Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
149s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
14/10/2026, 03:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://zoom-meet-invite7845957.s3.us-east-1.amazonaws.com/index.html
Resource
win11-20260911-en
windows11-21h2-x64
31 signatures
150 seconds
General
- Target https://zoom-meet-invite7845957.s3.us-east-1.amazonaws.com/index.html
- Sample261014-d19dvaec76
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 18 4480 chrome.exe - Executes dropped EXE 18 IoCs
pid Process 3728 zoom-workspace.exe 1104 zoom-workspace.tmp 780 _setup64.tmp 396 InstallUninstallApp.exe 5976 7za.exe 4220 ZecuritAgentRegister.exe 3500 ZecuritAgentService.exe 5468 ZecuritLiveNotifier.exe 6092 ZecuritCommandProcessor.exe 1524 ZecuritAgentRegister.exe 1532 ZecuritAgentAssetMgr.exe 3180 ZecuritAgentAssetMgr.exe 4608 ZecuritAgentService.exe 5308 ZecuritLiveNotifier.exe 5916 ZecuritAgentTray.exe 1684 ZecuritCommandProcessor.exe 2220 ZecuritAgentWinStore.exe 5016 ZecuritCommandProcessor.exe - Loads dropped DLL 25 IoCs
pid Process 3696 MsiExec.exe 3696 MsiExec.exe 4220 ZecuritAgentRegister.exe 4220 ZecuritAgentRegister.exe 3500 ZecuritAgentService.exe 3500 ZecuritAgentService.exe 5468 ZecuritLiveNotifier.exe 5468 ZecuritLiveNotifier.exe 6092 ZecuritCommandProcessor.exe 6092 ZecuritCommandProcessor.exe 6092 ZecuritCommandProcessor.exe 1532 ZecuritAgentAssetMgr.exe 1532 ZecuritAgentAssetMgr.exe 3180 ZecuritAgentAssetMgr.exe 3180 ZecuritAgentAssetMgr.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 5308 ZecuritLiveNotifier.exe 5308 ZecuritLiveNotifier.exe 1684 ZecuritCommandProcessor.exe 1684 ZecuritCommandProcessor.exe 1684 ZecuritCommandProcessor.exe 5016 ZecuritCommandProcessor.exe 5016 ZecuritCommandProcessor.exe 5016 ZecuritCommandProcessor.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ZecuritAgentWinStore.exe.log ZecuritAgentWinStore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request ZecuritAgentAssetMgr.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates ZecuritAgentAssetMgr.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\CRLs ZecuritAgentAssetMgr.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\CTLs ZecuritAgentAssetMgr.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Zecurit\Agent\ZecuritPromptUI.exe.config 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe 7za.exe File created C:\Program Files\Zecurit\Agent\libssl-1_1.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\RCStream.dll 7za.exe File created C:\Program Files\Zecurit\Agent\Storage\PowerEventHistory.json ZecuritAgentService.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\device_asset_scan.log ZecuritAgentAssetMgr.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_cmd_handler.log ZecuritCommandProcessor.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe.config 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritApplicationControlService.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritAssetMonitoring.exe 7za.exe File created C:\Program Files\Zecurit\Agent\msvcp140.dll 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritApplicationControlHandler.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\device_asset_scan.log ZecuritAgentAssetMgr.exe File opened for modification C:\Program Files\Zecurit\Agent\ZBitLocker.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAgentUpgrader.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritPromptUI.exe 7za.exe File created C:\Program Files\Zecurit\Agent\RCStream.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\vccorlib140.dll 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritWinHandler.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_service.log ZecuritAgentService.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\libcrypto-1_1.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\msvcp140.dll 7za.exe File created C:\Program Files\Zecurit\Agent\vccorlib140.dll 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritAgentWinStore.exe.config 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritApplicationControlService.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritGeoLocationApp.exe 7za.exe File created C:\Program Files\Zecurit\Agent\vcruntime140.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_install.log ZecuritAgentRegister.exe File created C:\Program Files\Zecurit\Agent\Storage\ZecuritAgentInstaller.msi ZecuritAgentRegister.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_cmd_handler.log ZecuritCommandProcessor.exe File created C:\Program Files\Zecurit\Agent\mfc140.dll 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritADEntraHandler.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_cmd_handler.log ZecuritCommandProcessor.exe File created C:\Program Files\Zecurit\Agent\Storage\Softwares.json ZecuritAgentAssetMgr.exe File created C:\Program Files\Zecurit\Agent\Storage\Hardwares.json ZecuritAgentAssetMgr.exe File created C:\Program Files\Zecurit\InstallUninstallApp.exe msiexec.exe File opened for modification C:\Program Files\Zecurit\Agent\Get-DeviceWarranty.ps1 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\mfc140.dll 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritDeviceControl.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritScreenReaderApp.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritScreenReaderService.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritScreenReaderAppUI.exe.config 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe.config 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritScreenReaderService.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_live_notifier.log ZecuritLiveNotifier.exe File created C:\Program Files\Zecurit\Agent\Storage\AgentSettings.json ZecuritCommandProcessor.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_live_notifier.log ZecuritLiveNotifier.exe File created C:\Program Files\Zecurit\Agent\Get-DeviceWarranty.ps1 7za.exe File created C:\Program Files\Zecurit\Agent\ZBitLocker.exe 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAlertManager.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritScreenReaderApp.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritWinHandler.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\Storage\ZecuritAgentInstaller.msi ZecuritAgentRegister.exe - Drops file in Windows directory 33 IoCs
description ioc Process File created C:\Windows\rescache\_merged\2343073371\3082931569.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\4052159476\3675361134.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\3989159129\2307585260.pri ZecuritAgentWinStore.exe File created C:\Windows\Installer\e598a0a.msi msiexec.exe File created C:\Windows\rescache\_merged\2878548818\848821867.pri ZecuritAgentWinStore.exe File created C:\Windows\SystemTemp\~DF1BDF5ECC2A7DC55D.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{D16197C5-AF74-4C36-B385-907AD910E9F3} msiexec.exe File created C:\Windows\SystemTemp\~DFAE9D68F0DB3247DD.TMP msiexec.exe File created C:\Windows\rescache\_merged\1154286595\2784302321.pri ZecuritAgentWinStore.exe File opened for modification C:\Windows\Installer\e598a06.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI8CA7.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI8E00.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF0F32E8921BA8107B.TMP msiexec.exe File created C:\Windows\rescache\_merged\39430164\3317300949.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\3766950118\605067786.pri ZecuritAgentWinStore.exe File opened for modification C:\Windows\Installer\MSI8BCB.tmp msiexec.exe File created C:\Windows\rescache\_merged\4062111013\3454469763.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\942627682\3891061386.pri ZecuritAgentWinStore.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\rescache\_merged\1831202810\1805344512.pri ZecuritAgentWinStore.exe File created C:\Windows\Installer\e598a06.msi msiexec.exe File created C:\Windows\rescache\_merged\2277971356\2472853308.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\98783150\4101472588.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\2689159751\1388195692.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\2879188468\1688591165.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\3559780703\447832725.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\1079253649\3122425603.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\926178228\2944723266.pri ZecuritAgentWinStore.exe File created C:\Windows\SystemTemp\~DF0C896BC70669B9EB.TMP msiexec.exe File created C:\Windows\rescache\_merged\566188972\3260097662.pri ZecuritAgentWinStore.exe File created C:\Windows\rescache\_merged\179954523\768502937.pri ZecuritAgentWinStore.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\zoom-workspace.exe:Zone.Identifier chrome.exe -
pid Process 4760 powershell.exe 2624 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 12 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob = 5900000001000000120000005200530041002f0053004800410031000000040000000100000010000000e1c07ea0aabbd4b77b84c228117808a71400000001000000140000000eac826040562797e52513fc2ae10a539559e4a469000000010000000e000000300c060a2b0601040182373c03020b000000010000004a0000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000030000000100000014000000cdd4eeae6000ac7f40c3802c171e30148030c0720f0000000100000014000000391be92883d52509155bfeae27b9bd340170b76b190000000100000010000000983b132635b7e91deef54a6780c092695c00000001000000040000000010000020000000010000009d0500003082059930820381a003020102021079ad16a14aa0a5ad4c7358f407132e65300d06092a864886f70d0101050500305f31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c64011916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479301e170d3031303530393233313932325a170d3231303530393233323831335a305f31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c64011916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f7420436572746966696361746520417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100f35dfa8067d45aa7a90c2c9020d035083c7584cdb707899c89dadecec360fa91685a9e94712918767cc2e0c82576940e58fa043436e6dfaff780bae9580b2b93e59d05e3772291f734643c22911d5ee10990bc14fefc755819e179b70792a3ae885908d89f07ca0358fc68296d32d7d2a8cb4bfce10b48324fe6ebb8ad4fe45c6f139499db95d575dba81ab79491b4775bf5480c8f6a797d1470047d6daf90f5da70d847b7bf9b2f6ce705b7e11160ac7991147cc5d6a6e4e17ed5c37ee592d23c00b53682de79e16df3b56ef89f33c9cb527d739836db8ba16ba295979ba3dec24d26ff0696672506c8e7ace4ee1233953199c835084e34ca7953d5b5be6332594036c0a54e044d3ddb5b0733e458bfef3f5364d842593557fd0f457c24044d9ed6387411972290ce684474926fd54b6fb086e3c73642a0d0fcc1c05af9a361b9304771960a16b091c04295ef107f286ae32a1fb1e4cd033f777104c720fc490f1d4588a4d7cb7e88ad8e2dec45dbc45104c92afcec869e9a11975bdece5388e6e2b7fdac95c22840dbef0490df813339d9b245a5238706a5558931bb062d600e41187d1f2eb597cb11eb15d524a594ef151489fd4b73fa325bfcd13300f95962700732ea2eab402d7bcadd21671b30998f16aa23a841d1b06e119b36c4de40749ce15865c1601e7a5b38c88fbb04267cd41640e5b66b6caa86fd00bfcec1350203010001a351304f300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e041604140eac826040562797e52513fc2ae10a539559e4a4301006092b06010401823715010403020100300d06092a864886f70d01010505000382020100c5114d033a60dd5d5211778fb2bb36c8b205bfb4b7a8d8209d5c1303b61c22fa061335b6c863d49a476f2657d255f104b1265fd6a95068a0bcd2b86eccc3e9acdf19cd78ac5974ac663436c41b3e6c384c330e30120da326fe515300ffaf5a4e840d0f1fe46d052e4e854b8d6c336f54d264abbf50af7d7a39a037ed63030ffc1306ce1636d4543b951b51623ae54d17d40539929a27a85baabdecbbbee3208960716c56b3a513d06d0e237e9503ed683df2d863b86b4db6e830b5e1ca944bf7a2aa5d9930b23da7c2516c28200124272b4b00b79d116b70beb21082bc0c9b68d08d3b2487aa9928729d335f5990bdf5de939e3a625a3439e288551db906b0c1896b2dd769c319123684d0c9a0daff2f6978b2e57adaebd70cc0f7bd6317b8391338a2365b7bf285566a1d6462c138e2aabf5166a294f5129c6622106bf2b730922df229f03d3b144368a2f19c2937cbce3820256d7c67f37e24122403088147eca59e97f518d7cfbbd5ef7696effdcedb569d95a042f99758e1d73122d35f59e63e6e2200ea4384b625dbd9f3085668c0646b1d7cecb693a262576e2ed8e7588fc4314926ddde293587f53071705b143c69bd89127deb2ea3fed87f9e825a520a2bc1432bd930889fc810fb898de6a18575337e6c9edb7313646269a52f7dca966d9ff8044d30923d6e211421c93de0c3fd8a6b9d4afdd1a19d9943773fb0da ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob = 5900000001000000100000005200530041002f004d0044003500000014000000010000001400000001f0334c1aa1d9ee5b7ba9de43bc027d570933fb0b00000001000000400000004d006900630072006f0073006f00660074002000410075007400680065006e007400690063006f0064006500280074006d002900200052006f006f0074000000090000000100000016000000301406082b0601050507030406082b060105050703030300000001000000140000007f88cd7223f3c813818c994614a89c99fa3b52470f0000000100000010000000d67576f5521d1ccab52e9215e0f9f74319000000010000001000000007d34ded498d4577f261bd38b6b8736e2000000001000000da030000308203d6308202bea003020102020101300d06092a864886f70d01010405003050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479301e170d3935303130313038303030315a170d3939313233313233353935395a3050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100df08bae33f6e649bf589af28964a078f1b2e8b3e1dfcb88069a3a1cedbdfb08e6c8976294fca603539ad7232e00bae293d4c16d94b3c9ddac5d3d109c92c6fa6c2605345dd4bd155cd031cd2595624f3e578d807ccd8b31f903fc01a71501d2da712086d7cb0866cc7ba853207e1616faf03c56de5d6a18f36f6c10bd13e69974872c97fa4c8c24a4c7ea1d194a6d7dceb05462eb818b4571d8649db694a2c21f55e0f542d5a43a97a7e6a8e504d2557a1bf1b1505437b2c058dbd3d038c93227d63ea0a5705060adb6198652d4749a8e7e656755cb8640863a9304066b2f9b6e334e86730e1430b87ffc9be72105e23f09ba74865bf09887bcd72bc2e799b7b0203010001a381ba3081b7300d0603551d0a040630040302078030320603550403042b13294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930720603551d01046b306980101a1be75b9ffd8c2ac339ae0c622e5332a1523050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479820101300d06092a864886f70d010104050003820101002dc9e2f6129e5d5667fafa4b9a7edc29565c80140228856e26f3cd58da5080c5f819b3a67ce29d6b5f3b8f2274e61804fc4740d87a3f3066f012a4d1eb1de7b6f498ab5322865158ee230976e41d455c4bff4ce302500113cc41a45297d486d5c4fe8383657deabea2683bc1b12998bfa2a5fc9dd384ee701750f30bfa3cefa9278b91b448c845a0e101424b4476041cc219a28e6b2098c4dd02acb4d2a20e8d5db9368e4a1b5d6c1ae2cb007f10f4b295efe3e8ffa17358a9752ca2499585feccda448ac21244d244c8a5a21fa95a8e56c2c37bcf4260dc821ffbce74067ed6f1ac196a4f745cc51566316cc16271910f595b7d2a821adfb1b4d81d37de0d0f ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob = 5900000001000000100000005200530041002f004d004400350000001400000001000000140000009aa6587f94dd91d91e63dfd3f0ce5fae1893aab7030000000100000014000000fee449ee0e3965a5246f000e87fde2a065fd89d4190000000100000010000000edbccdd5106a071c5d8b4690918e48aa2000000001000000ce010000308201ca30820174a003020102021006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405003016311430120603550403130b526f6f74204167656e6379301e170d3936303532383232303235395a170d3339313233313233353935395a3016311430120603550403130b526f6f74204167656e6379305b300d06092a864886f70d0101010500034a0030470240815522b98aa46fedd6e7d9660f55bcd7cdd5bc4e400221a2b1f78730855ed2f244b9dc9b75b6fb465f42b69d23360bde540fcdbd1f992a105811cb40cbb5a7410203010001a3819e30819b3050060355040304491347466f722054657374696e6720507572706f736573204f6e6c792053616d706c6520536f667477617265205075626c697368696e672043726564656e7469616c73204167656e637930470603551d010440303e801012e4092d061d1d4f008d6121dc166463a1183016311430120603550403130b526f6f74204167656e6379821006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405000341002d2e3e7b8942893fa82117faf0f5c395db62695bc9dcc1b3faf0c46f6f649abde71b2568728367bd56b08d01bd2af7cc4bbd87a5ba87204c421141ad10173b8c ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob = 5900000001000000120000005200530041002f0053004800410031000000030000000100000014000000d559a586669b08f46a30a133f8a9ed3d038e2ea818000000010000001000000091161b894b117ecdc257628db460cc041900000001000000100000006ed6ed7df52fc19bdc9e5fe9e2be21fb1400000001000000140000000acfeb4b07e703a01f4cef28ee7256f7517591550f00000001000000140000004973e092cf8a9e2ca5f988493a5bacfe3895942e040000000100000010000000acd80ea27bb72ce700dc22724a5f1e9220000000010000008703000030820383308202eca003020102021046fcebbab4d02f0f926098233f93078f300d06092a864886f70d0101050500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3937303431373030303030305a170d3136313032343233353935395a3081ba311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20496e7465726e6174696f6e616c20536572766572204341202d20436c617373203331493047060355040b13407777772e766572697369676e2e636f6d2f43505320496e636f72702e6279205265662e204c494142494c495459204c54442e286329393720566572695369676e30819f300d06092a864886f70d010101050003818d0030818902818100d88280e8d619027d1f85183925a2652be1bfd405d3bce6363baaf04c6c5bb6e7aa3c734555b2f1bdea9742ed9a340a15d4a95cf54025ddd907c132b2756cc4cabba3fe56277143aa63f5303e9328e5faf1093bf3b74d4e39f75c495ab8c11dd3b28afe70309542cbfe2b518b5a3c3af9224f90b202a7539c4f34e7ab04b27b6f0203010001a381e33081e0300f0603551d13040830060101ff02010030440603551d20043d303b3039060b6086480186f84501070101302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f43505330340603551d25042d302b06082b0601050507030106082b0601050507030206096086480186f8420401060a6086480186f845010801300b0603551d0f040403020106301106096086480186f842010104040302010630310603551d1f042a30283026a024a0228620687474703a2f2f63726c2e766572697369676e2e636f6d2f706361332e63726c300d06092a864886f70d010105050003818100408e4997968a73dd8e4def3e61b7caa062adf40e0abb753de26ed82cc7bff4b98c369bcaa2d09c724639f6a682036511c4bcbf2da6f5d93b0ab598fab378b91ef22b4c62d5fdb27a1ddf33fd73f9a5d82d8c2aead1fcb028b6e94948134b838a1b487b24f738de6f4154b8ab576b06dfc7a2d4a9f6f136628088f28b75d68071 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob = 5900000001000000100000005200530041002f004d00440035000000140000000100000014000000265d0507d82fa26084bd837df52180a7056f5a85030000000100000014000000109f1caed645bb78b3ea2b94c0697c740733031c19000000010000001000000083b65318664e6fa245e0d7609fb958202000000001000000130400003082040f308202f7a003020102020a198b11d13f9a8ffe69a0300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937313030313037303030305a170d3032313233313037303030305a3081c3312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e3141303f060355040b13384d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747920496e7465726d656469617465204341311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3131302f060355040313284d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747930819f300d06092a864886f70d010101050003818d0030818902818100e04e100eb8a7ef21ca605adc9f1e3e83775a292ef94ee5085ddee1cf09c01f44b707a84ba422303b190683eef3ac2778aecad6402bce7901e19d568b3672b163905fa0b2c066a649c53cfa26a262c3d3b5cc61154cf23fb4e7450843897f6a8dd566fbd7ff6400c411fd2ca30b75b0fbe5ac2665a381e666493d1d737a9b71d70203010001a381da3081d7300f0603551d130101ff040530030101ff301f0603551d250418301606082b06010505070303060a2b0601040182370a03053081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010016d8587683608be849582c050b644d40ad2d4dc2fc5f7d963cd0afb954522828d5655e8f710eb3080e1509c9d592cc241144242d51dfaf54444b7bd671d4d73a357cd186b405dca7097498b21b166d39a7446aad79eaa2cdff5b2a63d1848422ab98c68762621b539615604731571ee00161ad36efc52d0ab4d01853f3569cb4b7b7050433ad29279351070c9ebe80ff15bc26c741f36ce2c2eaafb4ae5e08bba8c95b509b4a08430ccedcffbb2aa7816f5facbc7528ea363ebc0a94450b5ccdb5e39f238cb507813d5978514639bca7f66d17037fee529a39bc09f2d2baa8d79505eb465254718ee87ecd9a6ee74af3a449f0cac695a5516055bd741ecb2c01 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5900000001000000160000005200530041002f00530048004100320035003600000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob = 5900000001000000100000005200530041002f004d004400350000000f0000000100000010000000e8a598be84828efeae701115013576b20400000001000000100000007f667a71d3eb6978209a51149d83da20030000000100000014000000be36a4562fb2ee05dbb3d32323adf445084ed65609000000010000000c000000300a06082b060105050703080b000000010000002e0000005400680061007700740065002000540069006d0065007300740061006d00700069006e0067002000430041000000190000000100000010000000181c2be05851f96993e196f279954b23140000000100000014000000ddbcbd869c3f07ed40e31b08efcec4d188cd3b155c0000000100000004000000000400002000000001000000a5020000308202a13082020aa003020102020100300d06092a864886f70d010104050030818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e67204341301e170d3937303130313030303030305a170d3230313233313233353935395a30818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e6720434130819f300d06092a864886f70d010101050003818d0030818902818100d62b587861458653ea347b519cedb0e62e180efee05fa827d3b4c9e07c594e160e735460c17ff69f2ee93a8524153cdb470463c39ec4941a5adf4c7af3d9431d3c107a7925db90fef051e730d64100fd9f28df79be94bb9db614e32385d7a941e04ca479b02b1a8bf2f83b8a3e45ac719200b4904198fb5fedfab72e8af888370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810067dbe2c2e6873d40838637357d1fce9ac30c6620a8baaa048986c2f510080dbfcba2058ad04d363ef4d7ef69c65ee4b0946f4ab9e7de5b88b67bdbe327e576c3f035c1cbb5279b3379dc90a6009e77fafccd279442169cd31c68ecbf5cdde5a97b100a32745413318b85038491b75801301438af28cafcb150191909ac8949d3 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob = 5900000001000000100000005200530041002f004d004400350000000400000001000000100000002a954eca79b2874573d92d90baf99fb61400000001000000140000004a5c7522aa46bfa4089d39974ebdb4a360f7a01d030000000100000014000000a43489159a520f0d93d032ccaf37e7fe20a8b4190b00000001000000320000004d006900630072006f0073006f0066007400200052006f006f007400200041007500740068006f007200690074007900000069000000010000000e000000300c060a2b0601040182373c03020f00000001000000100000008b3c3087b7056f5ec5ddba91a1b901f01900000001000000100000003fc8cb0bc05241e58d65e9448b2d07c25c00000001000000040000000008000020000000010000001604000030820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e3115a204fea627bafaa19c82b37252dbe65a1128a250f63a3f7541cf921c9d615f352ac6e433207fd8217f8e5676c0d51f6bdf152c7bde7c430fc203109881d95291a4dd51d02a5f180e003b45bf4b1ddc857ee6549c75254b6b4032812ff90d6f0088f7eb897c5ab372ce47ae4a877e376a000d06a3fc1d2368ae04112a8356a1b6adb35e1d41c04e4a84504c85a33386e4d1c0d62b70aa28cd3d5543f46cd1c55a670db123a8793759fa7d2a0 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000190000000100000010000000bb048f1838395f6fc3a1f3d2b7e97654140000000100000014000000722d3a02319043b914054ee1eaa7c731d12389340300000001000000140000008f43288ad272f3103b6fb1428485ea3014c0bcfe69000000010000000e000000300c060a2b0601040182373c03020b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003100310000000f0000000100000020000000279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1040000000100000010000000ce0490d5e56c34a5ae0be98be581185d5c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a00302010202103f8bc8b5fc9fb29643b569d66c42e144300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131303332323232303532385a170d3336303332323232313330345a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100b28041aa35384d13723268224db8b2f1ffd552bc6cc7f5d24a8c36eed1c25c7e8c8aaeaf13286fc073e33aced025a85a3a6defa8b859ab132368cd0c2987d16f805c8f447f5d90015258ac51c55f2a87dcdcd80a1dc103b97bb056e8a3de6461c29ef8f37cb9ec0db554fe4cb6654f88f09c48990c420b097c315917790678288d893a4c0325be716a5c0be78460a49922e3d2af84a4a7fbd198ed0ca9de9489e10ea0dcc0ce993dea0852bb5679e41f84ba1eb8b4c4495c4f314b87dddd0567269980e07111a3b8a541e2a453b9f73229830c13bf365e04b34b43472f6be2911ed3984fdd4207c8e81d12fc99a96b3e927ec8d6693afc64bdb6099dcafd0c0ba29b77604b0394a4306912d6422dc1414ccadcaafd8f5b83469ad9fcb1d1e3b3c97f487acd24f0418f5c74d0acb010200649b7c72d21c857e3d086f30368fbd0ce71c189994a64016cfdec3091cf413c92c7e5ba861d6184c75f833962aeb4922f47f30bf855eba01f59d0bb749b1ed076e6f2e906d710e8fa64de69c635968802f046b83f27996fcb71892935f7481602358fd5797c4d02cf5feb8a834f457188f9a90d4e72e9c29c07cf491b4e040e63518c5ed800c1552cb6c6e0c2654ec93439f59cb3c47ee8616e135f15c45fd97eed1dceee44eccb2e86b1ec38f670edab5c13c1d90f0dc780b255ed34f7ac9be4c3dae7473ca6b58f31dfc54bafebf10203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414722d3a02319043b914054ee1eaa7c731d1238934301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201007f72cf0fb7c515db9bc049ca265bfe9e13e6d3f0d2db975ff24b3f4db3ae19aeedd797a0acefa93aa3c241b0e5b8919e13812403e609fd3f574039212456d1102f4b40a936864bb453579afbf17e898f11fe186c51aae8ed0995b5e571c9a1e98775a6157fc97e37545e7493c5c367cc0d4f6ba8170c6d08927e8bdd81aa2d7021c33d0614bbbf245ea784d73f0f2122bd4b0006db971cd85ed4c50b5c876e50a4e8c338a4fbcb2cc592669b855ecb7a6c937c8029585b57b54069ba0879a66462159d879645b5662320038b1c73a0d3a27933e0505986db2fe50225ea732a9f0014c836c7923be94e00ecd85609b9334912d2540b01abac47b691297d4cb475805201e8ca82f69fccac9c8f17ea2f26b0ab72ac0bfe9e511ec74355674f51b357d6b6ecee52b73ae94ee1d78188bc4f8e75bb4ba8f035aa26d4676749b2704c3b93dc1ddf78908672b238a4d1dc924dc958eb2b125cd43bae8c6bb083e5013ff80932f693353422afdd370d7709802bcd4800f18c9919470501e9d1bfd14ed0e628433799a40a4a08d99a7173d2aacd31136376a1376f92381e7d123c6632e7cb6de1fc5289ddcad666059a9661bea228c71ca3a736503c3aa4df4a6ee6873bceebf0e081379d133c528ebdb91d34c61dd50a6a3d9829708c892ad1ab8210481fdcf4efa5c5bb551a3863844eb76cad9554ec6522104917b8c01ec70fac5447 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000040000000100000010000000a266bb7dcc38a562631361bbf61dd11b140000000100000014000000d5f656cb8fe8a25c6268d13d94905bd7ce9a18c40300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd50b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020003200300031003000000069000000010000000e000000300c060a2b0601040182373c03020f000000010000002000000008fba831c08544208f5208686b991ca1b2cfc510e7301784ddf1eb5bf03932391900000001000000100000003c70faea25600ce3b2cc5f0b222ed6295c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob = 5900000001000000100000005200530041002f004d00440035000000140000000100000014000000344f302d25693191eaf7735cabf5868d378240ec030000000100000014000000245c97df7514e7cf2df8be72ae957b9e04741e8509000000010000000c000000300a06082b060105050703080b00000001000000320000004d006900630072006f0073006f00660074002000540069006d0065007300740061006d007000200052006f006f00740000000f00000001000000100000009df0d13100123aeca770130f4ad8d2091900000001000000100000007fdff50729446710244a447ca2a197ea2000000001000000b1020000308202ad30820216020101300d06092a864886f70d010104050030819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e301e170d3937303531333136313235395a170d3939313233303233353935395a30819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e30819f300d06092a864886f70d010101050003818d0030818902818100b75a38f51f37cca943c4dc2418bef28552b41d5b5f18b90b8f4b6da8ffcd40506cd3a0d35c47c2b9f786e4cd7d350569371faf3ddd1ffd8f1534c2c479cc59748a6f8c0ec3e811eb8438479853e1f10c0de4010cf01b1e20da2a7a3dc215528e8aff7b32bf581e25988326cb8ac9c4071424bc499ed77ab3871a2533bc6d08470203010001300d06092a864886f70d010104050003818100505bc56b6f8d525b0dc9bdac347398ca0a87caae4c4aba14a4eb52709521e0b5a1604ef743025101af1e3a70cebf18b686289967eb08e897405c1682fdb825fb366f6f763ec54c8ee2a751facac163ba5e8324470b9372f6449acea7953a8f50109e1db15916abcf3edf838bc7fac36bdc649f402b1f452404ae492ff6df0c91 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob = 5900000001000000100000005200530041002f004d004400350000001400000001000000140000003edf290cc1f5cc732ceb3d24e17e52dabd27e2f00b000000010000003400000056006500720069005300690067006e002000540069006d00650020005300740061006d00700069006e006700200043004100000009000000010000000c000000300a06082b0601050507030803000000010000001400000018f7c1fcc3090203fd5baa2f861a754976c8dd250f000000010000001000000065fc47520f66383962ec0b7b88a0821d190000000100000010000000e53d34cecb05c17ee332c749d78c02562000000001000000c0020000308202bc3082022502104a19d2388c82591ca55d735f155ddca3300d06092a864886f70d010104050030819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e301e170d3937303531323030303030305a170d3034303130373233353935395a30819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e30819f300d06092a864886f70d010101050003818d0030818902818100d32e20f0687c2c2d2e811cb106b2a70bb7110d57da53d875e3c9332ab2d4f6095b34f3e990fe090cd0db1b5ab9cde7f688b19dc08725eb7d5810736a78cb7115fdc658f629ab585e9604fd2d621158811cca7194d522582fd5cc14058436ba94aab44d4ae9ee3b22ad56997e219c6c86c04a47976ab4a636d5fc092dd3b4399b0203010001300d06092a864886f70d01010405000381810061550e3e7bc792127e11108e22ccd4b3132b5be844e40b789ea47ef3a707721ee259efcc84e389944cdb4e61efb3a4fb463d50340b9f7056f68e2a7f17cee563bf796907732eb095288af5edaaa9d25dcd0aca10098fceb3af2896c479298492dcffba674248a69010e4bf61f89c53e593d1733ff8fd9d4f84ac55d1fd116363 ZecuritAgentAssetMgr.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 22 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritAgentRegister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritLiveNotifier.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritAgentRegister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritLiveNotifier.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritAgentWinStore.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritLiveNotifier.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritLiveNotifier.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritAgentWinStore.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zoom-workspace.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage ZecuritAgentRegister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage ZecuritAgentAssetMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zoom-workspace.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language ZecuritAgentRegister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language ZecuritAgentAssetMgr.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4480 chrome.exe - Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
resource yara_rule behavioral1/files/0x002800000002b51d-95.dat innosetup behavioral1/memory/3728-118-0x0000000000400000-0x00000000004D8000-memory.dmp innosetup behavioral1/memory/3728-148-0x0000000000400000-0x00000000004D8000-memory.dmp innosetup behavioral1/memory/3728-437-0x0000000000400000-0x00000000004D8000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ ZecuritAgentAssetMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ ZecuritAgentAssetMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000655f0e1918fbd5600000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000655f0e190000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900655f0e19000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a655f0e19000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d655f0e19000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 ZecuritAgentAssetMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LocationInformation ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags ZecuritAgentAssetMgr.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Enumerates system info in registry 2 TTPs 7 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ZecuritAgentRegister.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ZecuritAgentRegister.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ZecuritAgentAssetMgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CallingShellApp_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri\1d75a17566f896a\a01460c8\@{Microsoft.Windows.SecureAssessmentBrowser_10.0.22000.1_neutral_n = "Microsoft Corporation" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CWindows.CBSPreview_cw5n1h2txyewy%5Cresources.pri\1d75a0380a5b25\a01460c8 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" ZecuritAgentAssetMgr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.BioEnrollment_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03dbb3ff1 ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03db8de77\a01460c8\@{Microsoft.Windows.PeopleExperienceHost_10.0.22000.1_neutral_neutral_ = "Microsoft Corporation" ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.ECApp_8wekyb3d8bbwe%5Cresources.pri\1d75a03e943da6\a01460c8\@{Microsoft.ECApp_10.0.22000.1_neutral__8wekyb3d8bbwe?ms-resource://Microsoft.ECApp/Resources = "Microsoft Corporation" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3 ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri\1d75a0324ef8be\a01460c8\@{Microsoft.XboxGameCallableUI_1000.22000.1.0_neutral_neutral_cw5n1h2txyewy?ms-r = "Microsoft Corporation" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03db8de77\a01460c8 ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri\1d75a03dcbf1be\a01460c8\@{Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutr = "Microsoft Corporation" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" ZecuritAgentAssetMgr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" ZecuritAgentAssetMgr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3\a01460c8\@{Microsoft.LockApp_10.0.22000.1_neutral__cw5n1h2txyewy?ms-resource://Microsoft.LockApp/re = "Microsoft Corporation" ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d75a032a505f68\a01460c8\@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resour = "Microsoft Corporation" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" ZecuritAgentAssetMgr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03db8de77 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CWindows.CBSPreview_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CWindows.CBSPreview_cw5n1h2txyewy%5Cresources.pri\1d75a0380a5b25 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CShellExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a0335b833b5 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CImmersiveControlPanel%5Cresources.pri ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CWindows.CBSPreview_cw5n1h2txyewy%5Cresources.pri\1d75a0380a5b25\a01460c8\@{Windows.CBSPreview_10.0.19580.1000_neutral_neutral_cw5n1h2txyewy?ms-resource://Windows.C = "Microsoft Corporation" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7d186bed84ec6\a01460c8 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d75a032a505f68 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3\a01460c8 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.creddialoghost_cw5n1h2txyewy%5Cresources.pri\1d75a03103a4674 ZecuritAgentWinStore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AsyncTextService_8wekyb3d8bbwe%5Cresources.pri\1d75a039a93b17\a01460c8\@{Microsoft.AsyncTextService_10.0.22000.1_neutral__8wekyb3d8bbwe?ms-resource://Mic = "Microsoft Corporation" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d75a0383a0870\a01460c8\@{Microsoft.AAD.BrokerPlugin_1000.19580.1000.0_neutral_neutral_cw5n1h2txyewy?ms-re = "Assigned by your organization" ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39\a01460c8 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.creddialoghost_cw5n1h2txyewy%5Cresources.pri\1d75a03103a4674\a01460c8 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy%5Cresources.pri\1d75a033ba4eb74 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy%5Cresources.pri\1d75a03dce542f\a01460c8 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E ZecuritAgentAssetMgr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7d186bed84ec6 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CImmersiveControlPanel%5Cresources.pri\1d75a03421c99da ZecuritAgentWinStore.exe - Modifies registry class 22 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\LastUsedSource = "n;1;C:\\Windows\\TEMP\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5CA5B1CE2340AC1469E388621EBFD063\5C79161D47FA63C43B5809A79D019E3F msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\ProductName = "Zecurit Agent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\PackageCode = "5B3998CB09D26E548B6A409DFFB21513" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\Net\1 = "C:\\Windows\\TEMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5C79161D47FA63C43B5809A79D019E3F\DefaultFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\PackageName = "ZecuritAgentInstaller.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5C79161D47FA63C43B5809A79D019E3F msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\Version = "419430414" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5CA5B1CE2340AC1469E388621EBFD063 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\Net msiexec.exe - Modifies system certificate store 2 TTPs 37 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000000400000001000000100000008eadb501aa4d81e48c1dd1e1140095190300000001000000140000003679ca35668772304d30a5fb873b0fa77bb70d547e000000010000000800000000c0032f2df8d6011d0000000100000010000000439b4d52906df7a01771d729528723b3140000000100000014000000b677fa6948479f5312d5c2ea07327607d19707197f0000000100000016000000301406082b0601050507030306082b060105050703016200000001000000200000002399561127a57125de8cefea610ddf2fa078b5c8067f4e828290bfb860e84b3c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b0601050507030853000000010000004200000030403021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000006000000056006500720069005300690067006e00200055006e006900760065007200730061006c00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f000000010000002000000017fe16f394ec70a5bb0c6784cab40b1e61025ae9d50ecaa0531d6b4d997bbc59190000000100000010000000ad6d6ff31b24013151f279e26a8c33245c0000000100000004000000000800002000000001000000bd040000308204b9308203a1a0030201020210401ac46421b31321030ebbe4121ac51d300d06092a864886f70d01010b05003081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479301e170d3038303430323030303030305a170d3337313230313233353935395a3081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c761375eb10134db62d7159bff585a8c2323d6608e91d79098837ae65819388cc5f6e56485b4a271fbedbdb9dacd4d00b4c82d73a5c76971951f393cb244079ce80efa4d4ac421df29618f32226182c5871f6e8c7c5f16205144d1704f57eae31ce3cc79ee58d80ec2b34593c02ce79a172b7b00377a413378e133e2f3101a7f872cbef6f5f742e2e5bf8762895f004bdfc5dde4754432413a1e716e69cb0b754608d1cad22b95d0cffbb9406b648c574dfc13117984ed5e54f6349f0801f3102506174adaf11d7a666b986066a4d9efd22e82f1f0ef09ea44c9156ae2036e33d3ac9f5500c7f6086a94b95fdce033f18460f95b2711b4fc16f2bb566a80258d0203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e04160414b677fa6948479f5312d5c2ea07327607d1970719300d06092a864886f70d01010b050003820101004af8f8b003e62c677be4947763cc6e4cf97d0e0ddcc8b935b9704f63fa24fa6c838c479d3b63f39af976329591b177bcac9abeb1e43121c68195565a0eb1c2d4b1a659acf163cbb84c1d59904aef9016281f5aae10fb8150380c6cccf13dc3f563e3b3e321c92439e9fd156646f41b11d04d73a37d46f93deda85f62d4f13ff8e074572b189d81b4c428da9497a570ebac1dbe0711f0d5dbdde58cf0d532b083e657e28fbfbea1aabf3d1db5d438ead7b05c3a4f6a3f8fc0666c63aae9d9a416f481d195140e7dcd9534d9d28f7073817b9c7ebd9861d845879890c5eb8630c635bff0ffc35588834bef05920671f2b89893b7eccd8261f138e64f97982a5a8d ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074002000470032000000620000000100000020000000cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f391d00000001000000100000007dc30bc974695560a2f0090a6545556c7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a419000000010000001000000014c3bd3549ee225aece13734ad8ca0b85c0000000100000004000000000800002000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6\Blob = 5900000001000000120000004400530041002f00530048004100310000000300000001000000140000002c85006a1a028bcc349df23c474724c055fde8b620000000010000001f0300003082031b308202dba003020102020900bea900b78b6470ef300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3136303530393230343035355a170d3231303530383230343035355a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012c06072a8648ce3804013082011f02818100a9a733a14a9c9d68b075811ddf231c514c0cdc328087287fd11f1d6eb125b536b88cd5579591bb6e7545b45b98eaa8cdeb0ae38be4781c7d36d97b3d2bb45b9449142130f68e112c6d09e343160cd0d0fbb8aabc8b0cea5b2066b0e3368589dadfd8ae79e9d2bdc5f5836d8fb278be02c260d3a592bda471f1a28e2f925e8b57021500a86236ce56c046d8f3fac8a6bb63e28543e45753028181009eb2085cfbe32af5a25dddeebdeede0d2f2a4475bbca802c7952e078421b4b85528fff6242aba7c75c1e40695db3be422d982972b638679c1b9314a39cad44577d2a71ee3e5738176062d9200be5efcc1b00c16b1b48e8b1771c01b9aa54ce0b5f6679caed531293d92ef822695e20264e23b188489ea3e6dc1c36a90fa0668903818400028180168cdc3d074cf4c9accef116317b85adf100f2454c9ca23203ad296928bb08879c48096c44bcb0dc3f49f69456e871dd45980eacabe735c63ade0281e7a48aca3eabde71aab64c04a6ef72c352be936692c8970a3c7615370d549b931c289810278f5284914f6965df0d93ce0a980ca5dce26e75a331c4da939af3e051d252d3a38198308195301d0603551d0e04160414a353ea5503cd0a69c45870b6ffe3912091c79f7a30530603551d23044c304a8014a353ea5503cd0a69c45870b6ffe3912091c79f7aa127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900bea900b78b6470ef30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403032f00302c021468e7a7cdfca81ff04d476fa11b781b7696d1fbf402145ef1c64374ebde4c309b59a9deeb99e556fd1477 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5900000001000000120000005200530041002f005300480041003100000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6205c0000000100000004000000000800002000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5900000001000000160000005200530041002f0053004800410033003800340000000400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000002000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5900000001000000120000005200530041002f0053004800410031000000190000000100000010000000a823b4a20180beb460cab955c24d7e210f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c0400000001000000100000003e455215095192e1b75d379fb187298a5c000000010000000400000000080000200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 59000000010000001a000000450043004400530041002f005300480041003300380034000000040000000100000010000000f55da450a5fb287e1e0f0dcc965756ca0f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f007400200047003300000062000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc61d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb130300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e190000000100000010000000b009e99a5cfc928a173190106dbb32a95c0000000100000004000000800100002000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5900000001000000120000005200530041002f0053004800410031000000040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa25c000000010000000400000000080000200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5900000001000000100000005200530041002f004d004400320000007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5900000001000000120000005200530041002f00530048004100310000000f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C\Blob = 5900000001000000120000004400530041002f0053004800410031000000030000000100000014000000b68d8f953e551914324e557e6164d68b9926650c2000000001000000200300003082031c308202dba003020102020900f5610f0c1a4d426b300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3231303331383138343233375a170d3431303331333138343233375a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012b06072a8648ce3804013082011e02818100dc1911eb3e0ac27a1b8fcf7b95e6192f5ee6a922eca3cc87df88539244fb3d07d10e2fe7570a602726d0e1ed4ad078a1317746a4dc613eb0629fe4e8272b19454aa3ad2d598dc2fa884e001a5fa009ecb4b5ff6d9996610f3b2b3911a41db558608026ca0d439574a106f09c479e58ee6c7d9e93de57cfed8832798e0d6ad5a10215008453f6990ad5473bab4ebb0f46ce52d5a354596502818070de55e09bdc70d46f414acf263fdb2ff0879f0bceed06ea6789a518fe5cfe025374aacead5cf1d27aca1b085c4b0cd4f4561c387d24c904f96af7db6f57a8a9110901b51dc2a2531532ad06ec4096f288e73d651cc1d6140b2932ee4c95ec4bb09d462800de2765606137d04e8ff9ced03b391c89ebc91d119d312f4f4ba88f0381850002818100d920e184f0439cac6f987f511ef4d45b4a6f693c806c55f143558ffab70deb4f1a92a2a6c8c8ac931094c92a0118011b13fb33701a93bb8569bec9323811d8e8b8ba7b060fe5ca557bb980461dbbf9cb863b3cf7259015c22efd0fabbdffa3b19cbc9f6dd469605ab4aa59ad5126eab69f3de5cb3470b9fc4c8a69b7e87a8832a38198308195301d0603551d0e04160414d8201fdaa7f2d1002bf5eda7be5e8e49897208f030530603551d23044c304a8014d8201fdaa7f2d1002bf5eda7be5e8e49897208f0a127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900f5610f0c1a4d426b30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403033000302d021470c61b78deaf41f3cbf42bd3c0f1fd7a5018f1bf0215008399b086c63512f057352a2bf1e6b248d8ab107d ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5900000001000000120000005200530041002f00530048004100310000000f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a ZecuritAgentAssetMgr.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\zoom-workspace.exe:Zone.Identifier chrome.exe - Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 2764 msiexec.exe 2764 msiexec.exe 4220 ZecuritAgentRegister.exe 4220 ZecuritAgentRegister.exe 3500 ZecuritAgentService.exe 3500 ZecuritAgentService.exe 6092 ZecuritCommandProcessor.exe 6092 ZecuritCommandProcessor.exe 6092 ZecuritCommandProcessor.exe 6092 ZecuritCommandProcessor.exe 3500 ZecuritAgentService.exe 3500 ZecuritAgentService.exe 3500 ZecuritAgentService.exe 3500 ZecuritAgentService.exe 3500 ZecuritAgentService.exe 3500 ZecuritAgentService.exe 3500 ZecuritAgentService.exe 3500 ZecuritAgentService.exe 6092 ZecuritCommandProcessor.exe 6092 ZecuritCommandProcessor.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4760 powershell.exe 4760 powershell.exe 4760 powershell.exe 5532 chrome.exe 5532 chrome.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 4608 ZecuritAgentService.exe 2624 powershell.exe 2624 powershell.exe 2624 powershell.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe Token: SeShutdownPrivilege 3996 chrome.exe Token: SeCreatePagefilePrivilege 3996 chrome.exe - Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 1104 zoom-workspace.tmp 1452 msiexec.exe 1452 msiexec.exe 5916 ZecuritAgentTray.exe - Suspicious use of SendNotifyMessage 17 IoCs
pid Process 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 3996 chrome.exe 5916 ZecuritAgentTray.exe - Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 3996 wrote to memory of 5220 3996 chrome.exe 81 PID 3996 wrote to memory of 4480 3996 chrome.exe 82 PID 3996 wrote to memory of 3212 3996 chrome.exe 83 PID 3996 wrote to memory of 3212 3996 chrome.exe 83 PID 3996 wrote to memory of 4120 3996 chrome.exe 84 PID 3996 wrote to memory of 4120 3996 chrome.exe 84 PID 3996 wrote to memory of 1644 3996 chrome.exe 85 PID 3996 wrote to memory of 1644 3996 chrome.exe 85 PID 3996 wrote to memory of 3476 3996 chrome.exe 86 PID 3996 wrote to memory of 3476 3996 chrome.exe 86 PID 3996 wrote to memory of 4208 3996 chrome.exe 88 PID 3996 wrote to memory of 4208 3996 chrome.exe 88 PID 3996 wrote to memory of 5500 3996 chrome.exe 91 PID 3996 wrote to memory of 4432 3996 chrome.exe 93 PID 3996 wrote to memory of 5676 3996 chrome.exe 94 PID 3996 wrote to memory of 2072 3996 chrome.exe 95 PID 3996 wrote to memory of 3524 3996 chrome.exe 96 PID 3996 wrote to memory of 3524 3996 chrome.exe 96 PID 3996 wrote to memory of 1516 3996 chrome.exe 97 PID 3996 wrote to memory of 3728 3996 chrome.exe 98 PID 3728 wrote to memory of 1104 3728 zoom-workspace.exe 99 PID 1104 wrote to memory of 780 1104 zoom-workspace.tmp 100 PID 1104 wrote to memory of 1452 1104 zoom-workspace.tmp 102 PID 2764 wrote to memory of 4588 2764 msiexec.exe 107 PID 2764 wrote to memory of 3696 2764 msiexec.exe 109 PID 2764 wrote to memory of 396 2764 msiexec.exe 110 PID 396 wrote to memory of 5976 396 InstallUninstallApp.exe 111 PID 396 wrote to memory of 4220 396 InstallUninstallApp.exe 113 PID 3500 wrote to memory of 5468 3500 ZecuritAgentService.exe 119 PID 3500 wrote to memory of 6092 3500 ZecuritAgentService.exe 121 PID 6092 wrote to memory of 1532 6092 ZecuritCommandProcessor.exe 125 PID 6092 wrote to memory of 3180 6092 ZecuritCommandProcessor.exe 127 PID 4608 wrote to memory of 5308 4608 ZecuritAgentService.exe 130 PID 4608 wrote to memory of 5916 4608 ZecuritAgentService.exe 132 PID 4608 wrote to memory of 1684 4608 ZecuritAgentService.exe 133 PID 3180 wrote to memory of 2220 3180 ZecuritAgentAssetMgr.exe 135 PID 3180 wrote to memory of 4760 3180 ZecuritAgentAssetMgr.exe 136 PID 3996 wrote to memory of 5532 3996 chrome.exe 137 PID 4608 wrote to memory of 5016 4608 ZecuritAgentService.exe 138 PID 3180 wrote to memory of 2624 3180 ZecuritAgentAssetMgr.exe 140 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://zoom-meet-invite7845957.s3.us-east-1.amazonaws.com/index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e9b2c728,0x7ff9e9b2c734,0x7ff9e9b2c7402⤵PID:5220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1920,i,2077606660133823924,10784436054781360291,524288 --field-trial-handle=1992,i,2300663790041774305,9369932948477374674,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2020 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,10461576615665161904,11578984988185134090,262144 --field-trial-handle=1992,i,2300663790041774305,9369932948477374674,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1980 /prefetch:22⤵PID:3212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,2690202627025698028,6828020486557050583,524288 --field-trial-handle=1992,i,2300663790041774305,9369932948477374674,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2412 /prefetch:132⤵PID:4120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,10628426689945560781,10161811886738101602,2097152 --field-trial-handle=1992,i,2300663790041774305,9369932948477374674,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,2610673401043066535,7351778002049962844,2097152 --field-trial-handle=1992,i,2300663790041774305,9369932948477374674,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,15267766461388787193,8866430541534093196,2097152 --field-trial-handle=1992,i,2300663790041774305,9369932948477374674,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4304 /prefetch:92⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5212,i,4982626018261152999,11663720706344460702,524288 --field-trial-handle=1992,i,2300663790041774305,9369932948477374674,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5380 /prefetch:142⤵PID:5500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,18012067091531106243,141940669453174574,524288 --field-trial-handle=1992,i,2300663790041774305,9369932948477374674,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5676 /prefetch:142⤵PID:4432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,4302025439607592003,15749889841442525090,524288 --field-trial-handle=1992,i,2300663790041774305,9369932948477374674,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5604 /prefetch:142⤵PID:5676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,15982902891903773160,12364412244778315372,524288 --field-trial-handle=1992,i,2300663790041774305,9369932948477374674,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5720 /prefetch:142⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5668,i,4333403847890326609,13975755269049335641,2097152 --field-trial-handle=1992,i,2300663790041774305,9369932948477374674,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5680 /prefetch:12⤵PID:3524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,465061449354711710,15193186817559194415,524288 --field-trial-handle=1992,i,2300663790041774305,9369932948477374674,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5800 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:1516
-
-
C:\Users\Admin\Downloads\zoom-workspace.exe"C:\Users\Admin\Downloads\zoom-workspace.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\is-8R12S.tmp\zoom-workspace.tmp"C:\Users\Admin\AppData\Local\Temp\is-8R12S.tmp\zoom-workspace.tmp" /SL5="$B029C,21491936,832512,C:\Users\Admin\Downloads\zoom-workspace.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\is-LDFJO.tmp\_isetup\_setup64.tmphelper 105 0x4384⤵
- Executes dropped EXE
PID:780
-
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Windows\TEMP\ZecuritAgentInstaller.msi" /qb4⤵
- Suspicious use of FindShellTrayWindow
PID:1452
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6504,i,4654776251905599748,5486557932977201571,262144 --field-trial-handle=1992,i,2300663790041774305,9369932948477374674,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6560 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:5532
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3372
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5108
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4588
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2A08956E6D7A5129ACA4DA6462C6E3532⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3696
-
-
C:\Program Files\Zecurit\InstallUninstallApp.exe"C:\Program Files\Zecurit\InstallUninstallApp.exe" install2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Program Files\Zecurit\7za.exe7za.exe x "C:\Program Files\Zecurit\Agent.7z" -o"C:\Program Files\Zecurit"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5976
-
-
C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe" install3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4220
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5404
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:5276
-
C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe"C:\Program Files\Zecurit\Agent\\ZecuritLiveNotifier.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:5468
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exeZecuritAgentAssetMgr.exe -cmdID 217391 -cmdType PatchScanDetails -cmdVer 1.0 -reqTime 1791948681328 -scanLevel FULL -queries AllPatch&PortInfo3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:1532
-
-
C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exeZecuritAgentAssetMgr.exe -cmdID 217390 -cmdType DeviceScanDetails -cmdVer 1.0 -reqTime 1791948681288 -scanLevel FULL -queries DeviceInformation&InstalledSoftwareList&HardwareList&Certificates&system&security&Location&Warranty&DiskInfo3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Program Files\Zecurit\Agent\ZecuritAgentWinStore.exeZecuritAgentWinStore.exe GetStoreApps4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
PID:2220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Program Files\Zecurit\Agent\GetWinGetSoftwares.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4760
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Program Files\Zecurit\Agent\Get-DeviceWarranty.ps1" DELL 1 serial4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2624
-
-
-
-
C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"1⤵
- Executes dropped EXE
PID:1524
-
C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe"C:\Program Files\Zecurit\Agent\\ZecuritLiveNotifier.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:5308
-
-
C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exeZecuritAgentTray.exe -title "Zecurit Agent" -appServer "https://app.zecurit.com:443" -agentVersion "3.25" -agentInstalledTime "2026-10-14T03:31:21.232310517Z" -showInventoryMenu "true" -agentInstalledBy "Elite Commerce Hub" -showSendLogs "true"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5916
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:1684
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:5016
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e598a09.rbs
- Size 9KB
- SHA256 09a94ea2ee6f70abcc587d56adeb6a35fec9010a77e9dc1bdace9bdc203d2ec1
- MD5 d13b4dfbc95f7497d908414440c94f2c
- SHA1 20233a31d50e1547edfa22d14040c6c838de699d
- SHA512 80084fbeed54b581d2f4cc9fa73cb2b4e153b94dbed35bbcd7dda166d96b5cab9abb495efeeb722d2ebc4dd0d718482bf323eb1a4af844035989ebebe9dfce79
- SSDEEP 192:MpKvIOvkkvFvNvFvFvynvSvHvNvNvKvEvzvIv4v8AjwNBOT9CSJY/kkIgwY/kkPr:MGIoXN1NNyvkP11cuDaq8+wNBOTf7V70
- TLSH T18D224302F94091F3E5B25F34CA0707A537ABCB8A9250728F0D8D5834BF177DA9F651AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\7za.exe
- Size 574KB
- SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
- MD5 42badc1d2f03a8b1e4875740d3d49336
- SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
- SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
- SSDEEP 12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
- TLSH T15FC47C2A3AE5C079D65215308B6E5BF5D0F693680F2308C72794DF2C1E359D6CA3AE39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent.7z
- Size 18.0MB
- SHA256 f9e19bcfbc6f60c3bdd707cca60f51a8e572ad9dc302c289e506c19371680642
- MD5 dbe98cf2a8dc0ae05c6aedfe3c825084
- SHA1 2313a569e116bac35d8358311b292d905708290f
- SHA512 0dc12761fe7b0d6857661569c6beedaa7ffdcfb22fd76cf03faa29eae88b8189d3c08b5f2e1c716c7c66b82802b63680c49fe162cfc0445f6d974c145c93d470
- SSDEEP 393216:L8zu7zA6W3OMqEDNpk4yTSXBPn01DHUbf3Bb6OyuFYVCgtw2HD/T:oy7zA6tEDNpkQRvIDHOtFYVCLC/T
- TLSH T1DF17336FEE5DCAA4C9BF6533C3847A056B97200F44C6943DE4BED1DA11B9E842D0A4EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\Storage\PowerEventHistory.json
- Size 172B
- SHA256 4b9d324e41a9b7529df7bea5bd61e2cf5dbb789ccd2927705f1446c12a509454
- MD5 055a1ea5c41438785df70b6d449d86bd
- SHA1 87fe5ebb8a2a1acf1753c3cbfc01f73e8011c03d
- SHA512 8acbd506d7bfe811d3143f1fcdb4e5430f399862c2e5586ba61e61c93ef653ef41b04951cbb46ece33355d233ee38ebbe5f21c49c5b3f3acbe87da3a81bf1611
- TLSH T116C012077A8C04064686188C8635C1A2959ACFD6784104D1F560DF05F05B570893E701
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritADEntraHandler.dll
- Size 2.6MB
- SHA256 2f97843949d19417b9a514840f365f55980141f89f517069d7d466d92332868a
- MD5 59637ee818c5ddf928ce5f06439bb841
- SHA1 78c3f2eca66726c7768480c6ef77ce227b8a5082
- SHA512 a77841030193824ff1090e64f0fa09f3cc7047e513ace042be91fa3d0b96e3763f9290c428a2c5f107c26e6375ea66f6e335fb451286497f6df6a6f8263189cf
- SSDEEP 49152:yVZipwGmjS+hYG2YptqbqPYldeGhFwSg33W7upChZINzodFw:VWDW7ffINP
- TLSH T172C57D4AA2FD4095DDAAD1B8C6175E0BD7F2B8010632D79F02505BDEDFBB361462A323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exe
- Size 3.4MB
- SHA256 c0d28cab21dfefedd7e99790d6479dd1d94688a6ab66252ace66a2b0e4153ba5
- MD5 72e19504d27e81265b642f4907840e77
- SHA1 b49a7edeef32e7bade80763559308099a2b9a9ed
- SHA512 3442e2382b2a774e62bb50de37e6cbafb3ed2569052f5ff5d4c6472d966299c47f9a02baffbf0b41e5cab1cb106570b0aaec2d444d7faf38b8dc2a3979f67f25
- SSDEEP 49152:DuFh02lIVEMBlwcYGol//Yq7FPKyGKj/mBBI4RnZk89ucEdkRrTfWFxNc5p8KjUQ:202lLMoz//YVGdklQxNex
- TLSH T1BFF58D4963B800E4D5F6D0BCCA2B490BDBF17841063597EF46A16F966F336A18E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentHandler.dll
- Size 4.6MB
- SHA256 7f5c830f2c5e36f7be951eacd2a8c4bd387fc0cc913c37da34abbae622849ce6
- MD5 e56143cd66f66f73121fe26356407952
- SHA1 575f5c6dffb2196e502ce6e9d3e170be4611c7a9
- SHA512 61f855c2179f6f6e2960c787bb0f4ad06512f332d00fccf6b93b4c0e46315316afe18cace0819cf433d5589929c2cf6336c1080b96b14579e648e2dfe23e96aa
- SSDEEP 49152:d1PHb5ncGWx88TWPkxYaHsFRoOpRdcNCeH87YZMv4+wHb1wjGgYAOi9EDnXCLPtS:LP3aNCWevNuR9AtLFpH+/CA95o7zG
- TLSH T1EB267D46A6EC40E5D9B6D13CCA9B490BD7F2B81103719BCF02A05AAE1F37BE1563E315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe
- Size 2.7MB
- SHA256 7aaf1fc8b56adf61b3ce4667b391ae2b253e1dc3e35178d33d1088bae0c5a4bb
- MD5 e05b0e028c8e7bade791ecb8d0ae1466
- SHA1 ef978e5cec2c74bd147d2262900ee17107e8caf3
- SHA512 71da4f91cf5aa9e529d811f37646cd7a1919a0881a3928ba560d13231b7c9eea055e6af349610178dec41d1cbb3364165b7439d801207a23f51b3564f85517e0
- SSDEEP 49152:gY+BpXbTrxJ5/t3KLsBaCkxVAf5MjcquwFBJqfsHQjn9:azAxncquwxCsHW9
- TLSH T179D56B89E7ED40E5E9AAD07DC907451BDBB1B8010731C7CB06A49B6B9F732D24E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe
- Size 2.9MB
- SHA256 6f7609e0d544e449d21067b028ea916a7d57e1705915596e168fb8cfdf74e4a4
- MD5 b05d1096a14ed367d88ea1587dda0b05
- SHA1 c5479ccd9aa5b8e85f0369bcf661c49f0cc94bfd
- SHA512 76fe5b8f988a5d589ed8a040d51ac2b1d2dd932572ec864be99da0d1695c6938c06b2f3f4cab1f02fcf15c2675210bdda3e8e5b5ff0aa9f5e40c633b57e24b2a
- SSDEEP 49152:ZOxly1P7k14UGE5LcBFTLMo74rVKAeFD0THCAhwJthfNijjMR+q/Y96:lYzpTH3wHhfwjU+q/Y96
- TLSH T1D6E56B4AA6BD40D5DAA6D079C94B851BE2B2B8510332C7CF02784B5B1F777E14E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe
- Size 5.4MB
- SHA256 c826c6234833eae66620af5cbe79065e78de86807a37f338efc6e1600f52d9d5
- MD5 eb1dcec11ff1c0d9933df4f60c1581ef
- SHA1 1572d7ad8beb90bdeba61c9a5e511915143c9030
- SHA512 ffa25e15c7c8cdfbc6681cec401cffba8f9ad35540c1cacbf276732ada9a64863516259ce030e8458245b09d217a9bcde52a2d4ee59912bd75eb523edda71d21
- SSDEEP 49152:s1G33RANJAyVYmcmOANJdQdGcAdxkS9IVQ1cmh6nZBUC2W24OF5IqzJTHz5AXjOh:MGOr+AdgscmUz4ImfAice+ztU
- TLSH T168468C46A7E811E4C5B6D179CA17890BEBF1B8410372D7DF01A14AA62F237E25F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe
- Size 4.8MB
- SHA256 a83f73a4782332dd0580af0bfaee1e4137efcde683196cce56e6809e531feb76
- MD5 9c5d180ed56a92ddc81df35ed39e471b
- SHA1 4e211e753471bc397c0f6609dc09c45ab3dcb338
- SHA512 a2f6f36e56f9cc033b3d672c271e267692f703ca1aec2a6ef11f065b6063478d95efb5c75bbc0a94ebd2d5519ea8bbbaaeb798645805c6280e6cc5c428c68f89
- SSDEEP 49152:Nw1Zd+lfP6Z7X0BIrWyS34HUNS/g9L0SmpIX/0eFC8w/Fe+odIXbtQ3vXjNvguVS:neymo/0Gke+hLAVmqLPoB+u
- TLSH T1B5367C55ABE800E8D9B6D079C947851BE7F2B85203718BCF01A05BAA5F376F05E3E361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritWinHandler.dll
- Size 5.2MB
- SHA256 e4da82519a0cdba6445d3fff6d6c19c61ab4c7af0f06f311f9b9d95b8f877078
- MD5 b8004dfbb630b3a3ee27b33ff3c2b1ca
- SHA1 352abaaaeac5354bcdcaef8392413e3e703845dd
- SHA512 1a755d759fa3b23ea193444a14e902082202584b850c77620757262a3f44364a43ce2cfa8aaac9ee472759ed1aeb871a54fda56a26532ee40974f25347082c57
- SSDEEP 49152:vUN2WPeZyw4/AiN7dYYJJ47iz4Oa3ui47bDOWmkX3UY/AcpEPxQd2FI1+GtAFQRZ:3T4qWmA3E59BQNcAy+4Lm
- TLSH T1EF468C0AA7AD00A4D9F6D17DCA178A1BD3B2B851037297CF19605BAE5F737E10A3E350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\InstallUninstallApp.exe
- Size 2.7MB
- SHA256 968887bd37071c091f3204192bdd96ab82c5d16eac5796a284d7bb00d5bba92a
- MD5 2e9ccbd9802a202a0ff7fb5ee00afc9d
- SHA1 db657ad395ef3dc686579fb4a526fd4eb0ac90b3
- SHA512 032564c993a12405fbeea3c8518202fb597ed4ff8c71450a480fcdc894aaa1cb98c3c99db279da92ab5736ac778950dbd326fc666ac483d2f7a807e161df2d2d
- SSDEEP 49152:6PS1IfyAkry6LJp13aw48XOXTWLwb13BX0aoeNPDc6/gLS:oVzb15xPQR+
- TLSH T19BD55B9AA6AD40E4D9A9D07D8E07850FE7B1B8110335C7CB02798B5B9F372D14E3AB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
- Size 765B
- SHA256 9338c592de13d9d8fe92458e540aff1a9a0f403e9b144f180ac9e071639fb5e4
- MD5 268b58871579abaaba13fdda8b39b414
- SHA1 ce3bb12b8d9b4850cae2980b7e3175dd72e19392
- SHA512 499f46d5ae23ff3814e9263d14b58df8f00ec4cc21c47a9515b62c9aa6573263f95c31fac68381d05841ee66759155fb0ba6d8dbac3db82af3b1fbadd29f2244
- TLSH T19E01B5520C833AD72F0D0D9A81A7E83B2960383238D8DBCBFDFE12980AC8756DB4400C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_11C80D5BA5914901432C2CA8C2925389
- Size 638B
- SHA256 722a1c4377c1ec7da007883eadf6e21cd4781b5436a0bfacff655deca3534184
- MD5 08ed08ef45c57abc29b863f122e25049
- SHA1 8ca6084770d909f137d2f1a2239a545de6d31831
- SHA512 a4cbf3da98b20703f5e5906a2bab0ad23753bf27c89e998567de5ec9418615fba3f2aa855ded754318ea04f13d258bf365944b6b71562c80912ac7eb8c9e0065
- TLSH T10FF023054C83D5409BDB25E3045EF890AF80358B39D0B789BF6926C58EA33D51B6005A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
- Size 1KB
- SHA256 412619f97c6ba75ddeb3e89d000c902ae655d2659decaadf25e6bb8150a10ec3
- MD5 09c1ae5debc9c94e031266562af0b96e
- SHA1 f500c85726cf70554da8c686ea25f1eb5978f0cf
- SHA512 4be7d6e3c8db77b6d6de53702a38e139903266371032287bf5c6a68dca5ccd24ccf1af6685198b5cecfb405aa941e394d30d7983b8e16ccf1cec8440bb7313bd
- TLSH T13731E9D7ABB43A101E090CD4D45D8F72ACF136E1B1359DB838A64096D896FE06C4980D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
- Size 484B
- SHA256 e583999ff791df70c7d4890734786d19ec2368ffc47ad07db63db2705b697ee1
- MD5 b0483691dd846e0d7b4f030f66e566db
- SHA1 d0906ed9e10c90d15d0da54cf626877e4fcce556
- SHA512 091bb4b5cb49f51dba1f80cab6ac9ca702af074655f1798883e1be14eecd8527bf85583862fcbc6ef59678a34f6100b6a563343320672f9e0e98c3e8102d0059
- TLSH T168F0A33869E74039F03BAC7CAAD1B1A54C45F1036804447D1BD056058907F891D910BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_11C80D5BA5914901432C2CA8C2925389
- Size 484B
- SHA256 4d8efc28d34515d9d44cf205e2af18030122f8f3e4637c0ed6466cb50f7fb3b9
- MD5 16b2ba5e6b085c1f2e23c772dc1eeabe
- SHA1 7f72f9027881893d4cd401915c8c48adba4fdeb5
- SHA512 25befa48a9dc685fa80d85c88c7d8603dc685ab122e2059aa82548c113bbe385b5c3212877c4665cd9d48dfb4ef32197cae3ac20d72e2319690e60709e7f8a87
- TLSH T187F0AB3C79EE512EF0B3863943E85E90061EF006140E27A80E840B122903F825F91968
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
- Size 482B
- SHA256 6116c1365f8e4cbfa75c859bb393b88ad5c8a4f633ddda59e0d206ab0a48c4fa
- MD5 356104182bc432d9d286abb369aa7565
- SHA1 b9959acc449876ab2949ccc22647ddc5d499c076
- SHA512 caba3ec3117a1477d0db22ae337ce5396eafa77c364ecf642a11c81fb172ba995302e3bb75d386e4058faa3d4b62f759b3552b474c561008e9244cfe5a0e1dda
- TLSH T161F0AB246578011DE03B6E75CBC4F227CDADF715784811671A23170A660BA83CEA197B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\116e1cc2-de30-4e98-a9a4-678f0645252f.tmp
- Size 131KB
- SHA256 9a4a01697235b3a933ed2e88f2b702de21df29fea530596ae01f571b411e2cf9
- MD5 e7718e0d6000c9d4731c0c742fff6486
- SHA1 dce4f6f06ea49e0f97a410e83374ee64d22d9aa0
- SHA512 046b4a31a2f8f1b75867cda847d4a53240401c787a63c69506d96774f9be56ce4876e16b3e94523380ce7610d263e3d754b19e934261cf011507b642a478dd03
- SSDEEP 3072:JJT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:JSThDxWhaj5mjie/JYFobx
- TLSH T1C4D31223ACEE01FB14BCC508907D3F0086F985B39640FFA39ADC6A4F60D7EA4A366155
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\248431e7-4af1-4a86-8cc5-762625ba5e42.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\324f5e7b-50be-4a49-ab42-95d697be1cfc.tmp
- Size 12KB
- SHA256 11935745e3ab84fd42fcdaa7fb0e8080d3e680a1ae1387e3f96a6edbd4efde43
- MD5 8df1f0bf0e3b349c6451378bd4b65fb9
- SHA1 4a1ed97d95c9ac732eef3bbc70f396275e2c5176
- SHA512 fbc2a8d3db41feb08c30c19258fc0e8a33ccf96656ea129804373e9034c2b906c5ebed836b5cc85bb7e2df1e3145f559bf82bf05151920c9444b08eb42d3962b
- SSDEEP 192:qRicg1lFUoRA9pT9L8nkMa9v79fGpAPRp2/Y9+Hsb+WNneNAGd2HF2ikEFVyIsnR:qRiToHNGUX1owcz2l2iRe
- TLSH T19542C52EED10797BACEBC61AF9A17767D6F5102224C42E84E6FC892C14E76DD321701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3edd4a74-ed0c-4a7a-b076-ac78e44d9db4.tmp
- Size 17KB
- SHA256 52faa1c0a2c145f24cb6bf0e4a48b0237ba969495c82d742d374c6759b4dc290
- MD5 10219fe671f251c5a102a95887dac447
- SHA1 7f90b76134fd16f85ae158bfb5c71425e83ed0ae
- SHA512 caee2e22a50a8965d0fb94b1a22f1071e58b061efd33cb3d9eeb5e5a6d58e48d84366477559486942f9c5103a8a77cad8186aef0b09c97ec8427f2be08e3f9cc
- SSDEEP 384:SEjml7KxkXqKf/pUZNCgVLH2HfgsluN7pLuLceSMtXODml+ErU3I6HGCX2v41q:SIml7KxkXqKf/pUZNCgVLH2HfgsAN7pe
- TLSH T18A720A677C4C9E7B4FA4CA8DD8277E4FACB5024B55D9886442FA5C2603D4ACF11062FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4390c587-69bd-41c4-932d-8f793be55ad1.tmp
- Size 414B
- SHA256 8a10cf617a4ff663afb840522a96a586c7cd52be63cd15cd15917d52408aec7c
- MD5 87860214635769f874c3a87d3525f008
- SHA1 0a36f05929bfc0c9411cda039806c0a02bbdd56d
- SHA512 cad7f505b8ea7d77f38121d3192ff0281ec22c3319ca1d620e0d6be791131e29bef49334f9484b90483e0a4fab43abd14c6ebf426b60ab136eb910c550bdce02
- TLSH T12AE02BA6D921ACBB0CFD072865A14B85D7A5135B3680894F3B3C410C4FB063B4585C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3b48cd02-3444-47ee-b81c-c0a7c3f52fb6.tmp
- Size 2KB
- SHA256 e9c103ddd37c83347884ea7459e184ed3424a52bf02c9f254161cf85caa47c6c
- MD5 195122f66922d6fa98d961a232546257
- SHA1 556a7cfa27da818e13606f2399f70a7c957220db
- SHA512 9480a72316dbd70135f4796f65d8b42ef697202f796ceea33660c9a49aed03dc9b7b8611201495d4878ec7fd3e7a078af8ea513a6ac4005beefbc3d392fc6dd0
- TLSH T12241AFF783F4897D861096E4AB156E1FCE790524032C3C6688D46E1B93F2872D20078E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3f9fd84c-86b1-4572-9c95-48b1b349bda8.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 b0b651be8c5ad6c58e944e056df9451b3d3b29ce12cfbbac2c62d2f8bde5ae81
- MD5 5e82212f9b75145b68bfa6749571bcfd
- SHA1 13f6928c2625934951adbccc41d159f03c54ac4a
- SHA512 5391a81d489fa42ee457fba70ec483bf7c205488e3b4cda2467386eb172488bbc0a8b6235ebf8c29dbf9dbd2e7063ec1b0341af62bffd6da13b7d067ba3c15f3
- TLSH T147B0125488415311C05A02B01561648832D4EF20A705570181F00E02DC36161801F059
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 a027fabb5af294f9a539c7de59488cf082fd04a59cf6a4f5bf65e0c22912dec6
- MD5 d8713e3ca9348bc13024a957de2771cd
- SHA1 7ce6623a08f6b7bb2c6c937d7e674dda9401947e
- SHA512 eeaacb8360f1c9910bfff3c3c6a564b0b677d6459ff3f8640a5455fee87472a602280c11748c9348af76c1db9e6cff54cefa185ee91fe97646edf46be6e39adb
- TLSH T143B0029EC6027622C04203B835959AD8B160DF2AC627265293F01BF6DC2677145662A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c6ca7c82-c523-4f3f-a8be-552cafbbffca.tmp
- Size 12KB
- SHA256 08508d63714bfa234f497c2b4bf9e4a98fabe3aaecc542198b9bc2af4a5b75ee
- MD5 8afd025e94e17500226f55ac488bf998
- SHA1 fc42e04ff76f3e5978a48b8f56f77c3d9527a94d
- SHA512 28251c0087cdec9f352a0e3aececda5549b53aa34d1dbfa174df15545198644270a4b182d489961f8d20f7556aa23cdd04a2bad04d9d742edba98e01203668bf
- SSDEEP 192:qRiYg1lFUoRA9pT9L8nkMaXv79fGpAPRp2/Y9+Hsb+WNneNAViYhF2ikEkVyIsnv:qRi/o1NGUX1owcfYD2i6E
- TLSH T11252C62AED10797BACEBD61AF9A27767D6F5102220C42E44E6FC8D2C15E76CD221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b657e323-17e8-402f-8380-48d7c86fc089.tmp
- Size 178KB
- SHA256 92297066c6b35374efcbdc28b262a23c90095cb2945ac0d1423ecfe54d25a55c
- MD5 1de7cc563d188b81c911a115635396df
- SHA1 37d0033687ec9dc7b36e66e85a7c5fa793119177
- SHA512 a34f1842f3afcee95c87b1c99fac343d4b85c22d8250b55dccbeafbb0d4e4842eb9c44fdaac11e5fc76164bcd265bbb9fe954ca65eafacd1b09f8fc18baa3f01
- SSDEEP 3072:oWIK08kBne/r0K1mttAT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:oWI21utHThDxWhaj5mjie/JYFobx
- TLSH T173041233ACBD05BB44BCCD18605A7F10C5F985339944FFA78FA42A4F60DBDA8535226A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d38e89c7-1f49-4af7-a3c8-6f768f9da40d.tmp
- Size 132KB
- SHA256 172d64b76b638ea2bce2677d6f6c9778987062e45d874f296b100533ab3f7ac5
- MD5 9cdcf7235b9481083b1c3da507835c10
- SHA1 7c9883e59d0a4a8038f69dc557f5597e19c96ad8
- SHA512 50d7c516ae92d1ed8b30f870d3d394dc520e685f8afffa12a1f37336504c88aae3c1a7c433e7222c345ba51c2d710ebe53bb74448877a175246ab72a55824986
- SSDEEP 3072:o30T8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:o3TThDxWhaj5mjie/JYFobx
- TLSH T1E2D31223ACFE05FB15BCC50880797F0086F985B39640FF639AE86A4F50C7EA4A36B155
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ehthy4r0.zrv.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-8R12S.tmp\zoom-workspace.tmp
- Size 3.1MB
- SHA256 f96c32bfb2770c6b06a45024f4f632b5408f3981527225af0c4bb34e03323051
- MD5 61e00f331fdee6f7cebae1bc7f9d66be
- SHA1 2be3c3aeee0da4ebebdcb3d5a9327694494fb23f
- SHA512 93e245ebd483ed14ffcdce1c2bed1596ae4512ad54fff02113ada493f3f081c31259ef21bcca1eada18d8180f5a059f9a917a7e1db03bc081e8221af88ffc04b
- SSDEEP 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
- TLSH T1A5E53A17F28C713ED06B3A364A3385909837FA6179168C279BFC794C8F365942A3E647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-LDFJO.tmp\_isetup\_setup64.tmp
- Size 6KB
- SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
- MD5 e4211d6d009757c078a9fac7ff4f03d4
- SHA1 019cd56ba687d39d12d4b13991c9a42ea6ba03da
- SHA512 17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e
- SSDEEP 96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
- TLSH T198C1E80ECA279263FD5A09B79E8219C46FFC262339C6623FCF0045D667C1E4E59A17B0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\03cfd8a7-353c-43d0-846c-db709fed2ffd.tmp
- Size 23KB
- SHA256 19a3c38591987ce766ae5b26fbd0adcef4c3535a1c8ec32cd4caf8ac99e0d667
- MD5 c2bf29894d2c9d1be22cdc72651b9293
- SHA1 bc46f6dcea63c53d8256ba67b6093c638fb93229
- SHA512 649829af8466c7a939a284619ebbf2ef5d41c310ad777d3313ed3ae65d6c187228b1970c8dc4902bcc463aea0c56ce5fc08284052db4cdcc5f4a3aaa5bb3177f
- SSDEEP 384:+3mCRRHr6uFpsxW4BBb7eN5LPedHNW0gr5ywSsB3c6SPU8SKmUFzR:rWLNPgbS5ylNoVB35Ss8cUT
- TLSH T125B25C07A30B91BBCA3E533244FA6161FCBB157036034D7047E9987A27998617D6BE8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\zoom-workspace.exe
- Size 21.3MB
- SHA256 7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2
- MD5 414654138697b0f8fe04e8a6c5b0c5cc
- SHA1 86edd55c3fa394fb4493c2e20a06d28681305d8c
- SHA512 b33f204c206809a6c825d06e4a3e748e7e39d5b36a106cb6b54c7686e2bfdce2ef0289abcfb5002f9dc4b2de02eedd91d4f6549461b3c49bd6c70137d9262ff2
- SSDEEP 393216:RTXZK22o6WYPmRaLeoTh/Dyi8y//+iGFV0N+bxYMWFBnjrNbuF1zTCyPjgo98:Rzk22o6maLeoTclo2iGbkFBnjp4z+yPW
- TLSH T18737333FF25CE53EC46F0A3285B292109A777A15640A8C1EA3FC744DCF769601E3B696
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\zoom-workspace.exe:Zone.Identifier
- Size 179B
- SHA256 0294b4d54d59a287c989dc989af8fd68f1c333e24012545d0222dece74ef04c1
- MD5 7ee142c6bc7cd64b72cc5355f1757ae1
- SHA1 d730798f64f65aaad703c05c19ec38b5e950b98d
- SHA512 21d44de5f0cf5f0cca521d66ff7626265ff3456ef87e5ba37e15db9e7a78d9715854350601d69e8cbf357766b882b7e05bd9b4a32b5900a4e80d106f60b5d94e
- TLSH T14AC0C0C30C808B60160337E53C84D66CF20F3134CC400288EC10C092234AC5F8054C01
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI8BCB.tmp
- Size 285KB
- SHA256 f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
- MD5 b77a2a2768b9cc78a71bbffb9812b978
- SHA1 b70e27eb446fe1c3bc8ea03dabbee2739a782e04
- SHA512 a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57
- SSDEEP 6144:cAOfnUdzb4m26KFHF/jliAYktxjw0gCvo5VGWg6AZzGbasKHr45I:cRUFb4H6KJF/pDYkw0gCvoKWg6AZznX4
- TLSH T18B547C117AD5D432E1BE0530397DABA52ABEF8316DF0C68F9384566D2D712C0A728F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\ServerData.json
- Size 245B
- SHA256 708e323a20790cdc47c395941778180f2cfd9041cfdffbd47309ebd834bc8732
- MD5 de4651abcc32820e1ba564fd5328daac
- SHA1 9ce0b9b94a46d7585bec16bf7832c8ab4cbe7cec
- SHA512 cff05457daeee4cb545cae55a64120ac8765a52adc5863c89b85e5e5ffb0b97cfdf68875eaac96716b6235883ad5c9da8acfd6301b4ccf0c171f0dc68c66482a
- TLSH T18CD0A78748E5093E61C117BCC178813D97E30F1C679E8042B686BF48F169DA1116707C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\ZecuritAgentInstaller.msi
- Size 20.2MB
- SHA256 fbd82ce0e70c123f253cfcf6b77a9fed8d9f468b31bd88af7d035d096e1927c8
- MD5 281241e9150c1c2c8d9fab9fd5abb3e5
- SHA1 e80a47c22c5567469f565f14bf6901e605e2485a
- SHA512 b567027c74d6d296f9c5f973a27ea77e4ccf674329309f0aa91732e3e776bc567a8fbd0e4398d5b318e460ad9e4b2dcc1a93a47e72c5b0918e7badeea5b9a524
- SSDEEP 393216:dHHG2fGy6Q2R1qWlSw3f6kpbKK4st1YFV8XNb977WFYj5yQnKI12pCUx6:5lfGy60WlSw37mlu1YcYFYj5Vj2MUx6
- TLSH T10D27332A7E8ECB31C6BB143286AD3F1D17BA3C254495912FD3A8F05D19B2E801B199D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 442ea7277a9da5417b99f680d33ff0356809b081c89c2cabb9f89d840f908453
- MD5 fd1a6e81cca24895ad8f47262d8b5dab
- SHA1 0d9bae1454ec03787365cb2ea8ff9e1cb4775c46
- SHA512 28a724be90924579cac66a5415f9dcb51d8ecdb9c740f97be668ebd12590ea564a41d9d3df8685f11560187efbd561a9424a4c0013fcb3784a5cd53b48be47e7
- SSDEEP 24576:02gmSp1GdoO/vvTLAGLuRkXKfaJQQIvhWGIdH50byAKo0nfu4A6cLWhcR:/
- TLSH T1C847D52436F92210E7F79F3DA8F06A2389397D579C15DE8D05421B8E0961FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{190e5f65-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bf49805d-65c2-4dd0-bda6-e882c1d4cc1d}_OnDiskSnapshotProp
- Size 6KB
- SHA256 98274e56b651d18f1a7d7b0a0e2be96bfff6a1b83744ccc955fb7d7e851039ff
- MD5 726cb66f8b4a0810d4552c0c6a5284d5
- SHA1 79b660af7e2798978a83950aee8da8c3c35efc13
- SHA512 0ac2ec453712e1b2205dd8dbd3c747c205a345d937f3b11ac7c431a599e0b53cccb9afa20f2da97162b598c4409ca448e8209ecdef8ee20070e48a54487bc565
- SSDEEP 96:F8pnkpvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:mEb++ZVmN
- TLSH T131D19B085AE54711E2B3AB322DF54557A877B911EF33CB8E0198238E2670910F975F5F
- MD5 SHA1 SHA512 SSDEEP TLSH