"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.27!6\Name = "SpcFinancialCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.13!6\Name = "NetscapeComment"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.26!6\Name = "SpcMinimalCriteria"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.4!6\Name = "NetscapeCARevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.10!6\Name = "SpcSpAgencyInfo"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.2!6\Name = "NetscapeBaseURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.8!6\Name = "NetscapeCAPolicyURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.3!6\Name = "NetscapeRevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.4!6\Name = "NetscapeCARevocationURL"	certmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.1!6\Name = "NetscapeCertType"	certmgr.exe

Executes dropped EXE 10 IoCs

pid	Process
5992	SignCloudPC.exe
3288	certmgr.exe
3988	certmgr.exe
5352	certmgr.exe
2444	certmgr.exe
2228	kchain.exe
1600	certmgr.exe
5348	kchain.exe
4516	4identity.exe
1300	kchain_gui.exe

Loads dropped DLL 53 IoCs

pid	Process
5992	SignCloudPC.exe
5992	SignCloudPC.exe
5992	SignCloudPC.exe
5992	SignCloudPC.exe
2848	rundll32.exe
5992	SignCloudPC.exe
5992	SignCloudPC.exe
2228	kchain.exe
5992	SignCloudPC.exe
2228	kchain.exe
2228	kchain.exe
2228	kchain.exe
2228	kchain.exe
2228	kchain.exe
5348	kchain.exe
2228	kchain.exe
2228	kchain.exe
2228	kchain.exe
2228	kchain.exe
2228	kchain.exe
5348	kchain.exe
5348	kchain.exe
5348	kchain.exe
5348	kchain.exe
5348	kchain.exe
5348	kchain.exe
5348	kchain.exe
5348	kchain.exe
5348	kchain.exe
5348	kchain.exe
2228	kchain.exe
2228	kchain.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe

Modifies service settings 1 TTPs
Alters the configuration of existing services.
defense_evasion

Windows Service
T1543.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\csp12.dll	SignCloudPC.exe
File created	C:\Windows\system32\bit4ukcsp.scg	SignCloudPC.exe
File opened for modification	C:\Windows\SysWOW64\csp12.dll	SignCloudPC.exe
File created	C:\Windows\SysWOW64\csp12.dll	SignCloudPC.exe
File created	C:\Windows\SysWOW64\bit4ukcsp.scg	SignCloudPC.exe
File created	C:\Windows\SysWOW64\bit4p11.dll.conf	SignCloudPC.exe
File created	C:\Windows\system32\bit4ukcsp.dll	SignCloudPC.exe
File opened for modification	C:\Windows\system32\bit4p11.dll	SignCloudPC.exe
File created	C:\Windows\system32\bit4p11.dll	SignCloudPC.exe
File created	C:\Windows\system32\bit4p11.dll.conf	SignCloudPC.exe
File opened for modification	C:\Windows\SysWOW64\bit4ukcsp.dll	SignCloudPC.exe
File created	C:\Windows\SysWOW64\bit4ukcsp.dll	SignCloudPC.exe
File created	C:\Windows\SysWOW64\bit4p11.dll	SignCloudPC.exe
File created	C:\Windows\system32\csp12.dll	SignCloudPC.exe
File opened for modification	C:\Windows\SysWOW64\bit4p11.dll	SignCloudPC.exe
File opened for modification	C:\Windows\system32\bit4ukcsp.dll	SignCloudPC.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\translations\designer_zh_CN.ts	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\pkcs11\win64\bit4p11.dll	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\etc\universal-keychain\zsign\icons\login.png	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\lib\Python2.7\site-packages\Crypto.zip-dyn\Crypto\Cipher\AES.pyd	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\c23080ff8e4a199361957170ffd291a7a88d857c.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\bin\qt.conf	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\Crypto.zip-dyn\Crypto\Util\strxor.pyd	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\pyside-python2.7.dll	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\stdlib.zip-dyn\_msi.pyd	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\stdlib.zip-dyn\unicodedata.pyd	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\etc\universal-keychain\browser-intent\icons\proxy.png	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\lib\Python2.7\site-packages\ctk.eb	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\a129babd5b8c6023a4358fca5b5fb223b8238cb3.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\translations\assistant_ru.ts	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\06debbfa66665065c0f1883b8d60f370d1d3adf8.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\1f3d568026e372c122244533a339f86dfdfcfaab.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\2f1ed375c18a32f14061bda0def00c9044101527.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\e7b2c4c60a41f1d54c7d664fb87b5b4619df0348.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\bin\ssleay32.dll	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\Crypto.zip-dyn\Crypto\Cipher\DES.pyd	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\4331b796682d585362ef294aaf1837e7df244337.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\526983cab2ce278dc1cb0f5551e21b77289894f1.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\etc\universal-keychain\zsign\locale\ar	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\lib\Python2.7\site-packages\pkg_resources.zip	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\5c4df5ddc8e269a35d26ec18e14402f109b25030.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\lib\Python2.7\site-packages\lxml.pth	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\lib\Python2.7\site-packages\PySide\plugins\imageformats\qgif4.dll	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\lib\Python2.7\stdlib.zip-dyn\_bsddb.pyd	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\lib\Python2.7\stdlib.zip-dyn\unicodedata.pyd	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\26567abfd29aefbf82788f19c13753c9f4b40999.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\a1f53aebd7dba326498ca9b8b43b007eeda4a0fc.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\etc\ukc\settings_sandbox.conf	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\pycurl.zip	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\etc\intent.ico	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\phonon4.dll	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\stdlib.zip-dyn\_sqlite3.pyd	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\etc\signengine\layers\n1.txt	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\90c7a16ddf8a992ca646707debf952d63d9efb1b.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\ea9db7b28563879d7cb490cfb80df88c7c9329b2.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\shiboken-python2.7.dll	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\plugins\imageformats\Microsoft.VC90.CRT.manifest	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\translations\designer_cs.ts	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\etc\universal-keychain\zsign\icons\customer_logo.png	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\747bfcdf9482b15e38b9564f5ef442f7c3026b59.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\translations\assistant_sl.ts	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\etc\universal-keychain\zsign\icons\loading.gif	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\lib\Python2.7\site-packages\cryptoki.pth	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\76594a513e85182befe87f234ea5764dd9d2a8ad.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\9fcdf094368d1b025c4c5574f8c59db8df75d0c3.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\cba1c5f8b0e35eb8b94512d3f934a2e90610d336.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\plugins\designer\qt3supportwidgets.dll	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\translations\qt_de.ts	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\5e2f59e6acd8a50e120288556954bd8a12532ed6.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\94f055623025d70c0d3f0db0d18118f2b336731e.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\fe727a78ea0c0335cdda9c2ed75fd4d46f35c2ef.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\etc\ukc\bit4xpki.dll.conf	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\bin\msvcp90.dll	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\plugins\codecs\qkrcodecs4.dll	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\translations\designer_fr.ts	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\translations\qtconfig_pl.ts	SignCloudPC.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\lib\Python2.7\site-packages\PySide\plugins\imageformats\qsvg4.dll	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\0cfe43b1859c0b627811152b9c535a57d7bd4195.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\190081ca0355907279a01ee735d6eeefc90429c7.cer	4identity.exe
File created	C:\Program Files (x86)\Bit4id\fouridentity\browser_intent\var\rootstore\3eb70d199460869d0fa2825bf85d94f4a52a47a5.cer	4identity.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3128	sc.exe
2112	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SignCloudPC.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 5 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC08450A95CD32662C0910F8C2DCE230D7466AD\Blob = 0300000001000000140000006dc08450a95cd32662c0910f8c2dce230d7466ad20000000010000000707000030820703308204eba00302010202084d6392e98ed7e594300d06092a864886f70d01010b05003081b9310b30090603550406130245533144304206035504070c3b42617263656c6f6e6120287365652063757272656e742061646472657373206174207777772e75616e61746163612e636f6d2f616464726573732931163014060355040a0c0d55414e415441434120532e412e31153013060355040b0c0c5453502d55414e4154414341311b301906035504030c1255414e415441434120524f4f5420323031363118301606035504610c0f56415445532d413636373231343939301e170d3136303331313039313335335a170d3431303331313039313335335a3081b9310b30090603550406130245533144304206035504070c3b42617263656c6f6e6120287365652063757272656e742061646472657373206174207777772e75616e61746163612e636f6d2f616464726573732931163014060355040a0c0d55414e415441434120532e412e31153013060355040b0c0c5453502d55414e4154414341311b301906035504030c1255414e415441434120524f4f5420323031363118301606035504610c0f56415445532d41363637323134393930820222300d06092a864886f70d01010105000382020f003082020a02820201009a779aed41ecbbd3870ccf3ec0d6fb81e072ecd18f18947ec15ca140bb1c33b2dd463a5ed3cd9cce7831231993128c8d3425151d999fe5986f76eed112e5d0e5adf0eb36f2aede6a1ff63e968dc8781e636a4fa237d135e784135bb4a1181d6c42708bd0d0e29a15450112df8dcd2eac9b20c0cdbc321543d23e277c26819a194332ee185a877f1c2cde34f1f7e28021537a1648b11bc39ec535594df8bdc0182cb9a08ecbc1366ab657e4ecf3ebedacb7116e943cbac31bc0948ed5aa22ef52ee2127811898ea6acccc3ceb72f76dcf1877a6226c479799874f5de4e616bdf042b86573057e3c5256bca9be91e08d3854577b3865e692a526d6905c65e9397ef8e4dc88c2cea7aea3c195772380ea79198d5c992245e6ece6ef1b0c3671c5e48f46eb28148d5c2e6f5ca82372e7585dd8b36ff1010250d43f44fa27d2c87e052a1279da69617aba4c5aa969b13f1539ed24153b08c255dc4149fe34af5dfeaa8fb2632275105da8d2c4376dd16ae60d6f1a40244a099d0c97f2306fcca4f37ff2643b7a13e133eb757fc7bb00d99ca01bad737f8c0e4fde45340e19d5ab5f384729ff6b9ce475caad44d74cc0c92597c358ca37d007b545e8bde1345dffd5d1a8f74493407f54be7ff7dd529445fa3a5d0dc0a44f9ba1cd359a166dd9e62c473e0869d7d728f4d51e7563851339a949fd6ee888dc66a5940074073d34dfe0930203010001a382010b30820107301d0603551d0e04160414552cf1bca15eb9eea02f8857105bfc96f7919a2c300f0603551d130101ff040530030101ff3081a60603551d2004819e30819b3081980604551d200030818f303306082b060105050702011627687474703a2f2f7777772e75616e61746163612e636f6d2f7075626c69632f706b692f6470632f305806082b06010505070202304c0c4a436572746966696361646f207261c3ad7a2064652055414e41544143412e2056657220687474703a2f2f7777772e75616e61746163612e636f6d2f7075626c69632f706b692f6470632f300e0603551d0f0101ff040403020106301c0603551d11041530138111696e666f4075616e61746163612e636f6d300d06092a864886f70d01010b050003820201004c0c8e48a98aff28fa2456ff45a1cc9a8afc927930416562de514048ac9f2d073a15f1e85631208a1bba1de90894c4bb581cdeb5056899a4d14c3bba7897b2a3ffbb081f951861ce6188d275cf05f162351c53777faced2ae33ace5573dd7ca3f411e18351f882a34b6317bdf64ab5e31404391fdf9b4a7bad581579e1e11bc9b54b9506cb2275ba47a20747743eac155a51b59e9fa2fe785f9ebc464939db449c87cf1eadb9a2ee4321d053e0e0d134bc93ae5af14462a15910d0259bef22322796c40663d1db2a973b0b7a9d847cff76e5ad4f7dfb0a7aee9990b6d4a0817dec0766bd59f63de18e6e20f07b262b0e5019aa1f6dd18da90473e50c2cc8e7bc943cdbed4cee819e6e76957754552bea247a6439cf1e7b0739334a5fe2e06f99c726bca106f6708a851e7bf20955c339de3f0963412d94024f219150a3a872fbb590a5e099563a85340684cf13af9ca0fd74f6d60680bf7ffbb61e626f688682af10f04dc05b7343fbc37fa8c8d9d9a22404a41850598b5a266dea7ea78bbdc4d8b41012cfb4ba1f7ed714cf708ec07c3bfea749ba1c33f4a6ad2dec15f40d06e1e50c0fa621c1901f1ab731398264319e4b78fe0d12d9abf92dcf94eee7d9e7f6a8eed2cbd6a9135f6afcee337b4fcfa564e48705b41a9f6428b3205f6565e0c5a1584eca68cb9b4f9f844c702817a87498940ad429a43c396993e3600a2dd6	certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7F2CB4F769224CB0CF8B692751CBD4CC64A2C450\Blob = 0300000001000000140000007f2cb4f769224cb0cf8b692751cbd4cc64a2c45020000000010000005e0800003082085a30820642a00302010202085bc160006870521b300d06092a864886f70d01010b05003081b9310b30090603550406130245533144304206035504070c3b42617263656c6f6e6120287365652063757272656e742061646472657373206174207777772e75616e61746163612e636f6d2f616464726573732931163014060355040a0c0d55414e415441434120532e412e31153013060355040b0c0c5453502d55414e4154414341311b301906035504030c1255414e415441434120524f4f5420323031363118301606035504610c0f56415445532d413636373231343939301e170d3136303331313130333533335a170d3239303331313130333533335a3081b8310b30090603550406130245533144304206035504070c3b42617263656c6f6e6120287365652063757272656e742061646472657373206174207777772e75616e61746163612e636f6d2f616464726573732931163014060355040a0c0d55414e415441434120532e412e31153013060355040b0c0c5453502d55414e4154414341311a301806035504030c1155414e41544143412043413120323031363118301606035504610c0f56415445532d41363637323134393930820222300d06092a864886f70d01010105000382020f003082020a0282020100dffdd893ccefc8b126d9e71a42d9f311bb0841cdf4e8abc1b171cc3ff0046696056e1bc25a091f0f6f80405d6386bfc8b9c8df792087e98922bcbc0dc6266e4531fbff66f406c8351fd6e105bdd0b3af09fd7af11e6fdc17fc2242918cb35bcc6f35568e00b94236364593bc1abff2f35445e2bc1f8fd37b1c6ab2d0d503b68dcd1a23db39932cf4340add0e4c8babff365bfaf7f5899fef41451b0ac001db1e6e767a746b09a5fc3badc14a1ab3edbc7061e2d73a53d8e14eb808391d38eb8dea82f0389fe71e21e7eafdf6821ff95df84c020ed1a0a2091192dbfb93748d1b71776eadab95d3f43a2bb462bf0936344c97e424b77cc2fd557607e3d521a9107edfab8f34374971052404ff86fedd173150cd2303991c6880d327d44a880f49c745c96609942b79f09264257a7600d59899d66f40a210f1a51d79e12873ad06034efade30feab8859015c30ec9e350ecbbd0cd378ce23eeaf3d24671ddff1f8ced08a3eb983dcb72fc16c78d1cad599d03a08223f48e57c35825a8761914170b1fd04e85519e6e679a686672fe1c1b4df4d2a1a44620781ede5670b3f932b34c83656e044dd3564780e72a6f6034cd0f1a6e6fea752da80f18829a30ca8c372d66086b51a5f464c7b4bbe3feeb1971b23b3562063604bd470f6d983ca2fe0b5bcee572f47b8d5ed54b92555f85825b0ce7afee44ac34927c15cb7c05380dc730203010001a38202633082025f307e06082b0601050507010104723070303606082b06010505073001862a687474703a2f2f6f637370312e75616e61746163612e636f6d2f7075626c69632f706b692f6f6373702f303606082b06010505073001862a687474703a2f2f6f637370322e75616e61746163612e636f6d2f7075626c69632f706b692f6f6373702f301d0603551d0e041604142d71efb0637ff5fde08322447f441030814f4de530120603551d130101ff040830060101ff020100301f0603551d23041830168014552cf1bca15eb9eea02f8857105bfc96f7919a2c301c0603551d12041530138111696e666f4075616e61746163612e636f6d3081cc0603551d200481c43081c13081be0604551d20003081b5303306082b060105050702011627687474703a2f2f7777772e75616e61746163612e636f6d2f7075626c69632f706b692f6470632f307e06082b0601050507020230720c70436572746966696361646f206465206c6120456e7469646164206465204365727469666963616369c3b36e207375626f7264696e6164612064652055414e41544143412e2056657220687474703a2f2f7777772e75616e61746163612e636f6d2f7075626c69632f706b692f6470632f30818b0603551d1f048183308180303ea03ca03a8638687474703a2f2f63726c312e75616e61746163612e636f6d2f7075626c69632f706b692f63726c2f61726c5f75616e61746163612e63726c303ea03ca03a8638687474703a2f2f63726c322e75616e61746163612e636f6d2f7075626c69632f706b692f63726c2f61726c5f75616e61746163612e63726c300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820201000a23c60dda320d3d516b67a69fd65e78a700e5a7f997eb787c73ee4a75bae234db19ea6eaccb29ec09276c62207ae50201b14b6a4b8d741fecf79671401723ceca24a53b1cec15c836a92d378670eb35cb19322362c7ea4af28c6e9ffdffeaaea93d9cf4318c185298018e3c27e622d4584766d31898cdf49494553fff65b6c5ec185080fbbe8c2856e3a56b47bced09215011d1f04bae4c51cf229971b14f2490d60ade7272b4e8c957de5f6cac5b695a81ae5d5b39af82451276630114c20e24470f3c6333d07b39ecaf846bd555fa0c8316a3d133f0337201e9fe4536bc1e83e5d078635c697bfa9512ef265774771fb728a5f40ed86a2e2ab1cffb46f7d32c6ae71f23597ff10d41a56b8a76b0ac116c3fe0f64015985d581e18b511705f624221dd49d77be75a14df339489f78f0178e334e9d4b26414cf5ea271dc0b854d866d016ce9c126778c0114e6e81d4e7c9aa6f277957b4a344b15e687e6040aa68338936334889fb1fe53e422ff999e860695868df9c624a2b8cb0eebff1e635da2c1d7a17fe18bf86f4aadce9e5115c06ed50f02c2349c808a36ea9664228cd4ab79f68cbac6d2456be9df1837a373ba0e9318b7f6d1f6661936f2ccc48100a8421ccfcf5c2cd2051c2155e9c7837ca3b1acac0491cadecc656d679b8dace52f48d60289be85d6eb758c205972e9c4d7cc750220e0b542324a3b258ef73f56	certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\0ECE527803C9DB6E63BCEA5536B93AE8284E8D2D\Blob = 0300000001000000140000000ece527803c9db6e63bcea5536b93ae8284e8d2d20000000010000005e0800003082085a30820642a00302010202082027ca2ed163ad13300d06092a864886f70d01010b05003081b9310b30090603550406130245533144304206035504070c3b42617263656c6f6e6120287365652063757272656e742061646472657373206174207777772e75616e61746163612e636f6d2f616464726573732931163014060355040a0c0d55414e415441434120532e412e31153013060355040b0c0c5453502d55414e4154414341311b301906035504030c1255414e415441434120524f4f5420323031363118301606035504610c0f56415445532d413636373231343939301e170d3136303331313130333733315a170d3239303331313130333733315a3081b8310b30090603550406130245533144304206035504070c3b42617263656c6f6e6120287365652063757272656e742061646472657373206174207777772e75616e61746163612e636f6d2f616464726573732931163014060355040a0c0d55414e415441434120532e412e31153013060355040b0c0c5453502d55414e4154414341311a301806035504030c1155414e41544143412043413220323031363118301606035504610c0f56415445532d41363637323134393930820222300d06092a864886f70d01010105000382020f003082020a0282020100cf64c220c6698d1282cf158046b07c9f98061c9ef825f7447f52f8c39d80319136aa4d5331031300a18d304c57a731fb5bbc82f9fe1f8d654da08691e6ba9cb20037a10869557948f981b7d280a51eb04e56c2963c79c893cd679e5283f146607aee40b6770f7b2dd6daf82a1fd3ba6f36fec1a4586aee3f3ca552dc8e78139373403dd98bf719d034d12449cbd163b256dba1eaad593548e5193c4f17f29f90430bb829dbbb2d7c23fd2bf5840b18c520ca9d1ed9be6dd4b2c984e6fac7920b8adacd9fbd7d248406646f6e93dd12d66e837f14a12aff629ddba3d734f6a2cee8ddf924ed297128c6e7f5046720bdc174b3445a6aec5636957da5d326696dce79dd0c936d1ba54c6cd010d8f2dc9e5868077a062574a046bf213463b41b1b6c8af77bb2c572b1cd0b1f40d27f8ba135328f4e01ec0eedcc0324c1f3395453452279e45898146d02f3fd566dc2a9a6fc599fe342f29cc5795e6741abce6fd1d99d0eb95eb8da55f26e0040e11d8334da1b02e2b7231631ea4d10a3753dac342353f81da9d2461925e4ae7ab0078556c7ae03a4152461d0fab752bfc9c214017ea4b777ac8ed599a4276b4c2426f48421ae61d820c67ac5ebdfd56f06e40e3436ff9ccfda701423a4eb66c2c5428bc85198f2af46fcdcaa95262655a150c06d1ebd11730efe6ce3fddac340b4478840e7710fedd636e02e7c6684b62cd1d577590203010001a38202633082025f307e06082b0601050507010104723070303606082b06010505073001862a687474703a2f2f6f637370312e75616e61746163612e636f6d2f7075626c69632f706b692f6f6373702f303606082b06010505073001862a687474703a2f2f6f637370322e75616e61746163612e636f6d2f7075626c69632f706b692f6f6373702f301d0603551d0e041604147d57e76073ce0746a9e2a368f0e111b2749273fd30120603551d130101ff040830060101ff020100301f0603551d23041830168014552cf1bca15eb9eea02f8857105bfc96f7919a2c301c0603551d12041530138111696e666f4075616e61746163612e636f6d3081cc0603551d200481c43081c13081be0604551d20003081b5303306082b060105050702011627687474703a2f2f7777772e75616e61746163612e636f6d2f7075626c69632f706b692f6470632f307e06082b0601050507020230720c70436572746966696361646f206465206c6120456e7469646164206465204365727469666963616369c3b36e207375626f7264696e6164612064652055414e41544143412e2056657220687474703a2f2f7777772e75616e61746163612e636f6d2f7075626c69632f706b692f6470632f30818b0603551d1f048183308180303ea03ca03a8638687474703a2f2f63726c312e75616e61746163612e636f6d2f7075626c69632f706b692f63726c2f61726c5f75616e61746163612e63726c303ea03ca03a8638687474703a2f2f63726c322e75616e61746163612e636f6d2f7075626c69632f706b692f63726c2f61726c5f75616e61746163612e63726c300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820201000718d1d33153a5bb93a4caa0021f3b8d561988ff74878115b37b63a7fbd8a84fe68e9c7519af2dab8035d127e473b93f4e2691fed3238d1b479eefc9b3358783534c69dd06aa205eb8e664b0bc0cedc59ba5e15e8e10c1d6def5cfb43f77a25af832aeebf49e2b09196416e7f99588afe12766f0e919d4f76e524e5178ed7b6a0ea792d705c92264b253ae615429e27f080903607fa2588fd1591b551ad07d98533250bc7d05be7f7189d7e4c379f70988ac5a76a506082bc6b7529e804d0b89a715d53ef3f708df28edb53c5713b9916254f5b5ebb3522ac229c06846f00e15ae3ac9252e0894f0331cb941886e61a3f89b70aed00c05ce1b63cc241af7f13bf54f3b166538a6e175536ec2f3cc76974659a3e592d76a0c95ae225a75921841dac96dd31d209fa07e1400aa6b7b99cb551633011613726d0cef7f17c9c18ad89ce084ec175669a88a2c74f70d1fa04188a77300f9a781aaf58dc614b18ed6af4b42249d63308aad1c78b8d9cc41b64000a9c51aeb92722d34dbd6e67bed4348dfa061dd6f0cb5e44cb789172c6cefa0db6599995da72b1b22a3ffe13e812c25f74a489d77d9f8841c3e7ffdaaf75238f82b2d01a6ec05904a16c8288ff25a75c7cfb6b45957cadeb10b492bd56ed77999d7fc405dad82ae7dfee3332740939f13152bed1fc7cde5b8237cd582ec5297697377b45111bb78330a346e785afb56	certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\41F53131DD4469421620287F7E75B46C89EA7535\Blob = 03000000010000001400000041f53131dd4469421620287f7e75b46c89ea7535200000000100000046080000308208423082062aa00302010202086274a9c42962d4ee300d06092a864886f70d01010b05003081b9310b30090603550406130245533144304206035504070c3b42617263656c6f6e6120287365652063757272656e742061646472657373206174207777772e75616e61746163612e636f6d2f616464726573732931163014060355040a0c0d55414e415441434120532e412e31153013060355040b0c0c5453502d55414e4154414341311b301906035504030c1255414e415441434120524f4f5420323031363118301606035504610c0f56415445532d413636373231343939301e170d3138303531373134313431335a170d3331303531373134313431335a30818a310b30090603550406130247543112301006035504070c0947756174656d616c61312c302a060355040a0c235472616e73616363696f6e65732079205472616e73666572656e6369617320532e412e310f300d060355040b0c065053432d3542310f300d06035504030c063542204341313117301506035504610c0e56415447542d343435383131383130820222300d06092a864886f70d01010105000382020f003082020a0282020100b2b7de3e122076163392e354d6b9f8e8e662837f69ef7b684b8dbdf7e155a688aa63396592ddc04ee58d74dcc95c3187e36ae8a2cab0b62777d8db0a67ccb76424a47381e4676d4593edf8b1120f4b86816dfc789b678d92a7648b4a6d584422b98142fb77e173feca49a7e0163af9bbb7f3be525d2f64b64a110e34fab944093f48237feaed22bb7ec05bbc388dff66b19fcceb9c07169c88d1cd5612e833c08294cb86f12bae0aef0d97738d065e9e77cf3be78f3f0e1480868f398e4e6472d5dfc90c3c19275dea26756b93b1292d26aed08c588add5d1d78cb5bc9ff1e62cffeda9c76ae96835bc05f05b759e4ed7ace3e309976f8ddf1531f42dbabc42343a0498516284ee6f706c17f0ede72245ff18ce11f6588d423788e002b36b984abbebe970fdb283c984c2b3c51a1cf2efb66bcbb9926231ee55e32fc8c7fbe500069b8dfc0d16d11760c931c201ac552307f0573a685602e199f1c6ce0f5822da219bfb08396588948cdbb924990b7cde0f167b4985957964419a3be426a5e948cd1fa332eaf00c7ec16830956b4d617a3a65a9f9baa5e74ba931679ee443928d4710ed2d54e6df6b89d12a19e01fd80c8ff8c8333befbcdb17a9ff636d896ebba10dba699a63516b75b8b80118c3a0f7b8a016439f882e91ab025a76f834400f86a7720e7f677f1c1bc75a9dec2a0b730230734ab3616c75ca326dbb200805b0203010001a382027930820275307e06082b0601050507010104723070303606082b06010505073001862a687474703a2f2f6f637370312e75616e61746163612e636f6d2f7075626c69632f706b692f6f6373702f303606082b06010505073001862a687474703a2f2f6f637370322e75616e61746163612e636f6d2f7075626c69632f706b692f6f6373702f301d0603551d0e041604141950dbfd7be94ae396017fd010a1e77b19528b7330120603551d130101ff040830060101ff020100301f0603551d23041830168014552cf1bca15eb9eea02f8857105bfc96f7919a2c301c0603551d12041530138111696e666f4075616e61746163612e636f6d3081ba0603551d200481b23081af3081ac0604551d20003081a3303206082b06010505070201162668747470733a2f2f7777772e35622e636f6d2e67742f6669726d616469676974616c2e706870306d06082b0601050507020230610c5f436572746966696361646f206465206c6120456e7469646164206465204365727469666963616369c3b36e205375626f7264696e6164612064652035422e202d207777772e35622e636f6d2e67742f6669726d616469676974616c2e70687030818b0603551d1f048183308180303ea03ca03a8638687474703a2f2f63726c312e75616e61746163612e636f6d2f7075626c69632f706b692f63726c2f61726c5f75616e61746163612e63726c303ea03ca03a8638687474703a2f2f63726c322e75616e61746163612e636f6d2f7075626c69632f706b692f63726c2f61726c5f75616e61746163612e63726c300e0603551d0f0101ff04040302010630260603551d11041f301d811b6669726d61736469676974616c657335624035622e636f6d2e6774300d06092a864886f70d01010b0500038202010037ba0c2f672e56593c18f820e1d7ad20fc3b627de552a8e8f9b2f51f6b2d6c2dff00c4ddbabb53919009c3f2e1d8055412d7d11a70be5ab67369a77caaa5687cc0a011baf17dbca53ca9478d718e4894eb145b980224f5db3f7bedd48ae33993873279b17eb40ff53dd2294d1e1f6748ada9604bdd99b1d68b96195162cd502f11ce5efedcc9573a5d8a1a2070cdcd9c67b0f8e000ed699b5ed5c49cebde02455deee24bba8ed5ee712ea805431d6e67959f548f07f28d79db7856e6ed30571cca25b19726327d82dca271b4ac54eb2117b6f8d9b74591803ad48bbdf42e18d83df960bbc6281107bd99162a55fe281f2eb9a7bff693b8294cd857bde442d2a48dd5565c50636ad2f962b3a4a3ecf7592c103898f4ec18029e800236c715afc83299a7c0adb901ecb19eb3c5efa70d29ca475ff88af65b4fd2340e6ebc5656e22dbcc3bc83cea24bd2fe494da4b8b412960bf76179f63b40e0fce189850086d2633b79d702c0b1e21f376725602421d628ee8a9d2654a1dff45fba358b4d7ddb6cb5adc6e1b2c9a0f30387bcec0228b9bdaebeaa68750cd342c1c0229860b5b4c70cbb1829880a0fd91a5c1e4dc1023048298a458d5899c67e976a5a499c7d722582f221e66698d16b2280794a88d4f112384ac9a3d32fa1bc5ebf8ab587d9ab7e328c5f0a6e63fc498cc8cfca07092c74e192935048a132e659d628ae99a427	certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\24B2BA9E5BD3F041D269B9A96AE2DB9F54C1CEC1\Blob = 03000000010000001400000024b2ba9e5bd3f041d269b9a96ae2db9f54c1cec12000000001000000e0070000308207dc308205c4a00302010202082d02514272ebc902300d06092a864886f70d01010b05003081b9310b30090603550406130245533144304206035504070c3b42617263656c6f6e6120287365652063757272656e742061646472657373206174207777772e75616e61746163612e636f6d2f616464726573732931163014060355040a0c0d55414e415441434120532e412e31153013060355040b0c0c5453502d55414e4154414341311b301906035504030c1255414e415441434120524f4f5420323031363118301606035504610c0f56415445532d413636373231343939301e170d3137303830333130323734385a170d3431303331313039313335335a308185310b30090603550406130245533112301006035504070c0942617263656c6f6e6131163014060355040a0c0d55414e415441434120532e412e31153013060355040b0c0c5453502d55414e41544143413119301706035504030c1055414e415441434120455850524553533118301606035504610c0f56415445532d41363637323134393930820222300d06092a864886f70d01010105000382020f003082020a0282020100bffa4bb1edb1188a701fd222698835a5d627494b93769cb362c0e0f1d6f5f2dc2a409a07321ed7d2d4d371e5134face7dfc2ecadb3efdc27d72fd0d5711b3ee46294ea399ef3163e9a5bf3343ef30b29f1e8677053c73ddad15ea8424a0ad44fac6b27b839fab203ebb893e3aa4a3fb74139bcbdff4625a71a54dd0cd634b9b8e5c3b40b5b6164abfd33d96f7aa6a3ad33e517546480a3c2bd88eda7bc63508cd53f033a454982ea3120cab6f100a8ece1dfe7ded2bdb03e3e15b9e67cef724898bf7c69af4cc4dc3802bff1ca5626e80726ab8b8560ec6de0fc3c9d6bf7084785104deaa951620cf46e6282692cbb2ecd11bdcd7a0426ad33a2b4ba060f35b945e0416ca88f8a744d016348f211fbfbc7ea1fd653009f49f8a92ff708f64a0955451922214724f906b243e02ee43f800275b0cfcbb82ee457227569b9c02aca37baac1534f76fac01973cbdec29236499c3c07eeba0ceb6e77f0cf8078795636ba2cc2ed85c610aa9b2f05cc3964957b32e48465bf3c80581e44ff80f626ca5f766eb72956825d3185cf5c1c6fccbc21db68127e4c2b61841bbc51642860f58582f2bbfe98d1238ec9550266bad71857f8d3503ea468fce2860f20a4fb71e38081caaf9217710a29f9cca23dcfd61d76710560e8e49f6680f8d23805f952ac8f94292e16d8e680862ca3a720389634a57972e047f1165975ff2ef8775e48a870203010001a382021830820214301d0603551d0e041604141230202478dda95f08c9124a777e8d2fa1a662fc30120603551d130101ff040830060101ff020100301f0603551d23041830168014552cf1bca15eb9eea02f8857105bfc96f7919a2c301c0603551d12041530138111696e666f4075616e61746163612e636f6d3081e30603551d200481db3081d83081d50604551d20003081cc304a06082b06010505070201163e200920322e352e32392e33322e30204350532055524920687474703a2f2f7777772e75616e61746163612e636f6d2f7075626c69632f706b692f6470632f307e06082b0601050507020230720c70436572746966696361646f206465206c6120456e7469646164206465204365727469666963616369c3b36e207375626f7264696e6164612064652055414e41544143412e2056657220687474703a2f2f7777772e75616e61746163612e636f6d2f7075626c69632f706b692f6470632f30818b0603551d1f048183308180303ea03ca03a8638687474703a2f2f63726c312e75616e61746163612e636f6d2f7075626c69632f706b692f63726c2f61726c5f75616e61746163612e63726c303ea03ca03a8638687474703a2f2f63726c322e75616e61746163612e636f6d2f7075626c69632f706b692f63726c2f61726c5f75616e61746163612e63726c300e0603551d0f0101ff040403020106301c0603551d11041530138111696e666f4075616e61746163612e636f6d300d06092a864886f70d01010b0500038202010075636f159387a3226756490aead404ad1d6d5b7f91df472b69bf9a16509ee40fc63fa2d3f9626c1dffc1cc11eb61675866654f6a0853537e17398f5be3a2585afcd18924c964e147c62f25735fb3f88a1107f7b1bc103b591889e107f9433d0a6e42b64b85081eed1f9556c6f04c7ef2ef7601dbdaf92f93d9bb301e9e9401db6a3f805b15ff5a7861e04845e6d93cce0b98b7546b19241bf0dd781decc1ca754a2f0ee6e4f277cff3d541de10c5f4b2f78362a21a3abfb9d9c5757cd87015d3c690036f3f1cd0099e6ece9bb178dfc372484ca6e31f1dc7182f72bc12985dd106740fb4e59f681cd5b0278f9747b208ddf5ee86d8d590d72e631d4512974075130d982d75e02e67e6390c91af82e5a38957b0dc1e9ad4383e5ec3df51ce50951c1672e2bf6b0cb98dad32ffce0e14e4be934f500ae10c73c4b1ba1a52b71bf5c33d1a4de3035dbbef815b43a3d8c411f43b448afeb3bb3b4a12ca4589d996f90be97794a8deacb3c2f5bc9981f6f415a019d4113da03d9d9ee130886a5e20efc0de185c5ba9140eef32776bcb2ee2420c18f6250018c4e36853aec8e6e5ae1ea08b1d9f6bc38115bffb5a3b31bd1ddce4b3a906eaa22c094f08a7216a259ad19f5cb12437a7bd66ffc7b6faa75d3bed79b59beb18f941e6a3e390c8a18b4dc38b82b8f932dae3d0101115a7f5996f43ece0a971b8628530e1253c7484a10488	certmgr.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SignCloudPC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kchain_gui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kchain.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4identity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kchain.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4216	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4400	TaskKill.exe
5984	TaskKill.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "250"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239201501481152"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\fouridentity\shell\open\command	4identity.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\fouridentity\shell\open\command\ = "\"C:\\Program Files (x86)\\Bit4id\\fouridentity\\browser_intent\\bin\\4identity.exe\" \"%1\""	4identity.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keychain\Content Type = "application/x-keychain"	SignCloudPC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\fouridentity\ = "fouridentity Connector URI"	4identity.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\fouridentity\Content Type = "application/x-fouridentity"	4identity.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\fouridentity\DefaultIcon\	4identity.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keychain\shell\open\command\ = "\"C:\\Program Files (x86)\\Bit4id\\UKC\\UKC\\bin\\kchain_intent.exe\" \"%1\""	SignCloudPC.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\keychain	SignCloudPC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keychain\ = "Keychain Connector URI"	SignCloudPC.exe
Key created	\REGISTRY\MACHINE\Software\Classes\keychain\DefaultIcon	SignCloudPC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keychain\DefaultIcon\	SignCloudPC.exe
Key created	\REGISTRY\MACHINE\Software\Classes\keychain\shell\open\command	SignCloudPC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keychain\URL Protocol	SignCloudPC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keychain\shell	SignCloudPC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keychain\shell\open	SignCloudPC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keychain	SignCloudPC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\fouridentity\URL Protocol	4identity.exe
Key created	\REGISTRY\MACHINE\Software\Classes\fouridentity\shell\open\command	4identity.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\fouridentity	4identity.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\fouridentity\shell	4identity.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keychain\shell\open\command	SignCloudPC.exe
Key created	\REGISTRY\MACHINE\Software\Classes\fouridentity	4identity.exe
Key created	\REGISTRY\MACHINE\Software\Classes\fouridentity\DefaultIcon	4identity.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\fouridentity\shell\open	4identity.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6DC08450A95CD32662C0910F8C2DCE230D7466AD	certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7F2CB4F769224CB0CF8B692751CBD4CC64A2C450	certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\0ECE527803C9DB6E63BCEA5536B93AE8284E8D2D	certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\41F53131DD4469421620287F7E75B46C89EA7535	certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\24B2BA9E5BD3F041D269B9A96AE2DB9F54C1CEC1	certmgr.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SignCloudPC.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
3160	chrome.exe
3160	chrome.exe
2228	kchain.exe
2228	kchain.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe
Token: SeShutdownPrivilege	5396	chrome.exe
Token: SeCreatePagefilePrivilege	5396	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe

Suspicious use of SendNotifyMessage 23 IoCs

pid	Process
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe
1300	kchain_gui.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1300	kchain_gui.exe
5148	LogonUI.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5396 wrote to memory of 5372	5396	chrome.exe	81
PID 5396 wrote to memory of 4216	5396	chrome.exe	82
PID 5396 wrote to memory of 2856	5396	chrome.exe	85
PID 5396 wrote to memory of 2856	5396	chrome.exe	85
PID 5396 wrote to memory of 5068	5396	chrome.exe	83
PID 5396 wrote to memory of 5068	5396	chrome.exe	83
PID 5396 wrote to memory of 5240	5396	chrome.exe	86
PID 5396 wrote to memory of 5240	5396	chrome.exe	86
PID 5396 wrote to memory of 1760	5396	chrome.exe	87
PID 5396 wrote to memory of 1760	5396	chrome.exe	87
PID 5396 wrote to memory of 3280	5396	chrome.exe	88
PID 5396 wrote to memory of 3280	5396	chrome.exe	88
PID 5396 wrote to memory of 2320	5396	chrome.exe	90
PID 5396 wrote to memory of 5508	5396	chrome.exe	92
PID 5396 wrote to memory of 5836	5396	chrome.exe	93
PID 5396 wrote to memory of 5796	5396	chrome.exe	94
PID 5396 wrote to memory of 5788	5396	chrome.exe	95
PID 5992 wrote to memory of 2848	5992	SignCloudPC.exe	99
PID 5992 wrote to memory of 5984	5992	SignCloudPC.exe	100
PID 5992 wrote to memory of 4400	5992	SignCloudPC.exe	103
PID 5992 wrote to memory of 3128	5992	SignCloudPC.exe	105
PID 5992 wrote to memory of 2112	5992	SignCloudPC.exe	107
PID 5992 wrote to memory of 3288	5992	SignCloudPC.exe	110
PID 5992 wrote to memory of 3988	5992	SignCloudPC.exe	112
PID 5992 wrote to memory of 5352	5992	SignCloudPC.exe	114
PID 5992 wrote to memory of 2444	5992	SignCloudPC.exe	118
PID 5992 wrote to memory of 1600	5992	SignCloudPC.exe	121
PID 5396 wrote to memory of 3160	5396	chrome.exe	124
PID 5992 wrote to memory of 4516	5992	SignCloudPC.exe	125
PID 2228 wrote to memory of 1300	2228	kchain.exe	126

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dafvz5743x4yg.cloudfront.net/SignCloudPC.exe
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87435c728,0x7ff87435c734,0x7ff87435c740
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,16400200708504515203,12935703238569533061,524288 --field-trial-handle=1992,i,12881628403919833914,5283552455955788317,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2088 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,6374817226599690846,18054124820519123861,262144 --field-trial-handle=1992,i,12881628403919833914,5283552455955788317,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,11392682664300721499,12698473430376187623,524288 --field-trial-handle=1992,i,12881628403919833914,5283552455955788317,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,9114308545224794125,17706476909383430846,2097152 --field-trial-handle=1992,i,12881628403919833914,5283552455955788317,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,16340183958010987886,195414441092822074,2097152 --field-trial-handle=1992,i,12881628403919833914,5283552455955788317,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,17716556597302594640,1817543693650932438,2097152 --field-trial-handle=1992,i,12881628403919833914,5283552455955788317,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,13869294640081858463,10168829271568924618,524288 --field-trial-handle=1992,i,12881628403919833914,5283552455955788317,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,18324846698341228189,11363636362257800131,524288 --field-trial-handle=1992,i,12881628403919833914,5283552455955788317,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,5117273854161705277,10385667854507528556,524288 --field-trial-handle=1992,i,12881628403919833914,5283552455955788317,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,16096635711490472091,13947016856965469345,524288 --field-trial-handle=1992,i,12881628403919833914,5283552455955788317,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,6367439355130281611,11307131000499960578,524288 --field-trial-handle=1992,i,12881628403919833914,5283552455955788317,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6056,i,2949472814167628956,12385581007448490976,262144 --field-trial-handle=1992,i,12881628403919833914,5283552455955788317,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6176 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5428

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:1576

C:\Users\Admin\Downloads\SignCloudPC.exe
"C:\Users\Admin\Downloads\SignCloudPC.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\csp12.dll",RegisterKSP -ksp "Bit4id UKC Storage Provider" -csp "Bit4id UKC Service Provider"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2848
- C:\Windows\SysWOW64\TaskKill.exe
  TaskKill /F /IM kchain.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:5984
- C:\Windows\SysWOW64\TaskKill.exe
  TaskKill /F /IM kchain_gui.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:4400
- C:\Windows\SysWOW64\sc.exe
  "sc" "config" "SCardSvr" "start=" "auto"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3128
- C:\Windows\SysWOW64\sc.exe
  "sc" "start" "SCardSvr"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2112
- C:\Program Files (x86)\Bit4id\UKC\crt\certmgr.exe
  "C:\Program Files (x86)\Bit4id\UKC\crt\certmgr.exe" -add -c "C:\Program Files (x86)\Bit4id\UKC\crt\ROOT.cer" -s -r localMachine root
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:3288
- C:\Program Files (x86)\Bit4id\UKC\crt\certmgr.exe
  "C:\Program Files (x86)\Bit4id\UKC\crt\certmgr.exe" -add -c "C:\Program Files (x86)\Bit4id\UKC\crt\CA1.cer" -s -r localMachine ca
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:3988
- C:\Program Files (x86)\Bit4id\UKC\crt\certmgr.exe
  "C:\Program Files (x86)\Bit4id\UKC\crt\certmgr.exe" -add -c "C:\Program Files (x86)\Bit4id\UKC\crt\CA2.cer" -s -r localMachine ca
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:5352
- C:\Program Files (x86)\Bit4id\UKC\crt\certmgr.exe
  "C:\Program Files (x86)\Bit4id\UKC\crt\certmgr.exe" -add -c "C:\Program Files (x86)\Bit4id\UKC\crt\TYT.cer" -s -r localMachine ca
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:2444
- C:\Program Files (x86)\Bit4id\UKC\crt\certmgr.exe
  "C:\Program Files (x86)\Bit4id\UKC\crt\certmgr.exe" -add -c "C:\Program Files (x86)\Bit4id\UKC\crt\EXPRESS.cer" -s -r localMachine ca
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:1600
- C:\Program Files (x86)\Bit4id\UKC\4identity.exe
  "C:\Program Files (x86)\Bit4id\UKC\4identity.exe" /S
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -s SCardSvr
1⤵
PID:5172

C:\PROGRA~2\Bit4id\UKC\UKC\bin\kchain.exe
C:\PROGRA~2\Bit4id\UKC\UKC\bin\kchain.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2228
- C:\PROGRA~2\Bit4id\UKC\UKC\bin\kchain_gui.exe
  C:\PROGRA~2\Bit4id\UKC\UKC\bin\kchain_gui.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1300

C:\Program Files (x86)\Bit4id\UKC\UKC\bin\kchain.exe
"C:\Program Files (x86)\Bit4id\UKC\UKC\bin\kchain.exe" 128
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5348

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a3a855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

python27.dll

Path C:\PROGRA~2\Bit4id\UKC\UKC\bin\python27.dll
Size 2.4MB
SHA256 3c2d756807de2aaf53787694986e7ee7c091c64ec24ee5f7216c6430ed174007
MD5 b84197af2b594b469d4005d547bdf8ba
SHA1 791bf150b715f9f232f75c492f9a6f78d3c11984
SHA512 bbffe36779065521b1c17126344393c22416a9e0b69bf7d011e12a616b15ec978989336d2fdab0f4d21037a722756e0d90bfa5d562774810f240bba42d86b62c
SSDEEP 49152:To2HD+pxX70/jRTT4WvrKODOhL95T76IK2HZfnXMZDPPxvIn:To2BvFDOBTlHpXMZj9In
TLSH
T11BB5AE51A642D0B1DC6E0CF951B662B71E709D08BB23B9D394A87D88D9732F09A3D3CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebkey

Path C:\PROGRA~2\Bit4id\UKC\UKC\etc\ebkey
Size 32B
SHA256 a41181b50a4227f28b4645c61b2f851fb32542f8522f5289b679bce329df22c1
MD5 67ea9a7253cfe3c289570480412b2b88
SHA1 3e49de1effca6b392619ac2fd29bde408df75817
SHA512 40266a0214c72d550b4b86014ce4ef48c0af16e5ac4ce484272e8169710d70170b242ffe97d56d1b679a6cbc6935e7189cf04f25753727bae790b1132980be45
MD5 SHA1 SHA512

Submit Download

paths

Path C:\PROGRA~2\Bit4id\UKC\UKC\etc\paths
Size 124B
SHA256 e54c791ff2e9871616bb61ead18102a6b8c36f41d9618f1b35f1497c37cedf7e
MD5 39610e3ecd19ffe631b0fd445e5686c7
SHA1 b4f96ae2bd38196f82274424301405b42fa46f40
SHA512 9468212412de8a55ffdd79e75236296a233c7ba3d3db5c87c014acab2bc6545f72bdcc499f2d2c6f78937e1c355439c28d803b25f39b74678f4ca05d6330931c
TLSH
T1E2B0080867F90EE62AC039DDB10D9D30A0182A6C53422F85F6BB8BD8242120A11EA56A
MD5 SHA1 SHA512 TLSH

Submit Download

Crypto.pth

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\Crypto.pth
Size 10B
SHA256 dea705064d9960c8212a4cdb2488beba541e897bb042a53ff44e57dc40d957b8
MD5 cd2e20b9360251c1884b45eee38163ba
SHA1 d00954b2500b6b0b34c68c3714f66bf4b1fff49b
SHA512 9d39e3d88c2dff50ab1e15d3c05f28d4213e1763e2bf4b7f9cc69185309f1e9af006fab4414a281d4bd2ca815d4bb8565d939e45d3a862a930ee47b42331a40e
MD5 SHA1 SHA512

Submit Download

Crypto.zip

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\Crypto.zip
Size 297KB
SHA256 965500218db0d0e20a6322f4af9d846975e8b9affa2d39b1f73550afe9d0c3ad
MD5 e27d6f9c16e51b48e1cb2314d772f933
SHA1 62a5059e0eb92722e5ae2e20bb45bb288321f289
SHA512 ffdf7620ff720ea1ff6f9fb19e8ab1243733f93e1b08fe1c630e3265722a5d62f78f20790bc14ae68d6502b1015f72f0952f124bd1e1e20788e33b69b22df43e
SSDEEP 6144:KebwuqvUOWHZOC1yuJRGELK8wciZlMNKETsEzafvrK+0:DbFM4ZJ1ylM+ZlMAETsg
TLSH
T14E54013B5566E9C1DD4B15734639CE4AC04BE3427F38EB6E3B1C30EAE4C61E82789859
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cryptoki.eb

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\cryptoki.eb
Size 21KB
SHA256 9819bb55fe1bccc4edeeccdc8f195ddc1d13742cfa378569cc35c88e19ff86cb
MD5 65bc1d24143273c004cd1ae70a702d2d
SHA1 caa8591f1142f28738172c4ec7db69d999db1484
SHA512 298ae6001945bacd534ef71b0ec4db00bdb8eff6175931ca3c703982111f0c044670a6a63d29260625d4c14aa94bb870969f2a92237ea281687530245b15b9f0
SSDEEP 384:unFh+kROq2ZHysrm9YxT9oO2558Ql7yxAhYlefW7fFOOgdTERr9VDPC:UF8W12VyWm9YxxKqMge+BOOIIRr9Q
TLSH
T161A2D0D24FDA609C0703C47718D26E5A97C031D7DC2B29BFECE5E3682366E921674D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cryptoki.pth

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\cryptoki.pth
Size 11B
SHA256 930c13796e8b6f254cdb9830663dca00f7dab474c570a0b4732e04d02504cbc6
MD5 e6956d1bf07c8c179e7fae1b597df633
SHA1 4d033bf09823fc6e3c8261c5e6aa56c658c808b9
SHA512 31219e9297bc0a7a67928916c2e6d12f4727cb33fe126fbead0f4a893e0ba9fe0e312ac0fb35898942262e56515f6967b9cb2c34a1ff0d0f6e354c3c92a71e1d
MD5 SHA1 SHA512

Submit Download

ctk.eb

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\ctk.eb
Size 49KB
SHA256 0fd1d0140a2ab493e62bea2ab93f3baf818bd3c5ededaa88d7570a9ae8da43c0
MD5 9f8099b59f8264946071fa176f13a16a
SHA1 c328ee072a1c224c23baf1525945ab52455a60ea
SHA512 45aafdaf7ae93959ecbea5e1834520cac2f9c4677ee9ddf278db1f07f8f8a47b8b1d88a962a3e61aeed4d2709de23d83046963e3bd28f6c4bdd63f38fd38080c
SSDEEP 1536:TSwypvai3cEIbZPemaXsmLqA5rvjZ8vXFd:TSwyj3c5JemYxOA5zFkVd
TLSH
T1D4330257CE2A0B261965765A88CBDD2CE203B93387E4F4DBC47BB058D05B13E3D811B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ctk.pth

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\ctk.pth
Size 6B
SHA256 46dd7b46685b0e4905e4c286f38e74fc1132ca7c62b8505e0173a6290d111b0e
MD5 5b9d83f9b7ad2a88d2522bef1b342646
SHA1 63d71e5ef6f3f53f501a6f78dfda206c057ccaa5
SHA512 6f5d7a90417af9bd4839acc1b54bbe7b267634b21c2f03473a82d662229f89da9e797f1d82f4e98e18cd6204af69aa503608a287f8f3eefeac13784707b06239
MD5 SHA1 SHA512

Submit Download

curldebug.eb

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\curldebug.eb
Size 5KB
SHA256 1720c03dbd5f3148485258b9fd730442be45e3940986f9e2b69c3b73b396177a
MD5 1270d2889b6f64ee745aa38158459198
SHA1 50417b38c8ff5f2c55f62777c55d2d8e835c0a3d
SHA512 0c0cc727679625f731faa3fc453315fefe84f740a6ba3f42208c2ef05e5b316984a357814f35210e71c735b2264351cbc055d696306bd6595a53149a10d178eb
SSDEEP 96:964lY4MKmLr+RJQm7q0f26dapN7xb6NMYVKjLFPBChPdnN1F4:9lYLLyRJHT+6dapHQDVMBCHnNz4
TLSH
T193B18ED28B6D726D02AC7D148AB3B5953243B574B306B0F910518DCDAAB08739F6A4A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

curldebug.pth

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\curldebug.pth
Size 12B
SHA256 bb2c36c869a0dfa5600a0134a765e739068a3fa368465f46422f906d5da20616
MD5 89f56d5ec3ccd2b1e98ad1bcd4372b92
SHA1 d641d3fae373eb31e6ac7cae51c94fc57e32878b
SHA512 9d7e81e1a5df463356746cbe597a5fddfbadbe02d7ea5883c72b789d86fbd1782701e0368d18cefaf3e66ec40b7d7e541feb6a2ebf127774ae5ed079a345d5c1
MD5 SHA1 SHA512

Submit Download

idprovider_smartcard.eb

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\idprovider_smartcard.eb
Size 31KB
SHA256 19badcaeaef859a04a5cd6d3ed4ce2f0e18da9e9f01477ff4eaa0728ad56a2c1
MD5 65f246ecbbce4e13c6b755db93787534
SHA1 466fdb0aac0c345d1d7ea616ac52e19083e15a27
SHA512 9652dfb5ec23982ba5468585c060b00173580a8e69de44f46ee85c00802c8c7b20ddae42850ff76d35bd7ef50701203f65087ced06656afffb216a68cf13070e
SSDEEP 768:Dbr7GLSJBj+2SQSf7vIcZOowJlYEs2Zs06aw4TFpNsPx:DHK6EQWDjIlAEsNhawCUZ
TLSH
T142E2F16E120FA05EC5FFC987529A31266EE5D5E64886B3C7C8F2CCD081F2298C454AB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idprovider_smartcard.pth

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\idprovider_smartcard.pth
Size 23B
SHA256 b662dfcf8a1b4f8f9c5127e067f214ee58153df7e79e8e334ff6987f87428e5c
MD5 02a29eb1e783a439607a6d6ff28e503b
SHA1 054968da38f957eef8c2e4f9624951668ddf8063
SHA512 1f88a99c4624df50f2352f5f73269720c300b4eaa80e246612ed3feb562233d2ba777cc63c48a9600ba0d89100539b7f492444d673e708cb695ce1e53410ac45
MD5 SHA1 SHA512

Submit Download

idprovider_smartup.eb

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\idprovider_smartup.eb
Size 52KB
SHA256 1bb8de562ad1a83d74644cdce7ab074f4c12b76c98513f39233725471f9df693
MD5 79474b9b77fac2dccb5fc152f0e82bd7
SHA1 fa149f4ad995a624563861cd8819c24378fd5c30
SHA512 87b104a321deca48fe1a76958da54cef47c30d987e8c721751e7363b4265a80b203b23dd3711bc63ba891b171132397813dcd5b12b86d5ff4b392ce0ef1a57b9
SSDEEP 768:MzV0Ggme8SDclp3koLYIMRH3E+L+snml1su57yqVsfcTfxInCGLNgOlme3hcgK:sV0VmrSAlpUoLYxRUCOVUdNLlnRPK
TLSH
T15233F1B53FA9509F81E169064A36D703D5F731190C3F399E49723F6B02F8AA8D98CC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idprovider_smartup.pth

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\idprovider_smartup.pth
Size 21B
SHA256 e607d4f6a41aa9c23a21b0a18477722c1561c5a6d73b0e00a617f0c076348368
MD5 69300fb08b7fccaa2f4c52882865f261
SHA1 5d0e8f8ce0d0c6bc8a96ffd9b7405c238ce59e4f
SHA512 ed0b3b0db354c43a9f570bc8b6da291fc2806dabb0e376097882bb0505394983c06b1ef59aa49eb21b9ccfee32fc1991464b23eee0334f6b2e4e2c8303a9307c
MD5 SHA1 SHA512

Submit Download

minitwisted.eb

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\minitwisted.eb
Size 53KB
SHA256 5ff8e5ce81dae02ff6e47182c15c039432975bfe0bb827850200ca8a37939b42
MD5 87a762fbad457d510ec0fd225aced0e6
SHA1 cdd6f1aba1153af327ba62a79713d448c54a0f2f
SHA512 10602af74d15df1eed22a1170d25e8856f30d47017ddf2f8ab9067194a21e30d10652ddbdc4ef1146861478c6c15bcabd9ca2b2db72dc65d32bd5c335246e1aa
SSDEEP 1536:JqTpQQyWilc8WxpkThX9XjeFg861rKzSQpp4sJPgz0yZ4ddV:ITp9yWZ8Wbw5txKekp1Pe0y4jV
TLSH
T1C533027363EC7A2404EB02171E13F51CE25A288A6FEB9D75B22E55F054A6BFD0D081E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

minitwisted.pth

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\minitwisted.pth
Size 14B
SHA256 d6dbb2ea0d14be3f579984c273a9447574001c616aa5c1b1fa2ebd6c443c7e07
MD5 999ac41ba8d7a5053e1ac11f4bf9622e
SHA1 d49d00b8d410730db4cb9900257322f7a3c25f89
SHA512 b5e7e666629af9f9cb16648f8492b72a3d40676282014c0e212127dab44f9c938c43f72823c37d0b90b220e40cfd85879a5ec164d4c7747016c90179209ae6bb
MD5 SHA1 SHA512

Submit Download

pkg_resources.pth

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\pkg_resources.pth
Size 18B
SHA256 ca627010613b62805194f43955703d1f1f85fc8b01feb8ad0c810a4df6b054f0
MD5 b634884149f7afc0e7a97f1c426b70cc
SHA1 96654da40a09f9f2070ea7cc15743fb189cf9d57
SHA512 79f54ae8a681b5c90c04127a35478d95a883543414c7e99594a7ddce5879d7560be3176d1e50a9e3e91481ea74e196cc086a8cac646f18607f5e0df458f83ded
MD5 SHA1 SHA512

Submit Download

pkg_resources.zip

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\pkg_resources.zip
Size 30KB
SHA256 36a90c39556c5ee57d6a12e02ca2c2c76aacd6350f14d04e0b0cfd82c42eb13c
MD5 3519d2bc0fefbe99d93ea1b1e3813be5
SHA1 9fcdf6a7da88ad952f4e725fdd6ebb8db3173f20
SHA512 f20cdfe45228cb83d49b94f857ffa1931ed67c8ec8ffbd11b489a7a34562c2808e753bed36a50e90cd062fd4958ba53a433af8e535058cee99166739d907911c
SSDEEP 768:e74dwGWPktLXkc4OzkjONRTg9kKihTfznpaE85S:QKt7jzkwNrcE8g
TLSH
T1E1E2E1A339B4BE07D3AB8364507D4A48D19734A1F484D6229B31A0A42FCE7BDB4C8F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pycurl.pth

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\pycurl.pth
Size 26B
SHA256 97486bb72596bb1a5c7562ec3af635df52addfb3f44c98614af0bf958ccb39b0
MD5 3867ec0dc459eb3a3c6f8d54f4f3010d
SHA1 87e2f2106defdd983dcf1adb719111d68d1218be
SHA512 19a52a11c6dfa426d3a0f70f94ac1d1d024ae8e35bfb6a59a1f1e7005313d8f0b38d774a65143a49bd2703cd81338c651b5bd8f7530024f57fd21dd54b9a2dd8
MD5 SHA1 SHA512

Submit Download

pycurl.zip

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\pycurl.zip
Size 3KB
SHA256 a5121756a5d0a9fe3afea44b1a62520c739cba8bd52678ca0aec1dd4c75149ed
MD5 fb5450819446624fcbb2ea5e3833571c
SHA1 03cebf374c1283cc4e2662aac5833b92b81ecfc8
SHA512 8af5d98870cfaea25d3b459dc5953723e103c011f113034edafab3df3dbefbf65e7dac2f422e4bfcd49d614a8cce049183b20cc851fd33ad5843e639a519a01f
TLSH
T148613B41CCEFD08A8493037968811BDC44A84AD22C5588DC944AFBDDC979BF67C43B9E
MD5 SHA1 SHA512 TLSH

Submit Download

qtbuilder.eb

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\qtbuilder.eb
Size 4KB
SHA256 9c4bb9919683ddb180aff82ba203b9130de1640b55f961c576777e5ebfd17c50
MD5 f82c57cb0d03b7800d6bf30e19a87c1e
SHA1 286f84b47ca4278b66bdbb75aa97e2567fe4161b
SHA512 edb7f4a2fef07a71cbe0262c755551ab508cd185e2fe2da022f52eada40a1bae9e4fbdf993d5124a685734045ea660dc87edecddc1fd6d331eda3f84d7c1736b
SSDEEP 96:8150drRdrPCMWMQk/IyWnoQGsTsP+Oxg2qi05Yo48q6t9m/:8150drPrKM5z5qodAsP+OWiOq8qa9e
TLSH
T107918DC3D40F2B2380EE689DBFC84875DC9A217136697DDAC8AC6FC4D62D8566422652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qtbuilder.pth

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\qtbuilder.pth
Size 12B
SHA256 a616438cd6fdb42dc8e4e23148534b01258359c6b1e8ee8f9b342689b39021a9
MD5 c8553c11396f68fa76f74d828fc44feb
SHA1 1cc594eda47f60db656d4e0dd1a5233ec6935adc
SHA512 509467b78610b3e9f88fd8574b55938b17605227d36123dab3ae01f10666d7333722b1916b7c7ddacea824fbd2cbb64ae6f219a9681feea3b62ef1cd254f62ba
MD5 SHA1 SHA512

Submit Download

universal_keychain.eb

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\universal_keychain.eb
Size 390KB
SHA256 c34e1828c539f0e794cd59081c25884319eaa1c034923efdada853f0335d45c2
MD5 603a31fcba0392c429425f2437e77e5a
SHA1 67562fb0da33c182755bfce4c9ab420064ca70c0
SHA512 446fb48a58cb50c07ff3884be2330138de518918a69f13e17c0dadc8f4cdf95c6fb1f762b855e046f9aa811bb990d0f5886e2af3c2e444aeb2588bfcf4dcea61
SSDEEP 12288:Yb1JrYAOi5sgdEB2YTKZuomXPgxiFZB5IT:Yb/8AOittpnAFi
TLSH
T1C68423497B1B83333FBACEEF09C2C154DCF9824A1AB72039510BA3550A68DED2957776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

universal_keychain.pth

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\universal_keychain.pth
Size 21B
SHA256 77c3bcd7506e5d3f60d1a0707a64fc37afc64530ae0ef3d034d77d3dff61d41e
MD5 2e2aa3e45301ec9901a2831ecc7d99ae
SHA1 afe2cf3f8184a65efc3da420171850a31ada944d
SHA512 5cd1f2e04cfc10a4078f5cdee62b9601a25a4f4df5ea3d9120e03f165972d9cf573d4483c3202c180de476e6a40e8482bd2550acb81908e2ccadd90820db23dc
MD5 SHA1 SHA512

Submit Download

~idprovider_smartcard.pth

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\~idprovider_smartcard.pth
Size 104B
SHA256 49cd0bbcb32fc24159b378df965a35f1aae3047c0a2c9911d2a23ad914c5a52b
MD5 7add5653dc337a254d41669907bcea22
SHA1 f0997baa4fd73407609244c2652790a07b3d136e
SHA512 8db3e0c230d29160f34eb96c1a5083bac7bc8e63523accbd42ef14d69eeb4e2913c97ca17ac8c4cb9c7808330c4b749ea87a59f0eeae288664cfe4cf11b21901
TLSH
T191B012427097413BC3E1C18500546DAC4E2974B14A200005DCC0433DCD37F0C9C80FD5
MD5 SHA1 SHA512 TLSH

Submit Download

~idprovider_smartup.pth

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\site-packages\~idprovider_smartup.pth
Size 103B
SHA256 b218340487e13ca5a3d8b641d9c94c852001eac643680273047c9aaeef9b8ac8
MD5 b5522119cbb5ee927fb5cc45f32f7cfc
SHA1 3f5118ecf4e385ce597bad4749fe98a546690739
SHA512 03d2854e86dc13328787502798b1f9996c0934ea0987c61267b3dbb9bd74d80faba66e741120f0287370ba70a6cf4fed14e83c924e5b96759bc1a7bc76823a10
TLSH
T10DB01251B057413B86E1D08400546DAC5B3970B14A300004CC80073FCC37F1CD888FD0
MD5 SHA1 SHA512 TLSH

Submit Download

stdlib.zip

Path C:\PROGRA~2\Bit4id\UKC\UKC\lib\Python2.7\stdlib.zip
Size 2.3MB
SHA256 3064f9cc1a2afc2e6e2f3404ff575ba73a28f7c966ac64f0c32c0921da8fe378
MD5 f80c5847427682bc83aa895aa5538175
SHA1 8499e4808bfad354c7e0d317120e6b326c277715
SHA512 6710c4e4ccb2b91f90f1a60fb7db173c5345468461bbcc21440f7f5d1860264b58dde07b480cd2498edb0649f42daeba40a44d631a140e3a258530fa073dc052
SSDEEP 49152:FobDSsuf99NjhDiTUdmycqHi46S+fwLsxvTan96G89PV9rOybUdMXMUZkIx:F/lQimhq3qwLsxv29BKxbUVUZkIx
TLSH
T18EB52331C43C950DDFA3E2B591A6FC86A91E96C43167769B294C701ABBA38CCD73F058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kchain.exe

Path C:\Program Files (x86)\Bit4id\UKC\UKC\bin\kchain.exe
Size 48KB
SHA256 b995d35f108dfca0063fcdd6dfdd46ee2346060dda5f73223053f4c9d2b279f1
MD5 e30d9bbca13850fec67396d2d6f6c352
SHA1 76b92a85bf9a17f66186eccfcf3a565338d28897
SHA512 2f39417dada6e8054c41a804c31af55c431f9d9f28d9a7e90e79b599250a3cbfb861d0e1875b90c7ff5e4169f39682d279dba27439ba2618854414902533b019
SSDEEP 768:HgwN40nerOllPnKIUlT2Wn5YiEENAMxv6SLY2Wn5YiVAMxkEP:A6SOlRUI07hxCKF07tx
TLSH
T1DD231A7259954811CF0A4C3C2498AC7F5C2F737FFB9092F21258D15A5BC0BCEAAA91F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VC90.CRT.manifest

Path C:\Program Files (x86)\Bit4id\UKC\UKC\lib\Python2.7\site-packages\PySide\plugins\graphicssystems\Microsoft.VC90.CRT.manifest
Size 520B
SHA256 149a1af249a5074de446a47ac51c9af1a70386a179f1f986b9521d1f87d08aad
MD5 35bd7ef673318e38fa29ffdd76169792
SHA1 83b6da9fc480333751225cd3b896fb328e28a3f6
SHA512 3df10e3b835e09ee14be06d5605b42671b2fed84ac27f7146662a34ccdeab0644f0e3e9a07d50c891e26e870d10796f9bdf3cc2b708aae27d8a8777cafb47ff5
TLSH
T1B3F09780D648AD362E218672A893E844B35E4F63184D592874FD711A5F378AB81810BF
MD5 SHA1 SHA512 TLSH

Submit Download

UKC_uninstall.exe

Path C:\Program Files (x86)\Bit4id\UKC\UKC_uninstall.exe
Size 158KB
SHA256 d15a3950b9be4f98fad7747e7fa4419c39208eb415ff9d23782a92cbcfcf1ae7
MD5 77b475994ca6810dadbca2013435ed8f
SHA1 ddc052fe0208d74658021a6efee4f26600f65a8e
SHA512 fa3da810d3573264f02232ec293d6501203062c649d525450021c01ad5d70138fe15dee8c819021384a867ac13dd925827a1a9b3c5f602e51e5d71535604b4ba
SSDEEP 3072:rfi3k+oWDBDh1duyYsANs0+n6XgENilv6BREliufJoqma:rfL+oqPINL+O9kroqma
TLSH
T1ACF3F202B229C4B3DEBD1BB1017A17B94FB6D9BF8246960703407B5E3DB36C5B52B186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CA1.cer

Path C:\Program Files (x86)\Bit4id\UKC\crt\CA1.cer
Size 2KB
SHA256 00a278f431d9397987112e6941b8131d662266267e15b8f7d9ee17b475d796d5
MD5 9ec6766eee2c2e9d5d36b37a1ae1f88d
SHA1 27e77968beb68e1a4ad98bc229fd8dcb137e4513
SHA512 fa25ebdef6c9c38029463afebe52b3fba62d3503981fd4c17dbbfd9f1f1612857875b038c9c12b107e6001414ca285881d15a70d395ec83e1c802e9eae2b787e
TLSH
T124513C955D717D6C2C27C41894DA7CE14A50362780C333E550D93EB2ABCEA7F1341ADA
MD5 SHA1 SHA512 TLSH

Submit Download

CA2.cer

Path C:\Program Files (x86)\Bit4id\UKC\crt\CA2.cer
Size 2KB
SHA256 1ae134b6c773ae000b432b36e4f993e13f73e69f9c795a517626167b2c8b3871
MD5 2aac499063d7eeb1b33a27f1999606ee
SHA1 bb32cefeff503f871585ded06a6f69bc72100338
SHA512 a0f09dd58fd3976b09ee10c0966a993aac7b3e6cd0531a82092cd26b67a0738b60e0742aa575167b0c2f4e99eeb9e004cd04d1cbec6ffa158c44329b31a969e1
TLSH
T1B6513C4F9FA07A1C1C51D45CC4676CEC1515324ACD82B6E64286292ACB8EDBF2316FF9
MD5 SHA1 SHA512 TLSH

Submit Download

EXPRESS.cer

Path C:\Program Files (x86)\Bit4id\UKC\crt\EXPRESS.cer
Size 2KB
SHA256 e4d314f04f3b428d94106536ab76afeed47848e14ea67b6bb412b4ed3c308c53
MD5 2ba55a4d717e2004d4dc677673c74670
SHA1 4b472fc1b8c27bf59399d874c731b1a16cb6d1df
SHA512 fe99c7b2153aa375f3017561ff1d66b21058842fb2912d1ecbea3e7de22f27c719a455d04e61eae33e8bdf14fe50402381d333aa2a036a579e960e76812eb9c8
TLSH
T126514CEB9E34241A68A14418C0F7DE95813222158CD370F578D73F9447CF09E27799DC
MD5 SHA1 SHA512 TLSH

Submit Download

ROOT.cer

Path C:\Program Files (x86)\Bit4id\UKC\crt\ROOT.cer
Size 2KB
SHA256 c54fd4ef5401195a10443282d9266aca80f60fcc37da354e4e8f7574a75697be
MD5 22f793a79596babe19f5372ddf43b4aa
SHA1 c4d4bf91f45d8f450c809c923ce0431017f47a99
SHA512 bc5e8b808e37f7dcecb1ef96ccad722bb9d8ad32b43de6c625e7068609e1ee57867e0fa7aadc8014e795eca114a922473eaeb0e7903ad226b85d4b37092b3c61
TLSH
T1F2510A7E6B215406786FE8895CF66880099D1130CDA2A6F19DF03DCDCF08D96E62956F
MD5 SHA1 SHA512 TLSH

Submit Download

TYT.cer

Path C:\Program Files (x86)\Bit4id\UKC\crt\TYT.cer
Size 2KB
SHA256 f0f96eaf2849e56859446a1d4c60286f42af0bbfcb71910a9d883cae824fa89c
MD5 2dce21ac2a6670243d72bd11b5c13151
SHA1 d5c5b91f512c826ca24d40fe7508e9cea11f8453
SHA512 430f1dadb65602996e8dfa7041a584d191e1f643463527eadc378a2a73c3c3447df749e402296a17081b9b026d074dbeac6fce6e6be0edb000c1d934b93e75db
TLSH
T1A9515C3C1A10B24B3ACB8549D9B2169EA10C3233C95835F8D50E16C7C9466F931CAFC6
MD5 SHA1 SHA512 TLSH

Submit Download

certmgr.exe

Path C:\Program Files (x86)\Bit4id\UKC\crt\certmgr.exe
Size 58KB
SHA256 9167db7f9a9a583fccf5333cfe3d6b5331668e8755086d43386e6fc25b8f429c
MD5 545192538c259c4c4e61e3788df198f1
SHA1 92b1f458c58ae08b73500ec43e9d0d88b03e2603
SHA512 e5d41f4c3ebd45e331a0458ca2c608f559c56d83b685c4012240de3b2d63285cd344455b996b8510dae64a1c06302601246f70c84d3c3c1b1800f2afd74e5c15
SSDEEP 768:WiY9alfoPmVFzwWNweD+Itznxl4wDOi47PcA3WXs4S9i4zv:WdUlfoPizJthznEi4DcA3WXs39i4zv
TLSH
T1E8437201A3F58119FAF3A6765A769724CF73BA545A34CA0F23E4404D0EBBA19C871F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 1405439e8f13a6f11778e05e40233da5d5df3c3a4652a14a6061cef899dcc4e3
MD5 668ddb4ecd93dd2afd6ff24a8f9b9f6d
SHA1 93f5d7de63a28039480a54327e999d6af38b41cf
SHA512 909a8b2b22d5cbb93112e9577cdca25d6d9c5c4215afc56e4ba0e053b5ccc1e242a2b78bd4bdc6d47fd53a36dcf00d9b51dedf968fead90c4d28f0398eaae213
TLSH
T10AF0F4A6C821EC3708FD4B2970954B86F754137B2B80858F3B3C420D8FB463B85A592C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 93148e188119058ecce999323a30c185e0266a23d55295bbf2b5a7fe69d42f86
MD5 3e618e63c95d3def54237a38d5436966
SHA1 906b6014099c27a0a6f3560423f14b2ca925cdd9
SHA512 9d7482934cf53c4ab68c14c65cb7e4acfa96c58b912df577253c9ce2c01076f2138f6e9ef0666d6782e5b07405e81f239aa15a1b49ecba4734e181ba0d977c3c
TLSH
T1CB518DB3C7E8897D890156F8AB156E2FCE690E18536C3C66C8D4AF0B53E2D71D20069F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9ba3bdd652f387629ea34ecc62dc8ef22ecc5d130f76f9c5b99377b35ec88a2c
MD5 aa56f9371f57eb7b1babfc934195242d
SHA1 4413a5abe0ec93f5e7c550516e2f186e8ad91a12
SHA512 6600aa9e32a5b9b468fd0d86eb0610d0b47125e721bac02dfee8b3b3810f437b3ae18541b64c720b539dbf0a6655532f6115dd31a8b15fbc3df900fda963c852
SSDEEP 192:RRv9vxoIJBlv7H+pAPRp2X9WHsb+WNnNKP5Y2SewcwJVyIsnAUge:RRvNKYViUXQUwAPK2ave
TLSH
T19C42A43EAD54653B9CCBC22AFA657763E7F5203161A42E80E6FC8A2C15D75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0460d7af8195ba2cb26ceff15cc991869867aae6a3c7e2383afcdb9eb37af84f
MD5 390dfec495d9f4eb2f75be36005a3358
SHA1 2298a9e476dc87ee75d03cabde07665aa181ad56
SHA512 91a4c50a8d111554677a002fcd919316b8e16346db44f698d624a6274417358fb53d9131312e549c694189ff010b79d21684a1ed05711f89d8d6dfc4fe734e7c
SSDEEP 192:RR89vCoIJBlv7H+pWPRp4X9WHsb+WNnNKP7Y2SewcaJVyIsnAUgE:RR8NdYVieXWUwAPc2gvE
TLSH
T13C42C73EAD14653B9CCBC22EFA657B63E7F5203161A42E44E6FC8A2C15D75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 376821221a347fd5405784533032132fb171537cc3b3e4cbf2e681ca414471dd
MD5 8af604f9120382a806c9dcb79cc4ba54
SHA1 3ffd6fa58f2c4047fd4ba1eb99f7b01f0835d282
SHA512 da1bb314644002983a3879e405c351c64ee7a5599f61cab7f45dc0e2086ac394ab226353f69444b633dc48f0300494ee1dac18b88ca2622c2c707bc8b4e40330
TLSH
T131B012008002514DC18302B41586149971246F229B0A1F4243E0A922C8251628018150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5846d8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5846d8.TMP
Size 96B
SHA256 5ad52eb6ff026a0be4381edc6c43acb2fecd1869a83d0a8c0a48e4730aa3e450
MD5 7d47d5efa9c54fcbdf4895cc81baae1f
SHA1 be47a368279aae492ff99e5cc5fbb3d98794ecbc
SHA512 b230dd44df75641d74bd452932b6e281a255c34bb280544f3cdb58d7d25d3ac678c9cd38bcb36b74ce4bd237d08a5793b202bc48bce7a92c35ffa580a1b3d39c
TLSH
T147B02203C0023222C00283B020C0E0F83030CF32CA030322C2E00BE2CC202B20230030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0fd15a2eae2266566aea6ed5a78088535082f51375aa10a803a80eead5e3f5d8
MD5 156a1846ed02db831ef31fd90bf967c9
SHA1 f4c308c1eaffeacd428531d5de2cf5c32e5aa27e
SHA512 1f96083eb66c576a2c5968858ea178b41be79c1b758a70bdab2292036f167f6b5f56b2e5e922d2cd48b0816590d8cdb06132166de3fad14e5f37b25e3dff25f6
SSDEEP 3072:/0zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:CWDfxA3OnjrYQ9EU0/hEV
TLSH
T1E6C302A11C39BD660DF8EE98740D3A60BFF4ADAA92875DC352E91F4C14FA5C81179D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 7cb5621032477b3c437b02450a3efa5ffa7106009cd8fbd6edc98017547a2b28
MD5 354a8498e00b4e158641526af212ab86
SHA1 1d73cdb41c95a5e921d2e7de0fa4aa4fb7e99868
SHA512 c9a19986cab9a3c84b8636fce58773e3f328d03332e3a0a2a3a29b80a9f5dde7bc88ad1dac0d4f935271412554519b14dde27ea98409d7810e94adeab50b1cd7
SSDEEP 3072:yyQzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:yrWDfxA3OnjrYQ9EU0/hEV
TLSH
T13EC302A15C3ABD660DF8ED98740D3E60BFF4ACAA91476DD3A2E81F4C14FA5C81179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b8a64efb693350cfe4d19836676cffa3f1e73549f9f40e48a728d89c1101c88e
MD5 009c1d328ad763ad0b44d5e5690e105b
SHA1 8d4d2282776c7955a18051ab5ceffac7227aae96
SHA512 4989adeb157fb806e6ce44b526b3f5f41f91ac3c0496ec60ed50c1c97b5870045932be73e08f79775e005eb8a27d5e8bfe9f37f9e448a95496676568083fa8ed
SSDEEP 3072:ozWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:2WDfxA3OnjrYQ9EU0/hEV
TLSH
T183C302A11C3ABD660DF8EE99B44D3A60BFF4AD9A91435DC361ED1F0C14FA5C81179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 cbe520a7247d98046702591801babc8771656867c29a2ac9b7fbd7dbb39a7840
MD5 30f91d3475888993668130e7c2db3eb8
SHA1 4316ccf5524ff58e598a4d8e564ebfd179730d62
SHA512 f7d01399a5b23141ecdbeb51573639acdb9c57b27755fabcfe284e8d8003cc4c790543dbf618e0169e20f0675cd3e659a407c56f8ada697cd2b5bf2483a4e498
SSDEEP 3072:U0zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:9WDfxA3OnjrYQ9EU0/hEV
TLSH
T1A2C302A11C39BD660DF8EE98740D3A60BFF4ADAA92875DC392E91F4C14FA5C81179D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nst7F68.tmp\LangDLL.dll
Size 5KB
SHA256 32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
MD5 50016010fb0d8db2bc4cd258ceb43be5
SHA1 44ba95ee12e69da72478cf358c93533a9c7a01dc
SHA512 ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
SSDEEP 48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL
TLSH
T113C18370F3D248B9C5D1413778A732D36612AE74A784504F9B6315AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellExecAsUser.dll

Path C:\Users\Admin\AppData\Local\Temp\nst7F68.tmp\ShellExecAsUser.dll
Size 43KB
SHA256 1f17e4d5ffe7b2c9a396ee9932ac5198f0c050241e5f9ccd3a56e576613d8a29
MD5 552cba3c6c9987e01be178e1ee22d36b
SHA1 4c0ab0127453b0b53aeb27e407859bccb229ea1b
SHA512 9bcf47b62ca8ffa578751008cae523d279cdb1699fd916754491899c31ace99f18007ed0e2cbe9902abf132d516259b5fb283379d2fead37c76b19e2e835e95a
SSDEEP 768:SA49ATJ9ONLkh9J5lDYDzG8yVAf7hiJFkkAqnTEDlV4vihdk:SA4CJ9OFpXf0AfNiTkIMrhdk
TLSH
T19B135A0072A184B6E577553459B497A24B6EBD016AF4808B3FBE13BE5FB16C09B3C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nst7F68.tmp\System.dll
Size 12KB
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nst7F68.tmp\modern-wizard.bmp
Size 150KB
SHA256 d092789ec8aebd227408d874e7f7ff9a7937a1bcb6f3e78edb1aab4ecc490465
MD5 2dddafd7d1c70ece7d062ea77def5cc8
SHA1 0096acc96b044dafda7c6c832986c158b97414b1
SHA512 4979d4b07e9069f2c5ef615c887f8d7b33dc19779cc81c130b9a37d97c027c634bd51c6bb882a3810a9a72ceffff316fca7f2eb0fe72846e483dd768d532894d
SSDEEP 1536:w0ah8WnENdK+S9PqSGy9ea7dytITf0skY5zTxRqf512j+iiksy+:vah8XhyjqITPkUxR0W3Sy+
TLSH
T1B9E38531C060CD6A6D6FF91F04C4F361A9CDFD60A99D63D20EEA350F963EE92846E650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nst7F68.tmp\nsDialogs.dll
Size 9KB
SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
MD5 1d8f01a83ddd259bc339902c1d33c8f1
SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
TLSH
T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nst7F68.tmp\nsExec.dll
Size 7KB
SHA256 01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
MD5 b4579bc396ace8cafd9e825ff63fe244
SHA1 32a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c
SHA512 3a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a
SSDEEP 96:JwzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuH0DQ:JTQHDb2vSuOc41ZfUNQZGdHM
TLSH
T171E1093571C02DF7D08D89743816BD2F43F4D52627BE05A04A7B1AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SignCloudPC.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\SignCloudPC.exe:Zone.Identifier
Size 88B
SHA256 20e6408495525409a7f6e30e0870be9b048574572373babbb5c933eec364d143
MD5 2951e0008d8f8813865ac6651a6efe43
SHA1 fabc5ef509db23ae22bc799f2962e63abc772c09
SHA512 eb9502f3a71a4b13d8dd7ee7bfe2389940e3aeb5373ff4d128604aff8538dc14243866fade10129077e8a9cc86b506782d85556de6381068fd3d0c6ca49051b0
TLSH
T128B0120B8CC48A10394135844A88515CD00E361C0D410241A90084E3C5C1098A3B0961
MD5 SHA1 SHA512 TLSH

Submit Download

csp12.dll

Path C:\Windows\SysWOW64\csp12.dll
Size 396KB
SHA256 ed7f5e038095705364de1916d82389779d50256439cddf3eae5e23e9d7c36653
MD5 c9d7ca85ff622303a382fbb51d2a0eac
SHA1 d3b88ed1af12371fd8e0275ba50aa19fc6883c46
SHA512 2d3df8dc21f6e109db0a75dc0fc41e5e4020f57251ea34cda1ad30295a9da6f5fc53b21a8a8a7a76021d7091bd3ed2ef644ea540527f7bc52ce5ea4a7eea0a7f
SSDEEP 6144:9aSnAT5iWZ1AiiCW4I+4hZni1he81NRw5diiM:9zAN83b5554h
TLSH
T1A7846D32F292C435C07732364DA9674667B57E7062B5B90F77C8363DABB54D2AE20283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1300-546-0x0000000000740000-0x000000000074C000-memory.dmp

Download

memory/1300-567-0x00000000022D0000-0x00000000022EE000-memory.dmp

Download

memory/1300-572-0x0000000003CD0000-0x0000000004368000-memory.dmp

Download

memory/1300-571-0x0000000003CD0000-0x0000000004368000-memory.dmp

Download

memory/1300-569-0x0000000002300000-0x000000000231E000-memory.dmp

Download

memory/1300-566-0x0000000003310000-0x00000000034CE000-memory.dmp

Download

memory/1300-562-0x0000000002E40000-0x0000000002FCC000-memory.dmp

Download

memory/1300-558-0x0000000002260000-0x00000000022AA000-memory.dmp

Download

memory/2228-528-0x0000000002D90000-0x0000000002F1C000-memory.dmp

Download

memory/2228-526-0x0000000002570000-0x00000000025BA000-memory.dmp

Download

memory/2228-525-0x0000000000920000-0x000000000092C000-memory.dmp

Download

memory/5348-530-0x00000000021E0000-0x00000000021EC000-memory.dmp

Download

memory/5348-535-0x0000000002D30000-0x0000000002EBC000-memory.dmp

Download

memory/5348-532-0x0000000002350000-0x000000000239A000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads