Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
427s - max time network
431s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
10/09/2026, 20:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://vaellune.com.br/pdf/acrobatupdate61626340676d61696c2e636f6d
Resource
win11-20260513-en
windows11-21h2-x64
30 signatures
600 seconds
General
- Target https://vaellune.com.br/pdf/acrobatupdate61626340676d61696c2e636f6d
- Sample260910-zlbpxswcmd
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 39 6016 msedge.exe - Executes dropped EXE 44 IoCs
pid Process 4656 AdobeAcrobatPDF.exe 4728 AdobeAcrobatPDF.tmp 5272 _setup64.tmp 5000 InstallUninstallApp.exe 1704 7za.exe 5192 ZecuritAgentRegister.exe 3408 ZecuritAgentService.exe 5376 ZecuritLiveNotifier.exe 4712 ZecuritCommandProcessor.exe 3280 ZecuritAgentRegister.exe 4820 ZecuritAgentAssetMgr.exe 2988 ZecuritAgentAssetMgr.exe 4824 ZecuritAgentWinStore.exe 5380 ZecuritAgentService.exe 4880 ZecuritLiveNotifier.exe 5932 ZecuritAgentTray.exe 3912 ZecuritCommandProcessor.exe 6220 ZecuritAgentWinStore.exe 6284 ZecuritCommandProcessor.exe 1064 ZecuritPromptUI.exe 6996 ZecuritCommandProcessor.exe 4048 ZecuritRemoteTools.exe 6300 ZecuritRemoteTools.exe 6492 ZecuritCommandProcessor.exe 6604 ZBitLocker.exe 1460 ZecuritAgentAssetMgr.exe 2832 ZecuritAgentRegister.exe 2564 ZecuritAgentRegister.exe 6260 ZecuritAgentRegister.exe 6228 ZecuritAgentTray.exe 6176 ZecuritAgentTray.exe 6164 ZecuritAgentService.exe 6756 ZecuritAgentService.exe 6220 ZecuritAgentService.exe 3036 ZecuritAgentService.exe 6740 ZecuritAgentService.exe 6688 ZecuritAgentUpgrader.exe 6632 ZecuritDeviceControl.exe 6964 ZecuritDeviceControl.exe 5300 ZecuritAssetMonitoring.exe 6340 ZecuritAssetMonitoring.exe 6656 ZecuritCommandProcessor.exe 6588 ZecuritScreenReaderService.exe 6800 ZecuritCommandProcessor.exe - Loads dropped DLL 53 IoCs
pid Process 5128 MsiExec.exe 5128 MsiExec.exe 5192 ZecuritAgentRegister.exe 5192 ZecuritAgentRegister.exe 3408 ZecuritAgentService.exe 3408 ZecuritAgentService.exe 5376 ZecuritLiveNotifier.exe 5376 ZecuritLiveNotifier.exe 4712 ZecuritCommandProcessor.exe 4712 ZecuritCommandProcessor.exe 4712 ZecuritCommandProcessor.exe 4820 ZecuritAgentAssetMgr.exe 4820 ZecuritAgentAssetMgr.exe 2988 ZecuritAgentAssetMgr.exe 2988 ZecuritAgentAssetMgr.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 4880 ZecuritLiveNotifier.exe 4880 ZecuritLiveNotifier.exe 3912 ZecuritCommandProcessor.exe 3912 ZecuritCommandProcessor.exe 3912 ZecuritCommandProcessor.exe 6284 ZecuritCommandProcessor.exe 6284 ZecuritCommandProcessor.exe 6284 ZecuritCommandProcessor.exe 6996 ZecuritCommandProcessor.exe 6996 ZecuritCommandProcessor.exe 6996 ZecuritCommandProcessor.exe 6492 ZecuritCommandProcessor.exe 6492 ZecuritCommandProcessor.exe 6492 ZecuritCommandProcessor.exe 6604 ZBitLocker.exe 1460 ZecuritAgentAssetMgr.exe 1460 ZecuritAgentAssetMgr.exe 6164 ZecuritAgentService.exe 6164 ZecuritAgentService.exe 6756 ZecuritAgentService.exe 6756 ZecuritAgentService.exe 6220 ZecuritAgentService.exe 6220 ZecuritAgentService.exe 3036 ZecuritAgentService.exe 3036 ZecuritAgentService.exe 6740 ZecuritAgentService.exe 6740 ZecuritAgentService.exe 6688 ZecuritAgentUpgrader.exe 5300 ZecuritAssetMonitoring.exe 6340 ZecuritAssetMonitoring.exe 6656 ZecuritCommandProcessor.exe 6656 ZecuritCommandProcessor.exe 6656 ZecuritCommandProcessor.exe 6800 ZecuritCommandProcessor.exe 6800 ZecuritCommandProcessor.exe 6800 ZecuritCommandProcessor.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\CRLs ZecuritAgentAssetMgr.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\CTLs ZecuritAgentAssetMgr.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ZecuritAgentWinStore.exe.log ZecuritAgentWinStore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request ZecuritAgentAssetMgr.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates ZecuritAgentAssetMgr.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAlertManager.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritGeoLocationApp.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\libssl-1_1.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritADEntraHandler.dll 7za.exe File created C:\Program Files\Zecurit\Agent\Storage\ZecuritAgentInstaller.msi ZecuritAgentRegister.exe File created C:\Program Files\Zecurit\Agent\ZecuritPromptUI.exe.config 7za.exe File created C:\Program Files\Zecurit\Agent\GetWinGetSoftwares.ps1 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZBitLocker.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritDeviceControl.exe 7za.exe File created C:\Program Files\Zecurit\Agent\msvcp140.dll 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritADEntraHandler.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_cmd_handler.log ZecuritCommandProcessor.exe File created C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritAssetMonitoring.exe 7za.exe File created C:\Program Files\Zecurit\Agent\Storage\Patches.json ZecuritAgentAssetMgr.exe File created C:\Program Files\Zecurit\Agent\Storage\Softwares.json ZecuritAgentAssetMgr.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\device_asset_scan.log ZecuritAgentAssetMgr.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\device_control.log ZecuritDeviceControl.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\device_control.log ZecuritDeviceControl.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_cmd_handler.log ZecuritCommandProcessor.exe File created C:\Program Files\Zecurit\Agent.7z msiexec.exe File created C:\Program Files\Zecurit\Agent\ZecuritAgentWinStore.exe.config 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritGeoLocationApp.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritApplicationControlHandler.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_cmd_handler.log ZecuritCommandProcessor.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAgentUpgrader.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritAlertManager.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritScreenReaderApp.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritWinHandler.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_cmd_handler.log ZecuritCommandProcessor.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe.config 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritApplicationControlService.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritPromptUI.exe 7za.exe File created C:\Program Files\Zecurit\Agent\libcrypto-1_1.dll 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritAgentHandler.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAgentHandler.dll 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe.config 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAgentWinStore.exe 7za.exe File created C:\Program Files\Zecurit\Agent\mfc140.dll 7za.exe File created C:\Program Files\Zecurit\Agent\RCStream.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_install.log ZecuritAgentRegister.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_live_notifier.log ZecuritLiveNotifier.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritGeoLocationApp.exe.config 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritPromptUI.exe.config 7za.exe File created C:\Program Files\Zecurit\Agent\Get-DeviceWarranty.ps1 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritRemoteTools.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\msvcp140.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\vccorlib140.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\Storage\ZecuritAgentInstaller.msi ZecuritAgentRegister.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_live_notifier.log ZecuritLiveNotifier.exe File created C:\Program Files\Zecurit\Agent\ZecuritScreenReaderService.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritRemoteTools.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_cmd_handler.log ZecuritCommandProcessor.exe File created C:\Program Files\Zecurit\Agent\Storage\PowerEventHistory.json ZecuritAgentService.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_service.log ZecuritAgentService.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\remote_tools.log ZecuritRemoteTools.exe File opened for modification C:\Program Files\Zecurit\Agent\Get-DeviceWarranty.ps1 7za.exe - Drops file in Windows directory 33 IoCs
description ioc Process File created C:\Windows\rescache\_merged\2689159751\3030768879.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\4052159476\2447381432.pri ZecuritAgentWinStore.exe File opened for modification C:\Windows\Installer\MSIFBD1.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF1B7AFA90A0E81882.TMP msiexec.exe File created C:\Windows\rescache\_merged\926178228\832983665.pri ZecuritAgentWinStore.exe File opened for modification C:\Windows\Installer\e5bfac8.msi msiexec.exe File created C:\Windows\SystemTemp\~DF6321C485724648E8.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIFD79.tmp msiexec.exe File created C:\Windows\rescache\_merged\2878548818\115981084.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\1079253649\242833619.pri ZecuritAgentWinStore.exe File created C:\Windows\Installer\e5bfacc.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIFCAD.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF5CCD9E4843465D93.TMP msiexec.exe File created C:\Windows\rescache\_merged\2277971356\2485185387.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\3559780703\1315986413.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\4062111013\1129546084.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\942627682\1785861508.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\566188972\1048903725.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\2879188468\2150125737.pri ZecuritAgentWinStore.exe File created C:\Windows\Installer\e5bfac8.msi msiexec.exe File created C:\Windows\SystemTemp\~DFC3D595C7C635E112.TMP msiexec.exe File created C:\Windows\rescache\_merged\1831202810\109261846.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\2343073371\2673042085.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\98783150\1191735134.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\1154286595\4006449105.pri ZecuritAgentWinStore.exe File created C:\Windows\Installer\SourceHash{D16197C5-AF74-4C36-B385-907AD910E9F3} msiexec.exe File created C:\Windows\rescache\_merged\179954523\4069898366.pri ZecuritAgentWinStore.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\rescache\_merged\39430164\4155960362.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\3766950118\154749270.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\3989159129\499114771.pri ZecuritAgentWinStore.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\AdobeAcrobatPDF.exe:Zone.Identifier msedge.exe -
pid Process 4872 powershell.exe 6444 powershell.exe 6600 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 12 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob = 5900000001000000100000005200530041002f004d004400350000001400000001000000140000003edf290cc1f5cc732ceb3d24e17e52dabd27e2f00b000000010000003400000056006500720069005300690067006e002000540069006d00650020005300740061006d00700069006e006700200043004100000009000000010000000c000000300a06082b0601050507030803000000010000001400000018f7c1fcc3090203fd5baa2f861a754976c8dd250f000000010000001000000065fc47520f66383962ec0b7b88a0821d190000000100000010000000e53d34cecb05c17ee332c749d78c02562000000001000000c0020000308202bc3082022502104a19d2388c82591ca55d735f155ddca3300d06092a864886f70d010104050030819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e301e170d3937303531323030303030305a170d3034303130373233353935395a30819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e30819f300d06092a864886f70d010101050003818d0030818902818100d32e20f0687c2c2d2e811cb106b2a70bb7110d57da53d875e3c9332ab2d4f6095b34f3e990fe090cd0db1b5ab9cde7f688b19dc08725eb7d5810736a78cb7115fdc658f629ab585e9604fd2d621158811cca7194d522582fd5cc14058436ba94aab44d4ae9ee3b22ad56997e219c6c86c04a47976ab4a636d5fc092dd3b4399b0203010001300d06092a864886f70d01010405000381810061550e3e7bc792127e11108e22ccd4b3132b5be844e40b789ea47ef3a707721ee259efcc84e389944cdb4e61efb3a4fb463d50340b9f7056f68e2a7f17cee563bf796907732eb095288af5edaaa9d25dcd0aca10098fceb3af2896c479298492dcffba674248a69010e4bf61f89c53e593d1733ff8fd9d4f84ac55d1fd116363 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob = 5900000001000000100000005200530041002f004d00440035000000140000000100000014000000265d0507d82fa26084bd837df52180a7056f5a85030000000100000014000000109f1caed645bb78b3ea2b94c0697c740733031c19000000010000001000000083b65318664e6fa245e0d7609fb958202000000001000000130400003082040f308202f7a003020102020a198b11d13f9a8ffe69a0300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937313030313037303030305a170d3032313233313037303030305a3081c3312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e3141303f060355040b13384d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747920496e7465726d656469617465204341311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3131302f060355040313284d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747930819f300d06092a864886f70d010101050003818d0030818902818100e04e100eb8a7ef21ca605adc9f1e3e83775a292ef94ee5085ddee1cf09c01f44b707a84ba422303b190683eef3ac2778aecad6402bce7901e19d568b3672b163905fa0b2c066a649c53cfa26a262c3d3b5cc61154cf23fb4e7450843897f6a8dd566fbd7ff6400c411fd2ca30b75b0fbe5ac2665a381e666493d1d737a9b71d70203010001a381da3081d7300f0603551d130101ff040530030101ff301f0603551d250418301606082b06010505070303060a2b0601040182370a03053081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010016d8587683608be849582c050b644d40ad2d4dc2fc5f7d963cd0afb954522828d5655e8f710eb3080e1509c9d592cc241144242d51dfaf54444b7bd671d4d73a357cd186b405dca7097498b21b166d39a7446aad79eaa2cdff5b2a63d1848422ab98c68762621b539615604731571ee00161ad36efc52d0ab4d01853f3569cb4b7b7050433ad29279351070c9ebe80ff15bc26c741f36ce2c2eaafb4ae5e08bba8c95b509b4a08430ccedcffbb2aa7816f5facbc7528ea363ebc0a94450b5ccdb5e39f238cb507813d5978514639bca7f66d17037fee529a39bc09f2d2baa8d79505eb465254718ee87ecd9a6ee74af3a449f0cac695a5516055bd741ecb2c01 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob = 5900000001000000120000005200530041002f0053004800410031000000040000000100000010000000e1c07ea0aabbd4b77b84c228117808a71400000001000000140000000eac826040562797e52513fc2ae10a539559e4a469000000010000000e000000300c060a2b0601040182373c03020b000000010000004a0000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000030000000100000014000000cdd4eeae6000ac7f40c3802c171e30148030c0720f0000000100000014000000391be92883d52509155bfeae27b9bd340170b76b190000000100000010000000983b132635b7e91deef54a6780c092695c00000001000000040000000010000020000000010000009d0500003082059930820381a003020102021079ad16a14aa0a5ad4c7358f407132e65300d06092a864886f70d0101050500305f31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c64011916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479301e170d3031303530393233313932325a170d3231303530393233323831335a305f31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c64011916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f7420436572746966696361746520417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100f35dfa8067d45aa7a90c2c9020d035083c7584cdb707899c89dadecec360fa91685a9e94712918767cc2e0c82576940e58fa043436e6dfaff780bae9580b2b93e59d05e3772291f734643c22911d5ee10990bc14fefc755819e179b70792a3ae885908d89f07ca0358fc68296d32d7d2a8cb4bfce10b48324fe6ebb8ad4fe45c6f139499db95d575dba81ab79491b4775bf5480c8f6a797d1470047d6daf90f5da70d847b7bf9b2f6ce705b7e11160ac7991147cc5d6a6e4e17ed5c37ee592d23c00b53682de79e16df3b56ef89f33c9cb527d739836db8ba16ba295979ba3dec24d26ff0696672506c8e7ace4ee1233953199c835084e34ca7953d5b5be6332594036c0a54e044d3ddb5b0733e458bfef3f5364d842593557fd0f457c24044d9ed6387411972290ce684474926fd54b6fb086e3c73642a0d0fcc1c05af9a361b9304771960a16b091c04295ef107f286ae32a1fb1e4cd033f777104c720fc490f1d4588a4d7cb7e88ad8e2dec45dbc45104c92afcec869e9a11975bdece5388e6e2b7fdac95c22840dbef0490df813339d9b245a5238706a5558931bb062d600e41187d1f2eb597cb11eb15d524a594ef151489fd4b73fa325bfcd13300f95962700732ea2eab402d7bcadd21671b30998f16aa23a841d1b06e119b36c4de40749ce15865c1601e7a5b38c88fbb04267cd41640e5b66b6caa86fd00bfcec1350203010001a351304f300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e041604140eac826040562797e52513fc2ae10a539559e4a4301006092b06010401823715010403020100300d06092a864886f70d01010505000382020100c5114d033a60dd5d5211778fb2bb36c8b205bfb4b7a8d8209d5c1303b61c22fa061335b6c863d49a476f2657d255f104b1265fd6a95068a0bcd2b86eccc3e9acdf19cd78ac5974ac663436c41b3e6c384c330e30120da326fe515300ffaf5a4e840d0f1fe46d052e4e854b8d6c336f54d264abbf50af7d7a39a037ed63030ffc1306ce1636d4543b951b51623ae54d17d40539929a27a85baabdecbbbee3208960716c56b3a513d06d0e237e9503ed683df2d863b86b4db6e830b5e1ca944bf7a2aa5d9930b23da7c2516c28200124272b4b00b79d116b70beb21082bc0c9b68d08d3b2487aa9928729d335f5990bdf5de939e3a625a3439e288551db906b0c1896b2dd769c319123684d0c9a0daff2f6978b2e57adaebd70cc0f7bd6317b8391338a2365b7bf285566a1d6462c138e2aabf5166a294f5129c6622106bf2b730922df229f03d3b144368a2f19c2937cbce3820256d7c67f37e24122403088147eca59e97f518d7cfbbd5ef7696effdcedb569d95a042f99758e1d73122d35f59e63e6e2200ea4384b625dbd9f3085668c0646b1d7cecb693a262576e2ed8e7588fc4314926ddde293587f53071705b143c69bd89127deb2ea3fed87f9e825a520a2bc1432bd930889fc810fb898de6a18575337e6c9edb7313646269a52f7dca966d9ff8044d30923d6e211421c93de0c3fd8a6b9d4afdd1a19d9943773fb0da ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5900000001000000160000005200530041002f00530048004100320035003600000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob = 5900000001000000100000005200530041002f004d004400350000000400000001000000100000002a954eca79b2874573d92d90baf99fb61400000001000000140000004a5c7522aa46bfa4089d39974ebdb4a360f7a01d030000000100000014000000a43489159a520f0d93d032ccaf37e7fe20a8b4190b00000001000000320000004d006900630072006f0073006f0066007400200052006f006f007400200041007500740068006f007200690074007900000069000000010000000e000000300c060a2b0601040182373c03020f00000001000000100000008b3c3087b7056f5ec5ddba91a1b901f01900000001000000100000003fc8cb0bc05241e58d65e9448b2d07c25c00000001000000040000000008000020000000010000001604000030820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e3115a204fea627bafaa19c82b37252dbe65a1128a250f63a3f7541cf921c9d615f352ac6e433207fd8217f8e5676c0d51f6bdf152c7bde7c430fc203109881d95291a4dd51d02a5f180e003b45bf4b1ddc857ee6549c75254b6b4032812ff90d6f0088f7eb897c5ab372ce47ae4a877e376a000d06a3fc1d2368ae04112a8356a1b6adb35e1d41c04e4a84504c85a33386e4d1c0d62b70aa28cd3d5543f46cd1c55a670db123a8793759fa7d2a0 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000190000000100000010000000bb048f1838395f6fc3a1f3d2b7e97654140000000100000014000000722d3a02319043b914054ee1eaa7c731d12389340300000001000000140000008f43288ad272f3103b6fb1428485ea3014c0bcfe69000000010000000e000000300c060a2b0601040182373c03020b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003100310000000f0000000100000020000000279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1040000000100000010000000ce0490d5e56c34a5ae0be98be581185d5c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a00302010202103f8bc8b5fc9fb29643b569d66c42e144300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131303332323232303532385a170d3336303332323232313330345a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100b28041aa35384d13723268224db8b2f1ffd552bc6cc7f5d24a8c36eed1c25c7e8c8aaeaf13286fc073e33aced025a85a3a6defa8b859ab132368cd0c2987d16f805c8f447f5d90015258ac51c55f2a87dcdcd80a1dc103b97bb056e8a3de6461c29ef8f37cb9ec0db554fe4cb6654f88f09c48990c420b097c315917790678288d893a4c0325be716a5c0be78460a49922e3d2af84a4a7fbd198ed0ca9de9489e10ea0dcc0ce993dea0852bb5679e41f84ba1eb8b4c4495c4f314b87dddd0567269980e07111a3b8a541e2a453b9f73229830c13bf365e04b34b43472f6be2911ed3984fdd4207c8e81d12fc99a96b3e927ec8d6693afc64bdb6099dcafd0c0ba29b77604b0394a4306912d6422dc1414ccadcaafd8f5b83469ad9fcb1d1e3b3c97f487acd24f0418f5c74d0acb010200649b7c72d21c857e3d086f30368fbd0ce71c189994a64016cfdec3091cf413c92c7e5ba861d6184c75f833962aeb4922f47f30bf855eba01f59d0bb749b1ed076e6f2e906d710e8fa64de69c635968802f046b83f27996fcb71892935f7481602358fd5797c4d02cf5feb8a834f457188f9a90d4e72e9c29c07cf491b4e040e63518c5ed800c1552cb6c6e0c2654ec93439f59cb3c47ee8616e135f15c45fd97eed1dceee44eccb2e86b1ec38f670edab5c13c1d90f0dc780b255ed34f7ac9be4c3dae7473ca6b58f31dfc54bafebf10203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414722d3a02319043b914054ee1eaa7c731d1238934301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201007f72cf0fb7c515db9bc049ca265bfe9e13e6d3f0d2db975ff24b3f4db3ae19aeedd797a0acefa93aa3c241b0e5b8919e13812403e609fd3f574039212456d1102f4b40a936864bb453579afbf17e898f11fe186c51aae8ed0995b5e571c9a1e98775a6157fc97e37545e7493c5c367cc0d4f6ba8170c6d08927e8bdd81aa2d7021c33d0614bbbf245ea784d73f0f2122bd4b0006db971cd85ed4c50b5c876e50a4e8c338a4fbcb2cc592669b855ecb7a6c937c8029585b57b54069ba0879a66462159d879645b5662320038b1c73a0d3a27933e0505986db2fe50225ea732a9f0014c836c7923be94e00ecd85609b9334912d2540b01abac47b691297d4cb475805201e8ca82f69fccac9c8f17ea2f26b0ab72ac0bfe9e511ec74355674f51b357d6b6ecee52b73ae94ee1d78188bc4f8e75bb4ba8f035aa26d4676749b2704c3b93dc1ddf78908672b238a4d1dc924dc958eb2b125cd43bae8c6bb083e5013ff80932f693353422afdd370d7709802bcd4800f18c9919470501e9d1bfd14ed0e628433799a40a4a08d99a7173d2aacd31136376a1376f92381e7d123c6632e7cb6de1fc5289ddcad666059a9661bea228c71ca3a736503c3aa4df4a6ee6873bceebf0e081379d133c528ebdb91d34c61dd50a6a3d9829708c892ad1ab8210481fdcf4efa5c5bb551a3863844eb76cad9554ec6522104917b8c01ec70fac5447 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob = 5900000001000000100000005200530041002f004d0044003500000014000000010000001400000001f0334c1aa1d9ee5b7ba9de43bc027d570933fb0b00000001000000400000004d006900630072006f0073006f00660074002000410075007400680065006e007400690063006f0064006500280074006d002900200052006f006f0074000000090000000100000016000000301406082b0601050507030406082b060105050703030300000001000000140000007f88cd7223f3c813818c994614a89c99fa3b52470f0000000100000010000000d67576f5521d1ccab52e9215e0f9f74319000000010000001000000007d34ded498d4577f261bd38b6b8736e2000000001000000da030000308203d6308202bea003020102020101300d06092a864886f70d01010405003050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479301e170d3935303130313038303030315a170d3939313233313233353935395a3050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100df08bae33f6e649bf589af28964a078f1b2e8b3e1dfcb88069a3a1cedbdfb08e6c8976294fca603539ad7232e00bae293d4c16d94b3c9ddac5d3d109c92c6fa6c2605345dd4bd155cd031cd2595624f3e578d807ccd8b31f903fc01a71501d2da712086d7cb0866cc7ba853207e1616faf03c56de5d6a18f36f6c10bd13e69974872c97fa4c8c24a4c7ea1d194a6d7dceb05462eb818b4571d8649db694a2c21f55e0f542d5a43a97a7e6a8e504d2557a1bf1b1505437b2c058dbd3d038c93227d63ea0a5705060adb6198652d4749a8e7e656755cb8640863a9304066b2f9b6e334e86730e1430b87ffc9be72105e23f09ba74865bf09887bcd72bc2e799b7b0203010001a381ba3081b7300d0603551d0a040630040302078030320603550403042b13294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930720603551d01046b306980101a1be75b9ffd8c2ac339ae0c622e5332a1523050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479820101300d06092a864886f70d010104050003820101002dc9e2f6129e5d5667fafa4b9a7edc29565c80140228856e26f3cd58da5080c5f819b3a67ce29d6b5f3b8f2274e61804fc4740d87a3f3066f012a4d1eb1de7b6f498ab5322865158ee230976e41d455c4bff4ce302500113cc41a45297d486d5c4fe8383657deabea2683bc1b12998bfa2a5fc9dd384ee701750f30bfa3cefa9278b91b448c845a0e101424b4476041cc219a28e6b2098c4dd02acb4d2a20e8d5db9368e4a1b5d6c1ae2cb007f10f4b295efe3e8ffa17358a9752ca2499585feccda448ac21244d244c8a5a21fa95a8e56c2c37bcf4260dc821ffbce74067ed6f1ac196a4f745cc51566316cc16271910f595b7d2a821adfb1b4d81d37de0d0f ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob = 5900000001000000100000005200530041002f004d004400350000001400000001000000140000009aa6587f94dd91d91e63dfd3f0ce5fae1893aab7030000000100000014000000fee449ee0e3965a5246f000e87fde2a065fd89d4190000000100000010000000edbccdd5106a071c5d8b4690918e48aa2000000001000000ce010000308201ca30820174a003020102021006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405003016311430120603550403130b526f6f74204167656e6379301e170d3936303532383232303235395a170d3339313233313233353935395a3016311430120603550403130b526f6f74204167656e6379305b300d06092a864886f70d0101010500034a0030470240815522b98aa46fedd6e7d9660f55bcd7cdd5bc4e400221a2b1f78730855ed2f244b9dc9b75b6fb465f42b69d23360bde540fcdbd1f992a105811cb40cbb5a7410203010001a3819e30819b3050060355040304491347466f722054657374696e6720507572706f736573204f6e6c792053616d706c6520536f667477617265205075626c697368696e672043726564656e7469616c73204167656e637930470603551d010440303e801012e4092d061d1d4f008d6121dc166463a1183016311430120603550403130b526f6f74204167656e6379821006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405000341002d2e3e7b8942893fa82117faf0f5c395db62695bc9dcc1b3faf0c46f6f649abde71b2568728367bd56b08d01bd2af7cc4bbd87a5ba87204c421141ad10173b8c ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob = 5900000001000000120000005200530041002f0053004800410031000000030000000100000014000000d559a586669b08f46a30a133f8a9ed3d038e2ea818000000010000001000000091161b894b117ecdc257628db460cc041900000001000000100000006ed6ed7df52fc19bdc9e5fe9e2be21fb1400000001000000140000000acfeb4b07e703a01f4cef28ee7256f7517591550f00000001000000140000004973e092cf8a9e2ca5f988493a5bacfe3895942e040000000100000010000000acd80ea27bb72ce700dc22724a5f1e9220000000010000008703000030820383308202eca003020102021046fcebbab4d02f0f926098233f93078f300d06092a864886f70d0101050500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3937303431373030303030305a170d3136313032343233353935395a3081ba311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20496e7465726e6174696f6e616c20536572766572204341202d20436c617373203331493047060355040b13407777772e766572697369676e2e636f6d2f43505320496e636f72702e6279205265662e204c494142494c495459204c54442e286329393720566572695369676e30819f300d06092a864886f70d010101050003818d0030818902818100d88280e8d619027d1f85183925a2652be1bfd405d3bce6363baaf04c6c5bb6e7aa3c734555b2f1bdea9742ed9a340a15d4a95cf54025ddd907c132b2756cc4cabba3fe56277143aa63f5303e9328e5faf1093bf3b74d4e39f75c495ab8c11dd3b28afe70309542cbfe2b518b5a3c3af9224f90b202a7539c4f34e7ab04b27b6f0203010001a381e33081e0300f0603551d13040830060101ff02010030440603551d20043d303b3039060b6086480186f84501070101302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f43505330340603551d25042d302b06082b0601050507030106082b0601050507030206096086480186f8420401060a6086480186f845010801300b0603551d0f040403020106301106096086480186f842010104040302010630310603551d1f042a30283026a024a0228620687474703a2f2f63726c2e766572697369676e2e636f6d2f706361332e63726c300d06092a864886f70d010105050003818100408e4997968a73dd8e4def3e61b7caa062adf40e0abb753de26ed82cc7bff4b98c369bcaa2d09c724639f6a682036511c4bcbf2da6f5d93b0ab598fab378b91ef22b4c62d5fdb27a1ddf33fd73f9a5d82d8c2aead1fcb028b6e94948134b838a1b487b24f738de6f4154b8ab576b06dfc7a2d4a9f6f136628088f28b75d68071 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob = 5900000001000000100000005200530041002f004d004400350000000f0000000100000010000000e8a598be84828efeae701115013576b20400000001000000100000007f667a71d3eb6978209a51149d83da20030000000100000014000000be36a4562fb2ee05dbb3d32323adf445084ed65609000000010000000c000000300a06082b060105050703080b000000010000002e0000005400680061007700740065002000540069006d0065007300740061006d00700069006e0067002000430041000000190000000100000010000000181c2be05851f96993e196f279954b23140000000100000014000000ddbcbd869c3f07ed40e31b08efcec4d188cd3b155c0000000100000004000000000400002000000001000000a5020000308202a13082020aa003020102020100300d06092a864886f70d010104050030818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e67204341301e170d3937303130313030303030305a170d3230313233313233353935395a30818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e6720434130819f300d06092a864886f70d010101050003818d0030818902818100d62b587861458653ea347b519cedb0e62e180efee05fa827d3b4c9e07c594e160e735460c17ff69f2ee93a8524153cdb470463c39ec4941a5adf4c7af3d9431d3c107a7925db90fef051e730d64100fd9f28df79be94bb9db614e32385d7a941e04ca479b02b1a8bf2f83b8a3e45ac719200b4904198fb5fedfab72e8af888370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810067dbe2c2e6873d40838637357d1fce9ac30c6620a8baaa048986c2f510080dbfcba2058ad04d363ef4d7ef69c65ee4b0946f4ab9e7de5b88b67bdbe327e576c3f035c1cbb5279b3379dc90a6009e77fafccd279442169cd31c68ecbf5cdde5a97b100a32745413318b85038491b75801301438af28cafcb150191909ac8949d3 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000040000000100000010000000a266bb7dcc38a562631361bbf61dd11b140000000100000014000000d5f656cb8fe8a25c6268d13d94905bd7ce9a18c40300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd50b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020003200300031003000000069000000010000000e000000300c060a2b0601040182373c03020f000000010000002000000008fba831c08544208f5208686b991ca1b2cfc510e7301784ddf1eb5bf03932391900000001000000100000003c70faea25600ce3b2cc5f0b222ed6295c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob = 5900000001000000100000005200530041002f004d00440035000000140000000100000014000000344f302d25693191eaf7735cabf5868d378240ec030000000100000014000000245c97df7514e7cf2df8be72ae957b9e04741e8509000000010000000c000000300a06082b060105050703080b00000001000000320000004d006900630072006f0073006f00660074002000540069006d0065007300740061006d007000200052006f006f00740000000f00000001000000100000009df0d13100123aeca770130f4ad8d2091900000001000000100000007fdff50729446710244a447ca2a197ea2000000001000000b1020000308202ad30820216020101300d06092a864886f70d010104050030819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e301e170d3937303531333136313235395a170d3939313233303233353935395a30819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e30819f300d06092a864886f70d010101050003818d0030818902818100b75a38f51f37cca943c4dc2418bef28552b41d5b5f18b90b8f4b6da8ffcd40506cd3a0d35c47c2b9f786e4cd7d350569371faf3ddd1ffd8f1534c2c479cc59748a6f8c0ec3e811eb8438479853e1f10c0de4010cf01b1e20da2a7a3dc215528e8aff7b32bf581e25988326cb8ac9c4071424bc499ed77ab3871a2533bc6d08470203010001300d06092a864886f70d010104050003818100505bc56b6f8d525b0dc9bdac347398ca0a87caae4c4aba14a4eb52709521e0b5a1604ef743025101af1e3a70cebf18b686289967eb08e897405c1682fdb825fb366f6f763ec54c8ee2a751facac163ba5e8324470b9372f6449acea7953a8f50109e1db15916abcf3edf838bc7fac36bdc649f402b1f452404ae492ff6df0c91 ZecuritAgentAssetMgr.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language ZecuritAgentRegister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage ZecuritAgentRegister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language ZecuritAgentAssetMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeAcrobatPDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeAcrobatPDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage ZecuritAgentAssetMgr.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 6016 msedge.exe - Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
resource yara_rule behavioral1/files/0x000900000002afa0-1038.dat innosetup behavioral1/memory/4656-1985-0x0000000000400000-0x00000000004D8000-memory.dmp innosetup behavioral1/memory/4656-2013-0x0000000000400000-0x00000000004D8000-memory.dmp innosetup behavioral1/memory/4656-2335-0x0000000000400000-0x00000000004D8000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0018\ ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags ZecuritAgentAssetMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName ZecuritDeviceControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0018 ZecuritDeviceControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 ZecuritDeviceControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags ZecuritDeviceControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName ZecuritDeviceControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom ZecuritDeviceControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 pnputil.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0018\ = "0" ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0018 ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom ZecuritDeviceControl.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0018\ = "0" ZecuritDeviceControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc ZecuritDeviceControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0018 ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 ZecuritDeviceControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 ZecuritDeviceControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom ZecuritDeviceControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc ZecuritDeviceControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags ZecuritDeviceControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs ZecuritDeviceControl.exe - Enumerates system info in registry 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ZecuritAgentRegister.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ZecuritAgentRegister.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ZecuritAgentAssetMgr.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CShellExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a0335b833b5 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy%5Cresources.pri\1d75a03dce542f\a01460c8 ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CWindows.CBSPreview_cw5n1h2txyewy%5Cresources.pri\1d75a0380a5b25\a01460c8\@{Windows.CBSPreview_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.C = "Microsoft Corporation" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.creddialoghost_cw5n1h2txyewy%5Cresources.pri\1d75a03103a4674\a01460c8 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb\a01460c8 ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb\a01460c8\@{Microsoft.Windows.ParentalControls_1000.22000.1.0_neutral_neutral_cw5n1h2txyewy?ms-resourc = "Microsoft Corporation" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.BioEnrollment_cw5n1h2txyewy%5Cresources.pri\1d7d186da86753b\a01460c8 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.BioEnrollment_cw5n1h2txyewy%5Cresources.pri\1d7d186da86753b ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" ZecuritAgentAssetMgr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CImmersiveControlPanel%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CImmersiveControlPanel%5Cresources.pri\1d75a03421c99da ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri\1d75a0324ef8be\a01460c8\@{Microsoft.XboxGameCallableUI_1000.22000.1.0_neutral_neutral_cw5n1h2txyewy?ms-r = "Microsoft Corporation" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.ECApp_8wekyb3d8bbwe%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E ZecuritAgentAssetMgr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" ZecuritAgentAssetMgr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7d186bed84ec6\a01460c8\@{Microsoft.Windows.CloudExperienceHost_10.0.22000.1_neutral_neutral_c = "Email, phone, or Skype" ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.BioEnrollment_cw5n1h2txyewy%5Cresources.pri\1d7d186da86753b\a01460c8\@{Microsoft.BioEnrollment_10.0.19586.1000_neutral__cw5n1h2txyewy?ms-resource://Micro = "Microsoft Corporation" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri\1d75a03dcbf1be\a01460c8\@{Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutr = "Microsoft Corporation" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AsyncTextService_8wekyb3d8bbwe%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy%5Cresources.pri\1d75a033ba4eb74 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CShellExperienceHost_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.creddialoghost_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3\a01460c8\@{Microsoft.Windows.NarratorQuickStart_10.0.22000.1_neutral_neutral_8wek = "Microsoft" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3\a01460c8 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.creddialoghost_cw5n1h2txyewy%5Cresources.pri\1d75a03103a4674\a01460c8\@{Microsoft.CredDialogHost_10.0.19595.1001_neutral__cw5n1h2txyewy?ms-resource://Mic = "Microsoft Corporation" ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" ZecuritAgentAssetMgr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CImmersiveControlPanel%5Cresources.pri\1d75a03421c99da\a01460c8 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CWindows.CBSPreview_cw5n1h2txyewy%5Cresources.pri\1d75a0380a5b25 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7d186bed84ec6 ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri\1d75a0312c797d2\a01460c8\@{Microsoft.AccountsControl_10.0.22000.1_neutral__cw5n1h2txyewy?ms-resource://Micr = "Microsoft Corporation" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe - Modifies registry class 25 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5CA5B1CE2340AC1469E388621EBFD063 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\PackageName = "ZecuritAgentInstaller.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\Net\1 = "C:\\Windows\\TEMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\LastUsedSource = "n;1;C:\\Windows\\TEMP\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\ProductName = "Zecurit Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5CA5B1CE2340AC1469E388621EBFD063\5C79161D47FA63C43B5809A79D019E3F msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5C79161D47FA63C43B5809A79D019E3F\DefaultFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\Version = "419430414" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{BB0530A2-059D-4A36-B27D-87DEBDEA011F} msedge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5C79161D47FA63C43B5809A79D019E3F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\PackageCode = "137FB3A34AADC1346BA4553B77042084" msiexec.exe - Modifies system certificate store 2 TTPs 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5900000001000000120000005200530041002f0053004800410031000000040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa25c000000010000000400000000080000200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5900000001000000120000005200530041002f00530048004100310000000f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 5900000001000000160000005200530041002f00530048004100320035003600000019000000010000001000000014c3bd3549ee225aece13734ad8ca0b80f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074002000470032000000620000000100000020000000cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f391d00000001000000100000007dc30bc974695560a2f0090a6545556c7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a4040000000100000010000000e4a68ac854ac5242460afd72481b2a445c0000000100000004000000000800002000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5900000001000000160000005200530041002f0053004800410033003800340000000400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000002000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5900000001000000100000005200530041002f004d004400320000007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5900000001000000120000005200530041002f005300480041003100000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6205c0000000100000004000000000800002000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6\Blob = 5900000001000000120000004400530041002f00530048004100310000000300000001000000140000002c85006a1a028bcc349df23c474724c055fde8b620000000010000001f0300003082031b308202dba003020102020900bea900b78b6470ef300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3136303530393230343035355a170d3231303530383230343035355a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012c06072a8648ce3804013082011f02818100a9a733a14a9c9d68b075811ddf231c514c0cdc328087287fd11f1d6eb125b536b88cd5579591bb6e7545b45b98eaa8cdeb0ae38be4781c7d36d97b3d2bb45b9449142130f68e112c6d09e343160cd0d0fbb8aabc8b0cea5b2066b0e3368589dadfd8ae79e9d2bdc5f5836d8fb278be02c260d3a592bda471f1a28e2f925e8b57021500a86236ce56c046d8f3fac8a6bb63e28543e45753028181009eb2085cfbe32af5a25dddeebdeede0d2f2a4475bbca802c7952e078421b4b85528fff6242aba7c75c1e40695db3be422d982972b638679c1b9314a39cad44577d2a71ee3e5738176062d9200be5efcc1b00c16b1b48e8b1771c01b9aa54ce0b5f6679caed531293d92ef822695e20264e23b188489ea3e6dc1c36a90fa0668903818400028180168cdc3d074cf4c9accef116317b85adf100f2454c9ca23203ad296928bb08879c48096c44bcb0dc3f49f69456e871dd45980eacabe735c63ade0281e7a48aca3eabde71aab64c04a6ef72c352be936692c8970a3c7615370d549b931c289810278f5284914f6965df0d93ce0a980ca5dce26e75a331c4da939af3e051d252d3a38198308195301d0603551d0e04160414a353ea5503cd0a69c45870b6ffe3912091c79f7a30530603551d23044c304a8014a353ea5503cd0a69c45870b6ffe3912091c79f7aa127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900bea900b78b6470ef30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403032f00302c021468e7a7cdfca81ff04d476fa11b781b7696d1fbf402145ef1c64374ebde4c309b59a9deeb99e556fd1477 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000000400000001000000100000008eadb501aa4d81e48c1dd1e1140095190300000001000000140000003679ca35668772304d30a5fb873b0fa77bb70d547e000000010000000800000000c0032f2df8d6011d0000000100000010000000439b4d52906df7a01771d729528723b3140000000100000014000000b677fa6948479f5312d5c2ea07327607d19707197f0000000100000016000000301406082b0601050507030306082b060105050703016200000001000000200000002399561127a57125de8cefea610ddf2fa078b5c8067f4e828290bfb860e84b3c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b0601050507030853000000010000004200000030403021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000006000000056006500720069005300690067006e00200055006e006900760065007200730061006c00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f000000010000002000000017fe16f394ec70a5bb0c6784cab40b1e61025ae9d50ecaa0531d6b4d997bbc59190000000100000010000000ad6d6ff31b24013151f279e26a8c33245c0000000100000004000000000800002000000001000000bd040000308204b9308203a1a0030201020210401ac46421b31321030ebbe4121ac51d300d06092a864886f70d01010b05003081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479301e170d3038303430323030303030305a170d3337313230313233353935395a3081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c761375eb10134db62d7159bff585a8c2323d6608e91d79098837ae65819388cc5f6e56485b4a271fbedbdb9dacd4d00b4c82d73a5c76971951f393cb244079ce80efa4d4ac421df29618f32226182c5871f6e8c7c5f16205144d1704f57eae31ce3cc79ee58d80ec2b34593c02ce79a172b7b00377a413378e133e2f3101a7f872cbef6f5f742e2e5bf8762895f004bdfc5dde4754432413a1e716e69cb0b754608d1cad22b95d0cffbb9406b648c574dfc13117984ed5e54f6349f0801f3102506174adaf11d7a666b986066a4d9efd22e82f1f0ef09ea44c9156ae2036e33d3ac9f5500c7f6086a94b95fdce033f18460f95b2711b4fc16f2bb566a80258d0203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e04160414b677fa6948479f5312d5c2ea07327607d1970719300d06092a864886f70d01010b050003820101004af8f8b003e62c677be4947763cc6e4cf97d0e0ddcc8b935b9704f63fa24fa6c838c479d3b63f39af976329591b177bcac9abeb1e43121c68195565a0eb1c2d4b1a659acf163cbb84c1d59904aef9016281f5aae10fb8150380c6cccf13dc3f563e3b3e321c92439e9fd156646f41b11d04d73a37d46f93deda85f62d4f13ff8e074572b189d81b4c428da9497a570ebac1dbe0711f0d5dbdde58cf0d532b083e657e28fbfbea1aabf3d1db5d438ead7b05c3a4f6a3f8fc0666c63aae9d9a416f481d195140e7dcd9534d9d28f7073817b9c7ebd9861d845879890c5eb8630c635bff0ffc35588834bef05920671f2b89893b7eccd8261f138e64f97982a5a8d ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5900000001000000120000005200530041002f0053004800410031000000190000000100000010000000a823b4a20180beb460cab955c24d7e210f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c0400000001000000100000003e455215095192e1b75d379fb187298a5c000000010000000400000000080000200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 59000000010000001a000000450043004400530041002f005300480041003300380034000000040000000100000010000000f55da450a5fb287e1e0f0dcc965756ca0f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f007400200047003300000062000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc61d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb130300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e190000000100000010000000b009e99a5cfc928a173190106dbb32a95c0000000100000004000000800100002000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5900000001000000120000005200530041002f00530048004100310000000f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C\Blob = 5900000001000000120000004400530041002f0053004800410031000000030000000100000014000000b68d8f953e551914324e557e6164d68b9926650c2000000001000000200300003082031c308202dba003020102020900f5610f0c1a4d426b300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3231303331383138343233375a170d3431303331333138343233375a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012b06072a8648ce3804013082011e02818100dc1911eb3e0ac27a1b8fcf7b95e6192f5ee6a922eca3cc87df88539244fb3d07d10e2fe7570a602726d0e1ed4ad078a1317746a4dc613eb0629fe4e8272b19454aa3ad2d598dc2fa884e001a5fa009ecb4b5ff6d9996610f3b2b3911a41db558608026ca0d439574a106f09c479e58ee6c7d9e93de57cfed8832798e0d6ad5a10215008453f6990ad5473bab4ebb0f46ce52d5a354596502818070de55e09bdc70d46f414acf263fdb2ff0879f0bceed06ea6789a518fe5cfe025374aacead5cf1d27aca1b085c4b0cd4f4561c387d24c904f96af7db6f57a8a9110901b51dc2a2531532ad06ec4096f288e73d651cc1d6140b2932ee4c95ec4bb09d462800de2765606137d04e8ff9ced03b391c89ebc91d119d312f4f4ba88f0381850002818100d920e184f0439cac6f987f511ef4d45b4a6f693c806c55f143558ffab70deb4f1a92a2a6c8c8ac931094c92a0118011b13fb33701a93bb8569bec9323811d8e8b8ba7b060fe5ca557bb980461dbbf9cb863b3cf7259015c22efd0fabbdffa3b19cbc9f6dd469605ab4aa59ad5126eab69f3de5cb3470b9fc4c8a69b7e87a8832a38198308195301d0603551d0e04160414d8201fdaa7f2d1002bf5eda7be5e8e49897208f030530603551d23044c304a8014d8201fdaa7f2d1002bf5eda7be5e8e49897208f0a127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900f5610f0c1a4d426b30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403033000302d021470c61b78deaf41f3cbf42bd3c0f1fd7a5018f1bf0215008399b086c63512f057352a2bf1e6b248d8ab107d ZecuritAgentAssetMgr.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\AdobeAcrobatPDF.exe:Zone.Identifier msedge.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1544 msedge.exe 1544 msedge.exe 744 msiexec.exe 744 msiexec.exe 5192 ZecuritAgentRegister.exe 5192 ZecuritAgentRegister.exe 3408 ZecuritAgentService.exe 3408 ZecuritAgentService.exe 4712 ZecuritCommandProcessor.exe 4712 ZecuritCommandProcessor.exe 4712 ZecuritCommandProcessor.exe 4712 ZecuritCommandProcessor.exe 3408 ZecuritAgentService.exe 3408 ZecuritAgentService.exe 3408 ZecuritAgentService.exe 3408 ZecuritAgentService.exe 3408 ZecuritAgentService.exe 3408 ZecuritAgentService.exe 3408 ZecuritAgentService.exe 3408 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 4872 powershell.exe 4872 powershell.exe 4872 powershell.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 6444 powershell.exe 6444 powershell.exe 6444 powershell.exe 6600 powershell.exe 6600 powershell.exe 6600 powershell.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe 5380 ZecuritAgentService.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4212 msiexec.exe Token: SeIncreaseQuotaPrivilege 4212 msiexec.exe Token: SeSecurityPrivilege 744 msiexec.exe Token: SeCreateTokenPrivilege 4212 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4212 msiexec.exe Token: SeLockMemoryPrivilege 4212 msiexec.exe Token: SeIncreaseQuotaPrivilege 4212 msiexec.exe Token: SeMachineAccountPrivilege 4212 msiexec.exe Token: SeTcbPrivilege 4212 msiexec.exe Token: SeSecurityPrivilege 4212 msiexec.exe Token: SeTakeOwnershipPrivilege 4212 msiexec.exe Token: SeLoadDriverPrivilege 4212 msiexec.exe Token: SeSystemProfilePrivilege 4212 msiexec.exe Token: SeSystemtimePrivilege 4212 msiexec.exe Token: SeProfSingleProcessPrivilege 4212 msiexec.exe Token: SeIncBasePriorityPrivilege 4212 msiexec.exe Token: SeCreatePagefilePrivilege 4212 msiexec.exe Token: SeCreatePermanentPrivilege 4212 msiexec.exe Token: SeBackupPrivilege 4212 msiexec.exe Token: SeRestorePrivilege 4212 msiexec.exe Token: SeShutdownPrivilege 4212 msiexec.exe Token: SeDebugPrivilege 4212 msiexec.exe Token: SeAuditPrivilege 4212 msiexec.exe Token: SeSystemEnvironmentPrivilege 4212 msiexec.exe Token: SeChangeNotifyPrivilege 4212 msiexec.exe Token: SeRemoteShutdownPrivilege 4212 msiexec.exe Token: SeUndockPrivilege 4212 msiexec.exe Token: SeSyncAgentPrivilege 4212 msiexec.exe Token: SeEnableDelegationPrivilege 4212 msiexec.exe Token: SeManageVolumePrivilege 4212 msiexec.exe Token: SeImpersonatePrivilege 4212 msiexec.exe Token: SeCreateGlobalPrivilege 4212 msiexec.exe Token: SeBackupPrivilege 2532 vssvc.exe Token: SeRestorePrivilege 2532 vssvc.exe Token: SeAuditPrivilege 2532 vssvc.exe Token: SeBackupPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeBackupPrivilege 760 srtasks.exe Token: SeRestorePrivilege 760 srtasks.exe Token: SeSecurityPrivilege 760 srtasks.exe Token: SeTakeOwnershipPrivilege 760 srtasks.exe Token: SeBackupPrivilege 760 srtasks.exe Token: SeRestorePrivilege 760 srtasks.exe Token: SeSecurityPrivilege 760 srtasks.exe Token: SeTakeOwnershipPrivilege 760 srtasks.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe - Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 4728 AdobeAcrobatPDF.tmp 4212 msiexec.exe 4212 msiexec.exe 5932 ZecuritAgentTray.exe 6228 ZecuritAgentTray.exe 6176 ZecuritAgentTray.exe - Suspicious use of SendNotifyMessage 23 IoCs
pid Process 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5596 msedge.exe 5932 ZecuritAgentTray.exe 6228 ZecuritAgentTray.exe 6176 ZecuritAgentTray.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5596 wrote to memory of 2492 5596 msedge.exe 80 PID 5596 wrote to memory of 6016 5596 msedge.exe 81 PID 5596 wrote to memory of 4568 5596 msedge.exe 82 PID 5596 wrote to memory of 4568 5596 msedge.exe 82 PID 5596 wrote to memory of 4568 5596 msedge.exe 82 PID 5596 wrote to memory of 6116 5596 msedge.exe 84 PID 5596 wrote to memory of 6116 5596 msedge.exe 84 PID 5596 wrote to memory of 4764 5596 msedge.exe 85 PID 5596 wrote to memory of 3196 5596 msedge.exe 86 PID 5596 wrote to memory of 4764 5596 msedge.exe 85 PID 5596 wrote to memory of 4764 5596 msedge.exe 85 PID 5596 wrote to memory of 3196 5596 msedge.exe 86 PID 5596 wrote to memory of 3196 5596 msedge.exe 86 PID 5596 wrote to memory of 2312 5596 msedge.exe 88 PID 5596 wrote to memory of 6064 5596 msedge.exe 89 PID 5596 wrote to memory of 2312 5596 msedge.exe 88 PID 5596 wrote to memory of 6064 5596 msedge.exe 89 PID 5596 wrote to memory of 4528 5596 msedge.exe 90 PID 5596 wrote to memory of 5576 5596 msedge.exe 92 PID 4528 wrote to memory of 3808 4528 msedge.exe 93 PID 5596 wrote to memory of 5060 5596 msedge.exe 96 PID 5596 wrote to memory of 4916 5596 msedge.exe 97 PID 5596 wrote to memory of 2036 5596 msedge.exe 98 PID 5596 wrote to memory of 2224 5596 msedge.exe 99 PID 5596 wrote to memory of 4932 5596 msedge.exe 100 PID 5596 wrote to memory of 2224 5596 msedge.exe 99 PID 5596 wrote to memory of 4932 5596 msedge.exe 100 PID 5596 wrote to memory of 4932 5596 msedge.exe 100 PID 5596 wrote to memory of 4504 5596 msedge.exe 101 PID 5596 wrote to memory of 3508 5596 msedge.exe 102 PID 5596 wrote to memory of 3508 5596 msedge.exe 102 PID 5596 wrote to memory of 3508 5596 msedge.exe 102 PID 5596 wrote to memory of 5924 5596 msedge.exe 103 PID 5596 wrote to memory of 5924 5596 msedge.exe 103 PID 5596 wrote to memory of 2944 5596 msedge.exe 104 PID 5596 wrote to memory of 2944 5596 msedge.exe 104 PID 5596 wrote to memory of 2944 5596 msedge.exe 104 PID 5596 wrote to memory of 4956 5596 msedge.exe 105 PID 5596 wrote to memory of 4956 5596 msedge.exe 105 PID 5596 wrote to memory of 4956 5596 msedge.exe 105 PID 5596 wrote to memory of 4944 5596 msedge.exe 107 PID 5596 wrote to memory of 4944 5596 msedge.exe 107 PID 5596 wrote to memory of 4944 5596 msedge.exe 107 PID 5596 wrote to memory of 4812 5596 msedge.exe 108 PID 5596 wrote to memory of 696 5596 msedge.exe 109 PID 5596 wrote to memory of 696 5596 msedge.exe 109 PID 5596 wrote to memory of 696 5596 msedge.exe 109 PID 5596 wrote to memory of 3972 5596 msedge.exe 110 PID 5596 wrote to memory of 3972 5596 msedge.exe 110 PID 5596 wrote to memory of 1544 5596 msedge.exe 112 PID 5596 wrote to memory of 2284 5596 msedge.exe 114 PID 5596 wrote to memory of 2220 5596 msedge.exe 115 PID 5596 wrote to memory of 2220 5596 msedge.exe 115 PID 5596 wrote to memory of 2220 5596 msedge.exe 115 PID 5596 wrote to memory of 792 5596 msedge.exe 116 PID 5596 wrote to memory of 792 5596 msedge.exe 116 PID 5596 wrote to memory of 5224 5596 msedge.exe 119 PID 5596 wrote to memory of 5224 5596 msedge.exe 119 PID 5596 wrote to memory of 5224 5596 msedge.exe 119 PID 5596 wrote to memory of 2904 5596 msedge.exe 120 PID 5596 wrote to memory of 2904 5596 msedge.exe 120 PID 5596 wrote to memory of 2904 5596 msedge.exe 120 PID 5596 wrote to memory of 2036 5596 msedge.exe 122 PID 5596 wrote to memory of 6012 5596 msedge.exe 123 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vaellune.com.br/pdf/acrobatupdate61626340676d61696c2e636f6d1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffdcee7c188,0x7ffdcee7c194,0x7ffdcee7c1a02⤵PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,2444727602814432158,17022379321139949695,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
PID:6016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,17543720647937610686,246059396217393030,262144 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,10978219408467993145,7423619076131934134,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:132⤵PID:6116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,18362313105920022543,15576460660825060348,2097152 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:12⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,16749432033495088925,2161777533189144720,2097152 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:12⤵PID:3196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,2831203313017493023,272674886656780424,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:142⤵PID:2312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,15063706618733250619,11855854451689928921,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:142⤵PID:6064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,13794028867495546280,5179287318426073854,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵PID:3808
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,16970546819663088857,4076757258475400904,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:142⤵PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,16970546819663088857,4076757258475400904,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:142⤵PID:5576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,5781827473532799652,17300352290180724332,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:142⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,722373384044228013,14648096070289031280,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:142⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,7382293815058838485,17242844311000398584,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:142⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,11272482964815362633,759398329920365621,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:142⤵PID:2224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6284,i,10127796630461671882,9171096975740114742,2097152 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:12⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,3971916903008967324,5191234749331286980,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5844,i,6709892622638518948,684436473075114152,2097152 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:3508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,3847949818188170173,1381860444996842744,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:142⤵PID:5924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7116,i,4747305926156342137,2582335596249281216,2097152 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:12⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6708,i,2475950553667536967,10569716317411395417,2097152 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:12⤵PID:4956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7644,i,15190834528235102702,7181369020780609988,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:142⤵PID:5480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7620,i,1073334865689513376,16415604110943481013,2097152 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:12⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7644,i,15190834528235102702,7181369020780609988,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:142⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7144,i,10811773224249564675,9488508562880393660,2097152 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:12⤵PID:696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8000,i,1730097999858727540,15571986779138445981,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:142⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5056,i,7776556507690843189,10364471760048011850,262144 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:1544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,16361048381703702601,6983363616524188196,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:142⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,16361048381703702601,6983363616524188196,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:142⤵PID:2284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5012,i,13009461936544913100,6210757595142479950,2097152 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:2220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,14185461600989472172,598732161923254059,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:142⤵PID:792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8508,i,9571168300768885588,16325197464200578876,2097152 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:12⤵PID:5224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6372,i,8107671358662938261,5644569891761770681,2097152 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:12⤵PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7924,i,1713071973336174277,16728803627682725592,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:142⤵PID:1176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7924,i,1713071973336174277,16728803627682725592,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:142⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8364,i,4824988456758639046,7283955132402604922,2097152 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:12⤵PID:6012
-
-
C:\Users\Admin\Downloads\AdobeAcrobatPDF.exe"C:\Users\Admin\Downloads\AdobeAcrobatPDF.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\is-D9EOR.tmp\AdobeAcrobatPDF.tmp"C:\Users\Admin\AppData\Local\Temp\is-D9EOR.tmp\AdobeAcrobatPDF.tmp" /SL5="$7021E,21457211,832512,C:\Users\Admin\Downloads\AdobeAcrobatPDF.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\is-FT5FU.tmp\_isetup\_setup64.tmphelper 105 0x4384⤵
- Executes dropped EXE
PID:5272
-
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Windows\TEMP\ZecuritAgentInstaller.msi" /qb4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4212
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8624,i,8140608427130883590,9103143916325008738,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:142⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,11135381622620546368,14533246182914967717,524288 --field-trial-handle=2152,i,12013750573382626013,2652690926547032799,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:142⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4780
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:1604
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2408
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:760
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 091464D84589B48AAC8AE512A18678E62⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5128
-
-
C:\Program Files\Zecurit\InstallUninstallApp.exe"C:\Program Files\Zecurit\InstallUninstallApp.exe" install2⤵
- Executes dropped EXE
PID:5000 -
C:\Program Files\Zecurit\7za.exe7za.exe x "C:\Program Files\Zecurit\Agent.7z" -o"C:\Program Files\Zecurit"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1704
-
-
C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe" install3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5192
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2712
-
C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3408 -
C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe"C:\Program Files\Zecurit\Agent\\ZecuritLiveNotifier.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:5376
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4712 -
C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exeZecuritAgentAssetMgr.exe -cmdID 140857 -cmdType DeviceScanDetails -cmdVer 1.0 -reqTime 1789073553753 -scanLevel FULL -queries DeviceInformation&InstalledSoftwareList&HardwareList&Certificates&system&security&Location&Warranty&DiskInfo3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:4820 -
C:\Program Files\Zecurit\Agent\ZecuritAgentWinStore.exeZecuritAgentWinStore.exe GetStoreApps4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:6220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Program Files\Zecurit\Agent\GetWinGetSoftwares.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6444
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Program Files\Zecurit\Agent\Get-DeviceWarranty.ps1" DELL 1 serial4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6600
-
-
-
C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exeZecuritAgentAssetMgr.exe -cmdID 140858 -cmdType PatchScanDetails -cmdVer 1.0 -reqTime 1789073553831 -scanLevel DIFF -queries AllPatch&InstalledSoftwareList3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2988 -
C:\Program Files\Zecurit\Agent\ZecuritAgentWinStore.exeZecuritAgentWinStore.exe GetStoreApps4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Program Files\Zecurit\Agent\GetWinGetSoftwares.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4872
-
-
-
-
C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"1⤵
- Executes dropped EXE
PID:3280
-
C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:5380 -
C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe"C:\Program Files\Zecurit\Agent\\ZecuritLiveNotifier.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:4880
-
-
C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exeZecuritAgentTray.exe -title "Zecurit Agent" -appServer "https://app.zecurit.com:443" -agentVersion "3.20" -agentInstalledTime "2026-09-10T20:52:33.713403372Z" -showInventoryMenu "true" -agentInstalledBy "MARC JURMAN"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5932
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:3912
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:6284
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6996
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6492
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:6656
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:6800
-
-
C:\Program Files\Zecurit\Agent\ZecuritPromptUI.exe"C:\Program Files\Zecurit\Agent\ZecuritPromptUI.exe"1⤵
- Executes dropped EXE
PID:1064
-
C:\Program Files\Zecurit\Agent\ZecuritRemoteTools.exe"C:\Program Files\Zecurit\Agent\ZecuritRemoteTools.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4048
-
C:\Program Files\Zecurit\Agent\ZecuritRemoteTools.exe"C:\Program Files\Zecurit\Agent\ZecuritRemoteTools.exe"1⤵
- Executes dropped EXE
PID:6300
-
C:\Program Files\Zecurit\Agent\ZBitLocker.exe"C:\Program Files\Zecurit\Agent\ZBitLocker.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6604
-
C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1460
-
C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"1⤵
- Executes dropped EXE
PID:2832
-
C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"1⤵
- Executes dropped EXE
PID:2564
-
C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"1⤵
- Executes dropped EXE
PID:6260
-
C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6228
-
C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6176
-
C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6164
-
C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6756
-
C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6220
-
C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036
-
C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6740
-
C:\Program Files\Zecurit\Agent\ZecuritAgentUpgrader.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentUpgrader.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6688
-
C:\Program Files\Zecurit\Agent\ZecuritDeviceControl.exe"C:\Program Files\Zecurit\Agent\ZecuritDeviceControl.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks SCSI registry key(s)
PID:6632 -
C:\Windows\system32\pnputil.exe"C:\Windows\system32\pnputil.exe" /enable-device "SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001"2⤵
- Checks SCSI registry key(s)
PID:6980
-
-
C:\Windows\system32\pnputil.exe"C:\Windows\system32\pnputil.exe" /enable-device "SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002"2⤵
- Checks SCSI registry key(s)
PID:7080
-
-
C:\Windows\system32\pnputil.exe"C:\Windows\system32\pnputil.exe" /enable-device "HTREE\ROOT\0"2⤵
- Checks SCSI registry key(s)
PID:1844
-
-
C:\Program Files\Zecurit\Agent\ZecuritDeviceControl.exe"C:\Program Files\Zecurit\Agent\ZecuritDeviceControl.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks SCSI registry key(s)
PID:6964 -
C:\Windows\system32\pnputil.exe"C:\Windows\system32\pnputil.exe" /enable-device "SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001"2⤵
- Checks SCSI registry key(s)
PID:5076
-
-
C:\Windows\system32\pnputil.exe"C:\Windows\system32\pnputil.exe" /enable-device "SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002"2⤵
- Checks SCSI registry key(s)
PID:4992
-
-
C:\Windows\system32\pnputil.exe"C:\Windows\system32\pnputil.exe" /enable-device "HTREE\ROOT\0"2⤵
- Checks SCSI registry key(s)
PID:4272
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:4040
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:992
-
C:\Program Files\Zecurit\Agent\ZecuritAssetMonitoring.exe"C:\Program Files\Zecurit\Agent\ZecuritAssetMonitoring.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5300
-
C:\Program Files\Zecurit\Agent\ZecuritAssetMonitoring.exe"C:\Program Files\Zecurit\Agent\ZecuritAssetMonitoring.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6340
-
C:\Program Files\Zecurit\Agent\ZecuritScreenReaderService.exe"C:\Program Files\Zecurit\Agent\ZecuritScreenReaderService.exe"1⤵
- Executes dropped EXE
PID:6588
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5bfacb.rbs
- Size 9KB
- SHA256 eea799fdebcfcb65f01835550ed65ba6b71fe55b2b48feb94b1be5f3246e6755
- MD5 1133b2ac215ba04693a7dd112371f00b
- SHA1 7d34c8c05b9257cb24dd9e22fc7187107ab1d7fb
- SHA512 bd36cdd699b9ad91cf708a38c389bebc32d98a8a27b5aa606edfb4d51978d347b34ee246d733b8e95a87bee172e99b9443cb153288eca9d8eecb5d36aa62f542
- SSDEEP 192:mptvIOvkkvFvNvFvFvynvSvHvNvNvKvEvzvIv4v8AjwNBOe9C0JNZbkkIgwNZbk5:m3IoXN1NNyvkP11cuDaq8+wNBOeJNiVs
- TLSH T1E9222202F94081F3E5B25F34CA0707A537ABCB9A9250728F1D8D5834BF077DA9F651AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\7za.exe
- Size 574KB
- SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
- MD5 42badc1d2f03a8b1e4875740d3d49336
- SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
- SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
- SSDEEP 12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
- TLSH T15FC47C2A3AE5C079D65215308B6E5BF5D0F693680F2308C72794DF2C1E359D6CA3AE39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent.7z
- Size 18.0MB
- SHA256 a438be282d1f18a9dddeee6eeb6c9ddbfe8934f8f64e3fc09f99465c5e101d64
- MD5 c86092d2732433d54f116cd87791a7c5
- SHA1 5e0147b83c610fd8ecb79ba1e304dace9dd8c8da
- SHA512 3304bff4182cae1de736ed82fe3b0f1b390b1f8b75e2a060f4ead2d41d68f84d21253fea9531d0838bbdda844486ab4278e280430a85fc869639b83b2651d6ff
- SSDEEP 393216:mpVEwIqnNvkIL18nSp5oQTo/u88yj49U8bI9t61U7VSB+ws:m5TkIL1tzoQr8vX6kt6Xs
- TLSH T1411733AD6CC0FC07E8CF9EFC69338268488D1DB8E8261396AD51E9F5E547409E5B1D32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentHandler.dll
- Size 4.6MB
- SHA256 a4f21c1561b28f2e5119f3cf2de012117d09504b3bef655756ec840f3848a1be
- MD5 065d4082ccb7ca37c7fc4635ef7098d4
- SHA1 c08d8add93f6ea00815673a0cc086719d02af08e
- SHA512 b868658a27c9dddecd04e4f1e705088c9bb6eecee76f0e1d49db9a627b639a8b26a2a7b0fa7d24946c344c4d802bb99ee2c1d6484e639742813c6f307985bb1e
- SSDEEP 49152:5vjq4g9guRdnToEmcrbpikasl46b4456nNmjdIvBnhXqQjVQ9UF3FWhZQ1icu035:tjkVjbsNmhw5qY1F2Q+NII8Ed+31
- TLSH T1CD267C46A7AC00E4C5B6D13D8A9B4A0BD7F2B81103719BDF46A04ABE1F37BE1563B315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe
- Size 2.7MB
- SHA256 6b214b759cbb80c2ab87a34b25a5df6f8782213270e6ce9ae48e763f9172fac8
- MD5 f571da8a3f92a79c0ebf784166edabb4
- SHA1 d7eae57c4b2503aeed94e02ddbfc21d65a6c78e7
- SHA512 e4ee35f9c768ba62ec219dd637eef82fbc0af4d2c16225110327d6c9846092225a849cc65a680d7437ff3f30cbb136b0a9722c5fac938c47f81675f49ab9207a
- SSDEEP 49152:dY+BpXbTrxJ5/t3KLsBaCkxVAf5MjcquwFBJqfsHQjpw:1zAxncquwxCsHWy
- TLSH T1A5D56B89E7ED40E5E9AAD07DC907451BDBB1B8010731C7CB06A49B6B9F732D24E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe
- Size 2.9MB
- SHA256 52579ba9d1dc2dbdcca716a0e92031777bf7d39bb086383cd63a75fafae8d01e
- MD5 8ef4cda0ef5e0f65f00e6b5acf83d4cb
- SHA1 f0c556de63e2888d95424b1ac376c3488cbb09e9
- SHA512 84ca4649450aa6769d5fc89b21555bfba80e5e86ae7a183939a6810aa22eb67bf6e57e58cc8aab3c2dd125cea0783bacef65bedcf0410743c17639c617763656
- SSDEEP 49152:SXONzYJBFD7PVpq6dzr7C1GKiQ9DsFPZNYo62yg7CRMBi+XRK:pm5QuZNpyHRMhK
- TLSH T1C2E56B5AABED40D5C6A6D039C94B851BE6B2B8400732C7CF01788B5B5F777D24E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritWinHandler.dll
- Size 5.2MB
- SHA256 6417f40119ad39b856fe8ccd49303a2718ffcd70bba766931e25abeb4e5652da
- MD5 2a393af87a10806ec39de70834046b2f
- SHA1 fdfafd60d08e5425ec622806453a4c53386b4ac7
- SHA512 bede6cd45dce5a4a732e086bb0447e9161a94a237ded63000b2e18d4ca0556e91452923d6ab0f1b2d25410e618b0585cf9318ef64da96dea71f57da5dd4fb2b8
- SSDEEP 49152:xhe0/PMZbDnLTCN8/YY8+476D4Oa36C4iQozWmlX7EYPAMgEPu82FD1+GtAFQRzi:tB40Wmj+EWraQNhwy+hj
- TLSH T1BB468C0AA7AD00A4D9F6D17DCA17891BD3B2B851037297CF19605BAE5F73BE00A7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\InstallUninstallApp.exe
- Size 2.7MB
- SHA256 039058b564f56b61fa53cd6b657388bee7765bee655d5c5faec1f10add3dcbf0
- MD5 822a3915b85c5ac842b71232da4f4331
- SHA1 52ea1015dc1ca6e0386c7c5a426adcf023aa52e9
- SHA512 be05fccc4ded2ab55dca879df14d6caa5ab8a90316372d303564ec44256672fbdb55213ec01305024d979032d0a2133b8086a54ee3e6408ab0d9597176910a84
- SSDEEP 49152:YPS1IfyAkry6LJp13aw48XOXTWLwb13BX0aoeNPDc6/1L3:mVzb15xPQor
- TLSH T19FD55B9AA6AD40E4D9A9D07D8E07850FE7B1B8110335C7CB02798B5B9F372D14E3AB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
- Size 765B
- SHA256 969db48c7e5ad8b0764882d37b49aad20e96fcece55d08c78e3e51aed848e4bb
- MD5 7b9f61b94262c7726e4f041fc89594bd
- SHA1 e9325f73fa7467efc306ef4288bba3d11e2286c3
- SHA512 6a05efd6e3a2a391e6e8c979e79c2e1671de2ce7f64cbbe6b39502c36e01ffa572bda7ee319fcb7c293ca038dd15835eab4931baf76f856c8089da5d279bc60b
- TLSH T1350125450C25C843F3025ED943E894362625352AB0E22F897D79D3D91B35B795B3942C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_11C80D5BA5914901432C2CA8C2925389
- Size 638B
- SHA256 4419bfc10c56ce72bb0f4268bde88cc277b2347fa77d5a6e4510ceccfdfad4c8
- MD5 43d7b9688e82d6fc90e6aa0c77ce8771
- SHA1 6deadfec5e2d415cde7bc052a406454e9780691b
- SHA512 cac669706025623ae24ec56a8782a84a8950ee29c8b878587559fafacac3fc0ce930e0990c4971faf2b404c4fc4f1b7869919d9262274e20daa335c74e2b85d4
- TLSH T1C6F023025CEAD004AED1085404EEA8F87034686232C4D78F9638684499BE279474221A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
- Size 1KB
- SHA256 cbe8a8a4ccb61a9127ec293f77eb9ec4b38f2f8711738b4da88f2832c898e3f6
- MD5 a282d80b3bb07162861fe90e049d706a
- SHA1 3e693bdcd6520c2134010ca2d7dae05141368573
- SHA512 2fb7b46d54d03fc8f951b9311f56c18124de916d498cba5be58b1b9fbdbe62355f3e6a577e98b57caad13ead72751c04ac13f0d522d4985fffc435e1ee57b2b3
- TLSH T10C31E9D36EF978111F018CC8D8AE0B627CB035B3B6140C7D2598801BA8E3FF49589C0E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
- Size 484B
- SHA256 7c9617c3acca728a4d11b4474d97cde4158f7e570a2299fa744bf36b5b1e90f9
- MD5 56ac89af75c80f9fa56bfcacd4ecf4b8
- SHA1 81ca8b3eea01291c4dea94246d925c659ebd0915
- SHA512 479bee2f662486ddd3b87d486f8a16d1add6e910d6aa81b89f0df3b0b3881d9d60294d3198f49f23715f0f3305439502a756270f4a80ed3c29242b5825da652c
- TLSH T14BF0553869F6003EF13A9D7296E1A5A65865F193240148BD0AA112055E0BE462CD26AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_11C80D5BA5914901432C2CA8C2925389
- Size 484B
- SHA256 f7cc5df5d6660988a297bf86089b0e7a92d4a8caa75f4fa58b1561d962b4e302
- MD5 840e639692d6148660fc514edaee4408
- SHA1 5610e1b933ed9ef056b77d1af0ffbdf30776bd61
- SHA512 4156ad88ac8a08588d864f9668a292ce2604767aa09ef9a536059fef1dabf9469dd71aa0ef8c3ef5c7eda8d3e9fe52cff8124cd03ab7c756d92a2ea924cb60bc
- TLSH T1A7F0AB3C35FF002FF0FA883902E825A1D91DF204285663BC96921A176A02F046E66904
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
- Size 482B
- SHA256 24f6fb409559ed2eab35d9fcf77dd17759ca914ca0f9ac9b11d15d54c78b7324
- MD5 0dbd86297469eb99bf7612b80357cef3
- SHA1 fa1492a8bbe554923e80bcfa45fab0703933ecbc
- SHA512 59e1a1271ba9866ede0ffd9584f03d43a27ba60e412f1c4a9a8950f66ba10fd551b1b7740066068de27586f8c1324d2a6558cc2f29ed1112c0b7f7756007ba6e
- TLSH T185F0A32426B5533DF0775F3046D4B617DC7CFA0124052676025107065B0AA824F97577
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
- MD5 a9d241f865f7d582346ece871b98ee14
- SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
- SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
- TLSH T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
- MD5 2415c177850265ec333bf407bedd2c4b
- SHA1 2ccfbe660996437603bf4e0b70309310c3095994
- SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
- TLSH T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 334B
- SHA256 066bee9d2edd4ee2935c52a4c38971899ed81eb1e3b7617530a9a931552da812
- MD5 97a6926237d72bdb559cb1dfbb92d827
- SHA1 b1ef8da32a82382da2f532356a4398d81c4169e7
- SHA512 0d740b5285fe0515acd81ac1ab6c1e8ea9358e44fbbd6536f641597c07aa0299b106a6d991754e018ea0c8795bd63b4b30f8e4b88ac6602690aed207e3bd01c5
- TLSH T1BEE026840ACAC29ED24068A7C168570CD2E03F5A96CC7B4B1740888430C1B8CAAEB590
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 99b4e4acfcaee0d56022a454a92a37e754f79694d7ea71309bbb7365e1045e2b
- MD5 ad083b218661a951f56c070f9814359d
- SHA1 65cdeed444250812e754e14540dfb7593a3760bc
- SHA512 70053e3e6c0ab8ec2f59435ab746fa99efa34b0e688d63d50ba30af1140ff723adca1aa583511c37cd1f1e7950c7a846a842c43271019edbb377618e15333ac7
- TLSH T1AEE02BE9C862AC2B09FE071964645A06E74123262E40494F3B3C810D8FB463A469A91C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
- Size 17KB
- SHA256 37946a844b0942ed3090043df81c92050fd4758462b07b4344f12fadba298b07
- MD5 564a95a6b07d06ce9cf38e847ff3821e
- SHA1 58d465a4af15579988dca269c2b4ac6f0e460365
- SHA512 1b6ccf1172360170300c3c25aa872a76544baa37b54617f44797569179e95991f29fc0c600243238c27654c51aa44a4a9dd7da1daa23a28e1df414727d602e6e
- SSDEEP 384:56PIK0jMp+z+kR60RE76ePzCnGW5iYENyn75D/zSg7gH1ffXym5+Q:8nM+kk0RmRLY5iYEuF/mg7Efym5+Q
- TLSH T12082D01692EA7B1311E87B4A4E957808EA725DEE8D7EC30571671E8B7301BC1534FB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
- Size 55KB
- SHA256 fdb455624923892515b3019180854df0842f5a82e5d38996340e57f078769d86
- MD5 80336c617b88936c3a80611620c79e77
- SHA1 174db3b97029cf134265cf99cef6701f7dca8572
- SHA512 640a65d77a2b242d98aa9dcbd231fad93fd159764df9b2cba266bdd42f57cc071c5d8573002db6ce1687322bffbd008e61886949e1a9b4fedb7c372bffd4461c
- SSDEEP 1536:OUc95L2p0hgchot8lehVCYeBjZ71KVDLw6G:7g6p25VwhVCYYjZ7WwV
- TLSH T103430221EBD2EFBD29B028DFCDC535E87C921A666721DC54764F3084AE9C117E48886B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
- Size 62KB
- SHA256 dbd7a510f3f0f430a831acd9b7ff82825cb04b203ba03bcf0097ebab0530c471
- MD5 67ee7bf546fd9fb2b0135bc53df15f55
- SHA1 2624a86a07e9e0472bcec33f455c5f1eaf366afd
- SHA512 fdc04ce6c470084998a4e352a6601374af90809f5cd69d699a60bbc37dbd3251087cb234abebe9b64dbe660857b25b8527027ffc6e2246e5da14f556fbd245ed
- SSDEEP 1536:yoWVVn9bug3EeDjRtTDXlaXDPVYzwdcsXSofTF6lehh:eVnxf3pDjXfMXLV9OFMTF6lehh
- TLSH T1A65301E94EDD736B3CCEB089E2DC8911472622A1704D2A13C5B643EF6732E2795B35D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
- Size 72KB
- SHA256 cafeecde35780fb8540ee8e41d02125fbcc5f7893c112db96ed1e988e33ccb7a
- MD5 bdc2a57d5c90c3a6a8aa7e012c729555
- SHA1 119985a36f9d3806a7b3e52c8e49375e21599c5d
- SHA512 fee3bae424ac84af104431088ebcc4c32d53a79e14ad775b98189213997b2b98079c9aebe5aa6f5a2ee61b50fe1d753b4c70b94438b7f72d01f7951813ab254e
- SSDEEP 1536:T14mO9a8Uu9jA/pmQxa2qV0qbRcHaSN3hgSN8NEcpkc+XqhKaCH+Kr:pd8nOm+38bRc64d8NBPCe8
- TLSH T18B7302647A742D7BD6364C6878CF08A73A484603F6147677E4E59FE287C26BCF9A0809
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
- Size 52KB
- SHA256 4c3904e121b8ea88a167273295778c779b2e19eafbe071bd3224468ac3d5e33e
- MD5 fbd5c8ba372fcac9c342fd28617f9e21
- SHA1 5fa4cf3c35f79f3c512838b0353e525b74b7a560
- SHA512 4c46d2cef64bb374e9ead9bd7b706548713cd92ec9752c8d71548983ea39353fa909e409ac6db14261e20dfd6a69dd5808047975b85b6c2d17bf96ea24e20eb9
- SSDEEP 768:ZtjHAUbwxBAS1d9tLgIwo4W0JrFZI68VdyYEiK9MG7mWK8p4seGWsXUv9wGJA8:ZtrAUeBASkPW0BUTyYSmx8pNeGovCy
- TLSH T1F93301E5FB6FC2B48BE7DB2D4B548DFD4210038D97205D483A968A7DC8A5B2C087A473
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
- Size 16KB
- SHA256 ebcc0081f9761bb207ec35209d268f723a058c168013f15b1a401c92e25934ec
- MD5 2cf8c574a39ccdb4eff91446c82eed65
- SHA1 fd9cfeb4c4bcb34e2f40faab486d5d17c14943cf
- SHA512 4b2d9d53e1543f0a35f64334440c311102e5a89cd95ed67fa936c0c1b1a62086abd95ca66fd89332da8ed292313718a9146b0c6505e6a750dbb7b8809653d8a5
- SSDEEP 384:/TUjwI1S6QqeYhffUZ91ICdZ6ea3mm39WRUW+bXfdl2taEm4WhkXi:/bI5QRtHTdjat39rW+blVEiKi
- TLSH T14572E0F9572D2BA317C97E2D311CE53B22E70132466A00BB9EB96794BF14081D5E5C35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
- Size 19KB
- SHA256 2b8fff4d79c0ed10aeceff57bb3bdc9fa5d773a8893242d99094a3b4dfd40cf5
- MD5 41ffaa37d8050a6845d833091e52f36b
- SHA1 b1494afee2ed30b8e72037d2d8289d3fca2b8524
- SHA512 d7713b14b8be6b05ac266eead6c2a07697f588173024f917800554fba581a80b1d9f9f0f330d06cd54c586b5a50b53076bc22bc3a4753c699a12874a0bc49e4e
- SSDEEP 384:scMGxsaS3GSj1RXAMVpcx1TCgZSIlPggYngQkIl9Tmt:vrxlFc1J7swGJggYngUlI
- TLSH T18692E005F21E86523C6DC6A10550BF29BF807A8A60FA4C4EADA246BE345113FEF0625F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
- Size 16KB
- SHA256 17570575bc0ebaeaf8549a875dff25f879ebf4fddeadbae47eb51467541a790b
- MD5 63ed1294e22a8a235a2cc009c2f399a6
- SHA1 0409ebdae882425e2bb8d5cc2c408777c69bc7ee
- SHA512 b3a9d8451ef470896a2bf3a1a1dd69da434f2820a9e4697ac6708bf2d7063a5d337ee914d4555d5d370cdc27de6375b62721db4cf0a64a0ef7ef478312d6ca55
- SSDEEP 384:iVy2eD9VYF4++G0bS9X5ROy0hBQGAamiwmUEGp7f+B1bONv7zN23:iVfQ91++G0m4VrfAaECGJsb6vV23
- TLSH T15572D0839C99E2526D1FB33B3F78A57F314EBA8D7F05A22EB5513047A6B04C9900C5A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
- Size 32KB
- SHA256 ffc9caf563cdfae0e9f1c8b0e5fbfa98e7348e516a2d61e0f56a131b93207a7b
- MD5 122be3e67de5975b4f3816e479144a02
- SHA1 cab3b13956a72a08f4ae309e6f54e216d78e7635
- SHA512 406bd2cca74814e82da4fa461a182b5caa7bce66f69890e57460911637ef866bcec9833781dccb48750a85d25f65481e815d67a5288ed50ef36c46d646ea484c
- SSDEEP 768:zzqvzKq0MWNt+1COgiqXEpAV9b2+NE222/eUEmNQah4Ot:SrBGChgiqXO+2/T2WUxeah7
- TLSH T12AE2E17BBA0B45B8E0091BD47651370F2B2C4B82AE6B362C95B743CDC852AA49DC425F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d6
- Size 344KB
- SHA256 c1ba7027e790c346842569dc60319a75bb54ad9875b3a114cd3d60febdc1ecb0
- MD5 a76556d1143eac7869c5cdd2ba75aee7
- SHA1 62ace25f7a400460ef1550bd536b8006aff57655
- SHA512 b6763ac3d83198054c3e24685aab797d60c39df22f0eeed2ff4217bbfb891efa1f2ffda857b079443e0ee66fa3e0b2f1cca34867fcdd8a709b88abbd93c33e4f
- SSDEEP 6144:+1/dG8Lx2NjYH/1z2cvc5NFLhVke64uBSCGJ0qHQzr+LZ:+voj2hrvcdnlJWF8HQzrQZ
- TLSH T13F74231F614B6C6CECDE01C7216E44D5D32B8F52CB231ACBE649D16B04E749C8ED9A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 6KB
- SHA256 c8f7b5135e4db85674bc2ec20b1003000b7bd883460862dfc661c7362427dda8
- MD5 7cb9aa9f67b0df26218998468a0cb60a
- SHA1 953ca0e20eedd8bca724a9d5481f37266deaab67
- SHA512 44a2b98ec2f8fbea3587c5bb97799c78ed805572f7905110e258233812131f65a0292e860b69ce921fd2448e171593490fa31fed77b326923dce7a7fdd0b5dfb
- SSDEEP 192:JdokiCzcvAMNqONnAWZhwrsM/gU4JlNfQVy:esAXqiAWZzMYzdfQ8
- TLSH T1C6D100F725CAA496FB660532B4D0FFEF217418506C422FC349F1E8F4AA5BBD58093A24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 6KB
- SHA256 e7f4dd9c0565781e1a0bb992f1dbbd7d7aa870f46b3bba7fd9ff9de9cbfafbbc
- MD5 cd963819bca2c146a35325c875cf9a29
- SHA1 54b7eb395a73e4219561fae04308fb3137061b62
- SHA512 fa1dbcd45855c12966b5e5fde13898c9a51ef6e5c9c6d8d521bff4ad31c3e8eb11f5fe74cb99ebd189687c62912e41bd7f7a051e30448d255b7c3fa01b44edde
- SSDEEP 192:XoUMCzcvAZgqvhPnRHZhwrCs/7UBwzYl3jQVq:UsA7q1RHZFsj5z+jQI
- TLSH T1BDD1DEF625CAA895FF661131B0D0FEBB31742854BC432FC346E1D8F09A5BBD58497A24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 7KB
- SHA256 031745d1d766e88a6f6c785f7eff27d8f535593a9d94332e322a5c5f1df4a0cb
- MD5 7eda714dad3ad168ee2649faa5eb09c6
- SHA1 7c73eecc4739f0372c87e7193c4b3732502ffd13
- SHA512 a4f0404c7a62f7f7c1dd8cbea7937ba5594a9583eb4847498a0f887dc693a77026fc0d771abbab2f0e6fe4d9e6d8cbd72b15b5fa7388059e9980391aefc40b4c
- SSDEEP 192:uojuD/5cMHRXSvFYnQv7CnZ1Ow/9gCUBJ/zDEoV1:9MRf4+Qv74BV1a/zQo/
- TLSH T157F10BF324EA6455FB16163474C0FABB317066A1AC37AFE756E0DCF19ED2B900492A1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 ba549a3e8833b121f26cf93ebee36cd2a0b94c466b050c70bf0a36d6088bd0e9
- MD5 42f447463de2ea44942c7da9b0dc6f19
- SHA1 9c0acdf012f906fbb9cd74b27adf9cfb13a1ab72
- SHA512 61e2eeffaaf55b1989c399dbfdf87e3a1986f6ac63bee229784e519ccb0003aadfb10e37b7638f705f9e66e5d7f5159f1ca65aa43f675947d8a3e9bd6f96f728
- TLSH T13651C7D53ADF8220F3121B75B9C0D67C35B559847D532FC35EF09DF5AB2AB664022809
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58872c.TMP
- Size 2KB
- SHA256 76a4c37bbd03e92121c01c97e0b34e8d285c35f4d0afd6b53c0d4c7ac9e56858
- MD5 1fbfddd863763d69f06f5c58aaf4e27f
- SHA1 5eaac4db2dea6085ee646b6cd290cd44323b9184
- SHA512 8d1785d5a19df30bd2fbf78acd0cf9aa23abe05695741c88a117c79f2b33ef6837860d67ede91ffb17c07a0a97429e61c0c7c50e405ff3341b5e85876f6e3f40
- TLSH T14D51EAC53ACF8220F3121B75B9C0D67C357548447C832FC35EF05DF5AB26B664022409
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
- Size 42KB
- SHA256 7381b772f649bfef4840b78a22aa8d3d448b34ed2e5f77096a4293fe70ae7de4
- MD5 2535ba02ca3b21073d02a6130318c14f
- SHA1 6fb463be9165ef93eaa41f3ad1757bf5c047f147
- SHA512 9637cb468879561e2776d31be6bc65c9c3410d53df4dfb4ef0132139a1ba1bff644dfc870a2e618382a60cfc530c91d207802e1c245eb1dc2adb94424bff6390
- SSDEEP 768:JuCqTAPGyaCao4SElnix7rjkMdMA0ickT7yKn77N7gU0az1SWgW:WA+lixX/7531SWgW
- TLSH T1B6134662B5F9420AF2BB9E7BA8B617565C7BBE862D04C81D5860620D4C71F40CD73B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
- Size 383B
- SHA256 94fac8e9c77bfdfeaea4db3aeb190c3add2ff0b66d3934a4e456b9cac14980fb
- MD5 0144a0432fe2fa27a29609b6e671af24
- SHA1 82b70130f204e0dd1c6dcd615b0c127d778d97a9
- SHA512 3b7a637c12972e60c0bb08929cef41514bcdb4738adc861b118d972f6119895cefbd061355ed2575afee5ee4978b7895cdc1db4fb05e56d0069e99d2889a1c04
- TLSH T1E3E0EDA845CE825FE06820970129FF1896B37B0F968CBEC12B0A8855B841348B97F151
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 10KB
- SHA256 d709feb1ebd6347f2c8e4f2d360707edee50a9fc6db371858a15f87e67f61e49
- MD5 0a158769d5458b73be83fd8b304900ba
- SHA1 a141271f368ef04382bcab5eba1f3e31d9f5ad9b
- SHA512 c5248b1dac49fa98c011100fd758c7cc43afd410de938989fc079e1277d6f11ac5733c461374b4c54b06444773db52f89722e795755d182116f8e97e9baf1c0d
- SSDEEP 192:D1Bm30OZRjRMMsTXhoioaaij6o1Ax8OxzBd1pLTc9hV9uc5dF9UG+i0wVIUef57S:D1Bm30OZRjRMMsTXhoioaaiGo1Ax8Oxu
- TLSH T10C32ADF3C3E4862DC81162F09F183E1BCE190865636C3D5A85E4EF4BA3F24B2E25164E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 9KB
- SHA256 82fbacb3767ff1efb761c206d74998dfbf9d72094461393702dcdd0e59a3586c
- MD5 9f31c34b9e9904207dcd55c56900c711
- SHA1 019226a8f7b1822ebb72717fcd2256aa0772d40d
- SHA512 968c5085f0bda4742f29719092b0fa3e58047ff3fcd29fbbb1ccad71950142b09c343d9144c748d7af707383141e1642a340a4f8c33aef99f17e2aeeb7752803
- SSDEEP 192:D1Bm30OZRjRMIaaij6o1Akx7g5H78OxzFTSHB8d1aVpLTc9hV9uc5xtWR0F9U08q:D1Bm30OZRjRMIaaiGo1Akx7g5H78Oxz7
- TLSH T19E12BEF3C3E4862DCD11A2F4AF183E1BCE190825636C3D5A85E4AF4763E24B2E25164F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 9KB
- SHA256 e61172aa846a107438ffa77b2ed70424e781d99e695ec9fed455e2600b875406
- MD5 db6741d6d29c6383cb10f5b01c412866
- SHA1 fc93b2c9cac71ef03d8d14a9ce727c4c4ec4a8b1
- SHA512 ea754e58956265fc6dd7f845b1a1ba7d9899ea04124a184a44443ea532296d9705e000cf58dcc50c4d1aa442023d458ae81e2ded47eefdf9eef455f9ba7b962b
- SSDEEP 192:D1Bm30OZRjRMMsTLaaij6o1Ax7g5H78OxzFTSHB8d1pLTc9hV9uc5xtWF9U0G+ig:D1Bm30OZRjRMMsTLaaiGo1Ax7g5H78OP
- TLSH T10522ADF383E4862DCD11A6F09F187E1BCE190925636C3D5A85E4EE47A3E24B2E25164F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 9KB
- SHA256 78fe6e29058c356d648c44a275a9891b3c3b7f6f2e4a8bb93585521fbfd75603
- MD5 5f06d6a7a52b8889f1698ed540ef2ade
- SHA1 3a94d1444b588de11a259a46e686d08ec3023893
- SHA512 19d9ef69a46ed00185254d994d3663495e524ccfc6e447a11408d18854852cddb58993a347c51724d1fb39189fae5c6e5254ef5f6aeb11d6382a0823ee77baca
- SSDEEP 192:D1BdgbyzAWrqxhGshoioaaij6o1Ax8OxzFpLTc9hV9umxRGk+VIUVf577gTHt/G5:D1BdgbyzAWrqxhGshoioaaiGo1Ax8Oxf
- TLSH T18812C0F783B4862DDD11A2F09F187E1BCE590425536C396A85E4EE47A3F24B2E141B4F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 211B
- SHA256 57d07441272ec567dd1d1c0063e46f9341932cb04af6b63bb65230ecf721180e
- MD5 4428cf991f9ad2a2b3f58ef10baea3a4
- SHA1 ed31d65a3f42db7dd1a80c3e221c70657a902c4c
- SHA512 bad78165ce85f52d2b43c66e75240ee400b179ffe671b0f5630f0679b2927655531ac5dadb9125bd36e7d70b0300ee5e9f28b60b600731fd120fa3b445d860c6
- TLSH T100D02263220072B5B9AC3ED6A06BFE8FC72624204802EED820D058AD253247E0667080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 211B
- SHA256 756934a0fc8d01fdea52dafa88ed77e9b30077981ec9117d5d4e14ab46458770
- MD5 3ae960d65e551d73e80e6ac525973d49
- SHA1 5c19a072fd33179c082e17504d6a52a8031c637d
- SHA512 4fb00cc8e531573bbbeb769f6562da57b32260c64a3ccc2146437ca2b49c308ee7fd382fee07b5e5bd26f47fb3a2d1ce932ef14e7577a5d87c3f3a78498cc7a6
- TLSH T1E9D022231200B2B6B57C3EC5606AFFCFC73710301802EDD820D099DC1A3147C0527182
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 18KB
- SHA256 de925c2d98850d2b235e9a7c9e2a283d27cd7be58698afd24ca58ce205ee535f
- MD5 c8c7821781848c21aafaea59121a161f
- SHA1 7fb40d69654da6bb4c6fd348a5fd259d307c99c9
- SHA512 b42c075001e31f7a1f24f715cb5042081e373130dc76ffd11f6bc361239481755c9540b28ae4598893f2b89c16dda74e5faf0eb44ee3e1939be74cb61a2df017
- SSDEEP 384:sxZVxQH/fzsCCV7NP00pyL/bJDxX54oJ5:sdWH/fxCA0s/bb51
- TLSH T1F582081269346E779CEBD219F945BB53E6F85123D5844E44AAFC8A1C04E6BEC221382B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 88f69d6baadeb72f394225bdb88405edd045bbf56deaa0920a331d67b84b7d92
- MD5 5ec9d765463540660a858c4bd29adf87
- SHA1 9c403f8ad949ed997e9c1d906b5232c272e94855
- SHA512 3b02ffa7c5867b8e9aeffa80d242df3e0a93baf5dc347c9009063d324ea7f576d62164b7d6a27101ea992f4a5c204373b00c5c5b15f2288079ceecdb53c3b4b2
- SSDEEP 192:sxZERUyMqZjK1Ml8MoH/fzsCCKQ7PlP0Rzodp3//W6+WNlUVdY0ZeMNcIg5WJ7J:sxZExQH/fzsCCV7NP0av/bSd5aoJN
- TLSH T1AA6208056A386E77CCDFD209FA457F93D6F9553391910E44AAFC8A1C04E6AEC221382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 17KB
- SHA256 3ae54ab953f2e363c897dac58d7db61a5043732304fe238448e18065675c6fa4
- MD5 2609daace8c1ad2601575a02d1ddbbfd
- SHA1 8af294f5c48e95e5075a7c80f7a8e946161e9a2d
- SHA512 acb814db20f3734d4bcc6e95dea8660b59f11dcc07a7e8fd65d4c6e26ab70c68f6cd0860e4aaca4feb75f8fd9a459946a44c2714cf493aee5564e2118e706243
- SSDEEP 384:sxZqxQH/fzsCCV7NP00pyv/bJDR/5foJN:sSWH/fxCA0Y/bj50
- TLSH T15482190569346E779CEBD219F905BB53E6F85123D5914E44AAFCCE1C04E6BEC2213C2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 39c081c0094a64802cfa56422454a8ba870b4f6a6866f33e95b844c964e33bd4
- MD5 6c91a611bf08551080b7c6b911d3fff3
- SHA1 d1f18a1006b178a28d2ad63b81b382c597f723fd
- SHA512 54fe640acd866905a78f72b6a2c43fa840fdb32cf73ff6f8d22c1eaadab9b8742e8b184b5dc35cb4a7b9c480f2e47a13ab4828627b58c70a10121d69e2696e8e
- SSDEEP 192:sxZERUyMqZjK1Ml8MFH/fzsqbKQ7PT0Rzodp30/W6+WNlpu/Y0Z3MNcIgjJ7J:sxZExdH/fzsqbV770ak/bu/5DjJN
- TLSH T14562F7156A38AD77CCDBD209FA457B93D6F9552391904E44AAFCCA1C00E6AEC221782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 18KB
- SHA256 7fa1834e7966105e52b662ad59b38b7b81b555378540cd3d8f9a43f0194e0c9c
- MD5 3708d69995f9b6a04421717618508432
- SHA1 f168616a7860e2d8d14cb4ea315d1cd16f035e63
- SHA512 2087ddc800c3030ba05c84de180b3cd2c613f1ca173d7eea7844a00036b7e8714d370de6ef27bd212c8635d6ae4c2a34c1c340967d4e65e54884a4c14b7ccd80
- SSDEEP 384:sxZVxqeJH/fzsCCV7NP00pyL/bJDxX54oJ5:sdYeJH/fxCA0s/bb51
- TLSH T1F982081269346E779CEBD219F945BB53E6F85023D5844E44AAFCCE1C04E2BEC2213C2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 22KB
- SHA256 3e828049ca663b522f5420ae5f5d6725cf1935646a6f6f0fc3f6cbe9ee5df4c6
- MD5 cedd83a2124dd42441fc011f9cbf1f40
- SHA1 96d4e1cfc5c9d5870cfa14566e7568697a7b0751
- SHA512 2cb2bd64105b74718025af281e4599fb25d6c52011a7e036ca2ac63fe18c47d11b04fe0ed72093de99cd41c14831c99142b1a3453ee4ead5e974c45f8040eef9
- SSDEEP 384:sxZhnQxqe4mWH/fzsCCV7N008Pgf/bJDaid5xoJz39:sJQYe4mWH/fxCb8w/bL5A9
- TLSH T192A2F9526534AA77DCDBC219F921BF52E7F85423D9854E48AAFCC91C00E66FD2213C1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 31KB
- SHA256 0dc0fb9144ea796d9550509428b3774afe788a480b5de36b3fa44af52d7ad8a4
- MD5 a9d7f872b5a853cda67e2f78e6f01514
- SHA1 526b636c3658443e2952d90146568b34eafec42f
- SHA512 e79b80e2dced729501c6fb3ca5ae9fecfce52ca7fadb9733663d0de7e5160816f55a9f8fe090a8e73008512467c3e05f910f9f57513e1feb06c1bc78d61fa041
- SSDEEP 768:XwZh38Dv2aFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV309Ll/lv0bzkro1o:XwZh38Dv2aFWRm6GQFmu1jaK09LplMbC
- TLSH T119E21B3B280CC77E4F844E9DEC266F966ED802CB66684D5447FA894C03CA7EF511B49B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c2350ed-43be-4160-9475-f2d7cc98fd47\4f2277ea2139c475_0
- Size 81KB
- SHA256 9250a13ebfe19d9fce4058d9ccf9130327cd90765b22341b3297bcd95450588d
- MD5 da4346fa019e8d2efd7e0084c61e5b19
- SHA1 131d075541dc1fafae22ba9200b208cc08678765
- SHA512 9d4492b462983b8fa9e09e9bb9a7d875d5d8ef0260cdd754f7924cb840ee7c16de3ac6e826a7cc07334d6aa65635092e506d5f81cc169f95eab2f770851ac329
- SSDEEP 1536:cTXGeuSQ++HqsJs0wihp2VMGznX7HVyOAcU9dP2CsXMoTLH+PcG+qHPwqYzGB/e:c6ek+nKMVMGzX71yO4Z2dnhi/e
- TLSH T13E833AA7B262703587AD12D194566B01F22B07561448C9FCF07CA6D63F18ECB63B7BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c2350ed-43be-4160-9475-f2d7cc98fd47\index-dir\the-real-index
- Size 72B
- SHA256 40260a9b8f7150cdf53b30e27f3161b99dc2c189fe93b59442410400bd449963
- MD5 7b94c2acde21d4650eee05b2abe7486f
- SHA1 22f89adc108c6da0a34ea31e9ef983c5541832ce
- SHA512 6100e54f61b1a465636f89766e756bd394ead7c19d96a00aed3eb5b88a1b5aed53be3359c1d57c53c21ed40b960047fd7769c6847d71643512fcbc4fb3685b46
- TLSH T1A6A002F0865C3041C405C7F052C201516B2CDC25124147C7A0D0497ECD5125C5F03548
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c2350ed-43be-4160-9475-f2d7cc98fd47\index-dir\the-real-index
- Size 72B
- SHA256 0c789deb367296d0b7cf77f0b67f725a47db083d9b86c5c0f48dfca74d743ae5
- MD5 ffc705b0e1891011dc891713096a4689
- SHA1 8e551cf9884e2c820f4375afe406da72a0447c0e
- SHA512 e92b00c5b4f00bb7ed44f3ea0ec6ead4e76cfe96953e340d03aec4f72fc0b9d8734da2ad18d9f9f95a369c4aec94071b28f829f203d897f3f8f9b7c01fe3ef36
- TLSH T126A0023D01680281DC4827B06D4192E0239CDE111127477B44E1886A8C5195E6D01C4D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c2350ed-43be-4160-9475-f2d7cc98fd47\index-dir\the-real-index~RFe593d7c.TMP
- Size 72B
- SHA256 dcee8758dde0a0bcae1f01ad1285429156a859e1add156b539ed64a31400208a
- MD5 5cd511f933b68182d6c313546bce865d
- SHA1 29fdce9a63d777a02f45bf6d8692693202c1a838
- SHA512 0ee26611a41897bf0cf07b66b38c61c3cedcb11870fe9729b7b7a89c65f0bc7e8d325674d237cda87153fb1d92a34c249dfd943f6f08a2b7e6a73fd92d901f3d
- TLSH T166A002284B694084D0480EB065410351632CEC112902C30B94D048A68C6E4D94D12041
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2261811e-db42-4052-9775-ba1c4bcc9e08\index-dir\the-real-index
- Size 3KB
- SHA256 b4791f45a361f2033ead3fa59e993f6d82f42fefe975d793d6d3041b22ddc8d4
- MD5 830f2d6597130a790a124418ef898690
- SHA1 2728e6e3ad200cc0e283272784445619ba1dd3b8
- SHA512 292fcf4dde5c0d436c5c8fd3b7cdd0858bde4a65a00deef66ba8ba317f893b2f308830581289805d30a94302293bca59a4f87be61d42c77b8f621127eca91734
- TLSH T15F51C70E0D430B5ED99C21B204B754923774B9CD13881B1B65FDD634FCC77686D0D6A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f88a234-9428-4519-81a1-32228bf61e85\index-dir\the-real-index
- Size 96B
- SHA256 b26dc3d61efbea1b1e5406a4bd1f102d8bbf9772aaa5c37e999e36b96130856c
- MD5 b585857af5ed624a58f55a4bc651ee24
- SHA1 d1eccc83897181e6ffa6fa30d8715d98e3b577d3
- SHA512 db315b86d1f92861706ab80367dc8b0404e806fb263c910b0778e11fe064b0f5b7bd54b601794e3166b521b1d5758d7bc2054a802a8909d75014316bb28bd8b8
- TLSH T1F4B0122433DA411FC012837120C20052322188910311361B00C455B48D802080522008
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f88a234-9428-4519-81a1-32228bf61e85\index-dir\the-real-index~RFe5b99eb.TMP
- Size 48B
- SHA256 69ced4406ae20528be6a0e2a13ad36ad10eec07ac0dcbcaf369038e6487d7a4b
- MD5 49d7639401c8dce29d80a1e2824d5797
- SHA1 418615c375ec4f558c06f8ec59d7e36d5c06f23e
- SHA512 58d38fca66a2a8dad276677b64c769da306836bfe82e44f6f6790f69aa3bfb49ccdafc2228362bcbc68dd7b19b1dacaa8c7abee5a65e4afd0a7d9badf20d8e11
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c8d9706-d147-4773-84f7-c6f620552bef\623cd082b6202da0_0
- Size 81KB
- SHA256 07bc7ec72b245ff758695fb8f9fc87540311d7460080ac243786dce72932661a
- MD5 befae9d9912df2db56e1c02113a7b742
- SHA1 fd65fb00527327320d0b0ee354f1738981009a07
- SHA512 2df259b9df23f22e97ea4b8a914f867626c36d5ebe906bc8254002bbae0f90691049917e85ba9429f138193dedb5371cd5c93e2b5d3fed4fcd050afe2d08c72c
- SSDEEP 1536:PXGeuSQ++HqsJs0wihp2VMGznX7HVyOAcU9dP2CsXMoTLH+PcG+qHPwqYzGB/d:Oek+nKMVMGzX71yO4Z2dnhi/d
- TLSH T14B833AA7B262703587AD12D194566B01F22B07561448C9FCF07CA6D63F18ECB63B7BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c8d9706-d147-4773-84f7-c6f620552bef\index-dir\the-real-index
- Size 72B
- SHA256 0cb8a590c855b46324dee695537a24b72bed0f9767b89b31ea960f475adb5db4
- MD5 7b76321c214ff90527275bca84cded52
- SHA1 025a292296f07b8361747b65fe6c695921e64b86
- SHA512 0f556892c78ca9e902d49175ebda94d8d370bcf47042351eb03811ae1968562f02871c4512a3f07598d125f7aedbf5fdf268e2b253ecc26b78ee86340426bad6
- TLSH T1F1A002E15A812505D00717F026930246A310C8300205A3DBDA9554ACDCE99905B5756C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c8d9706-d147-4773-84f7-c6f620552bef\index-dir\the-real-index
- Size 72B
- SHA256 9abb308bddb479e1dc78f4674d003eb4f523dd365fecadd66e984876e2373af2
- MD5 33fd896d9e6c92a065ffd8aae50c9ed4
- SHA1 17e4174db5334e2a0e371877ea2347b4831c5b59
- SHA512 25dda3b84ae65b15c3c6cce5d7e06d93175b4a1b72fcf5264108a4c46220a79a6e1222f0f34063b012841fa2931bba5952df1f87c2d56e358413978fddf46fc0
- TLSH T100A002F043A26801C02717F13BD70349B324C8100611778B4991516DCC789A09B4321C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c8d9706-d147-4773-84f7-c6f620552bef\index-dir\the-real-index~RFe594666.TMP
- Size 72B
- SHA256 4d45ea7edbcf95667100130a85145fa99eec6c64db4c8d6f7a879883299f2254
- MD5 8afd53f2404211d434345724d8312df3
- SHA1 14557bd67b855af2f1095f42e3fb5e19d4ad933f
- SHA512 8197c323ca37efa85e398e3a94cdd3684f08fa636444f2c9f3a00c757e215bb40431ff76b9929638406850578a9c4954b3c35541b8aecadd5ae131a867c4ba9a
- TLSH T130A002144394411BD06A17F1A9DB0651B305D8516150275740D23148DC644418D5501C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b56d49a9-3c43-46fe-95ea-1ff70b7ac4c8\index-dir\the-real-index
- Size 72B
- SHA256 7adf49dbdc5f66b2b1721a3a55b3c069c32c78e9844a69bd51d3a1a32fa9be30
- MD5 4a9045fb914cc6d3ccc553c793726fab
- SHA1 dd8eec0827b7fefcabde431cbd967afb72687cc7
- SHA512 7c0146220d1a8b9c0a3b6443139d3fef7bb024ef855773563545c5d7ee84abe9929cbf4df66aa39060a12d017ee1c9015d0cee7b49a0bc2065337a2a0fe67e84
- TLSH T107A0023502690805C000927426C301D22E14592402255286B2E4F07E8DD21819591088
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b56d49a9-3c43-46fe-95ea-1ff70b7ac4c8\index-dir\the-real-index
- Size 72B
- SHA256 a5829db95b724e759ccee00b4445acd87814458d05749fd8d065bd63352a948b
- MD5 36d1b690b7561bd6798642aa34335d20
- SHA1 35cc6b5dab87f6e4ceb408760ffb0c4fb7253302
- SHA512 3021146e66dee39d47eb26ac6ce26e6eccc4198faad6cb2dcaa13ca9fc11b9197c936afbd60fbf1dbcca39d3a50b5312bb5d5af02570df6d968e465a9ee18af5
- TLSH T1E2A0023001790955C051D3712243019327D8893B5311561942D0E4A9EDD058547636C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b56d49a9-3c43-46fe-95ea-1ff70b7ac4c8\index-dir\the-real-index~RFe5943f5.TMP
- Size 72B
- SHA256 209bcf962ab85f148132cd5f32f7f96d097a7a38df0a4e77d0cdb3783777148a
- MD5 a494038bf9a079934c581a17bb9a66c9
- SHA1 c85fe5d667c7e36ecbedadb050a3694dc11db245
- SHA512 5d99e8303ff6904874c6f7309180dff857e87aea1ca49cd4b54ba86102ab4d290aac0a582402b3b8af2afa9e141ff0a9e88ed1cadb989060c85ad8d520371759
- TLSH T1E2A0021C4A484261D58093F5520206C43764CC1475E9425244E520889DA2CEE898395D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 624B
- SHA256 4254d36505dd281fd8a8f4371e3154ec6a07c50069df0740caa754eb9e288f89
- MD5 652e6ffe0fe1e07e8cdf79fe0637e4f8
- SHA1 11f31942ade32036702ae39f14ee9bdb13ff217e
- SHA512 0e0f0e3ff08396790eca524d56e28f62462201259019375cadc0a1a67ea43a7c20436d04682b694edb98cca5b09060353b1b46bdb4a76bf26365e02804726c9e
- TLSH T1A0F078F72EF72D05F9AFC3D5203104B504197D19C814EC5F005AB283A0B2768249CC73
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 619B
- SHA256 130c6de592452b3d5db88dda739f15bc3dbfc31e105fabc60ea750ff29d09ce4
- MD5 345ac09b8bc2ab3102d09e2071c6f3a3
- SHA1 277f608298bbd516d6f8a2f0695d1652aed123d1
- SHA512 5faefe7c762864894e22f84513c570eefacf2ea238ba3a74a7328c2f3dfe93c968fedacd162c817712151892f3de8f70dd91190433396ff7cd83d64aa1fada80
- TLSH T114F078F72EF72D05FCAFC7D5303104B508167959C514EC6F005AA28390B2728249CCB3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
- Size 476B
- SHA256 438568bc98c822bac8383f3fbb132c870fec68e6bc651a109b3df53194330630
- MD5 eff664c91df9493a9a349e38119e8800
- SHA1 589383754ae99a7c410e21288d19a38a9c6ba486
- SHA512 1c3ef749cc3d6dee4ead3a80cd5c0a0256280da7920c45176fc38fb7bd0257395fc344f16f8944d8bbbafb826c3a1150aedfd37d0546955c8af7d80fa8988e75
- TLSH T12CF027B72DE32D08FDABC3D5203145A1080579698554ECAF042AA29390A1768249DC62
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
- Size 129KB
- SHA256 a1b3fb08983c0c9881027940db600f60aec2e3e5a9147a9a8cc08f89ae4f5adb
- MD5 c643cae2e46d84fb31c5f8fcd2ff3395
- SHA1 71ca7344793e1a01975f01a445ab14041b34b430
- SHA512 10f48b6e5d6ef140a4cbec459ed6c67a343a9fc203897af18f86448f873785a3f6eaf4b723d6f12914a25064576a34c98fe600502bca682ad526e6086ee251ec
- SSDEEP 3072:C+ll9BQxPCx1jo0ePhZL/x+8ii4MiiZL/GL/wL/qL/fL/huJAKZt:C+lerZL/UNXMiiZL/GL/wL/qL/fL/huP
- TLSH T17AD39933769D50AB0E89BAB45156B50392BC7467B8449038F214A7FC25DBFB013FAEB1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 7812d6beeeba0b2d7501c9f069301b06efb764b9857793c8c45c1634146697b3
- MD5 c43f32f02b629b871fc5373f202d26b8
- SHA1 557a225755285d7b2932286c6f99c279f91d67c5
- SHA512 83b345020ab374de3e9fc029c875adbcf377051ccc228d48c8b086481c2bd96cc4590c73d5b51bf9993afcd4fea994be2d1338c80322d30e4d871f6e28c77680
- TLSH T17CB024540D0F704DC03C037400D31450713C7CC44705100041F4F4F4C751F4030C5041
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 26KB
- SHA256 efa2652a8a09472ac76c2dc51beb7250061dadc958d8c84318c7adba645a7d56
- MD5 56aeabfa304cf0ab4da64df24bb3d77d
- SHA1 040a9b9a35864294d011fa1d392aee143b18dfd9
- SHA512 b770def77e6d287696f007cbea4cd4d594edf8a1c4a0e8ffaaad54949af0effda235e070626cc9803d7cb967eae654544664a33f2eb162e8b4b33a266497b1f9
- SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjl5tj4V/r:ctGj+BCNC5qFVpKx554tr
- TLSH T1FDC2761672BA02023C3D791C87A597371A42B1B33428E93B7BE854B65E67E214DFD8CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 32KB
- SHA256 6ad40fc332aa490022a6c5e50cae95fc0c65ed2728a99e041885bd08c83c90f2
- MD5 351c4ec325e7a310a580f9687a127098
- SHA1 edd641f1297a2b6e6562f84769a0d4c651c309f0
- SHA512 e6c9cd2b2ce25d77f747816d6e5c234ce082c3dcc36f586627d62b97053f67e027a60679c1169b455543c1ae52bc51e4f253651ea2666774501242bd0fda1a92
- SSDEEP 384:n+iFoZcIfq8NLk8TUNTUlIRRTik65bi1zCfbLoAjFQXOyidPc0v4EW1XoU1e5atp:VFWfqQkwgv0wOoAGlidPzIoUCQ
- TLSH T10EE2A2F298E79577E8DE4B87A77E2D029ABCC163B5885580B7D41D0DCC861BFC30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 32KB
- SHA256 d8afce6f67cc7313418033eeaf207462e7f99b27d3b7855b16602108cbfb74a0
- MD5 7fec779849602e799e01e4d73a4c1659
- SHA1 3f251db34d10428ab1d27fdf1450ab519aa849d7
- SHA512 6c5aa9944df12603e70eda956f7de4c764584ef3e68c8377690eeb53071c1c3affb84032b966f8c726a5f7f7c95b88764d8b32cc5e409bdc6f7f8ed3fade4695
- SSDEEP 384:n+iFxZcIfK8NLk8TUNTUlIRMTik6pmP21zCfbLoAjFQXOyidzc0v4EW1XoU1e5aj:VFZfKQkwgQ3P8OoAGlidzzIoUCQ
- TLSH T131E292F298E79577E8DE4B87A77E2D029ABCC163B5885580B7D41D0DCC861BFC30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 26KB
- SHA256 c098260bee837bcf0f13d231cbe7ff3f72b77a8c413f6ad23457e8482dd56a80
- MD5 0590888bee954b84010a8089447d0d04
- SHA1 56eda1637c08f5b1545a412756cd3072b7e19c7a
- SHA512 3f97cdcf6f3b20f3123a0c9e75da1fdb75b5e3e4c0dd85884717d199d4dd2c87862966ad34f882cec1abe33e78d64354107942762d84291fe540a664471e7cb4
- SSDEEP 384:n0iF9CcmyWCs38Nv8TUNTUlIxBrk6psRf1zCfbLoAjFQXOyi1Rc0e4KV8p0CPtyh:PFccps3Iwg4dRJOoAGli1RzI8p0R
- TLSH T184C25B32EC68CAB7ECD74F98E74A3503DEE05163868C9AD4DAD81E0D00DB1AD570BD26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 3ddec4c24dabff82ddfcf59517f05f96ffe4f3889ada597bcda51ae5cecf2428
- MD5 b9f4afac242ef4fc2387ec0f5bd76881
- SHA1 37467104ae8beb9c36b7033a87b788316b1f2957
- SHA512 10785f09c7d3c5255cade864faf64c8e832cab3b3815e867793a8610de5e9fe7b65c4d6acd7343c6178608626367010ea79ef2538f5ae77114ac3bab6999228e
- SSDEEP 384:nDiFiZcIS38N78TUNTUlIR4rk6Qiu1zCfbLoAjFQXOyi1dc0v4EW1XoU1e5aty/k:uFQS34wglIUOoAGli1dzIoUCQ
- TLSH T131C25C72E865CAB7FCE74ED4E74A7603DEE09163869C9AD0D5D85E1D00CB1AD030BD2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 32KB
- SHA256 8be874ba0f288815a05079b981c1c283df03c3e4037bd2d22f153beb600a65b7
- MD5 a9560d1bce8b243a4db66c87ef146aa5
- SHA1 f1acda119596d90e754d5664ea445716af01cd40
- SHA512 69bec2dd2fca4f0bc19e9a66cb94189e187148195174cc4a35a193040b676221de2bd4c1c06edbd70a75d51da7909023def05575fd2f580a3ff77163d5a792f5
- SSDEEP 384:n+iFiZcIfH8N78TUNTUlIR4Tik6/mP21zCfbLoAjFQXOyidJc0v4EW1XoU1e5atp:VFQfH4wgQDP8OoAGlidJzIoUCQ
- TLSH T16AE2A2F298E79577E8DE4B87A77E2D029ABCC163B5885580B7D41D0DCC861BFC30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 858eb34c0075f8b11f43b9b335a32d2d5a17706ab8e78c1faab75972081e149a
- MD5 097a004fc02f8acb4f51e8f34bebb8d0
- SHA1 05d7e53e38d8db3e848fb1f989941a887b2a9293
- SHA512 6b86729e0fd0d594b7425e0ebeae8fca41da87494151581fd9e1e483b924b1b2f1ddab1e051bd5c8b5f32bec98a5bafd28b4edf4cb69404ef69186be3acac7b0
- SSDEEP 384:nmiFiZcIS38N78TUNTUlIR4rk6CUu1zCfbLoAjFQXOyi1dc0v4EW1XoU1e5aty/k:NFQS34wgl4UOoAGli1dzIoUCQ
- TLSH T102C25C72E865DAB7FCE74ED4E74A7603DEE09163869C9AD0D5D85E1D00CB1AD030BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 32KB
- SHA256 dca16e7a2e2d8002854bcd4808f8bbc83fa192fa0cadb3f2a8aec36b68600cfc
- MD5 797b6368a1ed7292437ed58714672579
- SHA1 3af8aa3fa264ac55ebc9d01d2362dbf41a1587d9
- SHA512 c0834ae45f748d86e55b13f3535445d8b03cbadd2bba9255d627365fa1820effc094bf3d1463fb509e64684dff5337a9adafbc593c697b6d37940056b4436b4b
- SSDEEP 384:n+iFPZcIf88NLk8TUNTUlIRMTik6pmP21zCfbLoAjFQXOyidzc0v4EW1XoU1e5aj:VFHf8QkwgQ3P8OoAGlidzzIoUCQ
- TLSH T1D5E292F298E79577E8DE4B87A77E2D029ABCC163B5885580B7D41D0DCC8617FC30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 25KB
- SHA256 786a4ba30bd9858bd8029ff2e6b26146f85bb7522ecefdfef75fa8768a2f3fa2
- MD5 a5bd8da738e89734ade64ba90a0137d9
- SHA1 a7b20db63d679593115790c26a3e883ea37ad219
- SHA512 13eb9d8d2752361b3c84c707a71f72a648836359c27acd1cc301091eaf3b853a06e592defd5dd1019739ba60f50bad02d61700de4acea2d25e93f2ce39f5bc0a
- SSDEEP 384:n5iF9CcmyWCs38Nm8TUNTUlIxBrk6oF7F1zCfbLoAjFIS7e4KV8p0CPty/7Igr:QFccps39wg4R7zOoA6S7I8p0R
- TLSH T1A3B25C32EC68CAB7ECD74F99E74E6A03DEE06163858C9AD4DAD81D0D10971AC170BD26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 b5ab17d48a4eb65e25fa09e6811b2e1de95b5013cc8fa1552b093777c59dd573
- MD5 40dc557d883bee2933905bb0524dc1fd
- SHA1 3c2fe4046e7e1635a2eca6dbcb208b0776ee3179
- SHA512 3251eae877f7e206bb374abe423af17c2340b1080a13c0183c64536c0a9073cfc4c0b23e3a81fa8dc41c429998f69242259716812767505d198f1bf1b71442a1
- TLSH T10AE00112D10040FDE43D077010436AB02BD2802055F5038A99511A593D177502F74FC0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 eac5b6e4c2c9e3cc67b142680a2f41ec7d65d7a4554a2729615bd76ee7e1abda
- MD5 5d1eb07273467bd8bb60660dcaf190dd
- SHA1 c3ddd2e1474c3333f5c7b2aadc49b97aace88306
- SHA512 fcf147e6f0e0e9386b5025738fa637e5774cee9f4d271bc0a60be81f292c5bc58c8554a5767f601f77aaa69aacc3198dff7a03caf136bf06ecbfb7cd3d8e97ad
- TLSH T19DE00992D34540BEE06D0BB054836BA06BE2803556F6028E9E215A6EBD277506EB8FA0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 00c8c2182628df11d302dd3801c8ae4db65d4acda1191c02d441b4eaf8c1015d
- MD5 ba3f7f375b1bb0181e5b4e4cfb0a492d
- SHA1 54d39b9c64864e849c93f7394a53f6df1634f3af
- SHA512 f7985750b0a1cd33436ab1d5148ff0ee21b239dbd9db8d6025300028b6d065989953a5ce9d5baf0fc052e1e6528a05d62630cc732521641c004fffd277e49a48
- TLSH T1B8E04893D34400FED02C077040C31B603BF2403402F3028A9E200A28BC233002E78F90
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 d3ca872cdc1edb72ccf327c3d254053ce4441d5290d3f25d4c85499ee36e948e
- MD5 95b7271ac3df6aa39b713954d8a20d3f
- SHA1 1b9a9ef6d70a0f8a0366ba39c8eb40667e84b6f2
- SHA512 844690226acbebbc06c97bf328c27f92a53d1d2900f5cae1a1a0cb1925338dfa2d2dc085b832f123dbe9971b56a12f1733930f16398fc6c470ea27315100e5cd
- TLSH T16FE00213D20040F9E43D0371104367A02BD3802055F5034A9D110A583D137402E74F80
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 eedb0e9e3274911854571f44f4fb3fd1a745ff5742846d5d19785d8dacebfd3c
- MD5 87e18765f2172334a13223a30bac72f2
- SHA1 3ea38c79665d34ff3814f84e38b6af337575f6cb
- SHA512 99698abe14f95b3237944d3533d26ad8990d74a2383b45864e93b8631d4662b373514eacf073614ffaf2533ce046813b17d624048735f15308612f5f31cbacd3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 5db1ab25fe6fa4b64a239d906cc8fb0227e0b125c1ac5f0f522cab014494f680
- MD5 2a2b704c3d13a14797d0a1d7f7e808fa
- SHA1 3ba50365c2378614cf93808e10ba71e85e567a8f
- SHA512 f4b378780da94bf2d9a00a6e006da69f91cb64121824f4a0aa865d23b1aa8107a731fb8c0def082ad6edbd24584b606be8f59b405cf99a440bc945d4804f2f6a
- TLSH T12EE00112D10440FEE43D077014836BB02BD2802056F6028ADA611A697D277502F74FD0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 8560e71e3c11bd06f316b0a2637fc37196eb3e1d243f3315ed8d26095c6669e4
- MD5 532368ddc3758975665a2c41e1f4b1f1
- SHA1 cb166a976113e9f79402d5428585e04d35c3cdf9
- SHA512 3d742c9f9d67da5d46b218b54beadcff7dae26bf1cb60aa6df13dd7fe67a7d3e4a01ff5a7ac4d99c3f235d156b07623aa87a58e553e09fcfb3bfd628667ce4a8
- TLSH T1FEE00992E20440BEE06D07B054836FB02BE2803456F6038A9A211A6D7D277506FB8FA0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 4954061dd8e0335f587c36c61fbdb148bb01254bfd188e5e2bd4bc52bca0b090
- MD5 9e5f06495aa33ba54356e233e573f676
- SHA1 81a1996a5059dba48a7f63405efa3de9352c8839
- SHA512 d837d18f65fee22c36ce73c64910827b68996d2865e6018c292e377db1bcfeb21455ddf2da43c363d0ea1c767066dd0faae9c52d282bf7abbaaa9832ebcc7cf4
- TLSH T1ABE04892D24000BED02C077000C31B602BE2803402F2028A9E200A297C233002E78F90
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 eac62a1f681c4e0159a9bc8b9a949a80eb55a074a64ebfd17e6a15b73386408e
- MD5 dea6f7ebbbb32177de56e985b3532756
- SHA1 d4a976a9263c848b6a3bfe77cfb8af3ab82c2713
- SHA512 58b80ea3861265f2a1c3fb26872b25d5dc5699c8a3f55f163adb95659246f7f425b69500f879a2686791c8bf4596562691347e8aeeace2c36f9e905206b2f0a4
- TLSH T16FE00193E34800BFE03C0B7045831B702AE2803402F2028A9E2009283C233542E78F80
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 6693dda1e193619d53e26347e62876f3ccfc041e5a2e9e954ac8f0b1b2971e26
- MD5 3d3e4f892e2c12136e2d21362e6476b3
- SHA1 7c62aa736c67bd8074134cf31dc151f7dadc0b15
- SHA512 d9903f5bc13bf6b5f01aa5cb4cd5ee4c74244910081c6a67a0c596ba269452e726e61066963bafd5b3c187bbf1515cd94e7cb8b414f911bda6160adaa1a75689
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59016d.TMP
- Size 392B
- SHA256 1567a9f9273de0b68ec8c935ae9fb655a7658631a0d97d58d128781cf63c6fe1
- MD5 2bb155eec27e91450fedc3a55a2b4848
- SHA1 a837f7c7498e1b1e1af94530d1f8d9baf5d81d37
- SHA512 e5c23f9cac9b800dde2f489464ee13794623bda0b05fceedd92fcaf4a5e175ea28a743694825260d98b2ca005d733cb5dda60b5536221b1d6a5d86076d2c1e3f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_13igs5xr.n4x.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-D9EOR.tmp\AdobeAcrobatPDF.tmp
- Size 3.1MB
- SHA256 f96c32bfb2770c6b06a45024f4f632b5408f3981527225af0c4bb34e03323051
- MD5 61e00f331fdee6f7cebae1bc7f9d66be
- SHA1 2be3c3aeee0da4ebebdcb3d5a9327694494fb23f
- SHA512 93e245ebd483ed14ffcdce1c2bed1596ae4512ad54fff02113ada493f3f081c31259ef21bcca1eada18d8180f5a059f9a917a7e1db03bc081e8221af88ffc04b
- SSDEEP 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
- TLSH T1A5E53A17F28C713ED06B3A364A3385909837FA6179168C279BFC794C8F365942A3E647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-FT5FU.tmp\_isetup\_setup64.tmp
- Size 6KB
- SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
- MD5 e4211d6d009757c078a9fac7ff4f03d4
- SHA1 019cd56ba687d39d12d4b13991c9a42ea6ba03da
- SHA512 17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e
- SSDEEP 96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
- TLSH T198C1E80ECA279263FD5A09B79E8219C46FFC262339C6623FCF0045D667C1E4E59A17B0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\AdobeAcrobatPDF.exe
- Size 21.3MB
- SHA256 fff855ef49242a714fdeca4b72cc560e4166d615fc98277a7522559c2aaab8b4
- MD5 770795fad220725a3cc3c9805181c59c
- SHA1 12e21abac0498cc29a54193bcc334a4daddd2e64
- SHA512 d85501116aeae4c7ed3af60961cce0acd4396d9476486e3d544c5306d67b2f12de403b480e8190c710b0964e049b0e480248d8e8ee811fef48063984704b63dd
- SSDEEP 393216:0YysS0eb86GDeAQCncf5Dly2ZI+K0DsjVnFv/N1BW8ywRKKCFdGn0I+o9L:FHjDeAQPRDla+l+F3N1hCFgn0IT
- TLSH T10A27333FF198E53EC49E1A7145738220997B7A60B41A8C0FA7FC745DCF275611E3AA22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\AdobeAcrobatPDF.exe:Zone.Identifier
- Size 139B
- SHA256 7c442963a6942c125cad9077afd5c406dc5eb877a668be9bb995751c7c262d91
- MD5 60a14ea89337dc82ece5a4c0bc71af60
- SHA1 f0cd549f799619dd31e8b5651a1bcfd64df523cd
- SHA512 fd047e52a20495602e9060471e25ef4c0d2f0edf3f8555f77dffcfe021462fba5773a8f93d581175351c64619eebf5cabaecfe28d2676baf0cbde53cacecec6b
- TLSH T130C09B5F5874E335075C17F400D4D13C941E75C54D6062C1EE4209C79FD0499557D41F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSIFBD1.tmp
- Size 285KB
- SHA256 f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
- MD5 b77a2a2768b9cc78a71bbffb9812b978
- SHA1 b70e27eb446fe1c3bc8ea03dabbee2739a782e04
- SHA512 a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57
- SSDEEP 6144:cAOfnUdzb4m26KFHF/jliAYktxjw0gCvo5VGWg6AZzGbasKHr45I:cRUFb4H6KJF/pDYkw0gCvoKWg6AZznX4
- TLSH T18B547C117AD5D432E1BE0530397DABA52ABEF8316DF0C68F9384566D2D712C0A728F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\ServerData.json
- Size 244B
- SHA256 017279704c37f2587b5ce9cad0cf3c50aa06db0b035276de19d61ef0d4c7bd9e
- MD5 b66bceaff2cd7c91d4b0b38772b9270c
- SHA1 5159cda2624582a2b68eeb3206e0fbd077042051
- SHA512 2d4f1e8f32be6775bf37ecc0ac33327ddedbbb60fc7c0fbe5bef313b08e35b81658e78c5f9038966366480e34086ad577ae3fa43143e915055f165d6d1c3ebd8
- TLSH T151D0A79658F1DD3C55C513BC81B8453D47B30F0C974A4016B3C6BE85F559D715053578
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\ZecuritAgentInstaller.msi
- Size 20.1MB
- SHA256 4172530fa8cdc5f68b15e1b2357a7be598bc2b61a63688752238ba125a40067c
- MD5 762b0559cc8ea5a629410072aaa0b9e3
- SHA1 aaddf5875cf37ad39c9bb82dabdb78c875ede585
- SHA512 7dc1fd4a4d81d43e4154a90112c568d375d1c55dded6851e4aac7348b090d1761e0fcd908372877feea93f4eb2d54c21e7061bd6f86c39a11ece1ef334d7f30d
- SSDEEP 393216:fJsP+AjjtBdIHFBsnXO5w+ykndtrR9/jid4iRo51ps+cnwI4FnCUxQ:RkhIHFBMuw+Bt3W+uo564FCUxQ
- TLSH T17827332138CAED32E99B19B5293B477C0AAD3D309825528BE390F97DAD731419375E33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 761f661250e279cb9e86535d201bf1c5f55700ae3289e144227c8c7c7df38011
- MD5 f2a839bc41dbd66e52f77657af9c5ce0
- SHA1 3431a9559c0802a2a974394c3c1f7ac54bd7b149
- SHA512 5bce6d6f846aac3c1e9f9d63089d5b3be332d5a04dcf189f8b58f74bcaba6f6735553c8db9968130d75269fcd3fef861330e12f6607bdef86ebfd1a44fb023ff
- SSDEEP 24576:z2gmSp1OdoO/vvTL5GSOh0nq/6p5Q4242WhdXJkC7J6oEeGHI5TVrPI1h:Q
- TLSH T12747A42436F92100E7F79E3D78F06A27493A7D5B9C15DE8D45411B8E0921BB0E8B2F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{731567b7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e25b299f-36f7-416c-8373-85f8ff386a68}_OnDiskSnapshotProp
- Size 6KB
- SHA256 46ea6b50e3dad608fa2e3d83de7492e715cd28d6b1213c521faa02c9a2aa3a4d
- MD5 0c2565d94a7ea4e5c406538cb749935f
- SHA1 4b715ab4918072ccb53fc4ffb28b2f072ab0c1eb
- SHA512 e351abaab71a808b4005eb83e876f5420bcc94969ec6f7200c2808690e3f59271884f932c9f6ab3cf9ef7ae84dbb5c038d3e334a2d97ba8ac4cfc113fc9ed9c0
- SSDEEP 96:FwdpnHzvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Gvb++ZVmN
- TLSH T118D199185AE54711E2B3AB3229F14557A877B911FF33CB8E0198638E2670A10F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH