From aef619e07046c7a035824dc0b1098a577b185cd5 Mon Sep 17 00:00:00 2001 From: Kyle Weller Date: Mon, 20 Feb 2017 17:07:06 -0500 Subject: [PATCH 001/471] My changes --- sysmonconfig-export.xml | 37 +++++++++++++++++++++++++++++++++++-- 1 file changed, 35 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e1be4a05..e26b1514 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -22,8 +22,8 @@ "LoginGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual user sessions. --> - - md5,IMPHASH + + md5,sha256 @@ -91,6 +91,9 @@ OneDrive.exe + vivaldi.exe + chrome.exe + C:\WINDOWS\system32\backgroundTaskHost.exe setup @@ -110,8 +113,18 @@ rundll32.exe notepad.exe regsvr32.exe + bitsadmin.exe + mshta.exe + python.exe + psexecsvc.exe + java.exe + installutil.exe + msiexec.exe + certutil.exe + PsExec.exe githubusercontent.com + github.com api.ipify.org whatismyipaddress.com @@ -121,6 +134,12 @@ ifconfig.me ifconfig.co ipaddress.com + ipinfo.io + goo.gl + git.io + bit.ly + t.co + ow.ly dlinkddns.com no-ip.com @@ -164,6 +183,12 @@ microsoft windows Intel + Lenovo + Synaptic + Nvidia + Broadcom + AMD + VMware @@ -198,6 +223,7 @@ C:\Windows\System32\audiodg.exe C:\windows\system32\kernel32.dll Google\Chrome\Application\chrome.exe + FireSvc.exe @@ -215,6 +241,11 @@ + winword.exe + excel.exe + mspub.exe + msbuild.exe + powerpnt.exe @@ -248,6 +279,7 @@ C:\Windows\Tasks\ C:\Windows\System32\Tasks .cmdline + C:\Windows\System32\ @@ -400,6 +432,7 @@ Downloads Temp\7z .vbs + .vbe .hta .bat From 7cc4f0b7386267f11d90b262bf90e7b59ad27ddb Mon Sep 17 00:00:00 2001 From: Kyle Weller Date: Mon, 20 Feb 2017 17:12:19 -0500 Subject: [PATCH 002/471] Update version & Contributors --- sysmonconfig-export.xml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e26b1514..80bdbcdf 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1,8 +1,12 @@ .application .sys + .reg + .docm + .xlsm + .xlam + .pptm + .potm + .pptm + .sldm + .scf + .appref-ms C:\Users\Default C:\Windows\System32\GroupPolicy\Machine\Scripts C:\Windows\System32\GroupPolicy\User\Scripts @@ -435,10 +445,16 @@ Content.Outlook Downloads Temp\7z + .vb .vbs .vbe .hta .bat + .cmd + .ps1 + .ps2 + .lnk + .reg From 3cc42ba3da7343e9fe889670dcd52649932170a8 Mon Sep 17 00:00:00 2001 From: Kyle Weller Date: Mon, 20 Feb 2017 17:35:44 -0500 Subject: [PATCH 004/471] Add Remote registry to network detection --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 3ff6d920..58870985 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -126,6 +126,7 @@ msiexec.exe certutil.exe PsExec.exe + reg.exe githubusercontent.com github.com From a30978a6c0bc7ecd7860418323bf66626dc9614b Mon Sep 17 00:00:00 2001 From: Kyle Weller Date: Mon, 20 Feb 2017 17:45:50 -0500 Subject: [PATCH 005/471] Added RDP/MSTSC --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 58870985..06cf5ba6 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -127,6 +127,7 @@ certutil.exe PsExec.exe reg.exe + mstsc.exe githubusercontent.com github.com @@ -282,6 +283,7 @@ .sldm .scf .appref-ms + .rdp C:\Users\Default C:\Windows\System32\GroupPolicy\Machine\Scripts C:\Windows\System32\GroupPolicy\User\Scripts From da03cf3517070f3ef5b04f809ff149630475d60b Mon Sep 17 00:00:00 2001 From: Kyle Weller Date: Mon, 20 Feb 2017 20:09:48 -0500 Subject: [PATCH 006/471] Update README.md --- README.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/README.md b/README.md index de01c5bc..6cbb6c60 100644 --- a/README.md +++ b/README.md @@ -12,8 +12,6 @@ Pull requests and issue tickets are welcome, and new additions will be credited Note: Exact syntax and filtering choices are deliberate to catch appropriate entries and to have as little performance impact as possible. Sysmon's filtering abilities are different than the built-in Windows auditing features, so often a different approach is taken than the normal static listing of every possible important area. -You can contact @SwiftOnSecurity on Twitter for any urgent questions or issues. - ## Use ## ### Install ### Run with administrator rights From 639192ef49b497a1335f8af811b4cb6c68baf3c1 Mon Sep 17 00:00:00 2001 From: Kyle Weller Date: Mon, 20 Feb 2017 20:25:34 -0500 Subject: [PATCH 007/471] Add common SSH/Telnet utilities --- sysmonconfig-export.xml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 06cf5ba6..1e442e1a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -128,6 +128,13 @@ PsExec.exe reg.exe mstsc.exe + telnet.exe + ssh.exe + putty.exe + kitty.exe + kitty_portable.exe + psftp.exe + tftp.exe githubusercontent.com github.com From 5b722a2086ef30c9427584ab86c5c315963ac003 Mon Sep 17 00:00:00 2001 From: Kyle Weller Date: Mon, 20 Feb 2017 20:55:56 -0500 Subject: [PATCH 008/471] Add Windows 10 --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1e442e1a..e36a0019 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -40,6 +40,7 @@ AppContainer C:\Windows\System32\audiodg.exe + C:\Windows\System32\taskhostw.exe C:\Windows\System32\conhost.exe C:\Windows\System32\wbem\WmiApSrv.exe C:\Windows\system32\SearchIndexer.exe From 3a4a4311c193eb60a6186ea5792295317692f714 Mon Sep 17 00:00:00 2001 From: Kyle Weller Date: Mon, 20 Feb 2017 21:00:49 -0500 Subject: [PATCH 009/471] Revert taskhostw addition this may have some important things to watch --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e36a0019..1e442e1a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -40,7 +40,6 @@ AppContainer C:\Windows\System32\audiodg.exe - C:\Windows\System32\taskhostw.exe C:\Windows\System32\conhost.exe C:\Windows\System32\wbem\WmiApSrv.exe C:\Windows\system32\SearchIndexer.exe From 896781ee4c142b30e6b1dcb2fa9a90859cb4b6ce Mon Sep 17 00:00:00 2001 From: Kyle Weller Date: Mon, 20 Feb 2017 21:51:23 -0500 Subject: [PATCH 010/471] Add mimikatz detection --- sysmonconfig-export.xml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1e442e1a..457b78fa 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -259,7 +259,9 @@ mspub.exe msbuild.exe powerpnt.exe - + + powershell.exe + lsass.exe From 3a97995f0e2aadb1324e822ac3b6fbce9428ab12 Mon Sep 17 00:00:00 2001 From: Kyle Weller Date: Mon, 20 Feb 2017 22:41:43 -0500 Subject: [PATCH 011/471] Add some common Ransomware filenames --- sysmonconfig-export.xml | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 457b78fa..86f6e0e1 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -306,6 +306,44 @@ C:\Windows\System32\Tasks .cmdline C:\Windows\System32\ + + help_decrypt + help_restore + ReadDecryptFilesHere + howto_recover_file + recover_file_ + Recovery_file_ + how_to_decrypt + encryptor_raas_readme_liesmich + _how_recover_ + HOWTO_RESTORE_FILES_ + help_my_files + how_recover + HELP_TO_SAVE_FILES + DECRYPT_INSTRUCTIONS + YOUR_FILES.url + Coin.Locker.txt + _secret_code.txt + Decrypt_readme.txt + INSTUCCIONES_DESCRIFRADO + FILESAREGONE.txt + IAMREADYTOPAY.TXT + HELLOTHERE.TXT + READTHISNOW!!!.txt + SECRETIDHERE.KEY + IHAVEYOURSECRET.KEY + SECRET.KEY + HELPDECRYPT_YOUR_FILES.HTML + RECOVERY_FILES.TXT + RECOVERY_FILE. + HowtoRestore_Files + restorefiles + howrecover+ + recoveryfile + help_recover_instructions + _Locky_recover + _ReCoVeRy_ + From a206a9b56f9d8b9d3d33711295ce765437429ed1 Mon Sep 17 00:00:00 2001 From: Kyle Weller Date: Mon, 20 Feb 2017 22:43:28 -0500 Subject: [PATCH 012/471] Update sysmonconfig-export.xml --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 86f6e0e1..626a043d 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -343,7 +343,6 @@ help_recover_instructions _Locky_recover _ReCoVeRy_ - From ca1b6e0143bdddf4cec91dd6af196cb085ff28b8 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Feb 2017 13:35:45 -0500 Subject: [PATCH 013/471] Add Exclusion for Windows Taskbar Noise --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 626a043d..20ca4987 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -480,6 +480,7 @@ \UserChoice\Hash \OpenWithList\MRUList } 0xFFFF + SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe From 33337612c9c1b2ea10ac3ac1edb86038150deeff Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Feb 2017 13:43:41 -0500 Subject: [PATCH 014/471] Add wmic /node logging. --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 20ca4987..d1a702e9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -135,6 +135,7 @@ kitty_portable.exe psftp.exe tftp.exe + wmic.exe githubusercontent.com github.com From e800c2f2a14f7860be8f3d6374b8570e3615034d Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Feb 2017 15:42:03 -0500 Subject: [PATCH 015/471] Add ConnectWise & ScreenConnect exclusions to cut down on noise. --- sysmonconfig-export.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index d1a702e9..8d5a3768 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -136,6 +136,7 @@ psftp.exe tftp.exe wmic.exe + at.exe githubusercontent.com github.com @@ -174,6 +175,8 @@ Spotify.exe OneDrive.exe AppData\Roaming\Dropbox\bin\Dropbox.exe + controls\cef\ConnectWise.exe + ScreenConnect.WindowsClient.exe microsoft.com microsoft.com.akadns.net microsoft.com.nsatc.net From b5c349a4042c5ea7f8d3d178355f9eecc5b76d75 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Feb 2017 15:44:10 -0500 Subject: [PATCH 016/471] Screenconnect & Connectwise Noise exclusions. --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 8d5a3768..2d6a0486 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -175,8 +175,8 @@ Spotify.exe OneDrive.exe AppData\Roaming\Dropbox\bin\Dropbox.exe - controls\cef\ConnectWise.exe - ScreenConnect.WindowsClient.exe + controls\cef\ConnectWise.exe + ScreenConnect.WindowsClient.exe microsoft.com microsoft.com.akadns.net microsoft.com.nsatc.net From 181df78210abb7b6aeac3d486760dac82b923705 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Feb 2017 15:51:35 -0500 Subject: [PATCH 017/471] Add network logging of tor2web --- sysmonconfig-export.xml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 2d6a0486..5263313a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -170,6 +170,17 @@ zapto.org servehttp.com sytes.net + + onion.to + onion.cab + onion.sh + onion.nu + onion.direct + tor2web.org + tor2web.fi + tor2web.blutmagie.de + tor-gateways.de + hiddenservice.net Spotify.exe From 23dd12cde82ef9fda2d365d5417b82225c7b1651 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 21 Feb 2017 15:55:03 -0500 Subject: [PATCH 018/471] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 6cbb6c60..8f47ba82 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ This is a Microsoft Sysinternals Sysmon configuration file template with default The file provided should function as a great starting point for system monitoring in a self-contained package. This configuration and results should give you a good idea of what's possible for Sysmon. -      **[sysmonconfig-export.xml](https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml)** +      **[sysmonconfig-export.xml](https://github.com/ion-storm/sysmon-config/blob/master/sysmonconfig-export.xml)** Because virtually every line is commented and sections are marked with explanations, it should also function as a tutorial for Sysmon and a guide to critical monitoring areas in Windows systems. It demonstrates a lot of what I wish I knew when I began with Sysmon in 2014. From 747dec2a200e135794bb454ae959b5daca0861e7 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Feb 2017 16:03:33 -0500 Subject: [PATCH 019/471] Add Sysmon Auto Installer w/Config --- Install Sysmon.bat | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 Install Sysmon.bat diff --git a/Install Sysmon.bat b/Install Sysmon.bat new file mode 100644 index 00000000..6ec73acd --- /dev/null +++ b/Install Sysmon.bat @@ -0,0 +1,10 @@ +@echo off +cd %temp% +echo [+] Downloading Sysmon... +@powershell (new-object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon.exe','%temp%\sysmon.exe')" +echo [+] Downloading Sysmon config... +@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml','%temp%\sysmonconfig-export.xml')" +sysmon.exe -accepteula -i sysmonconfig-export.xml +echo [+] Sysmon Successfully Installed! +timeout /t 10 +exit \ No newline at end of file From 053a08ba04a2cbcbcd2ec03ae116726ab91b0f29 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Feb 2017 16:09:17 -0500 Subject: [PATCH 020/471] Cleanup a bit of excess --- sysmonconfig-export.xml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 5263313a..85a02eb7 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -171,16 +171,16 @@ servehttp.com sytes.net - onion.to - onion.cab - onion.sh - onion.nu - onion.direct - tor2web.org - tor2web.fi - tor2web.blutmagie.de - tor-gateways.de - hiddenservice.net + onion.to + onion.cab + onion.sh + onion.nu + onion.direct + tor2web.org + tor2web.fi + tor2web.blutmagie.de + tor-gateways.de + hiddenservice.net Spotify.exe From e21e9e7557ba3b6240909d22e9feed315c07322e Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 21 Feb 2017 16:11:43 -0500 Subject: [PATCH 021/471] Update README.md --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 8f47ba82..8bfc85c1 100644 --- a/README.md +++ b/README.md @@ -13,6 +13,10 @@ Pull requests and issue tickets are welcome, and new additions will be credited Note: Exact syntax and filtering choices are deliberate to catch appropriate entries and to have as little performance impact as possible. Sysmon's filtering abilities are different than the built-in Windows auditing features, so often a different approach is taken than the normal static listing of every possible important area. ## Use ## + +### Auto-Install ### +Install Sysmon.bat + ### Install ### Run with administrator rights ~~~~ From 026714faef6f26bf1c13e62f45584d08126a0e67 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Feb 2017 16:42:59 -0500 Subject: [PATCH 022/471] Add wermgr.exe Changes: - Ignore wermgr.exe launches MAJOR: 40 - Sysmon 6.0 required schema 3.3, performance Changes: - Adding networkconnect for msiexec.exe thanks @vector-sec - Schema version 3.3 brings changes to registry syntax. HKLM and HKCU replace \REGISTRY\MACHINE and \REGISTRY\USER - Network destination hostname monitoring has been removed, see issue #13 on Github - For performance, changed fully-qualified application pathes to "is" instead of "image" to prevent extra relative name checking - Extra commentary - Cleanup of default-disabled entries for better visual look FIX: ControlSet001 to CurrentControlSet Changes: - Fix ControlSet001 to CurrentControlSet after schema version updated to 3.3 - Change back to md5,imphash by default --- sysmonconfig-export.xml | 190 ++++++++++++++++++++++------------------ 1 file changed, 107 insertions(+), 83 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 85a02eb7..c571ce84 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1,14 +1,14 @@ - - md5,sha256 - + + sha256 @@ -39,51 +38,69 @@ Ultimately, you must weigh CPU time checking many detailed rules, against the risk of malware exploiting the blindness created.--> AppContainer - C:\Windows\System32\audiodg.exe - C:\Windows\System32\conhost.exe - C:\Windows\System32\wbem\WmiApSrv.exe - C:\Windows\system32\SearchIndexer.exe + C:\Windows\System32\audiodg.exe + C:\Windows\System32\conhost.exe + C:\Windows\System32\wbem\WmiApSrv.exe + C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DllHost.exe /Processid C:\Windows\system32\svchost.exe -k DcomLaunch - %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows + %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows C:\windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Windows Defender + C:\Windows\System32\CompatTelRunner.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= - "C:\Program Files (x86)\Google\Update\ + C:\Program Files (x86)\Google\Update\ "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel "C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel - - C:\Program Files\Dell\SupportAssist\pcdrcui.exe - C:\Program Files\Dell\SupportAssist\koala.exe AcroRd32.exe" /CR AcroRd32.exe" --channel= - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe - - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe + + C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe + + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe + + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe + C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe + C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe + + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe C:\Program Files\NVIDIA Corporation\Display\ C:\Program Files\Realtek\ + C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe + C:\Program Files\DellTPad\HidMonitorSvc.exe + "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe @@ -105,6 +122,8 @@ + + C:\Users C:\ProgramData @@ -112,8 +131,8 @@ powershell.exe cmd.exe wmic.exe - cscript.exe - wscript.exe + cscript.exe + wscript.exe rundll32.exe notepad.exe regsvr32.exe @@ -155,6 +174,7 @@ bit.ly t.co ow.ly + msiexec.exe dlinkddns.com no-ip.com @@ -195,6 +215,7 @@ + @@ -233,8 +254,8 @@ - - + + @@ -242,13 +263,13 @@ - C:\Windows\System32\wbem\WmiPrvSE.exe - C:\Windows\System32\svchost.exe - C:\Windows\System32\wininit.exe - C:\Windows\System32\csrss.exe - C:\Windows\System32\services.exe - C:\Windows\System32\winlogon.exe - C:\Windows\System32\audiodg.exe + C:\Windows\System32\wbem\WmiPrvSE.exe + C:\Windows\System32\svchost.exe + C:\Windows\System32\wininit.exe + C:\Windows\System32\csrss.exe + C:\Windows\System32\services.exe + C:\Windows\System32\winlogon.exe + C:\Windows\System32\audiodg.exe C:\windows\system32\kernel32.dll Google\Chrome\Application\chrome.exe FireSvc.exe @@ -284,11 +305,8 @@ \Start Menu \Startup - \Content.Outlook\ \Downloads\ - - .exe .vbs .hta @@ -359,7 +377,7 @@ _Locky_recover _ReCoVeRy_ - + \Downloads @@ -381,7 +399,11 @@ + + + + @@ -393,8 +415,8 @@ \ServiceDll \ImagePath \Start - \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ - \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ \shell\install\command\ \shell\open\command\ @@ -409,23 +431,23 @@ \Classes\AllFilesystemObjects\ \Classes\*\ - \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ + HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls\ - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram - \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock\ + HKLM\SYSTEM\ControlSet001\Services\WinSock\ - \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SecurityProviders - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SYSTEM\ControlSet001\Control\SecurityProviders\SecurityProviders + HKLM\SYSTEM\ControlSet001\Control\Lsa\ - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\Order\ + HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\Order\ - \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ \Microsoft\Office\Outlook\Addins\ @@ -438,20 +460,19 @@ \UrlUpdateInfo \InstallSource - \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ \FriendlyName - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Winlogon\ - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Safeboot\ - \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ - \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\ - \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SYSTEM\ControlSet001\Control\Winlogon\ + HKLM\SYSTEM\ControlSet001\Control\Safeboot\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - Office\root\integration\integrator.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe Toolbar\WebBrowser Toolbar\WebBrowser\ITBar7Height SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout @@ -466,27 +487,29 @@ clr_optimization_v4.0.30319_32\Start clr_optimization_v4.0.30319_64\Start \Control\WMI\Autologger\ - \services\TrustedInstaller\Start - \services\tunnel\Start - \services\BITS\Start - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\UsoSvc\Start + HKLM\SYSTEM\ControlSet001\Services\UsoSvc\Start \Lsa\OfflineJoin\CurrentValue \Components\TrustedInstaller\Events \Components\TrustedInstaller \Components\Wlansvc \Components\Wlansvc\Events - \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ \Directory\shellex \Directory\shellex\DragDropHandlers \Drive\shellex \Drive\shellex\DragDropHandlers _Classes\AppX - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Audit - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Audit\AuditPolicy - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Audit\PerUserAuditing\System - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache - \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Kerberos\Domains - \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit + HKLM\SYSTEM\ControlSet001\Control\Lsa\Audit + HKLM\SYSTEM\ControlSet001\Control\Lsa\Audit\AuditPolicy + HKLM\SYSTEM\ControlSet001\Control\Lsa\Audit\PerUserAuditing\System + HKLM\SYSTEM\ControlSet001\Control\Lsa\SspiCache + HKLM\SYSTEM\ControlSet001\Control\Lsa\Kerberos\Domains + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit + + \services\TrustedInstaller\Start + \services\tunnel\Start + \services\BITS\Start + \services\UsoSvc\Start \OpenWithProgids \OpenWithList @@ -524,14 +547,15 @@ + - + - - + + From 747a238be86807bacce4a9a2d8ba7743fa98fcd6 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Feb 2017 16:45:27 -0500 Subject: [PATCH 023/471] FIX: ControlSet001 to CurrentControlSet Changes: - Fix ControlSet001 to CurrentControlSet after schema version updated to 3.3 - Change back to md5,imphash by default --- sysmonconfig-export.xml | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index c571ce84..eee94ff6 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1,6 +1,6 @@ - + @@ -432,19 +432,19 @@ \Classes\*\ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ - HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls\ + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ - HKLM\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ - HKLM\SYSTEM\ControlSet001\Services\WinSock\ + HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SYSTEM\ControlSet001\Control\SecurityProviders\SecurityProviders - HKLM\SYSTEM\ControlSet001\Control\Lsa\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ - HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\Order\ + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ @@ -463,8 +463,8 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ \FriendlyName - HKLM\SYSTEM\ControlSet001\Control\Winlogon\ - HKLM\SYSTEM\ControlSet001\Control\Safeboot\ + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ @@ -484,10 +484,9 @@ \CurrentVersion\Shell Extensions\Cached \CurrentVersion\Shell Extensions\Approved }\PreviousPolicyAreas - clr_optimization_v4.0.30319_32\Start - clr_optimization_v4.0.30319_64\Start + \Control\WMI\Autologger\ - HKLM\SYSTEM\ControlSet001\Services\UsoSvc\Start + HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start \Lsa\OfflineJoin\CurrentValue \Components\TrustedInstaller\Events \Components\TrustedInstaller @@ -499,17 +498,21 @@ \Drive\shellex \Drive\shellex\DragDropHandlers _Classes\AppX - HKLM\SYSTEM\ControlSet001\Control\Lsa\Audit - HKLM\SYSTEM\ControlSet001\Control\Lsa\Audit\AuditPolicy - HKLM\SYSTEM\ControlSet001\Control\Lsa\Audit\PerUserAuditing\System - HKLM\SYSTEM\ControlSet001\Control\Lsa\SspiCache - HKLM\SYSTEM\ControlSet001\Control\Lsa\Kerberos\Domains + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit \services\TrustedInstaller\Start \services\tunnel\Start \services\BITS\Start \services\UsoSvc\Start + \services\clr_optimization_v2.0.50727_32\Start + \services\clr_optimization_v2.0.50727_64\Start + \services\clr_optimization_v4.0.30319_32\Start + \services\clr_optimization_v4.0.30319_64\Start \OpenWithProgids \OpenWithList From 76fcf15c8afc546f3a2afd1fa115b01dbc8ea383 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Feb 2017 16:46:38 -0500 Subject: [PATCH 024/471] Add wermgr.exe Changes: - Ignore wermgr.exe launches --- sysmonconfig-export.xml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index eee94ff6..ea0472d2 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -48,6 +48,8 @@ C:\windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Windows Defender C:\Windows\System32\CompatTelRunner.exe + C:\Windows\System32\wermgr.exe + C:\Windows\SysWOW64\wermgr.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe @@ -459,7 +461,7 @@ \UrlUpdateInfo \InstallSource - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ \FriendlyName @@ -484,7 +486,6 @@ \CurrentVersion\Shell Extensions\Cached \CurrentVersion\Shell Extensions\Approved }\PreviousPolicyAreas - \Control\WMI\Autologger\ HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start \Lsa\OfflineJoin\CurrentValue @@ -498,6 +499,7 @@ \Drive\shellex \Drive\shellex\DragDropHandlers _Classes\AppX + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System From c5e273a6f4f6509e8934c4af89a857b364a1ce69 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Feb 2017 16:50:01 -0500 Subject: [PATCH 025/471] md5,sha256 by default --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ea0472d2..806759f1 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -27,7 +27,7 @@ --> - sha256 + md5,sha256 From de414c9af8ca918407ad275c639d8fc1a6ab678f Mon Sep 17 00:00:00 2001 From: defcon Date: Tue, 21 Feb 2017 20:12:00 -0500 Subject: [PATCH 026/471] add onedrive exclusion --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 806759f1..b0ed7264 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -208,6 +208,7 @@ Spotify.exe OneDrive.exe AppData\Roaming\Dropbox\bin\Dropbox.exe + OneDriveStandaloneUpdater.exe controls\cef\ConnectWise.exe ScreenConnect.WindowsClient.exe microsoft.com From 0f3a3f53c0615314ca51c67851f25f5717dceeb6 Mon Sep 17 00:00:00 2001 From: defcon Date: Tue, 21 Feb 2017 20:18:59 -0500 Subject: [PATCH 027/471] Download sysmon to ProgramData rather than temp location. --- Install Sysmon.bat | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/Install Sysmon.bat b/Install Sysmon.bat index 6ec73acd..c1542e09 100644 --- a/Install Sysmon.bat +++ b/Install Sysmon.bat @@ -1,9 +1,10 @@ @echo off -cd %temp% +mkdir C:\ProgramData\sysmon +cd C:\ProgramData\sysmon\ echo [+] Downloading Sysmon... -@powershell (new-object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon.exe','%temp%\sysmon.exe')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon.exe','C:\ProgramData\sysmon\sysmon.exe')" echo [+] Downloading Sysmon config... -@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml','%temp%\sysmonconfig-export.xml')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" sysmon.exe -accepteula -i sysmonconfig-export.xml echo [+] Sysmon Successfully Installed! timeout /t 10 From 42c663834e5abbe1c1845e84eb84d8bbe9dadb67 Mon Sep 17 00:00:00 2001 From: defcon Date: Tue, 21 Feb 2017 20:21:37 -0500 Subject: [PATCH 028/471] Correct Google Update exception --- sysmonconfig-export.xml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b0ed7264..136a2c6e 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1,6 +1,6 @@ "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= + C:\Program Files (x86)\Google\Update\ C:\Program Files (x86)\Google\Update\ "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel @@ -478,7 +479,8 @@ C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe Toolbar\WebBrowser Toolbar\WebBrowser\ITBar7Height - SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout + Toolbar\ShellBrowser\ITBar7Layout + Internet Explorer\Toolbar\Locked ShellBrowser \CurrentVersion\Run \CurrentVersion\RunOnce From a8103fd1d51df87d4856530858d09f8feb3bc29e Mon Sep 17 00:00:00 2001 From: defcon Date: Tue, 21 Feb 2017 20:49:46 -0500 Subject: [PATCH 029/471] Add Common Signed Drivers & Office 2016 telemetry --- sysmonconfig-export.xml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 136a2c6e..746cb4fd 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -106,6 +106,7 @@ C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + root\Office16\msoia.exe @@ -242,6 +243,12 @@ Broadcom AMD VMware + Realtek + Micro-Star + Logitech + Asmedia + SteelSeries + Fortinet From 40d04fb26e36458fcb9b2b12b2de0e10ba388e80 Mon Sep 17 00:00:00 2001 From: defcon Date: Tue, 21 Feb 2017 21:44:55 -0500 Subject: [PATCH 030/471] Added Legacy Driver location Added little known and Legacy Persistence locations Added Word, Excel, Powerpoint Addins --- sysmonconfig-export.xml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 746cb4fd..cbe37938 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -461,6 +461,9 @@ HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ \Microsoft\Office\Outlook\Addins\ + \Microsoft\Office\Excel\Addins\ + \Microsoft\Office\Word\Addins\ + \Microsoft\Office\Powerpoint\Addins\ \Internet Explorer\Toolbar\ \Internet Explorer\Extensions\ @@ -479,6 +482,15 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + HKLM\Software\Microsoft\Windows\CurrentVersion\RunService + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load From bbde5dbf4da01adc26298366bb487a95d50fe000 Mon Sep 17 00:00:00 2001 From: defcon Date: Tue, 21 Feb 2017 21:56:46 -0500 Subject: [PATCH 031/471] Fix incorrect syntax --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index cbe37938..295b705b 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -63,7 +63,7 @@ "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= - C:\Program Files (x86)\Google\Update\ + C:\Program Files (x86)\Google\Update\ C:\Program Files (x86)\Google\Update\ "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel @@ -106,7 +106,7 @@ C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - root\Office16\msoia.exe + root\Office16\msoia.exe From ae00a73fa555d0feedee1f98b7ba566368b70590 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 22 Feb 2017 08:00:58 -0500 Subject: [PATCH 032/471] Update Sysmon to 64bit --- Install Sysmon.bat | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Install Sysmon.bat b/Install Sysmon.bat index c1542e09..bf253675 100644 --- a/Install Sysmon.bat +++ b/Install Sysmon.bat @@ -2,10 +2,10 @@ mkdir C:\ProgramData\sysmon cd C:\ProgramData\sysmon\ echo [+] Downloading Sysmon... -@powershell (new-object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon.exe','C:\ProgramData\sysmon\sysmon.exe')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon64.exe','C:\ProgramData\sysmon\sysmon64.exe')" echo [+] Downloading Sysmon config... @powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" -sysmon.exe -accepteula -i sysmonconfig-export.xml +sysmon64.exe -accepteula -i sysmonconfig-export.xml echo [+] Sysmon Successfully Installed! timeout /t 10 exit \ No newline at end of file From 8a58e19a70c1fc0146c39d2a8c03aef9da338446 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 22 Feb 2017 10:13:27 -0500 Subject: [PATCH 033/471] Exclude Dashlane Dashlane.exe creates network events ~5m, DashlanePlugin.exe creates a number of events on browser start. Excluding both to reduce noise. --- sysmonconfig-export.xml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 295b705b..fa1dd347 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1,6 +1,6 @@ controls\cef\ConnectWise.exe ScreenConnect.WindowsClient.exe + AppData\Roaming\Dashlane\Dashlane.exe + AppData\Roaming\Dashlane\DashlanePlugin.exe microsoft.com microsoft.com.akadns.net microsoft.com.nsatc.net From 1e0e7288b7ac8d86f70c575bffbb1ae389c5ff32 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 22 Feb 2017 10:33:22 -0500 Subject: [PATCH 034/471] Monitor Group policy logon, logoff, shutdown scripts. --- sysmonconfig-export.xml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index fa1dd347..23ba1491 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -493,6 +493,15 @@ HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load + + HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon + HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown + HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff + HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup From 6ea2b5a23e80d40cf5fe061da85f7d2076b371fa Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 22 Feb 2017 10:46:02 -0500 Subject: [PATCH 035/471] Change ConnectWise and Screenconnect image matching. --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 23ba1491..518ea6d3 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -211,8 +211,8 @@ OneDrive.exe AppData\Roaming\Dropbox\bin\Dropbox.exe OneDriveStandaloneUpdater.exe - controls\cef\ConnectWise.exe - ScreenConnect.WindowsClient.exe + ConnectWise.exe + ScreenConnect.WindowsClient.exe AppData\Roaming\Dashlane\Dashlane.exe AppData\Roaming\Dashlane\DashlanePlugin.exe microsoft.com From 36b997d45bdba30ec1d2b17effe77f6fb42d3e50 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 22 Feb 2017 11:15:38 -0500 Subject: [PATCH 036/471] Remove Trailing spaces --- sysmonconfig-export.xml | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 518ea6d3..aba1e4ee 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -238,19 +238,19 @@ about what you exclude from monitoring. Low event volume, little incentive to exclude.--> microsoft windows - Intel - Lenovo - Synaptic - Nvidia - Broadcom - AMD - VMware - Realtek - Micro-Star - Logitech - Asmedia - SteelSeries - Fortinet + Intel + Lenovo + Synaptic + Nvidia + Broadcom + AMD + VMware + Realtek + Micro-Star + Logitech + Asmedia + SteelSeries + Fortinet From 287074cbc193c0158a878b7217989d27acd761df Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 22 Feb 2017 12:07:04 -0500 Subject: [PATCH 037/471] Add Port logging. --- sysmonconfig-export.xml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index aba1e4ee..a6aa8b40 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -205,6 +205,23 @@ tor2web.blutmagie.de tor-gateways.de hiddenservice.net + + 3389 + 3540 + 22 + 25 + 137 + 138 + 139 + 445 + 5800 + 5900 + 1194 + 1701 + 1723 + 1293 + 4500 + 1080 Spotify.exe From 21cbbe1ff3e4882ffb923abeed8d648a35a0b775 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 22 Feb 2017 12:35:57 -0500 Subject: [PATCH 038/471] Add notes & Tor Ports --- sysmonconfig-export.xml | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index a6aa8b40..7620ea99 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -206,22 +206,24 @@ tor-gateways.de hiddenservice.net - 3389 - 3540 - 22 - 25 - 137 - 138 - 139 - 445 - 5800 - 5900 - 1194 - 1701 - 1723 - 1293 - 4500 - 1080 + 3389 + 3540 + 22 + 25 + 137 + 138 + 139 + 445 + 5800 + 5900 + 1194 + 1701 + 1723 + 1293 + 4500 + 1080 + 9001 + 9030 Spotify.exe From 1afd706e7172d952d96a7ba1332c26de819434a2 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 22 Feb 2017 12:40:20 -0500 Subject: [PATCH 039/471] Add Telnet and Socks Ports --- sysmonconfig-export.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 7620ea99..a03fe1cd 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -209,6 +209,7 @@ 3389 3540 22 + 23 25 137 138 @@ -222,6 +223,8 @@ 1293 4500 1080 + 8080 + 3128 9001 9030 From c41eba974de915a5a62f11ef4a4cb714377a6ebe Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 22 Feb 2017 13:40:45 -0500 Subject: [PATCH 040/471] Add Logging of USB Devices & Network History. --- sysmonconfig-export.xml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index a03fe1cd..f8aeb248 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -524,6 +524,13 @@ HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces + + HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR From 536a07a0203f61bc28cfd33a88a2d4fde6cbd662 Mon Sep 17 00:00:00 2001 From: defcon Date: Wed, 22 Feb 2017 20:15:27 -0500 Subject: [PATCH 041/471] Added Windows Defender updater exclusions & Intel Telemetry exclusions to cut down on noise --- sysmonconfig-export.xml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f8aeb248..23240f87 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -50,6 +50,10 @@ C:\Windows\System32\CompatTelRunner.exe C:\Windows\System32\wermgr.exe C:\Windows\SysWOW64\wermgr.exe + C:\Windows\System32\MpSigStub.exe + C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch + C:\Windows\System32\MusNotification.exe + C:\Windows\System32\MusNotificationUx.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe @@ -96,7 +100,7 @@ C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe - C:\Program Files\NVIDIA Corporation\Display\ + C:\Program Files\NVIDIA Corporation\ C:\Program Files\Realtek\ C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe C:\Program Files\DellTPad\HidMonitorSvc.exe @@ -106,7 +110,8 @@ C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - root\Office16\msoia.exe + + C:\Program Files\Intel\Telemetry 2.0\lrio.exe From 4729a088bb55b16d9dbd475bf3512ae0d12954d0 Mon Sep 17 00:00:00 2001 From: defcon Date: Wed, 22 Feb 2017 22:12:25 -0500 Subject: [PATCH 042/471] Add Fork Licensing :) --- sysmonconfig-export.xml | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 23240f87..4a039b29 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1,12 +1,13 @@ notepad.exe regsvr32.exe - bitsadmin.exe + C:\Windows\system32\svchost.exe mshta.exe python.exe psexecsvc.exe @@ -440,7 +440,6 @@ - From ef2b66f6bc0d76437ac82dfc23f28fa0772a0010 Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 23 Feb 2017 08:36:50 -0500 Subject: [PATCH 044/471] Add Remote Management console logging --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 38d6cd1e..bf8eda7c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -166,6 +166,7 @@ tftp.exe wmic.exe at.exe + C:\windows\system32\mmc.exe githubusercontent.com github.com @@ -217,6 +218,7 @@ 22 23 25 + 135 137 138 139 From 490506369b096c935d01f54d4256a989256b759c Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 23 Feb 2017 08:48:17 -0500 Subject: [PATCH 045/471] Remove noise from Cortana in Windows 10 in FileExts --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index bf8eda7c..18c63bcb 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -593,6 +593,7 @@ \OpenWithList\MRUList } 0xFFFF SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked + C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe From aac8b7490c09f035c4f94cbe92e8688dc4eb7759 Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 23 Feb 2017 08:52:37 -0500 Subject: [PATCH 046/471] remove dupe --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 18c63bcb..99ae56be 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -592,7 +592,6 @@ \UserChoice\Hash \OpenWithList\MRUList } 0xFFFF - SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe From 82216dc02f0f619156a1bfa4f7c06aca250d017c Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 23 Feb 2017 09:27:44 -0500 Subject: [PATCH 047/471] Image file Hijack: IFEO --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 99ae56be..9ef8a49c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -459,6 +459,7 @@ \Start HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ + CurrentVersion\Image File Execution Options\ \shell\install\command\ \shell\open\command\ From f287607c24350ca6fa68b4112c75c4042f2b8f88 Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 23 Feb 2017 09:31:29 -0500 Subject: [PATCH 048/471] Detection of changes to tcpip parameters to detect DNS changing trojans and unauthorized changes. --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 9ef8a49c..d4eab704 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -534,7 +534,7 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces + HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB From 977d44c378f8dad60d9f37a8503cc1093d78c4d7 Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 23 Feb 2017 09:56:11 -0500 Subject: [PATCH 049/471] Add more network connection detection images. --- sysmonconfig-export.xml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index d4eab704..03110df0 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -149,12 +149,15 @@ C:\Windows\system32\svchost.exe mshta.exe python.exe - psexecsvc.exe + psexe + pskill + psshutdown + psservice + PsPasswd java.exe installutil.exe msiexec.exe certutil.exe - PsExec.exe reg.exe mstsc.exe telnet.exe @@ -166,7 +169,15 @@ tftp.exe wmic.exe at.exe + net.exe C:\windows\system32\mmc.exe + nbtstat.exe + dsquery.exe + driverquery.exe + sc.exe + auditpol.exe + qwinsta.exe + rwinsta.exe githubusercontent.com github.com From 1e9f415c397d0fa61a5c052e98350e5f33b7a418 Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 23 Feb 2017 14:39:21 -0500 Subject: [PATCH 050/471] Quiet down network logging Not logging LLMR,SSDP,netbios-ns, netbios-dgm --- sysmonconfig-export.xml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 03110df0..ffbfe236 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -229,9 +229,6 @@ 22 23 25 - 135 - 137 - 138 139 445 5800 @@ -256,9 +253,19 @@ ScreenConnect.WindowsClient.exe AppData\Roaming\Dashlane\Dashlane.exe AppData\Roaming\Dashlane\DashlanePlugin.exe + Vivaldi\Application\vivaldi.exe microsoft.com microsoft.com.akadns.net microsoft.com.nsatc.net + llmnr + llmnr + ssdp + ssdp + 5353 + netbios-ns + netbios-dgm + 1e100.net + 5228 From 3a394a15c44ce1098c2f7b26e3edb7152b66adf5 Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 23 Feb 2017 14:52:35 -0500 Subject: [PATCH 051/471] Exclude Webroot from lsass logging. --- sysmonconfig-export.xml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ffbfe236..e4263fa8 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -360,7 +360,9 @@ powershell.exe lsass.exe - + + C:\Program Files (x86)\Webroot\WRSA.exe + From ab5c54837be2a25fa1ffb9971a52163e09d6fe1b Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 23 Feb 2017 15:01:26 -0500 Subject: [PATCH 052/471] Add additional Webroot AV Exclusions --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e4263fa8..0c080a50 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -113,6 +113,8 @@ C:\Program Files\Intel\Telemetry 2.0\lrio.exe + + "C:\Windows\sysnative\rundll32.exe" "C:\Windows\system32\WRusr.dll",SynProc From 1fc7e99cab84a0ab9008b6da5839f86853ecf790 Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 23 Feb 2017 15:24:09 -0500 Subject: [PATCH 053/471] Add smartgit exclusion --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 0c080a50..a4987d1c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -115,6 +115,8 @@ C:\Program Files\Intel\Telemetry 2.0\lrio.exe "C:\Windows\sysnative\rundll32.exe" "C:\Windows\system32\WRusr.dll",SynProc + + C:\Program Files (x86)\SmartGit From 8eb0fedd6873e5aa123e2a234f11efa54d1c56f3 Mon Sep 17 00:00:00 2001 From: defcon Date: Thu, 23 Feb 2017 20:45:25 -0500 Subject: [PATCH 054/471] Windows defender exclusions --- sysmonconfig-export.xml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index a4987d1c..12b33714 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -52,7 +52,9 @@ C:\Windows\System32\wermgr.exe C:\Windows\SysWOW64\wermgr.exe C:\Windows\System32\MpSigStub.exe - C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch + C:\Windows\SoftwareDistribution\Download\Install\AM_Delta + C:\Windows\SoftwareDistribution\Download\Install\AM_Engine + C:\Windows\SoftwareDistribution\Download\Install\AM_Base C:\Windows\System32\MusNotification.exe C:\Windows\System32\MusNotificationUx.exe @@ -366,6 +368,7 @@ C:\Program Files (x86)\Webroot\WRSA.exe + C:\Program Files\Windows Defender\MsMpEng.exe From 5d208d92d0b7249a29fb0ddb0f5ae6334b02dcb4 Mon Sep 17 00:00:00 2001 From: defcon Date: Thu, 23 Feb 2017 20:52:01 -0500 Subject: [PATCH 055/471] More Nvidia --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 12b33714..47b8b0a6 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -104,6 +104,7 @@ C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe C:\Program Files\NVIDIA Corporation\ + \NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe C:\Program Files\Realtek\ C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe C:\Program Files\DellTPad\HidMonitorSvc.exe From 12c097ede3e6394f24d189144dbfdd8807af575e Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 26 Feb 2017 12:58:19 -0500 Subject: [PATCH 056/471] Add info for Graylog --- README.md | 157 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 157 insertions(+) diff --git a/README.md b/README.md index 8bfc85c1..671972b3 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,9 @@ Note: Exact syntax and filtering choices are deliberate to catch appropriate ent ## Use ## ### Auto-Install ### +~~~~ Install Sysmon.bat +~~~~ ### Install ### Run with administrator rights @@ -34,3 +36,158 @@ Run with administrator rights ~~~~ sysmon.exe -u ~~~~ + +## Graylog Configuration ## + +## Sysmon Pipeline Rules ## + +## Stage -1 ## +## sysmon cleanup (gl2_source_fix) ## +~~~~ +// This rule is cleaning up the message +// -- It addresses an issue with older filebeat versions, which can have trouble with the 'source' field +// -- The rule will not cause any trouble with filebeat versions that do not have that issue +rule "sysmon cleanup (gl2_source_fix)" +when + is_not_null($message.winlogbeat_fields_gl2_source_collector) +then + set_field("gl2_source_collector", to_string($message.winlogbeat_fields_gl2_source_collector)); + remove_field("winlogbeat_fields_gl2_source_collector"); +end +~~~~ + +## sysmon cleanup ## +~~~~ +// Sysmon Installation +// -- Sysmon has to be installed on Windows, and be run with: sysmon –i –accepteula –h md5 –n -l +// -- Transport should be a winlogbeat +// -- Consider using the Graylog Sidecar to manage winlogbeat remotely +rule "sysmon cleanup" +when + // Only run for Sysmon messages + has_field("winlogbeat_source_name") AND contains(to_string($message.winlogbeat_source_name), "Microsoft-Windows-Sysmon") +then + + // Rename some fields to clean up + rename_field("winlogbeat_computer_name", "sysmon_computer_name"); + rename_field("winlogbeat_event_data_Image", "sysmon_data_process"); + rename_field("winlogbeat_event_data_UtcTime", "sysmon_data_utc_time"); + rename_field("winlogbeat_event_id", "sysmon_event_id"); + rename_field("winlogbeat_level", "sysmon_data_level"); + rename_field("winlogbeat_task", "sysmon_task"); + rename_field("winlogbeat_event_data_User", "sysmon_data_user"); + rename_field("winlogbeat_event_data_TargetFilename", "sysmon_data_file_created"); + rename_field("winlogbeat_event_data_CreationUtcTime", "sysmon_data_file_created_time"); + rename_field("winlogbeat_event_data_PreviousCreationUtcTime", "sysmon_data_file_created_time_previous"); + rename_field("winlogbeat_user_name", "sysmon_data_user_name"); + rename_field("winlogbeat_thread_id", "sysmon_thread_id"); + rename_field("winlogbeat_user_domain", "sysmon_user_domain"); + rename_field("winlogbeat_user_identifier", "sysmon_user_identifier"); + rename_field("winlogbeat_user_type", "sysmon_user_type"); + rename_field("winlogbeat_event_data_DestinationHostname", "sysmon_dns_lookup"); + rename_field("winlogbeat_event_data_DestinationIp", "sysmon_dns_lookup_ip"); + rename_field("winlogbeat_event_data_DestinationPort", "sysmon_dest_port"); + rename_field("winlogbeat_event_data_DestinationPortName", "sysmon_dest_port_name"); + rename_field("winlogbeat_event_data_Initiated", "sysmon_con_initiated"); + rename_field("winlogbeat_event_data_Protocol", "sysmon_con_proto"); + rename_field("winlogbeat_event_data_SourceHostname", "sysmon_src_name"); + rename_field("winlogbeat_event_data_SourceIp", "sysmon_src_ip"); + rename_field("winlogbeat_event_data_SourcePort", "sysmon_src_port"); + rename_field("winlogbeat_event_data_SourcePortName", "sysmon_src_port_name"); + rename_field("winlogbeat_event_data_CommandLine", "sysmon_cmd_event"); + rename_field("winlogbeat_event_data_CurrentDirectory", "sysmon_cmd_location"); + rename_field("winlogbeat_event_data_Hashes", "sysmon_cmd_hash"); + rename_field("winlogbeat_event_data_IntegrityLevel", "sysmon_cmd_integrity"); + rename_field("winlogbeat_event_data_LogonId", "sysmon_cmd_logon_id"); + rename_field("winlogbeat_event_data_ParentCommandLine", "sysmon_cmd_parent_cmd"); + rename_field("winlogbeat_event_data_ParentImage", "sysmon_cmd_parent_file"); + rename_field("winlogbeat_event_data_ParentProcessId", "sysmon_cmd_parent_pid"); + rename_field("winlogbeat_event_data_TerminalSessionId", "sysmon_cmd_terminal_pid"); + rename_field("winlogbeat_event_data_LogonGuid", "sysmon_cmd_logon_guid"); + rename_field("winlogbeat_event_data_ParentProcessGuid", "sysmon_cmd_parent_guid"); + rename_field("winlogbeat_event_data_TargetObject", "sysmon_registry_object"); + rename_field("winlogbeat_event_EventType", "sysmon_registry_Type"); + rename_field("winlogbeat_event_data_Details", "sysmon_registry_set"); + rename_field("winlogbeat_event_data_SourceImage", "sysmon_paccess_source_img"); + rename_field("winlogbeat_event_data_SourceProcessGUID", "sysmon_paccess_pguid"); + rename_field("winlogbeat_event_data_SourceProcessId", "sysmon_paccess_pid"); + rename_field("winlogbeat_event_data_SourceThreadId", "sysmon_paccess_threadid"); + rename_field("winlogbeat_event_data_TargetImage", "sysmon_paccess_target_image"); + rename_field("winlogbeat_event_data_TargetProcessGUID", "sysmon_paccess_target_guid"); + rename_field("winlogbeat_event_data_TargetProcessid", "sysmon_paccess_target_pid"); + + // Remove clutter. + let fix = regex("^\\{(\\S+)\\}$", to_string($message.winlogbeat_event_data_ProcessGuid)); + set_field("sysmon_data_process_guid", to_string(fix["0"])); + remove_field("winlogbeat_event_data_ProcessGuid"); + + let fix = regex("^\\{(\\S+)\\}$", to_string($message.winlogbeat_provider_guid)); + set_field("sysmon_data_provider_gui", to_string(fix["0"])); + remove_field("winlogbeat_provider_guid"); + + + // Remove unwanted fields + remove_field("name"); + remove_field("tags"); + remove_field("type"); + + // Remove winlogbeats fields we don't need + remove_field("winlogbeat_event_data_ProcessId"); + remove_field("winlogbeat_log_name"); + remove_field("winlogbeat_opcode"); + remove_field("winlogbeat_process_id"); + remove_field("winlogbeat_record_number"); + remove_field("winlogbeat_source_name"); + remove_field("winlogbeat_tags"); + remove_field("winlogbeat_type"); + remove_field("winlogbeat_version"); + remove_field("winlogbeat_event_data_SourceIsIpv6"); + remove_field("winlogbeat_event_data_DestinationIsIpv6"); +end +~~~~ + +## Stage 0 ## +~~~~ +// Threat Intelligence enrichment +// --- Needs installed Graylog Threat Intel plugin : https://github.com/Graylog2/graylog-plugin-threatintel +rule "sysmon threatintel" +when + // To save CPU cycles, only run if there is something to look up + has_field("sysmon_dns_lookup") OR has_field("sysmon_dns_lookup_ip") OR has_field("sysmon_src_ip") +then + + // look up the requested DNS captured by sysmon + // this will be the most fired rule + let sysmon_dns_lookup_intel = threat_intel_lookup_domain(to_string($message.query_domain), "sysmon_dns_lookup"); + set_fields(sysmon_dns_lookup_intel); + + // look up the ip from the DNS answer + // if we do not monitor the dns, then this might be nice to have + let sysmon_lookup_ip_answer_intel = threat_intel_lookup_ip(to_string($message.query_answer), "sysmon_dns_lookup_ip"); + set_fields(sysmon_lookup_ip_answer_intel); + + // look up the requesting IP + // this is useful if dealing with non internal IPs + // so you know if your IP is seen as a problem + let sysmon_src_ip_answer_intel = threat_intel_lookup_ip(to_string($message.query_answer), "sysmon_src_ip"); + set_fields(sysmon_src_ip_answer_intel); + + // WHOIS lookup. This is disabled by default. Enable and carefully watch latency and performance. + //let sysmon_dns_lookup_ip_whois = whois_lookup_ip(to_string($message.query_answer), "sysmon_dns_lookup_ip"); + //set_fields(sysmon_dns_lookup_ip_whois); +end +~~~~ + +## Stage 1 ## +~~~~ +rule "sysmon threatintel inflate" +when + // run only if one of the fields is true + to_bool($message.sysmon_dns_lookup_ip_threat_indicated) OR to_bool($message.sysmon_dns_lookup_threat_indicated) OR to_bool($message.sysmon_src_ip_threat_indicated) +then + + // This is to make Graylog searches easy + // -- Enables searches like threat_indicated:true + set_field("threat_indicated", true); +end +~~~~ From c92f1de7ee1abe3002bf2d5a00e66037c953a98d Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 26 Feb 2017 13:00:27 -0500 Subject: [PATCH 057/471] Update README.md --- README.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 671972b3..bb6fac9d 100644 --- a/README.md +++ b/README.md @@ -37,12 +37,13 @@ Run with administrator rights sysmon.exe -u ~~~~ -## Graylog Configuration ## +### Graylog Configuration ### -## Sysmon Pipeline Rules ## + +### Sysmon Pipeline Rules ### ## Stage -1 ## -## sysmon cleanup (gl2_source_fix) ## +# sysmon cleanup (gl2_source_fix) # ~~~~ // This rule is cleaning up the message // -- It addresses an issue with older filebeat versions, which can have trouble with the 'source' field @@ -56,7 +57,7 @@ then end ~~~~ -## sysmon cleanup ## +# sysmon cleanup # ~~~~ // Sysmon Installation // -- Sysmon has to be installed on Windows, and be run with: sysmon –i –accepteula –h md5 –n -l @@ -146,7 +147,7 @@ then end ~~~~ -## Stage 0 ## +# Stage 0 # ~~~~ // Threat Intelligence enrichment // --- Needs installed Graylog Threat Intel plugin : https://github.com/Graylog2/graylog-plugin-threatintel @@ -178,7 +179,7 @@ then end ~~~~ -## Stage 1 ## +# Stage 1 # ~~~~ rule "sysmon threatintel inflate" when From 5270b8043a560d194ec878e23aa9104a9575fd75 Mon Sep 17 00:00:00 2001 From: defcon Date: Sun, 26 Feb 2017 13:06:28 -0500 Subject: [PATCH 058/471] Add Graylog Content Pack --- Graylog_Content_Pack/sysmon_content_pack.json | 1 + 1 file changed, 1 insertion(+) create mode 100644 Graylog_Content_Pack/sysmon_content_pack.json diff --git a/Graylog_Content_Pack/sysmon_content_pack.json b/Graylog_Content_Pack/sysmon_content_pack.json new file mode 100644 index 00000000..ed739001 --- /dev/null +++ b/Graylog_Content_Pack/sysmon_content_pack.json @@ -0,0 +1 @@ +{"name":"sysmon dashboard","description":"Sysmon Dashboard\n\nGraylog Sysmon Dashboard\n","category":"sysmon, windows","inputs":[],"streams":[],"outputs":[],"dashboards":[{"title":"SysMon","description":"Windows Information Board","dashboard_widgets":[{"description":"Task (registered 24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_task","show_pie_chart":false,"query":"_exists_:sysmon_task","show_data_table":true},"col":1,"row":4,"height":2,"width":1},{"description":"Target Location (24h)","type":"org.graylog.plugins.map.widget.strategy.MapWidgetStrategy","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_dns_lookup_ip_geolocation","query":"_exists_:sysmon_dns_lookup_ip_geolocation"},"col":2,"row":1,"height":2,"width":2},{"description":"Integrity (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_cmd_integrity","show_pie_chart":false,"query":"_exists_:sysmon_cmd_integrity","show_data_table":true},"col":4,"row":3,"height":2,"width":1},{"description":"DNS Lookup (24h)","type":"QUICKVALUES","cache_time":100,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_dns_lookup","show_pie_chart":false,"query":"_exists_:sysmon_dns_lookup","show_data_table":true},"col":3,"row":3,"height":3,"width":1},{"description":"Event ID (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_event_id","show_pie_chart":true,"query":"_exists_:sysmon_event_id","show_data_table":false},"col":1,"row":2,"height":2,"width":1},{"description":"User Acting (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_user_type","show_pie_chart":false,"query":"_exists_: sysmon_user_type","show_data_table":true},"col":4,"row":2,"height":1,"width":1},{"description":"Programs (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_data_process","show_pie_chart":false,"query":"_exists_:sysmon_data_process","show_data_table":true},"col":2,"row":3,"height":3,"width":1},{"description":"Thread Indicated (24h)","type":"SEARCH_RESULT_COUNT","cache_time":10,"configuration":{"timerange":{"type":"relative","range":86400},"lower_is_better":true,"trend":true,"query":"_exists_:sysmon_task AND _exists_:threat_indicated AND threat_indicated:true"},"col":1,"row":1,"height":1,"width":1},{"description":"Threat Lookups (24h)","type":"SEARCH_RESULT_COUNT","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"lower_is_better":false,"trend":true,"query":"_exists_:sysmon_task AND _exists_:threat_indicated AND threat_indicated:false"},"col":4,"row":1,"height":1,"width":1}]}],"grok_patterns":[]} \ No newline at end of file From fecff433ef8b1d6f94c2dd8a1fb4d8b15b2a20d1 Mon Sep 17 00:00:00 2001 From: defcon Date: Sun, 26 Feb 2017 13:12:42 -0500 Subject: [PATCH 059/471] Keep Fields for now --- README.md | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index bb6fac9d..69f681f2 100644 --- a/README.md +++ b/README.md @@ -133,17 +133,17 @@ then remove_field("type"); // Remove winlogbeats fields we don't need - remove_field("winlogbeat_event_data_ProcessId"); - remove_field("winlogbeat_log_name"); - remove_field("winlogbeat_opcode"); - remove_field("winlogbeat_process_id"); - remove_field("winlogbeat_record_number"); - remove_field("winlogbeat_source_name"); - remove_field("winlogbeat_tags"); - remove_field("winlogbeat_type"); - remove_field("winlogbeat_version"); - remove_field("winlogbeat_event_data_SourceIsIpv6"); - remove_field("winlogbeat_event_data_DestinationIsIpv6"); + //remove_field("winlogbeat_event_data_ProcessId"); + //remove_field("winlogbeat_log_name"); + //remove_field("winlogbeat_opcode"); + //remove_field("winlogbeat_process_id"); + //remove_field("winlogbeat_record_number"); + //remove_field("winlogbeat_source_name"); + //remove_field("winlogbeat_tags"); + //remove_field("winlogbeat_type"); + //remove_field("winlogbeat_version"); + //remove_field("winlogbeat_event_data_SourceIsIpv6"); + //remove_field("winlogbeat_event_data_DestinationIsIpv6"); end ~~~~ From c356e43597dbaf9b7be3df5439ae62bd49df510c Mon Sep 17 00:00:00 2001 From: defcon Date: Sun, 26 Feb 2017 15:51:46 -0500 Subject: [PATCH 060/471] Add Windows Services to cut down on noise. --- sysmonconfig-export.xml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 47b8b0a6..9f52aee3 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -57,6 +57,19 @@ C:\Windows\SoftwareDistribution\Download\Install\AM_Base C:\Windows\System32\MusNotification.exe C:\Windows\System32\MusNotificationUx.exe + C:\Windows\System32\svchost.exe -k wsappx + C:\Windows\System32\svchost.exe -k appmodel + C:\Windows\System32\svchost.exe -k UnistackSvcGroup + C:\Windows\System32\svchost.exe -k defragsvc + C:\Windows\System32\svchost.exe -k RPCSS + C:\Windows\System32\svchost.exe -k utcsvc + C:\Windows\System32\svchost.exe -k wbioSvcGroup + C:\Windows\System32\svchost.exe -k DcomLaunch + C:\Windows\System32\svchost.exe -k swprv + C:\Windows\System32\svchost.exe -k imgsvc + C:\Windows\System32\svchost.exe -k NetworkServiceNetworkRestricted + C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted + C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe From ea638513cd4e12f8abafb8148e283b5f3479d1ad Mon Sep 17 00:00:00 2001 From: defcon Date: Sun, 26 Feb 2017 15:58:16 -0500 Subject: [PATCH 061/471] Add more .Net framework exclusions. --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 9f52aee3..2e7a11e7 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -75,6 +75,8 @@ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe From f84257392dc0241714b109a36c96890edbc63ac9 Mon Sep 17 00:00:00 2001 From: defcon Date: Sun, 26 Feb 2017 16:04:30 -0500 Subject: [PATCH 062/471] Add powercfg exclusion, allot of noise on MSI Gaming Laptops --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 2e7a11e7..09ab77c1 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -70,6 +70,7 @@ C:\Windows\System32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation + C:\Windows\System32\powercfg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe From 6e6a2ef12fdecf50ddea6680cb6c73b72c3e08c5 Mon Sep 17 00:00:00 2001 From: defcon Date: Sun, 26 Feb 2017 16:22:46 -0500 Subject: [PATCH 063/471] exclude .log and .etl files --- sysmonconfig-export.xml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 09ab77c1..3e7dcdde 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -474,7 +474,9 @@ WRITABLE.TST C:\Windows\System32\wbem\Performance\ C:\Windows\System32\DriverStore\Temp\ - C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\ + C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mou nt\ + .etl + .log C:\WINDOWS\winsxs\amd64_microsoft-windows Firefox Setup From 0c627710609dcc5ef60dd9cc201d01f7e12d4ed3 Mon Sep 17 00:00:00 2001 From: defcon Date: Sun, 26 Feb 2017 16:24:59 -0500 Subject: [PATCH 064/471] delete accidental tab ;) --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 3e7dcdde..e5764822 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -474,7 +474,7 @@ WRITABLE.TST C:\Windows\System32\wbem\Performance\ C:\Windows\System32\DriverStore\Temp\ - C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mou nt\ + C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\ .etl .log C:\WINDOWS\winsxs\amd64_microsoft-windows From 0972bdb10c085cff9da94535fdc27b07c54796f7 Mon Sep 17 00:00:00 2001 From: defcon Date: Sun, 26 Feb 2017 18:30:49 -0500 Subject: [PATCH 065/471] Exclude Network Noise from WS-Discovery --- sysmonconfig-export.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e5764822..aea6dcf8 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -289,6 +289,9 @@ netbios-dgm 1e100.net 5228 + 5357 + 3702 + 5228 From c3d22b0b0b94fd90336d35a5a16cac4e1641e021 Mon Sep 17 00:00:00 2001 From: defcon Date: Sun, 26 Feb 2017 18:32:19 -0500 Subject: [PATCH 066/471] Test: Log DNS for Graylog threat discovery --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index aea6dcf8..ab8e793c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -266,6 +266,7 @@ 3128 9001 9030 + 53 Spotify.exe From 696d22ef1f5cfc78866f53bb9d25719ee30dd711 Mon Sep 17 00:00:00 2001 From: defcon Date: Sun, 26 Feb 2017 19:11:28 -0500 Subject: [PATCH 067/471] Add additional ports to exclude --- sysmonconfig-export.xml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ab8e793c..ca21bd06 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -291,8 +291,10 @@ 1e100.net 5228 5357 + 3544 3702 - 5228 + 3702 + 50646 From 348c3cc36b656d3c9c560ecdaf6dc676efb90a8a Mon Sep 17 00:00:00 2001 From: defcon Date: Sun, 26 Feb 2017 19:30:12 -0500 Subject: [PATCH 068/471] HD Audio Noise exclusion --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ca21bd06..dfc50c3c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -648,6 +648,8 @@ C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe + HKLM\System\CurrentControlSet\Services\DeviceAssociationService\Start + HKLM\System\CurrentControlSet\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\ From 70a23dca061e42cb30e443d723fb51665c8d78ae Mon Sep 17 00:00:00 2001 From: defcon Date: Sun, 26 Feb 2017 20:23:50 -0500 Subject: [PATCH 069/471] Make network detection more specific, could not use: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\*\ Oddly... If anyone can make wildcards work, let me know. --- sysmonconfig-export.xml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index dfc50c3c..93d6a582 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -586,7 +586,14 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ + Domain + DefaultGateway + DHCPDefaultGateway + DhcpIPAddress + DhcpNameserver + Dhcpserver + DhcpSubnetMask + SubnetMask HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB From 509dd6772b1ee4cb8bd99af9c01290a72555379a Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 27 Feb 2017 09:58:10 -0500 Subject: [PATCH 070/471] Vivaldi browser installed in appdata exception --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 93d6a582..0f902693 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -136,6 +136,7 @@ "C:\Windows\sysnative\rundll32.exe" "C:\Windows\system32\WRusr.dll",SynProc C:\Program Files (x86)\SmartGit + Vivaldi\Application\vivaldi.exe From aea769107dab7ce594e9091bb34af2ae0f6b9418 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 27 Feb 2017 12:22:53 -0500 Subject: [PATCH 071/471] Add Labtech, Vivaldi Exceptions & Added Webroot AV threat detection --- sysmonconfig-export.xml | 36 +++++++++++++++++++++++++++++++++++- 1 file changed, 35 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 0f902693..c0999ed7 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -134,9 +134,39 @@ C:\Program Files\Intel\Telemetry 2.0\lrio.exe "C:\Windows\sysnative\rundll32.exe" "C:\Windows\system32\WRusr.dll",SynProc + + + + C:\Windows\LTSvc\LTSVC.exe -sLTService + C:\Windows\LTSvc\LTSVC.exe + find /i "Listening" + netstat -an + tasklist + find /i "Listening" + netstat -an + tasklist + wmic path win32_operatingsystem get + sc queryex type= service + powershell.exe "(Get-Item 'C:\Program Files\StorageCraft\ImageManager\ImageManager.exe' + powershell.exe "Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue;(Get-PSSnapin microsoft.sharepoint.powershell).Version.Major;" + find /i "Listening" + netstat -an + tasklist + wmic path win32_operatingsystem get + sc queryex type= service + powershell.exe "(Get-Item 'C:\Program Files\StorageCraft\ImageManager\ImageManager.exe' + powershell.exe "Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue;(Get-PSSnapin microsoft.sharepoint.powershell).Version.Major;" + powershell.exe "Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname" + powershell.exe "(Get-WmiObject -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType" + powershell.exe "(Get-WmiObject -Namespace Root\CimV2\TerminalServices -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType" + tasklist + "cmd.exe" /C "net view \\localhost | find " Print "" + "cmd.exe" /C "net view \\localhost | find " Disk "" + C:\Windows\system32\net1 Share C:\Program Files (x86)\SmartGit - Vivaldi\Application\vivaldi.exe + Vivaldi\Application\vivaldi.exe + controls\cef\ConnectWise.exe @@ -599,6 +629,10 @@ HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR + + + HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\WRData\Threats\Active + HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\WRData\Threats\History From d1c84510a713f794497273857761d5f7f53f0d60 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 27 Feb 2017 12:26:10 -0500 Subject: [PATCH 072/471] Network Services Exclusions --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index c0999ed7..e1c69294 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -70,6 +70,8 @@ C:\Windows\System32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation + C:\Windows\System32\svchost.exe -k netsvcs + C:\Windows\System32\svchost.exe -k netsvcs C:\Windows\System32\powercfg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe From 40a3df91a3ecf4a203a1bc33bc9c9275b064d49c Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 27 Feb 2017 15:04:08 -0500 Subject: [PATCH 073/471] Add file and process exclusions --- sysmonconfig-export.xml | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e1c69294..708d158f 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -132,10 +132,13 @@ C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + + C:\Windows\system32\LPlatSvc.exe C:\Program Files\Intel\Telemetry 2.0\lrio.exe "C:\Windows\sysnative\rundll32.exe" "C:\Windows\system32\WRusr.dll",SynProc + @@ -149,7 +152,7 @@ tasklist wmic path win32_operatingsystem get sc queryex type= service - powershell.exe "(Get-Item 'C:\Program Files\StorageCraft\ImageManager\ImageManager.exe' + powershell.exe "(Get-Item 'C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe' powershell.exe "Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue;(Get-PSSnapin microsoft.sharepoint.powershell).Version.Major;" find /i "Listening" netstat -an @@ -158,17 +161,25 @@ sc queryex type= service powershell.exe "(Get-Item 'C:\Program Files\StorageCraft\ImageManager\ImageManager.exe' powershell.exe "Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue;(Get-PSSnapin microsoft.sharepoint.powershell).Version.Major;" + powershell.exe "Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue;get-spfarm | select Products;" powershell.exe "Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname" - powershell.exe "(Get-WmiObject -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType" - powershell.exe "(Get-WmiObject -Namespace Root\CimV2\TerminalServices -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType" + powershell.exe "(Get-WmiObject -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType" + powershell.exe "(Get-WmiObject -Namespace Root\CimV2\TerminalServices -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType" tasklist "cmd.exe" /C "net view \\localhost | find " Print "" "cmd.exe" /C "net view \\localhost | find " Disk "" C:\Windows\system32\net1 Share - + "cmd.exe" /C "powershell.exe "Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname | format-table -autosize" | find /i "vss writer" | find /i "sql server"" + C:\Program Files (x86)\LabTech Client\LTClient.exe + + ScreenConnect.WindowsClient.exe C:\Program Files (x86)\SmartGit Vivaldi\Application\vivaldi.exe controls\cef\ConnectWise.exe + + C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe + C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe + C:\Program Files (x86)\SyncedTool\bin\agent_service.exe @@ -518,6 +529,17 @@ .log C:\WINDOWS\winsxs\amd64_microsoft-windows Firefox Setup + C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive + C:\Windows\System32\config\netlogon.ftl + \\?\C:\Windows\system32\wbem\WMIADAP.EXE + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe + C:\Windows\system32\CompatTelRunner.exe + C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\sqlservr.exe + C:\Windows\system32\igfxCUIService.exe + C:\Windows\System32\smss.exe + C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe + C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe From fa68a4aa31f073fa8fd0555ec942a692f87e6d7e Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 27 Feb 2017 16:04:06 -0500 Subject: [PATCH 074/471] Add Lenovo Exclusions --- sysmonconfig-export.xml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 708d158f..258e99cb 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -133,7 +133,11 @@ - C:\Windows\system32\LPlatSvc.exe + C:\Program Files (x86)\Lenovo\System Update\ConfigService.exe + C:\PROGRA~3\Lenovo\SYSTEM~1\SESSIO~1\REPOSI~1\fwdphb06\fwdphb06_version.exe + C:\Program Files (x86)\Lenovo\System Update\tvsukernel.exe + C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe + C:\Windows\system32\LPlatSvc.exe C:\Program Files\Intel\Telemetry 2.0\lrio.exe From 0570d73bc7907a1b02ef00b51f5409da5783fe77 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 27 Feb 2017 16:29:49 -0500 Subject: [PATCH 075/471] Add additional Lenovo, Microsoft and Synaptics Exclusions --- sysmonconfig-export.xml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 258e99cb..bd855433 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -57,6 +57,7 @@ C:\Windows\SoftwareDistribution\Download\Install\AM_Base C:\Windows\System32\MusNotification.exe C:\Windows\System32\MusNotificationUx.exe + C:\Windows\system32\SearchIndexer.exe /Embedding C:\Windows\System32\svchost.exe -k wsappx C:\Windows\System32\svchost.exe -k appmodel C:\Windows\System32\svchost.exe -k UnistackSvcGroup @@ -72,6 +73,7 @@ C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\System32\svchost.exe -k netsvcs C:\Windows\System32\svchost.exe -k netsvcs + C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\System32\powercfg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe @@ -127,6 +129,7 @@ C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe C:\Program Files\DellTPad\HidMonitorSvc.exe "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ + C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe @@ -138,8 +141,13 @@ C:\Program Files (x86)\Lenovo\System Update\tvsukernel.exe C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe C:\Windows\system32\LPlatSvc.exe + C:\Program Files\Lenovo\HOTKEY\tphkload.exe + C:\Program Files\Lenovo\HOTKEY\micmute.exe + C:\Program Files\Lenovo\InstantOn\InstantOnSrv.exe + C:\Program Files\Lenovo\Lenovo Mouse Suite\Service\PelService.exe - C:\Program Files\Intel\Telemetry 2.0\lrio.exe + C:\Program Files\Intel\Telemetry 2.0\lrio.exe + C:\Program Files\Intel Driver Update Utility\SUR\SurSvc.exe "C:\Windows\sysnative\rundll32.exe" "C:\Windows\system32\WRusr.dll",SynProc From 50c742e63229ec97d83d0b83eb9a2777aab27d0e Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 27 Feb 2017 17:16:40 -0500 Subject: [PATCH 076/471] adjusted personal exclusions for labtech EXCESSIVE noise, added LDAP exclusion. --- sysmonconfig-export.xml | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index bd855433..f7d0ce32 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -164,24 +164,23 @@ tasklist wmic path win32_operatingsystem get sc queryex type= service - powershell.exe "(Get-Item 'C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe' - powershell.exe "Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue;(Get-PSSnapin microsoft.sharepoint.powershell).Version.Major;" + C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe + Add-PSSnapin Microsoft.SharePoint.PowerShell find /i "Listening" netstat -an tasklist wmic path win32_operatingsystem get sc queryex type= service - powershell.exe "(Get-Item 'C:\Program Files\StorageCraft\ImageManager\ImageManager.exe' - powershell.exe "Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue;(Get-PSSnapin microsoft.sharepoint.powershell).Version.Major;" - powershell.exe "Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue;get-spfarm | select Products;" - powershell.exe "Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname" - powershell.exe "(Get-WmiObject -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType" - powershell.exe "(Get-WmiObject -Namespace Root\CimV2\TerminalServices -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType" + C:\Program Files\StorageCraft\ImageManager\ImageManager.exe + Add-PSSnapin Microsoft.SharePoint.PowerShell + Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname + Get-WmiObject -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType + Get-WmiObject -Namespace Root\CimV2\TerminalServices tasklist - "cmd.exe" /C "net view \\localhost | find " Print "" - "cmd.exe" /C "net view \\localhost | find " Disk "" - C:\Windows\system32\net1 Share - "cmd.exe" /C "powershell.exe "Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname | format-table -autosize" | find /i "vss writer" | find /i "sql server"" + net view \\localhost | find " Print + net view \\localhost | find " Disk + C:\Windows\system32\net1 Share + Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname | format-table -autosize" | find /i "vss writer" | find /i "sql server"" C:\Program Files (x86)\LabTech Client\LTClient.exe ScreenConnect.WindowsClient.exe @@ -338,6 +337,7 @@ microsoft.com.akadns.net microsoft.com.nsatc.net llmnr + ldap llmnr ssdp ssdp From 76344dd7cbd815cf7fe32bf20deb99530ec82963 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 27 Feb 2017 17:34:52 -0500 Subject: [PATCH 077/471] Add More Exclusions --- sysmonconfig-export.xml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f7d0ce32..ddef55f1 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -42,6 +42,8 @@ C:\Windows\System32\audiodg.exe C:\Windows\System32\conhost.exe C:\Windows\System32\wbem\WmiApSrv.exe + C:\Windows\servicing\TrustedInstaller.exe + C:\Windows\system32\sppsvc.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DllHost.exe /Processid C:\Windows\system32\svchost.exe -k DcomLaunch @@ -145,6 +147,7 @@ C:\Program Files\Lenovo\HOTKEY\micmute.exe C:\Program Files\Lenovo\InstantOn\InstantOnSrv.exe C:\Program Files\Lenovo\Lenovo Mouse Suite\Service\PelService.exe + C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe C:\Program Files\Intel\Telemetry 2.0\lrio.exe C:\Program Files\Intel Driver Update Utility\SUR\SurSvc.exe @@ -191,6 +194,7 @@ C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe C:\Program Files (x86)\SyncedTool\bin\agent_service.exe + C:\Program Files (x86)\Notepad++\notepad++.exe From 45f43d08ab6d8fef356776e065ae2596152de04b Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 27 Feb 2017 18:30:10 -0500 Subject: [PATCH 078/471] Detect Changes to Proxy Server settings in Windows --- sysmonconfig-export.xml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ddef55f1..ddac1d9d 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -667,12 +667,15 @@ SubnetMask HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR + HKLM\SYSTEM\CurrentControlSet\Enum\USB + HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR - HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\WRData\Threats\Active - HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\WRData\Threats\History + HKLM\SOFTWARE\WOW6432Node\WRData\Threats\Active + HKLM\SOFTWARE\WOW6432Node\WRData\Threats\History + + HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer + HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL From 2fb42f60ea99ff6f8ee76a6c47c8d41afc93de04 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 28 Feb 2017 08:55:05 -0500 Subject: [PATCH 079/471] Cleanup & Update Changes: - Monitor proxy server changes - Monitor writing Office macro documents - ngen/ngentask filtering - Now monitoring net.exe, sec.exe, qwinstal.exe, and sensitive ports. thanks to @ion-storm - Cleaned up NamedPipe area in sysmonconfig --- extra-NamedPipes.xml | 21 ++++++++++++ sysmonconfig-export.xml | 73 +++++++++++++++++++++++------------------ 2 files changed, 62 insertions(+), 32 deletions(-) create mode 100644 extra-NamedPipes.xml diff --git a/extra-NamedPipes.xml b/extra-NamedPipes.xml new file mode 100644 index 00000000..5f80e333 --- /dev/null +++ b/extra-NamedPipes.xml @@ -0,0 +1,21 @@ + + + + + + + + C:\Windows\SystemApps\Microsoft.Windows + C:\Windows\system32\SearchProtocolHost.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe + + \WRSVCPipe + \WRSynUM2 + C:\Program Files (x86)\Webroot\WRSA.exe + + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + C:\Program Files (x86)\Google\Update\GoogleUpdate.exe + + slack.exe + \ No newline at end of file diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ddac1d9d..7f8cf15a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1,10 +1,10 @@ C:\Program Files (x86)\Google\Update\ - "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel - "C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel + "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel + "C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel AcroRd32.exe" /CR AcroRd32.exe" --channel= - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe @@ -217,14 +217,14 @@ - C:\Users - C:\ProgramData - C:\Windows\Temp + C:\Users + C:\ProgramData + C:\Windows\Temp powershell.exe cmd.exe - wmic.exe - cscript.exe - wscript.exe + wmic.exe + cscript.exe + wscript.exe rundll32.exe notepad.exe regsvr32.exe @@ -278,7 +278,6 @@ bit.ly t.co ow.ly - msiexec.exe dlinkddns.com no-ip.com @@ -537,6 +536,8 @@ \Start Menu \Start Menu\Programs \Start Menu\Programs\Startup + + C:\Windows\System32\smss.exe WRITABLE.TST C:\Windows\System32\wbem\Performance\ C:\Windows\System32\DriverStore\Temp\ @@ -552,10 +553,13 @@ C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe C:\Windows\system32\CompatTelRunner.exe C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\sqlservr.exe - C:\Windows\system32\igfxCUIService.exe C:\Windows\System32\smss.exe C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe + + C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe + + C:\Windows\system32\igfxCUIService.exe @@ -565,6 +569,7 @@ + @@ -577,16 +582,17 @@ \CurrentVersion\Run \Group Policy\Scripts \Windows\System\Scripts - \ServiceDll - \ImagePath + \ServiceDll + \ImagePath \Start - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ - CurrentVersion\Image File Execution Options\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute - \shell\install\command\ - \shell\open\command\ - \shell\open\ddeexec\ + \shell\install\command\ + \shell\open\command\ + \shell\open\ddeexec\ \Explorer\FileExts\ \ContextMenuHandlers\ @@ -605,12 +611,14 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ + \ProxyServer HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ @@ -639,7 +647,6 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce HKLM\Software\Microsoft\Windows\CurrentVersion\RunService @@ -679,8 +686,11 @@ + Office\root\integration\integrator.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe + Toolbar\WebBrowser Toolbar\WebBrowser\ITBar7Height Toolbar\ShellBrowser\ITBar7Layout @@ -700,7 +710,7 @@ \Components\TrustedInstaller \Components\Wlansvc \Components\Wlansvc\Events - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ \Directory\shellex \Directory\shellex\DragDropHandlers \Drive\shellex @@ -752,24 +762,23 @@ .vbe .hta .bat - .cmd .ps1 .ps2 .lnk .reg + .cmd - + - - - - - + - + + + + From 2a3b5e7d80de83853f77e8ea13dfbaef812fc61a Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 28 Feb 2017 09:00:26 -0500 Subject: [PATCH 080/471] Remove duplicate on cherry-pick --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 7f8cf15a..fec0511f 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -681,7 +681,6 @@ HKLM\SOFTWARE\WOW6432Node\WRData\Threats\Active HKLM\SOFTWARE\WOW6432Node\WRData\Threats\History - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL From 2f1c4b492a96d92e55a2ef67d60b773a5b37cc0a Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 28 Feb 2017 11:37:40 -0500 Subject: [PATCH 081/471] Add my initial named pipe exclusions, excluding most Windows service pipes and custom apps I use in my environment. --- sysmonconfig-export.xml | 75 +++++++++++++++++++++++++++++++++++++---- 1 file changed, 69 insertions(+), 6 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index fec0511f..b80b85c9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -772,12 +772,75 @@ - - - - - + + + + + + C:\Windows\SystemApps\Microsoft.Windows + C:\Windows\system32\SearchProtocolHost.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe + vmware- + System + InitShutdown + C:\Windows\System32\wininit.exe + C:\Windows\System32\SearchIndexer.exe + C:\Windows\System32\services.exe + \ntsvcs + \scerpc + C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe + C:\Windows\System32\smss.exe + C:\Windows\System32\spoolsv.exe + \epmapper + \atsvc + \browser + \srvsvc + \Winsock2CatelogChangeListener + ProtectedPrefix\LocalService\FTHPIPE + \W32TIME_ALT + \eventlog + \wkssvc + \TDLN- + \WiFiNetworkManagerTask + + \WRSVCPipe + \WRSynUM2 + C:\Program Files (x86)\Webroot\WRSA.exe + + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + C:\Program Files (x86)\Google\Update\GoogleUpdate.exe + mojo. + crashpad_ + chrome. + GoogleCrashServices + + slack.exe + + booma\ + + qtsingleapp-enpass- + qtsingleapp-enpass- + + Everything Service + anchor_gui_agent + + C:\Program Files (x86)\Lenovo\System Update\SUService.exe + C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe + C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe + C:\Program Files\Lenovo\HOTKEY\shtctky.exe + C:\Windows\System32\LPlatSvc.exe + + C:\Windows\LTSvc\LTSVC.exe + C:\Program Files\OpenVPN\bin\openvpn-gui.exe + C:\Program Files\OpenVPN\bin\openvpn.exe + C:\Program Files\OpenVPN\bin\openvpnserv.exe + C:\Program Files\Synaptics\SynTP\SynTPEnh.exe + C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe + C:\Program Files\Lenovo\HOTKEY\tphkload.exe + C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe + Graylog-collector-sidecar.exe + C:\Program Files (x86)\SmartGit\ - From e5c8abd060049fc8bd3f21ebd6d8b3dc6a54e74d Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 28 Feb 2017 11:51:36 -0500 Subject: [PATCH 082/471] Add Rename fields for Graylog Filtering --- README.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 69f681f2..1b22274c 100644 --- a/README.md +++ b/README.md @@ -115,7 +115,10 @@ then rename_field("winlogbeat_event_data_SourceThreadId", "sysmon_paccess_threadid"); rename_field("winlogbeat_event_data_TargetImage", "sysmon_paccess_target_image"); rename_field("winlogbeat_event_data_TargetProcessGUID", "sysmon_paccess_target_guid"); - rename_field("winlogbeat_event_data_TargetProcessid", "sysmon_paccess_target_pid"); + rename_field("winlogbeat_event_data_TargetProcessid", "sysmon_paccess_target_pid"); + rename_field("winlogbeat_event_data_DestinationIp_geolocation", "sysmon_dns_lookup_ip_geolocation"); + rename_field("winlogbeat_event_data_PipeName", "sysmon_pipe_name"); + rename_field("winlogbeat_event_data_ProcessId", "sysmon_pipe_pid"); // Remove clutter. let fix = regex("^\\{(\\S+)\\}$", to_string($message.winlogbeat_event_data_ProcessGuid)); From 8d6765508653fa8103edf017e6fd52a1f8302127 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 28 Feb 2017 11:55:16 -0500 Subject: [PATCH 083/471] Add new Graylog Content pack with new dashboards --- Graylog_Content_Pack/new_content_pack.json | 1 + 1 file changed, 1 insertion(+) create mode 100644 Graylog_Content_Pack/new_content_pack.json diff --git a/Graylog_Content_Pack/new_content_pack.json b/Graylog_Content_Pack/new_content_pack.json new file mode 100644 index 00000000..ba945195 --- /dev/null +++ b/Graylog_Content_Pack/new_content_pack.json @@ -0,0 +1 @@ +{"name":"Sysmon Threat Intelligence","description":"Threat intelligence with Sysmon","category":"threat intel, dfir, sysmon","inputs":[],"streams":[],"outputs":[],"dashboards":[{"title":"Sysmon Threat Intelligence","description":"Windows Information Board","dashboard_widgets":[{"description":"Task (registered 24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_task","show_pie_chart":false,"query":"_exists_:sysmon_task","show_data_table":true},"col":4,"row":3,"height":2,"width":1},{"description":"Target Location (24h)","type":"org.graylog.plugins.map.widget.strategy.MapWidgetStrategy","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_dns_lookup_ip_geolocation","query":"_exists_:sysmon_dns_lookup_ip_geolocation"},"col":2,"row":1,"height":2,"width":2},{"description":"Integrity (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_cmd_integrity","show_pie_chart":false,"query":"_exists_:sysmon_cmd_integrity","show_data_table":true},"col":4,"row":5,"height":2,"width":1},{"description":"DNS Lookup (24h)","type":"QUICKVALUES","cache_time":100,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_dns_lookup","show_pie_chart":false,"query":"_exists_:sysmon_dns_lookup","show_data_table":true},"col":1,"row":4,"height":3,"width":1},{"description":"Event ID (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_event_id","show_pie_chart":true,"query":"_exists_:sysmon_event_id","show_data_table":false},"col":1,"row":2,"height":2,"width":1},{"description":"Programs (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_data_process","show_pie_chart":false,"query":"_exists_:sysmon_data_process","show_data_table":true},"col":2,"row":3,"height":3,"width":1},{"description":"Threat Lookups (24h)","type":"SEARCH_RESULT_COUNT","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"lower_is_better":false,"trend":true,"query":"_exists_:sysmon_task AND _exists_:sysmon_dns_lookup_ip_threat_indicated"},"col":4,"row":1,"height":1,"width":1},{"description":"User Acting (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_user_type","show_pie_chart":false,"query":"_exists_: sysmon_user_type","show_data_table":true},"col":4,"row":2,"height":1,"width":1},{"description":"Threat Indicated (24h)","type":"SEARCH_RESULT_COUNT","cache_time":10,"configuration":{"timerange":{"type":"relative","range":86400},"lower_is_better":true,"trend":true,"query":"_exists_:sysmon_task AND sysmon_src_ip_threat_indicated:true"},"col":1,"row":1,"height":1,"width":1},{"description":"Unidentified Files Created","type":"QUICKVALUES","cache_time":10,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_data_file_created","show_pie_chart":false,"query":"_exists_:sysmon_data_file_created","show_data_table":true},"col":5,"row":1,"height":3,"width":1},{"description":"Registry Change Locations","type":"QUICKVALUES","cache_time":10,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_registry_object","show_pie_chart":false,"query":"_exists_:sysmon_registry_object","show_data_table":true},"col":5,"row":4,"height":3,"width":1},{"description":"Top Command Line Events","type":"QUICKVALUES","cache_time":10,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_cmd_event","show_pie_chart":false,"query":"_exists_:sysmon_cmd_event","show_data_table":true},"col":3,"row":3,"height":3,"width":1},{"description":"Alternate Data Streams Detected","type":"QUICKVALUES","cache_time":10,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_data_file_created","show_pie_chart":false,"query":"_exists_:sysmon_data_file_created AND sysmon_task:\"File stream created (rule: FileCreateStreamHash)\"","show_data_table":true},"col":2,"row":6,"height":3,"width":1}]}],"grok_patterns":[]} \ No newline at end of file From 60656191aaa083d0697e4a2815e117aa6de931a7 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 28 Feb 2017 12:32:39 -0500 Subject: [PATCH 084/471] Add Pipe exclusions for Smartgit and Bash on Windows --- sysmonconfig-export.xml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b80b85c9..36bbfd4a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -781,9 +781,10 @@ C:\Windows\system32\SearchProtocolHost.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe + C:\Windows\System32\LxRun.exe vmware- - System - InitShutdown + \System + \InitShutdown C:\Windows\System32\wininit.exe C:\Windows\System32\SearchIndexer.exe C:\Windows\System32\services.exe @@ -810,6 +811,7 @@ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Update\GoogleUpdate.exe + AppData\Local\Google\Chrome\User Data\SwReporter\ mojo. crashpad_ chrome. @@ -840,7 +842,10 @@ C:\Program Files\Lenovo\HOTKEY\tphkload.exe C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe Graylog-collector-sidecar.exe - C:\Program Files (x86)\SmartGit\ + C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git-remote-https.exe + C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git.exe + C:\Program Files (x86)\SmartGit\bin\smartgit.exe + C:\Program Files (x86)\SmartGit\bin\smartgit.exe From b15ca41aa21054d16b42abea9478ead63dc6a9ad Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 28 Feb 2017 13:08:54 -0500 Subject: [PATCH 085/471] Add Destination Hostname exclusions originating from Windows svchost.exe services. --- sysmonconfig-export.xml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 36bbfd4a..6156ac2f 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -311,7 +311,7 @@ 23 25 139 - 445 + 5800 5900 1194 @@ -339,6 +339,9 @@ microsoft.com microsoft.com.akadns.net microsoft.com.nsatc.net + .search.msn.com + .wns.windows.com + akamaitechnologies.com llmnr ldap llmnr From e070bddb12cf5795f42665e4313ec4271f37eec1 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 28 Feb 2017 16:32:45 -0500 Subject: [PATCH 086/471] Some little stuff --- sysmonconfig-export.xml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6156ac2f..57188252 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -449,7 +449,7 @@ powerpnt.exe powershell.exe - lsass.exe + C:\Program Files (x86)\Webroot\WRSA.exe @@ -458,6 +458,7 @@ + C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates\ \Start Menu \Startup \Content.Outlook\ @@ -541,6 +542,7 @@ \Start Menu\Programs\Startup C:\Windows\System32\smss.exe + \Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates WRITABLE.TST C:\Windows\System32\wbem\Performance\ C:\Windows\System32\DriverStore\Temp\ @@ -677,7 +679,7 @@ SubnetMask HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU - HKLM\SYSTEM\CurrentControlSet\Enum\USB + HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR @@ -747,6 +749,7 @@ C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe HKLM\System\CurrentControlSet\Services\DeviceAssociationService\Start HKLM\System\CurrentControlSet\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\ + C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe From 6a74c6ecdf9373b7c0f5c4964ba740ec4e6017c7 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 28 Feb 2017 16:34:59 -0500 Subject: [PATCH 087/471] exclude! not include! lol --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 57188252..c286eb27 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -458,7 +458,6 @@ - C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates\ \Start Menu \Startup \Content.Outlook\ @@ -536,6 +535,7 @@ + C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates\ \Downloads \Start Menu \Start Menu\Programs From 86a8d465ff041061f9c9eecd5002b5b680412ae6 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 28 Feb 2017 16:37:09 -0500 Subject: [PATCH 088/471] exclude smartgit java --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index c286eb27..1526d9cf 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -357,6 +357,7 @@ 3702 3702 50646 + C:\Program Files (x86)\SmartGit\jre\bin\java.exe From f3194e899eb42068dd992d2b0040797cce53ad60 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 28 Feb 2017 16:43:45 -0500 Subject: [PATCH 089/471] MSOSync & Smartgit exclusions --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1526d9cf..d8f5fc05 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -89,6 +89,7 @@ C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE + C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= @@ -188,6 +189,7 @@ ScreenConnect.WindowsClient.exe C:\Program Files (x86)\SmartGit + C:\Program Files (x86)\SmartGit Vivaldi\Application\vivaldi.exe controls\cef\ConnectWise.exe From 57aec71260debe19312347e4889bddede35e41ea Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 28 Feb 2017 17:02:55 -0500 Subject: [PATCH 090/471] more smartgit commits --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index d8f5fc05..6e63bb4e 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -852,6 +852,7 @@ C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe Graylog-collector-sidecar.exe C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git-remote-https.exe + C:\Program Files (x86)\SmartGit\git\mingw32\bin\git.exe C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git.exe C:\Program Files (x86)\SmartGit\bin\smartgit.exe C:\Program Files (x86)\SmartGit\bin\smartgit.exe From 1a8a2b9f27eb6643f4159ece46d57816348e8ab5 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 28 Feb 2017 22:10:28 -0500 Subject: [PATCH 091/471] -Added additional Autorun Locations -Added Browser Hijack Detection. -Added Firewall Change Detection. -Added Security Center & Defender modification detection -Added New Fileless UAC Bypass detection --- sysmonconfig-export.xml | 106 ++++++++++++++++++++++++++-------------- 1 file changed, 70 insertions(+), 36 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6e63bb4e..0082f4b3 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -590,13 +590,20 @@ \CurrentVersion\Run \Group Policy\Scripts \Windows\System\Scripts + \Microsoft\System\Scripts \ServiceDll \ImagePath \Start HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet + HKLM\System\CurrentControlSet\Control\Session Manager\Execute + HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute + HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath \shell\install\command\ \shell\open\command\ @@ -654,42 +661,69 @@ HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - - HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - HKLM\Software\Microsoft\Windows\CurrentVersion\RunService - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load - - HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon - HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown - HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff - HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - Domain - DefaultGateway - DHCPDefaultGateway - DhcpIPAddress - DhcpNameserver - Dhcpserver - DhcpSubnetMask - SubnetMask - - HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU - - HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR - - - HKLM\SOFTWARE\WOW6432Node\WRData\Threats\Active - HKLM\SOFTWARE\WOW6432Node\WRData\Threats\History - - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL + + HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + HKLM\Software\Microsoft\Windows\CurrentVersion\RunService + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load + + HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon + HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown + HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff + HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + Domain + DefaultGateway + DHCPDefaultGateway + DhcpIPAddress + DhcpNameserver + Dhcpserver + DhcpSubnetMask + SubnetMask + PersistentRoutes + + HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU + HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR + + + HKLM\SOFTWARE\WOW6432Node\WRData\Threats\Active + HKLM\SOFTWARE\WOW6432Node\WRData\Threats\History + + HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL + + HKCU\Software\Microsoft\Internet Explorer\DOMStorage\ + HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ + HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage + + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + + \Security\Level + \Security\Level1Remove + + HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled + HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring + HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride + HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify + + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable + + HKCU\Software\Classes\mscfile\shell\open\command From 3905e28268081343b442ed4ce8d497919e255a56 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 28 Feb 2017 22:28:37 -0500 Subject: [PATCH 092/471] dotnet x64 exclusion --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 0082f4b3..69a730b5 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -84,6 +84,7 @@ C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe From 58c40e16334afcf1a89be78df91baea555b5031a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 28 Feb 2017 22:37:36 -0500 Subject: [PATCH 093/471] Windows Defender exclusion for registry entries created --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 69a730b5..588efe17 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -732,6 +732,7 @@ Office\root\integration\integrator.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe + C:\Program Files\Windows Defender\MsMpEng.exe Toolbar\WebBrowser Toolbar\WebBrowser\ITBar7Height From 053de7b2c41363d654824d6a6817700c2000ed70 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 1 Mar 2017 09:06:02 -0500 Subject: [PATCH 094/471] Add Exclusions for Framework, Lenovo Laptops, MSI Laptops, Webroot, Synaptic Touchpad, OpenVPN, and Enpass. --- sysmonconfig-export.xml | 32 +++++++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 588efe17..baa25383 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -47,6 +47,7 @@ C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DllHost.exe /Processid C:\Windows\system32\svchost.exe -k DcomLaunch + C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows C:\windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Windows Defender @@ -71,8 +72,10 @@ C:\Windows\System32\svchost.exe -k swprv C:\Windows\System32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k NetworkServiceNetworkRestricted + C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation + C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\svchost.exe -k netsvcs C:\Windows\System32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted @@ -129,6 +132,7 @@ C:\Program Files\NVIDIA Corporation\ \NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe + C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamuseragent.exe C:\Program Files\Realtek\ C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe C:\Program Files\DellTPad\HidMonitorSvc.exe @@ -142,19 +146,39 @@ C:\Program Files (x86)\Lenovo\System Update\ConfigService.exe C:\PROGRA~3\Lenovo\SYSTEM~1\SESSIO~1\REPOSI~1\fwdphb06\fwdphb06_version.exe - C:\Program Files (x86)\Lenovo\System Update\tvsukernel.exe C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe C:\Windows\system32\LPlatSvc.exe C:\Program Files\Lenovo\HOTKEY\tphkload.exe C:\Program Files\Lenovo\HOTKEY\micmute.exe C:\Program Files\Lenovo\InstantOn\InstantOnSrv.exe C:\Program Files\Lenovo\Lenovo Mouse Suite\Service\PelService.exe - C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe + C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe + C:\Program Files (x86)\Lenovo\System Update\tvsukernel.exe + C:\Program Files (x86)\Lenovo\System Update\UACSdk.exe + C:\Program Files (x86)\Lenovo\System Update\SUService.exe + C:\Program Files\Lenovo\Lenovo Ultraslim Plus Wireless Keyboard & Mouse\Pelico.exe + C:\Program Files\Lenovo\Lenovo Ultraslim Plus Wireless Keyboard & Mouse\LeDaemon.exe + C:\Program Files\Lenovo\Lenovo Mouse Suite\ICO.exe + + C:\Program Files (x86)\SCM\SCM.exe + C:\Program Files (x86)\SCM\SCM_Notice.exe + C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe + C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe + C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe + C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe C:\Program Files\Intel\Telemetry 2.0\lrio.exe C:\Program Files\Intel Driver Update Utility\SUR\SurSvc.exe + C:\Windows\System32\DriverStore\FileRepository\ki120591.inf_amd64_7a2f7b04e15632c2\igfxCUIService.exe + C:\Windows\System32\DriverStore\FileRepository\ki120591.inf_amd64_7a2f7b04e15632c2\igfxEM.exe "C:\Windows\sysnative\rundll32.exe" "C:\Windows\system32\WRusr.dll",SynProc + C:\Program Files (x86)\Webroot\WRSA.exe" -ul + "C:\Program Files (x86)\Webroot\WRSA.exe" -service + C:\Program Files (x86)\Webroot\WRSA.exe + + C:\Program Files\Synaptics\SynTP\SynTPEnh.exe + C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe @@ -198,6 +222,8 @@ C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe C:\Program Files (x86)\SyncedTool\bin\agent_service.exe C:\Program Files (x86)\Notepad++\notepad++.exe + C:\Program Files\OpenVPN\bin\openvpn-gui.exe + C:\Program Files (x86)\Enpass\Enpass.exe @@ -559,10 +585,10 @@ C:\Windows\System32\config\netlogon.ftl \\?\C:\Windows\system32\wbem\WMIADAP.EXE C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe - C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe C:\Windows\system32\CompatTelRunner.exe C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\sqlservr.exe C:\Windows\System32\smss.exe + C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe From 93658589127691ded08f272b02419600277ad520 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 1 Mar 2017 09:35:15 -0500 Subject: [PATCH 095/471] Detected & Identify Rogue Scheduled Tasks Created and added to Boot or Logon --- sysmonconfig-export.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index baa25383..41df3e8f 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -88,6 +88,7 @@ C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe @@ -153,6 +154,7 @@ C:\Program Files\Lenovo\InstantOn\InstantOnSrv.exe C:\Program Files\Lenovo\Lenovo Mouse Suite\Service\PelService.exe C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe + C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe C:\Program Files (x86)\Lenovo\System Update\tvsukernel.exe C:\Program Files (x86)\Lenovo\System Update\UACSdk.exe C:\Program Files (x86)\Lenovo\System Update\SUService.exe @@ -751,6 +753,9 @@ HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable HKCU\Software\Classes\mscfile\shell\open\command + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot From a9faef1633638a4741f05f8451f257ede89e76c6 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 1 Mar 2017 09:56:54 -0500 Subject: [PATCH 096/471] Add More IOC Detection --- sysmonconfig-export.xml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 41df3e8f..b094c6fb 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -641,6 +641,8 @@ \ContextMenuHandlers\ \CurrentVersion\Shell + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad \Classes\Folder\ \Classes\Directory\ \Classes\Drive\ @@ -756,6 +758,14 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad + \comfile\shell\open\command + \htafile\shell\open\command + \batfile\shell\open\command + \piffile\shell\open\command + \exefile\shell\open\command + \piffile\shell\open\command + \regfile\shell\open\command From 9a0935ab730a55b71284257e5160bb0ef4e227c6 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 1 Mar 2017 10:43:41 -0500 Subject: [PATCH 097/471] Add Detection: COMObject Hijacking --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b094c6fb..38f2b9e2 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -766,6 +766,8 @@ \exefile\shell\open\command \piffile\shell\open\command \regfile\shell\open\command + \InprocServer32 + \InprocServer32 From 50a31f942824d1b2fcd0631e276f521421253f59 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 1 Mar 2017 13:18:38 -0500 Subject: [PATCH 098/471] Removed old Graylog Content Pack --- Graylog_Content_Pack/sysmon_content_pack.json | 1 - 1 file changed, 1 deletion(-) delete mode 100644 Graylog_Content_Pack/sysmon_content_pack.json diff --git a/Graylog_Content_Pack/sysmon_content_pack.json b/Graylog_Content_Pack/sysmon_content_pack.json deleted file mode 100644 index ed739001..00000000 --- a/Graylog_Content_Pack/sysmon_content_pack.json +++ /dev/null @@ -1 +0,0 @@ -{"name":"sysmon dashboard","description":"Sysmon Dashboard\n\nGraylog Sysmon Dashboard\n","category":"sysmon, windows","inputs":[],"streams":[],"outputs":[],"dashboards":[{"title":"SysMon","description":"Windows Information Board","dashboard_widgets":[{"description":"Task (registered 24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_task","show_pie_chart":false,"query":"_exists_:sysmon_task","show_data_table":true},"col":1,"row":4,"height":2,"width":1},{"description":"Target Location (24h)","type":"org.graylog.plugins.map.widget.strategy.MapWidgetStrategy","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_dns_lookup_ip_geolocation","query":"_exists_:sysmon_dns_lookup_ip_geolocation"},"col":2,"row":1,"height":2,"width":2},{"description":"Integrity (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_cmd_integrity","show_pie_chart":false,"query":"_exists_:sysmon_cmd_integrity","show_data_table":true},"col":4,"row":3,"height":2,"width":1},{"description":"DNS Lookup (24h)","type":"QUICKVALUES","cache_time":100,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_dns_lookup","show_pie_chart":false,"query":"_exists_:sysmon_dns_lookup","show_data_table":true},"col":3,"row":3,"height":3,"width":1},{"description":"Event ID (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_event_id","show_pie_chart":true,"query":"_exists_:sysmon_event_id","show_data_table":false},"col":1,"row":2,"height":2,"width":1},{"description":"User Acting (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_user_type","show_pie_chart":false,"query":"_exists_: sysmon_user_type","show_data_table":true},"col":4,"row":2,"height":1,"width":1},{"description":"Programs (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_data_process","show_pie_chart":false,"query":"_exists_:sysmon_data_process","show_data_table":true},"col":2,"row":3,"height":3,"width":1},{"description":"Thread Indicated (24h)","type":"SEARCH_RESULT_COUNT","cache_time":10,"configuration":{"timerange":{"type":"relative","range":86400},"lower_is_better":true,"trend":true,"query":"_exists_:sysmon_task AND _exists_:threat_indicated AND threat_indicated:true"},"col":1,"row":1,"height":1,"width":1},{"description":"Threat Lookups (24h)","type":"SEARCH_RESULT_COUNT","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"lower_is_better":false,"trend":true,"query":"_exists_:sysmon_task AND _exists_:threat_indicated AND threat_indicated:false"},"col":4,"row":1,"height":1,"width":1}]}],"grok_patterns":[]} \ No newline at end of file From 3f4bad7974c0c6793a1aec05ddcebcb6eb5201cc Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 1 Mar 2017 15:07:20 -0500 Subject: [PATCH 099/471] update name. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 1b22274c..620c4e92 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# sysmon-config | A Sysmon configuration file for everybody # +# Sysmon Threat Intelligence Configuration # This is a Microsoft Sysinternals Sysmon configuration file template with default high-quality event tracing. From bdb8a608008a76dc2a66c09c090a1d5cf3d87842 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 1 Mar 2017 16:57:59 -0500 Subject: [PATCH 100/471] Turning down noise a bit. --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 38f2b9e2..664a92bf 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -777,6 +777,7 @@ C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe C:\Program Files\Windows Defender\MsMpEng.exe + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ Toolbar\WebBrowser Toolbar\WebBrowser\ITBar7Height Toolbar\ShellBrowser\ITBar7Layout From 7fe1314405fc8c65465b447ae357dd3dcc1ce002 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 1 Mar 2017 20:21:14 -0500 Subject: [PATCH 101/471] Add additional exclusions to cut down noise: We need the Sysinternals team to add File Image Signature detection to further improve sysmon's filtering and security capabilities. --- sysmonconfig-export.xml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 664a92bf..4ac4dfa1 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -259,7 +259,7 @@ rundll32.exe notepad.exe regsvr32.exe - C:\Windows\system32\svchost.exe + C:\Windows\system32\svchost.exe mshta.exe python.exe psexe @@ -573,7 +573,9 @@ \Start Menu\Programs \Start Menu\Programs\Startup - C:\Windows\System32\smss.exe + C:\Windows\System32\svchost.exe + C:\Windows\System32\smss.exe + \Microsoft\Windows\INetCache\IE \Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates WRITABLE.TST C:\Windows\System32\wbem\Performance\ @@ -777,6 +779,8 @@ C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe C:\Program Files\Windows Defender\MsMpEng.exe + HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files- + HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\User_Feed_Synchronization- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ Toolbar\WebBrowser Toolbar\WebBrowser\ITBar7Height @@ -833,6 +837,7 @@ HKLM\System\CurrentControlSet\Services\DeviceAssociationService\Start HKLM\System\CurrentControlSet\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\ C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe + C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe @@ -896,6 +901,7 @@ \WRSVCPipe \WRSynUM2 + \wrUrl C:\Program Files (x86)\Webroot\WRSA.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe From 41859493d9a9eaa2a580973bb342b5230c5b3635 Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 2 Mar 2017 21:34:29 -0500 Subject: [PATCH 102/471] Initial Release Of Graylog Sidecar Auto-Installer --- Graylog_Content_Pack/Install_Sidecar.bat | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 Graylog_Content_Pack/Install_Sidecar.bat diff --git a/Graylog_Content_Pack/Install_Sidecar.bat b/Graylog_Content_Pack/Install_Sidecar.bat new file mode 100644 index 00000000..acd01dbf --- /dev/null +++ b/Graylog_Content_Pack/Install_Sidecar.bat @@ -0,0 +1,18 @@ +@echo off +cd %temp% +set /p glg= "[+] What's the Graylog Server name or IP? " +echo [+] Server set to to: %glg% +echo [+] Downloading Graylog Sidecar to: %temp%\Sidecar.exe... +@powershell (new-object System.Net.WebClient).DownloadFile('https://github.com/Graylog2/collector-sidecar/releases/download/0.1.0-rc.1/collector_sidecar_installer_0.1.0-rc.1.exe','%temp%\Sidecar.exe')" +start /wait Sidecar.exe /S -SERVERURL=https://%glg%:443/api -TAGS="windows" +echo [+] Executing Script to edit content of sidecar configuration... +@powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('https://goo.gl/mYNrH7')" +cd "C:\Program Files\graylog\collector-sidecar\" +echo [+] Installing Graylog Services... +graylog-collector-sidecar.exe -service install +graylog-collector-sidecar.exe -service start +echo [+] Checking Services... +@powershell get-service collector-sidecar +echo [+] Graylog Sidecar Successfully Installed and Configured! +timeout /t 10 +exit \ No newline at end of file From ad32c19a8d6b10d17dc1d8a16ac62b31dc911bac Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 2 Mar 2017 21:42:32 -0500 Subject: [PATCH 103/471] Add noprompt installer, you know what to do --- .../Install_Sidecar_noprompt.bat | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 Graylog_Content_Pack/Install_Sidecar_noprompt.bat diff --git a/Graylog_Content_Pack/Install_Sidecar_noprompt.bat b/Graylog_Content_Pack/Install_Sidecar_noprompt.bat new file mode 100644 index 00000000..d50e9b26 --- /dev/null +++ b/Graylog_Content_Pack/Install_Sidecar_noprompt.bat @@ -0,0 +1,16 @@ +@echo off +cd %temp% +echo [+] Downloading Graylog Sidecar to: %temp%\Sidecar.exe... +@powershell (new-object System.Net.WebClient).DownloadFile('https://github.com/Graylog2/collector-sidecar/releases/download/0.1.0-rc.1/collector_sidecar_installer_0.1.0-rc.1.exe','%temp%\Sidecar.exe')" +start /wait Sidecar.exe /S -SERVERURL=https://YOURSERVERIPHERE:443/api -TAGS="windows" +echo [+] Executing Script to edit content of sidecar configuration... +@powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('https://goo.gl/mYNrH7')" +cd "C:\Program Files\graylog\collector-sidecar\" +echo [+] Installing Graylog Services... +graylog-collector-sidecar.exe -service install +graylog-collector-sidecar.exe -service start +echo [+] Checking Services... +@powershell get-service collector-sidecar +echo [+] Graylog Sidecar Successfully Installed and Configured! +timeout /t 10 +exit \ No newline at end of file From 406661b0f777446c3a3fbdbb9a789b21254a07bf Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 2 Mar 2017 21:50:15 -0500 Subject: [PATCH 104/471] double to's lol --- Graylog_Content_Pack/Install_Sidecar.bat | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Graylog_Content_Pack/Install_Sidecar.bat b/Graylog_Content_Pack/Install_Sidecar.bat index acd01dbf..8646ef94 100644 --- a/Graylog_Content_Pack/Install_Sidecar.bat +++ b/Graylog_Content_Pack/Install_Sidecar.bat @@ -1,7 +1,7 @@ @echo off cd %temp% set /p glg= "[+] What's the Graylog Server name or IP? " -echo [+] Server set to to: %glg% +echo [+] Server set to: %glg% echo [+] Downloading Graylog Sidecar to: %temp%\Sidecar.exe... @powershell (new-object System.Net.WebClient).DownloadFile('https://github.com/Graylog2/collector-sidecar/releases/download/0.1.0-rc.1/collector_sidecar_installer_0.1.0-rc.1.exe','%temp%\Sidecar.exe')" start /wait Sidecar.exe /S -SERVERURL=https://%glg%:443/api -TAGS="windows" From 2d08dbbcbfd6a0fb077b1bea17424a1aa8b91d96 Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 2 Mar 2017 21:56:54 -0500 Subject: [PATCH 105/471] unshorten URL's for the paranoid like myself :P --- Graylog_Content_Pack/Install_Sidecar.bat | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Graylog_Content_Pack/Install_Sidecar.bat b/Graylog_Content_Pack/Install_Sidecar.bat index 8646ef94..8f9a1795 100644 --- a/Graylog_Content_Pack/Install_Sidecar.bat +++ b/Graylog_Content_Pack/Install_Sidecar.bat @@ -6,7 +6,7 @@ echo [+] Downloading Graylog Sidecar to: %temp%\Sidecar.exe... @powershell (new-object System.Net.WebClient).DownloadFile('https://github.com/Graylog2/collector-sidecar/releases/download/0.1.0-rc.1/collector_sidecar_installer_0.1.0-rc.1.exe','%temp%\Sidecar.exe')" start /wait Sidecar.exe /S -SERVERURL=https://%glg%:443/api -TAGS="windows" echo [+] Executing Script to edit content of sidecar configuration... -@powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('https://goo.gl/mYNrH7')" +@powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('https://gist.githubusercontent.com/ion-storm/39d1e70fde966c6e69e57bcb989c5c8d/raw/e3bf0a7b589a340cc557c14bc0f619372cae8752/sidecar.ps1')" cd "C:\Program Files\graylog\collector-sidecar\" echo [+] Installing Graylog Services... graylog-collector-sidecar.exe -service install From 9a479022a0abdcfd9eb42bf803deafc26d4a9cd3 Mon Sep 17 00:00:00 2001 From: def ccon Date: Fri, 3 Mar 2017 10:56:10 -0500 Subject: [PATCH 106/471] get rid of short url, for security --- Graylog_Content_Pack/Install_Sidecar_noprompt.bat | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Graylog_Content_Pack/Install_Sidecar_noprompt.bat b/Graylog_Content_Pack/Install_Sidecar_noprompt.bat index d50e9b26..c9ac62cc 100644 --- a/Graylog_Content_Pack/Install_Sidecar_noprompt.bat +++ b/Graylog_Content_Pack/Install_Sidecar_noprompt.bat @@ -4,7 +4,7 @@ echo [+] Downloading Graylog Sidecar to: %temp%\Sidecar.exe... @powershell (new-object System.Net.WebClient).DownloadFile('https://github.com/Graylog2/collector-sidecar/releases/download/0.1.0-rc.1/collector_sidecar_installer_0.1.0-rc.1.exe','%temp%\Sidecar.exe')" start /wait Sidecar.exe /S -SERVERURL=https://YOURSERVERIPHERE:443/api -TAGS="windows" echo [+] Executing Script to edit content of sidecar configuration... -@powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('https://goo.gl/mYNrH7')" +@powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('https://gist.githubusercontent.com/ion-storm/39d1e70fde966c6e69e57bcb989c5c8d/raw/e3bf0a7b589a340cc557c14bc0f619372cae8752/sidecar.ps1')" cd "C:\Program Files\graylog\collector-sidecar\" echo [+] Installing Graylog Services... graylog-collector-sidecar.exe -service install From cf95b6956f05806775f625b4141d307a90e9f278 Mon Sep 17 00:00:00 2001 From: def ccon Date: Fri, 3 Mar 2017 11:42:50 -0500 Subject: [PATCH 107/471] Merge in and clean up. --- sysmonconfig-export.xml | 236 ++++++++++++++++++++++++---------------- 1 file changed, 144 insertions(+), 92 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 4ac4dfa1..ec044150 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1,16 +1,17 @@ + - AppContainer + C:\Windows\system32\DllHost.exe /Processid + C:\Windows\system32\SearchIndexer.exe /Embedding + C:\Windows\System32\CompatTelRunner.exe + C:\Windows\System32\MusNotification.exe + C:\Windows\System32\MusNotificationUx.exe C:\Windows\System32\audiodg.exe C:\Windows\System32\conhost.exe + C:\Windows\System32\powercfg.exe C:\Windows\System32\wbem\WmiApSrv.exe C:\Windows\servicing\TrustedInstaller.exe C:\Windows\system32\sppsvc.exe @@ -49,7 +56,8 @@ C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows - C:\windows\System32\svchost.exe -k WerSvcGroup + C:\Windows\system32\SearchIndexer.exe + C:\Program Files\Windows Defender C:\Windows\System32\CompatTelRunner.exe C:\Windows\System32\wermgr.exe @@ -82,8 +90,12 @@ C:\Windows\System32\powercfg.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe + C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe @@ -91,7 +103,6 @@ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE @@ -100,23 +111,23 @@ "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= C:\Program Files (x86)\Google\Update\ C:\Program Files (x86)\Google\Update\ - + "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel "C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel AcroRd32.exe" /CR AcroRd32.exe" --channel= - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe - + C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe - + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe - + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe @@ -125,20 +136,21 @@ C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe - + + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe + "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ C:\Program Files\NVIDIA Corporation\ \NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamuseragent.exe C:\Program Files\Realtek\ - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe C:\Program Files\DellTPad\HidMonitorSvc.exe "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe + C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe @@ -226,9 +238,10 @@ C:\Program Files (x86)\Notepad++\notepad++.exe C:\Program Files\OpenVPN\bin\openvpn-gui.exe C:\Program Files (x86)\Enpass\Enpass.exe + C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe - + C:\Users @@ -241,19 +254,20 @@ setup - + - + C:\Users C:\ProgramData C:\Windows\Temp - powershell.exe + + at.exe + certutil.exe cmd.exe - wmic.exe cscript.exe wscript.exe rundll32.exe @@ -270,7 +284,6 @@ java.exe installutil.exe msiexec.exe - certutil.exe reg.exe mstsc.exe telnet.exe @@ -281,7 +294,6 @@ psftp.exe tftp.exe wmic.exe - at.exe net.exe C:\windows\system32\mmc.exe nbtstat.exe @@ -358,8 +370,8 @@ 53 - Spotify.exe OneDrive.exe + Spotify.exe AppData\Roaming\Dropbox\bin\Dropbox.exe OneDriveStandaloneUpdater.exe ConnectWise.exe @@ -391,18 +403,18 @@ C:\Program Files (x86)\SmartGit\jre\bin\java.exe - + - + C:\Users - + - + - + @@ -442,7 +454,7 @@ - + + - + @@ -494,13 +507,16 @@ \Startup \Content.Outlook\ \Downloads\ - .exe - .vbs - .hta + .application + .appref-ms .bat .cmd + .cmdline + .docm + .exe + .hta + .pptm .ps1 - .application .sys .reg .docm @@ -513,13 +529,15 @@ .scf .appref-ms .rdp + .vbs C:\Users\Default + C:\Windows\System32\Drivers + C:\Windows\SysWOW64\Drivers C:\Windows\System32\GroupPolicy\Machine\Scripts C:\Windows\System32\GroupPolicy\User\Scripts - C:\Windows\System32\drivers - C:\Windows\SysWOW64\Drivers - C:\Windows\System32\wbem - C:\Windows\SysWOW64\wbem + C:\Windows\System32\Tasks + C:\Windows\System32\Wbem + C:\Windows\SysWOW64\Wbem C:\Windows\System32\WindowsPowerShell C:\Windows\SysWOW64\WindowsPowerShell C:\Windows\Tasks\ @@ -580,6 +598,9 @@ WRITABLE.TST C:\Windows\System32\wbem\Performance\ C:\Windows\System32\DriverStore\Temp\ + C:\Windows\System32\wbem\Performance\ + WRITABLE.TST + C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\ .etl .log @@ -601,7 +622,7 @@ C:\Windows\system32\igfxCUIService.exe - + @@ -619,12 +640,12 @@ \CurrentVersion\Run - \Group Policy\Scripts + \Group Policy\Scripts \Windows\System\Scripts \Microsoft\System\Scripts \ServiceDll \ImagePath - \Start + \Start HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet @@ -636,20 +657,27 @@ HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath + \Explorer\FileExts\ \shell\install\command\ \shell\open\command\ \shell\open\ddeexec\ - \Explorer\FileExts\ + + \InprocServer32\(Default) \ContextMenuHandlers\ \CurrentVersion\Shell HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad \Classes\Folder\ + \Classes\*\ + \Classes\AllFilesystemObjects\ \Classes\Directory\ \Classes\Drive\ - \Classes\AllFilesystemObjects\ - \Classes\*\ + \Classes\Folder\ + \ContextMenuHandlers\ + \CurrentVersion\Shell + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ @@ -662,8 +690,8 @@ \ProxyServer HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles @@ -685,11 +713,8 @@ \UrlUpdateInfo \InstallSource - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ - \FriendlyName - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ - HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ @@ -769,12 +794,16 @@ \piffile\shell\open\command \regfile\shell\open\command \InprocServer32 - \InprocServer32 + HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + \FriendlyName + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) Office\root\integration\integrator.exe + C:\WINDOWS\system32\backgroundTaskHost.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe C:\Program Files\Windows Defender\MsMpEng.exe @@ -794,41 +823,44 @@ \CurrentVersion\Shell Extensions\Cached \CurrentVersion\Shell Extensions\Approved }\PreviousPolicyAreas - \Control\WMI\Autologger\ - HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start - \Lsa\OfflineJoin\CurrentValue - \Components\TrustedInstaller\Events - \Components\TrustedInstaller - \Components\Wlansvc - \Components\Wlansvc\Events - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ - \Directory\shellex - \Directory\shellex\DragDropHandlers - \Drive\shellex - \Drive\shellex\DragDropHandlers - _Classes\AppX + \Control\WMI\Autologger\ + HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start + \Lsa\OfflineJoin\CurrentValue + \Components\TrustedInstaller\Events + \Components\TrustedInstaller + \Components\Wlansvc + \Components\Wlansvc\Events + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ + \Directory\shellex + \Directory\shellex\DragDropHandlers + \Drive\shellex + \Drive\shellex\DragDropHandlers + _Classes\AppX + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ + C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit - \services\TrustedInstaller\Start - \services\tunnel\Start - \services\BITS\Start - \services\UsoSvc\Start \services\clr_optimization_v2.0.50727_32\Start \services\clr_optimization_v2.0.50727_64\Start \services\clr_optimization_v4.0.30319_32\Start \services\clr_optimization_v4.0.30319_64\Start + \services\DeviceAssociationService\Start + \services\BITS\Start + \services\TrustedInstaller\Start + \services\tunnel\Start + \services\UsoSvc\Start \OpenWithProgids \OpenWithList \UserChoice - \UserChoice\ProgId - \UserChoice\Hash + \UserChoice\ProgId + \UserChoice\Hash \OpenWithList\MRUList } 0xFFFF C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe @@ -838,9 +870,11 @@ HKLM\System\CurrentControlSet\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\ C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe + + C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe - + Temp\7z .vb - .vbs - .vbe - .hta + .application + .appref-ms .bat - .ps1 - .ps2 - .lnk - .reg - .cmd + .cmd + .cmdline + .docm + .exe + .hta + .pptm + .ps1 + .sys + .reg + .docm + .xlsm + .xlam + .pptm + .potm + .pptm + .sldm + .scf + .appref-ms + .rdp + .vbs + .js - + + + @@ -943,5 +994,6 @@ C:\Program Files (x86)\SmartGit\bin\smartgit.exe C:\Program Files (x86)\SmartGit\bin\smartgit.exe + From ffeade2b04fe62e3df1ee5e0065d17e4a4163ad8 Mon Sep 17 00:00:00 2001 From: def ccon Date: Fri, 3 Mar 2017 14:45:47 -0500 Subject: [PATCH 108/471] Update Intel --- README.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 620c4e92..fd9b9c4d 100644 --- a/README.md +++ b/README.md @@ -162,23 +162,23 @@ then // look up the requested DNS captured by sysmon // this will be the most fired rule - let sysmon_dns_lookup_intel = threat_intel_lookup_domain(to_string($message.query_domain), "sysmon_dns_lookup"); + let sysmon_dns_lookup_intel = threat_intel_lookup_domain(to_string($message.sysmon_dns_lookup), "sysmon_dns_lookup"); set_fields(sysmon_dns_lookup_intel); // look up the ip from the DNS answer // if we do not monitor the dns, then this might be nice to have - let sysmon_lookup_ip_answer_intel = threat_intel_lookup_ip(to_string($message.query_answer), "sysmon_dns_lookup_ip"); + let sysmon_lookup_ip_answer_intel = threat_intel_lookup_ip(to_string($message.sysmon_dns_lookup_ip), "sysmon_dns_lookup_ip"); set_fields(sysmon_lookup_ip_answer_intel); // look up the requesting IP // this is useful if dealing with non internal IPs // so you know if your IP is seen as a problem - let sysmon_src_ip_answer_intel = threat_intel_lookup_ip(to_string($message.query_answer), "sysmon_src_ip"); + let sysmon_src_ip_answer_intel = threat_intel_lookup_ip(to_string($message.sysmon_src_ip), "sysmon_src_ip"); set_fields(sysmon_src_ip_answer_intel); // WHOIS lookup. This is disabled by default. Enable and carefully watch latency and performance. - //let sysmon_dns_lookup_ip_whois = whois_lookup_ip(to_string($message.query_answer), "sysmon_dns_lookup_ip"); - //set_fields(sysmon_dns_lookup_ip_whois); + let sysmon_dns_lookup_ip_whois = whois_lookup_ip(to_string($message.sysmon_dns_lookup_ip), "sysmon_dns_lookup_ip"); + set_fields(sysmon_dns_lookup_ip_whois); end ~~~~ From 316cbdcdefddfc39d6273869d8e942da6473c538 Mon Sep 17 00:00:00 2001 From: def ccon Date: Fri, 3 Mar 2017 21:17:41 -0500 Subject: [PATCH 109/471] Add Alienvault OTX to Graylog pipeline cfg --- README.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index fd9b9c4d..82df80e4 100644 --- a/README.md +++ b/README.md @@ -179,6 +179,14 @@ then // WHOIS lookup. This is disabled by default. Enable and carefully watch latency and performance. let sysmon_dns_lookup_ip_whois = whois_lookup_ip(to_string($message.sysmon_dns_lookup_ip), "sysmon_dns_lookup_ip"); set_fields(sysmon_dns_lookup_ip_whois); + + //AlienVault OTX + let intel = otx_lookup_ip(to_string($message.sysmon_src_ip)); + let intel = otx_lookup_domain(to_string($message.sysmon_dns_lookup_ip)); + set_field("otx_threat_indicated", intel.otx_threat_indicated); + set_field("otx_threat_ids", intel.otx_threat_ids); + set_field("otx_threat_names", intel.otx_threat_names); + end ~~~~ @@ -187,7 +195,7 @@ end rule "sysmon threatintel inflate" when // run only if one of the fields is true - to_bool($message.sysmon_dns_lookup_ip_threat_indicated) OR to_bool($message.sysmon_dns_lookup_threat_indicated) OR to_bool($message.sysmon_src_ip_threat_indicated) + to_bool($message.sysmon_dns_lookup_ip_threat_indicated) OR to_bool($message.sysmon_dns_lookup_threat_indicated) OR to_bool($message.sysmon_src_ip_threat_indicated) OR to_bool($message.otx_threat_indicated) then // This is to make Graylog searches easy From 3b96f6430a614b634923668662c44873642ce5b2 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 5 Mar 2017 10:15:10 -0500 Subject: [PATCH 110/471] Add Shellcode/Exploit Detection of Office Macro's --- sysmonconfig-export.xml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ec044150..7235ffc5 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -491,13 +491,16 @@ mspub.exe msbuild.exe powerpnt.exe - powershell.exe - + VBE7.dll + VBE6.dll + + C:\Program Files (x86)\Webroot\WRSA.exe C:\Program Files\Windows Defender\MsMpEng.exe + UNKNOWN From 66581427b52fb63b5efa22624cdf74cd209e0e32 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 5 Mar 2017 14:47:20 -0500 Subject: [PATCH 111/471] Add Detection of PoisonTap, USB RubberDucky, Driver & DLL Drops, LSA Security Providers, ACPI Rootkits, Debugger Hijack Location, Poweliks Detection --- sysmonconfig-export.xml | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 7235ffc5..c70fc556 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -269,7 +269,7 @@ certutil.exe cmd.exe cscript.exe - wscript.exe + wscript.exewscript.exe rundll32.exe notepad.exe regsvr32.exe @@ -510,6 +510,8 @@ \Startup \Content.Outlook\ \Downloads\ + .dll + .sys .application .appref-ms .bat @@ -649,6 +651,14 @@ \ServiceDll \ImagePath \Start + HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages + HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages + HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages + HKLM\HARDWARE\ACPI\DSDT HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet @@ -659,6 +669,11 @@ HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath + HKLM\Software\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLU\Software\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug \Explorer\FileExts\ \shell\install\command\ @@ -729,6 +744,7 @@ HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load + HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff @@ -801,6 +817,8 @@ HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ \FriendlyName HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318} From 0bd90fdb12337a0a278b6860a9e1465fb5e28539 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 5 Mar 2017 16:04:06 -0500 Subject: [PATCH 112/471] Add Image Loaded By Process, Excluding all signed and Valid DLL's --- sysmonconfig-export.xml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index c70fc556..4007a3d5 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -439,6 +439,8 @@ + false + Invalid @@ -452,6 +454,27 @@ + + + From 7a2bce3040023efae63aa46d8052de531ed4fd63 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 5 Mar 2017 16:14:28 -0500 Subject: [PATCH 113/471] Add unavailable status --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 4007a3d5..eb5d64ec 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -441,6 +441,7 @@ false Invalid + Unavailable From f381bd664adc06a38e7a233d4e88b96411d4917a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 5 Mar 2017 16:34:23 -0500 Subject: [PATCH 114/471] cut down the DLL Noise, excluding Program Files for Production for now --- sysmonconfig-export.xml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index eb5d64ec..4d327c7b 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -475,9 +475,14 @@ Steelseries Cisco Fortinet --> - - + + C:\Windows\System32\mmc.exe + C:\Program Files (x86)\SmartGit + C:\Windows\System32\backgroundTaskHost.exe + C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe + C:\Program Files + From 9a52dc70211fb5ee67278ee70c8704072695dc42 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 5 Mar 2017 16:45:26 -0500 Subject: [PATCH 115/471] add additional notice --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 4d327c7b..a10465c9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -481,7 +481,7 @@ C:\Program Files (x86)\SmartGit C:\Windows\System32\backgroundTaskHost.exe C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe - C:\Program Files + C:\Program Files From 79b974da859a5459b6820c65b6c2136e617cc276 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 5 Mar 2017 18:10:42 -0500 Subject: [PATCH 116/471] Rename ImageLoaded winlogbeat fields to sysmon fields --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 82df80e4..032d4751 100644 --- a/README.md +++ b/README.md @@ -119,6 +119,10 @@ then rename_field("winlogbeat_event_data_DestinationIp_geolocation", "sysmon_dns_lookup_ip_geolocation"); rename_field("winlogbeat_event_data_PipeName", "sysmon_pipe_name"); rename_field("winlogbeat_event_data_ProcessId", "sysmon_pipe_pid"); + rename_field("winlogbeat_process_id", "sysmon_img_pid"); + rename_field("winlogbeat_event_data_ImageLoaded", "sysmon_imgloaded"); + rename_field("winlogbeat_event_data_SignatureStatus", "sysmon_signatureStatus"); + rename_field("winlogbeat_event_data_Signed", "sysmon_signed"); // Remove clutter. let fix = regex("^\\{(\\S+)\\}$", to_string($message.winlogbeat_event_data_ProcessGuid)); From 51eb15eb2d6ff6ec689c805aeb2ab46baa10cb64 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 5 Mar 2017 18:51:09 -0500 Subject: [PATCH 117/471] fix formatting --- sysmonconfig-export.xml | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index a10465c9..a796b679 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -439,9 +439,9 @@ - false - Invalid - Unavailable + false + Invalid + Unavailable @@ -477,11 +477,12 @@ Fortinet --> - C:\Windows\System32\mmc.exe - C:\Program Files (x86)\SmartGit - C:\Windows\System32\backgroundTaskHost.exe - C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe - C:\Program Files + C:\Windows\System32\mmc.exe + C:\Program Files (x86)\SmartGit + syntevo\SmartGit + C:\Windows\System32\backgroundTaskHost.exe + C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe + C:\Program Files From a281c8356c021c12c139dca596bc93e394247d15 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 5 Mar 2017 19:39:28 -0500 Subject: [PATCH 118/471] Lower noise with dll loading with Windows 10 apps and mmc --- sysmonconfig-export.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index a796b679..d1e80933 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -483,6 +483,11 @@ C:\Windows\System32\backgroundTaskHost.exe C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe C:\Program Files + C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\ + C:\Windows\assembly\NativeImages_v4.0.30319_64\EventViewer\8f6ad0cc031c686d71ed83adf76119fe\EventViewer.ni.dll + C:\Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\a3e102751d6a27e8a54df2e57a4ae2d0\MIGUIControls.ni.dll + C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\04d8bd77c408266f65f7bb3f90ff7e1c\System.Web.ni.dll + C:\Program Files\WindowsApps\ From 7a5b01bd453bb1ec60a23ef96df5f4b652733086 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 5 Mar 2017 19:57:34 -0500 Subject: [PATCH 119/471] We detect file drops, for now were lowering noise here. --- sysmonconfig-export.xml | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index d1e80933..6ce83fcc 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -483,11 +483,8 @@ C:\Windows\System32\backgroundTaskHost.exe C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe C:\Program Files - C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\ - C:\Windows\assembly\NativeImages_v4.0.30319_64\EventViewer\8f6ad0cc031c686d71ed83adf76119fe\EventViewer.ni.dll - C:\Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\a3e102751d6a27e8a54df2e57a4ae2d0\MIGUIControls.ni.dll - C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\04d8bd77c408266f65f7bb3f90ff7e1c\System.Web.ni.dll - C:\Program Files\WindowsApps\ + C:\Windows\assembly\NativeImages + C:\Program Files\WindowsApps From 274a95aee0f4526824084c8791a3a2b541021888 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 5 Mar 2017 20:05:36 -0500 Subject: [PATCH 120/471] exclude noisy tasks that are standard windows tasks --- sysmonconfig-export.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6ce83fcc..3f8b32df 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -863,6 +863,9 @@ HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files- HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\User_Feed_Synchronization- + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsUpdate + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ Toolbar\WebBrowser Toolbar\WebBrowser\ITBar7Height From 35d56f41fb0a3d87dd0c1f0010b3347450783b4c Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 5 Mar 2017 20:24:52 -0500 Subject: [PATCH 121/471] Mimikatz detection credits: @Antonlovesdnb --- sysmonconfig-export.xml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 3f8b32df..8497a955 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -527,7 +527,8 @@ VBE7.dll VBE6.dll - + C:\Windows\System32\lsass.exe + C:\Windows\System32\winlogon.exe C:\Program Files (x86)\Webroot\WRSA.exe @@ -948,6 +949,8 @@ .cmdline .docm .exe + .dll + .sys .hta .pptm .ps1 From 32fb1c2c8780b4b843d73bf7783283542b04e6f0 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 5 Mar 2017 20:59:40 -0500 Subject: [PATCH 122/471] exclude sysmon and defender from process access detection --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 8497a955..1dd7335a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -533,6 +533,8 @@ C:\Program Files (x86)\Webroot\WRSA.exe C:\Program Files\Windows Defender\MsMpEng.exe + C:\Program Files\Windows Defender\MsMpEng.exe + C:\Windows\Sysmon.exe UNKNOWN From b8df5eadbbecd96b1b88ef483723a0b88a7c2bf8 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 6 Mar 2017 09:46:17 -0500 Subject: [PATCH 123/471] lync reg change exclusion --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1dd7335a..59dffb48 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -861,6 +861,8 @@ Office\root\integration\integrator.exe C:\WINDOWS\system32\backgroundTaskHost.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Program Files (x86)\Microsoft Office\Office16\lync.exe + C:\Program Files (x86)\Microsoft Office\Office15\lync.exe C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe C:\Program Files\Windows Defender\MsMpEng.exe From 67a3a57048c8672a8bbb2a726841e4be2d3d6c72 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 6 Mar 2017 12:48:03 -0500 Subject: [PATCH 124/471] Add exclusions to cut down noise, see Notice's --- sysmonconfig-export.xml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 59dffb48..4ece186a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -370,6 +370,7 @@ 53 + true OneDrive.exe Spotify.exe AppData\Roaming\Dropbox\bin\Dropbox.exe @@ -400,7 +401,8 @@ 3702 3702 50646 - C:\Program Files (x86)\SmartGit\jre\bin\java.exe + C:\Program Files (x86)\SmartGit\jre\bin\java.exe + C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe @@ -485,6 +487,9 @@ C:\Program Files C:\Windows\assembly\NativeImages C:\Program Files\WindowsApps + + C:\Program Files (x86)\AutoSizer\AutoSizer.dll + C:\Program Files (x86)\Notepad++ @@ -865,6 +870,7 @@ C:\Program Files (x86)\Microsoft Office\Office15\lync.exe C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe C:\Program Files\Windows Defender\MsMpEng.exe + Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\ HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files- HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\User_Feed_Synchronization- @@ -1012,6 +1018,7 @@ \wkssvc \TDLN- \WiFiNetworkManagerTask + \MsFteWds \WRSVCPipe \WRSynUM2 @@ -1049,6 +1056,7 @@ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe C:\Program Files\Lenovo\HOTKEY\tphkload.exe + C:\Program Files\Lenovo\ C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe Graylog-collector-sidecar.exe C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git-remote-https.exe @@ -1056,6 +1064,8 @@ C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git.exe C:\Program Files (x86)\SmartGit\bin\smartgit.exe C:\Program Files (x86)\SmartGit\bin\smartgit.exe + Anonymous Pipe + From f62ec86c43c9f0d3a9593d77322f7c7cdcb96b50 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 6 Mar 2017 14:02:21 -0500 Subject: [PATCH 125/471] Hide Sysmon from services.msc and the ability to query it. --- README.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/README.md b/README.md index 032d4751..ee5cd3ad 100644 --- a/README.md +++ b/README.md @@ -37,6 +37,15 @@ Run with administrator rights sysmon.exe -u ~~~~ +## Hide Sysmon from services.msc ## +~~~~ +Hide: +sc sdset Sysmon D:(D;;DCLCWPDTSD;;;IU)(D;;DCLCWPDTSD;;;SU)(D;;DCLCWPDTSD;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) +Restore: +sc sdset Sysmon D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) + +~~~~ + ### Graylog Configuration ### From 8c60b80d3d6f8c13f735273886cdf3c9163afc55 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 6 Mar 2017 15:37:20 -0500 Subject: [PATCH 126/471] Add Detection of Certificate store Hijacking, manipulation and changes to the Root certificate store. Also added detection of dropped certificate files and with alternate data streams. --- sysmonconfig-export.xml | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 4ece186a..7dd24b8e 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -626,6 +626,22 @@ help_recover_instructions _Locky_recover _ReCoVeRy_ + + .pem + .crt + .ca-bundle + .cer + .csr + .der + .p7b + .p7r + .p7s + .pfx + .sto + .p12 + .crl + .sst + .key @@ -839,6 +855,15 @@ HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable + + HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates + HKCU\Software\Policies\Microsoft\SystemCertificates + HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates + HKLM\SOFTWARE\Microsoft\EnterpriseCertificates + HKCU\SOFTWARE\Microsoft\EnterpriseCertificates + HKLM\SOFTWARE\Microsoft\SystemCertificates + HKCU\SOFTWARE\Microsoft\SystemCertificates + HKLM\SYSTEM\CurrentControlSet\Services\CertSvc HKCU\Software\Classes\mscfile\shell\open\command HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree @@ -978,6 +1003,22 @@ .rdp .vbs .js + + .pem + .crt + .ca-bundle + .cer + .csr + .der + .p7b + .p7r + .p7s + .pfx + .sto + .p12 + .crl + .sst + .key From 0f2f12f2a42b6e697347d008154ce28f0a805295 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 6 Mar 2017 16:37:57 -0500 Subject: [PATCH 127/471] SearchProtocolHost spamming registry Keystores --- sysmonconfig-export.xml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 7dd24b8e..d5140061 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -964,6 +964,15 @@ C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe + + HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed + HKCU\Software\Policies\Microsoft\SystemCertificates\Disallowed + HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\Disallowed + HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed + HKCU\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed + HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed + HKCU\SOFTWARE\Microsoft\SystemCertificates\Disallowed + C:\Windows\SysWOW64\SearchProtocolHost.exe From 5202228f70cee0799b11a86274e3d6fbf4c14d30 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 6 Mar 2017 16:40:36 -0500 Subject: [PATCH 128/471] derp fix --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index d5140061..e2dc4058 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -228,7 +228,7 @@ ScreenConnect.WindowsClient.exe C:\Program Files (x86)\SmartGit - C:\Program Files (x86)\SmartGit + C:\Program Files (x86)\SmartGit Vivaldi\Application\vivaldi.exe controls\cef\ConnectWise.exe From 8951db7c039484a15a43f656754ed4a0bfa1f970 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 6 Mar 2017 17:16:57 -0500 Subject: [PATCH 129/471] introduced too much noise, need better detection vector --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e2dc4058..b9814b05 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -856,6 +856,7 @@ HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable + HKCU\Software\Classes\mscfile\shell\open\command HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree From 53a48f63d7a739f6aa23185ec4de39d380adf7c6 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 6 Mar 2017 18:16:20 -0500 Subject: [PATCH 130/471] Revert to lower noise. --- sysmonconfig-export.xml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b9814b05..b3f87292 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -490,6 +490,7 @@ C:\Program Files (x86)\AutoSizer\AutoSizer.dll C:\Program Files (x86)\Notepad++ + C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe @@ -885,7 +886,9 @@ \FriendlyName HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318} + From 76285c11692497d579b166cb8843f65130968253 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 7 Mar 2017 16:01:45 -0500 Subject: [PATCH 131/471] Add CIA Vault 7 IOC's --- sysmonconfig-export.xml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b3f87292..ef218792 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -444,6 +444,9 @@ false Invalid Unavailable + C:\windows\system32\fxsst.dll + C:\Windows\System32\wbem\oci.dll + psapi.dll @@ -643,6 +646,13 @@ .crl .sst .key + + .mht + .cpl + .scr + .manifest + .inf + HammerDrillStatus.dll @@ -1033,6 +1043,12 @@ .crl .sst .key + + .mht + .manifest + .cpl + .scr + .inf From ce827491ad5f5f732023cf68856038fc5e5992a3 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 8 Mar 2017 09:03:47 -0500 Subject: [PATCH 132/471] disable psapi monitoring, too noisy, will re-introduce later with stronger ruleset --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ef218792..36db138c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -446,7 +446,6 @@ Unavailable C:\windows\system32\fxsst.dll C:\Windows\System32\wbem\oci.dll - psapi.dll From 86d6a493b8cf218a4e0786464f53cca26d200380 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 8 Mar 2017 11:28:00 -0500 Subject: [PATCH 133/471] Noise Reduction for Mass Deployment --- sysmonconfig-export.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 36db138c..ed35de15 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -54,6 +54,8 @@ C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DllHost.exe /Processid C:\Windows\system32\svchost.exe -k DcomLaunch + \SystemRoot\System32\smss.exe 00000100 0000007c + \SystemRoot\System32\smss.exe 00000100 0000007c C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows C:\Windows\system32\SearchIndexer.exe @@ -85,6 +87,7 @@ C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\svchost.exe -k netsvcs + C:\WINDOWS\System32\svchost.exe -k wsappx C:\Windows\System32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\System32\powercfg.exe @@ -239,6 +242,7 @@ C:\Program Files\OpenVPN\bin\openvpn-gui.exe C:\Program Files (x86)\Enpass\Enpass.exe C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe + C:\Program Files (x86)\Fortinet\FortiClient\scheduler.exe @@ -544,6 +548,7 @@ C:\Program Files\Windows Defender\MsMpEng.exe C:\Windows\Sysmon.exe UNKNOWN + C:\Program Files (x86)\ScreenConnect Client From 35efa38044d5e466c1e51432e1800a010c641738 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 8 Mar 2017 11:29:46 -0500 Subject: [PATCH 134/471] Forticlient noise reduction --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ed35de15..ab83228a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -243,6 +243,7 @@ C:\Program Files (x86)\Enpass\Enpass.exe C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe C:\Program Files (x86)\Fortinet\FortiClient\scheduler.exe + C:\Program Files (x86)\Fortinet\FortiClient\FCHelper64.exe From 756702ae728c8ee16c17652ff741c59cfe5805c5 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 8 Mar 2017 11:35:23 -0500 Subject: [PATCH 135/471] More Noise Reduction for Production --- sysmonconfig-export.xml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ab83228a..5d1b7014 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1124,6 +1124,7 @@ C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe C:\Program Files\Lenovo\HOTKEY\shtctky.exe C:\Windows\System32\LPlatSvc.exe + C:\Program Files (x86)\Lenovo\System Update\TvsuCommandLauncher.exe C:\Windows\LTSvc\LTSVC.exe C:\Program Files\OpenVPN\bin\openvpn-gui.exe @@ -1141,7 +1142,15 @@ C:\Program Files (x86)\SmartGit\bin\smartgit.exe C:\Program Files (x86)\SmartGit\bin\smartgit.exe Anonymous Pipe - + C:\Program Files (x86)\Fortinet\FortiClient\FortiESNAC.exe + C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe + C:\Program Files (x86)\Fortinet\FortiClient\FortiTray.exe + C:\Program Files (x86)\Fortinet\FortiClient\FCDBLog.exe + C:\Program Files (x86)\Enpass\Enpass.exe + C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe + C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgrhv.exe + C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe + C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmware-vmrc.exe From 4b38aa17775bdb461c6d00623af0a3081e6f4642 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 8 Mar 2017 11:41:31 -0500 Subject: [PATCH 136/471] Chrome noise reduction --- sysmonconfig-export.xml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 5d1b7014..6c81cc35 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -697,6 +697,19 @@ C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe C:\Windows\system32\igfxCUIService.exe + + Google\Chrome\User Data\Safe Browsing\UrlUws.store_new + Google\Chrome\User Data\Safe Browsing\UrlMalBin.store_new + Google\Chrome\User Data\Safe Browsing\UrlMalware.store_new + Google\Chrome\User Data\Safe Browsing\UrlSoceng.store_new + Google\Chrome\User Data\Safe Browsing\ChromeExtMalware.store_new + Google\Chrome\User Data\Safe Browsing\ChromeFilenameClientIncident.store_new + Google\Chrome\User Data\Safe Browsing\ChromeUrlClientIncident.store_new + Google\Chrome\User Data\Safe Browsing\IpMalware.store_new + Google\Chrome\User Data\Safe Browsing\UrlSubresourceFilter.store_new + Google\Chrome\User Data\Safe Browsing\UrlCsdWhitelist.store_new + Google\Chrome\User Data\Safe Browsing\UrlCsdDownloadWhitelist.store_new + Google\Chrome\User Data\Safe Browsing\CertCsdDownloadWhitelist.store_new From 7568850b758c60710d28ff9178af911c3262b9de Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 8 Mar 2017 11:47:02 -0500 Subject: [PATCH 137/471] spooler noise reduction --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6c81cc35..e6c30860 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1006,6 +1006,7 @@ HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed HKCU\SOFTWARE\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\SearchProtocolHost.exe + HKLM\System\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports From 895df80ffc72ad1a4931863e1103a86d18b1def1 Mon Sep 17 00:00:00 2001 From: def ccon Date: Thu, 9 Mar 2017 17:05:09 -0500 Subject: [PATCH 138/471] noise reduction --- sysmonconfig-export.xml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e6c30860..7e3b1d1c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -87,6 +87,7 @@ C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\svchost.exe -k netsvcs + C:\WINDOWS\system32\svchost.exe -k GPSvcGroup C:\WINDOWS\System32\svchost.exe -k wsappx C:\Windows\System32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted @@ -176,6 +177,10 @@ C:\Program Files\Lenovo\Lenovo Ultraslim Plus Wireless Keyboard & Mouse\Pelico.exe C:\Program Files\Lenovo\Lenovo Ultraslim Plus Wireless Keyboard & Mouse\LeDaemon.exe C:\Program Files\Lenovo\Lenovo Mouse Suite\ICO.exe + C:\Program Files\Lenovo\Lenovo Mouse Suite\Service\PelElvDm.exe + C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe + C:\Program Files (x86)\Lenovo\System Update\tvsu.exe + C:\Program Files (x86)\Lenovo\System Update\TvsuCommandLauncher.exe C:\Program Files (x86)\SCM\SCM.exe C:\Program Files (x86)\SCM\SCM_Notice.exe @@ -240,10 +245,13 @@ C:\Program Files (x86)\SyncedTool\bin\agent_service.exe C:\Program Files (x86)\Notepad++\notepad++.exe C:\Program Files\OpenVPN\bin\openvpn-gui.exe - C:\Program Files (x86)\Enpass\Enpass.exe + C:\Program Files (x86)\Enpass\Enpass.exe + C:\Program Files (x86)\Enpass\Enpass.exe C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe - C:\Program Files (x86)\Fortinet\FortiClient\scheduler.exe - C:\Program Files (x86)\Fortinet\FortiClient\FCHelper64.exe + C:\Program Files (x86)\Fortinet\FortiClient\scheduler.exe + C:\Program Files (x86)\Fortinet\FortiClient\FCHelper64.exe + C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe + C:\Program Files (x86)\SyncedTool\bin\agent_gui.exe From 898c910ce6eb062edb8ad9c5cd323ad270cd980b Mon Sep 17 00:00:00 2001 From: def ccon Date: Fri, 10 Mar 2017 22:38:33 -0500 Subject: [PATCH 139/471] no need any longer --- extra-NamedPipes.xml | 21 --------------------- 1 file changed, 21 deletions(-) delete mode 100644 extra-NamedPipes.xml diff --git a/extra-NamedPipes.xml b/extra-NamedPipes.xml deleted file mode 100644 index 5f80e333..00000000 --- a/extra-NamedPipes.xml +++ /dev/null @@ -1,21 +0,0 @@ - - - - - - - - C:\Windows\SystemApps\Microsoft.Windows - C:\Windows\system32\SearchProtocolHost.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - - \WRSVCPipe - \WRSynUM2 - C:\Program Files (x86)\Webroot\WRSA.exe - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe - - slack.exe - \ No newline at end of file From 248ff6bac106b2ed9996b33d48a3cf5c5e760b68 Mon Sep 17 00:00:00 2001 From: def ccon Date: Sat, 11 Mar 2017 12:20:42 -0500 Subject: [PATCH 140/471] Microsoft Exclusions --- sysmonconfig-export.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 7e3b1d1c..90467a1d 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -110,6 +110,11 @@ C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE + + C:\Program Files\Microsoft\Exchange Server\V15\Bin\Microsoft.Exchange.Diagnostics.Service.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe + + C:\Windows\System32\ddpcli.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= From 9a3f0dabde1f63be076add635e23b819ece1e033 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 12 Mar 2017 00:31:52 -0500 Subject: [PATCH 141/471] Exclude dns.exe for DC's --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 90467a1d..b1f89522 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -388,6 +388,8 @@ 53 + + C:\Windows\System32\dns.exe true OneDrive.exe Spotify.exe From 42a9a89f8f8f0a0598811429cddac3c52ff12fc7 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 12 Mar 2017 12:02:21 -0400 Subject: [PATCH 142/471] Initial MimiKatz Detection thanks to @Cyb3rWard0g and ProxyBypass Detection thanks to @SwiftOnSecurity --- sysmonconfig-export.xml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b1f89522..155c2b99 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -466,6 +466,14 @@ Unavailable C:\windows\system32\fxsst.dll C:\Windows\System32\wbem\oci.dll + + C:\Windows\System32\WinSCard.dll + C:\Windows\System32\cryptdll.dll + C:\Windows\System32\hid.dll + C:\Windows\System32\samlib.dll + C:\Windows\System32\vaultcli.dll + WMINet_Utils.dll + @@ -825,6 +833,7 @@ \Internet Explorer\Toolbar\ \Internet Explorer\Extensions\ \Browser Helper Objects\ + \ProxyBypass {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ From 2339161c12a8d3001b886d83d584f4ef5456682a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 12 Mar 2017 12:21:44 -0400 Subject: [PATCH 143/471] Add more labtech exclusions --- sysmonconfig-export.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 155c2b99..fe4ca0f5 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -238,6 +238,9 @@ C:\Windows\system32\net1 Share Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname | format-table -autosize" | find /i "vss writer" | find /i "sql server"" C:\Program Files (x86)\LabTech Client\LTClient.exe + C:\Windows\LTSvc\LTSvcMon.exe -sLTService + C:\Windows\LTSvc\LTSvcMon.exe + C:\Windows\LTSvc\LTTray.exe ScreenConnect.WindowsClient.exe C:\Program Files (x86)\SmartGit From b6438302cb04c5f6cac95869091ad7f5cba71fda Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 12 Mar 2017 14:04:59 -0400 Subject: [PATCH 144/471] Disable Inter-Process access Detection, Extremely high IO --- sysmonconfig-export.xml | 58 +++++++++++++++++++++++++---------------- 1 file changed, 36 insertions(+), 22 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index fe4ca0f5..b30c4d1f 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -29,7 +29,7 @@ --> - md5,sha256 + sha256,imphash @@ -512,6 +512,7 @@ Fortinet --> + C:\Windows\System32\backgroundTaskHost.exe C:\Windows\System32\mmc.exe C:\Program Files (x86)\SmartGit syntevo\SmartGit @@ -553,30 +554,43 @@ - + - winword.exe - excel.exe - mspub.exe - msbuild.exe - powerpnt.exe - powershell.exe - VBE7.dll - VBE6.dll + Encourage you to experiment with this feature yourself. + Uses 4mbs+ IO --> + + + + + + + + + + - C:\Windows\System32\lsass.exe - C:\Windows\System32\winlogon.exe - - - C:\Program Files (x86)\Webroot\WRSA.exe - C:\Program Files\Windows Defender\MsMpEng.exe - C:\Program Files\Windows Defender\MsMpEng.exe - C:\Windows\Sysmon.exe - UNKNOWN - C:\Program Files (x86)\ScreenConnect Client - + + + + + + + + + + + + + + + + + + + + + From 3e90beaff80e2338f43c3930864ce01f894be198 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 12 Mar 2017 14:40:21 -0400 Subject: [PATCH 145/471] Add Autoupdater for Sysmon to auto update my sysmon config Hourly --- Auto_Update.bat | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 Auto_Update.bat diff --git a/Auto_Update.bat b/Auto_Update.bat new file mode 100644 index 00000000..1e5aac6c --- /dev/null +++ b/Auto_Update.bat @@ -0,0 +1,5 @@ +@echo on +cd C:\ProgramData\sysmon\ +@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" +sysmon64 -c sysmonconfig-export.xml +exit \ No newline at end of file From 6ddbc751634b1c91c81b572e256c34a7fb6ae027 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 12 Mar 2017 14:40:59 -0400 Subject: [PATCH 146/471] Add Auto Update scheduling to install process --- Install Sysmon.bat | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/Install Sysmon.bat b/Install Sysmon.bat index bf253675..9b419d1e 100644 --- a/Install Sysmon.bat +++ b/Install Sysmon.bat @@ -1,11 +1,28 @@ @echo off +setlocal +set hour=%time:~0,2% +set minute=%time:~3,2% +set /A minute+=2 +if %minute% GTR 59 ( + set /A minute-=60 + set /A hour+=1 +) +if %hour%==24 set hour=00 +if "%hour:~0,1%"==" " set hour=0%hour:~1,1% +if "%hour:~1,1%"=="" set hour=0%hour% +if "%minute:~1,1%"=="" set minute=0%minute% +set tasktime=%hour%:%minute% mkdir C:\ProgramData\sysmon cd C:\ProgramData\sysmon\ echo [+] Downloading Sysmon... @powershell (new-object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon64.exe','C:\ProgramData\sysmon\sysmon64.exe')" echo [+] Downloading Sysmon config... @powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/Auto_Update.bat','C:\ProgramData\sysmon\Auto_Update.bat')" sysmon64.exe -accepteula -i sysmonconfig-export.xml +sc failure Sysmon actions= restart/10000/restart/10000// reset= 120 echo [+] Sysmon Successfully Installed! +echo [+] Creating Auto Update Task set to Hourly.. +SchTasks /Create /RU "NT AUTHORITY\LOCALSERVICE" /SC HOURLY /TN Update_Sysmon_Rules /TR C:ProgramData\sysmon\Auto_Update.bat /ST %tasktime% timeout /t 10 exit \ No newline at end of file From bbdec6087aa350c9c968ace4fe1306a62ad58299 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 12 Mar 2017 14:51:17 -0400 Subject: [PATCH 147/471] Fix typo's --- Install Sysmon.bat | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Install Sysmon.bat b/Install Sysmon.bat index 9b419d1e..43649db0 100644 --- a/Install Sysmon.bat +++ b/Install Sysmon.bat @@ -23,6 +23,6 @@ sysmon64.exe -accepteula -i sysmonconfig-export.xml sc failure Sysmon actions= restart/10000/restart/10000// reset= 120 echo [+] Sysmon Successfully Installed! echo [+] Creating Auto Update Task set to Hourly.. -SchTasks /Create /RU "NT AUTHORITY\LOCALSERVICE" /SC HOURLY /TN Update_Sysmon_Rules /TR C:ProgramData\sysmon\Auto_Update.bat /ST %tasktime% +SchTasks /Create /RU "NT AUTHORITY\LOCALSERVICE" /RL HIGHEST /SC HOURLY /TN Update_Sysmon_Rules /TR C:\ProgramData\sysmon\Auto_Update.bat /ST %tasktime% timeout /t 10 exit \ No newline at end of file From 9f427190f600a7b5321610d8b954885b1cce0d95 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 12 Mar 2017 14:59:41 -0400 Subject: [PATCH 148/471] Update Readme --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index ee5cd3ad..4670bf13 100644 --- a/README.md +++ b/README.md @@ -12,9 +12,11 @@ Pull requests and issue tickets are welcome, and new additions will be credited Note: Exact syntax and filtering choices are deliberate to catch appropriate entries and to have as little performance impact as possible. Sysmon's filtering abilities are different than the built-in Windows auditing features, so often a different approach is taken than the normal static listing of every possible important area. +This now has an Auto Updater script to update to the latest Sysmon config hourly. This is great for mass deployments without having to manually update thousands of systems. + ## Use ## -### Auto-Install ### +### Auto-Install with Auto Update Script:### ~~~~ Install Sysmon.bat ~~~~ From 7c3bcb8e1953c115da07e131647d488073c3455e Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 13 Mar 2017 20:48:12 -0400 Subject: [PATCH 149/471] Exclusions to lower noise in large environment w/servers. --- sysmonconfig-export.xml | 57 +++++++++++++++++++++++++++++++++++------ 1 file changed, 49 insertions(+), 8 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b30c4d1f..9b834fc6 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -393,6 +393,7 @@ C:\Windows\System32\dns.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe true OneDrive.exe Spotify.exe @@ -1036,18 +1037,22 @@ HKLM\System\CurrentControlSet\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\ C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe - + + HKLM\System\CurrentControlSet\Services\LTSvcMon\Start + HKLM\System\CurrentControlSet\Services\LTService\Start + + HKCR\Wow6432Node\CLSID\{F2C2787D-95AB-40D4-942D-298F5F757874}\InprocServer32 C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe - HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed - HKCU\Software\Policies\Microsoft\SystemCertificates\Disallowed - HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\Disallowed - HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed - HKCU\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed - HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed - HKCU\SOFTWARE\Microsoft\SystemCertificates\Disallowed + HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\ + HKCU\Software\Policies\Microsoft\SystemCertificates\ + HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ + HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\ + HKCU\SOFTWARE\Microsoft\EnterpriseCertificates\ + HKLM\SOFTWARE\Microsoft\SystemCertificates\ C:\Windows\SysWOW64\SearchProtocolHost.exe HKLM\System\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnotice @@ -1122,6 +1127,40 @@ + \lsass + \SQLLocal\RTCLOCAL + + \M.E.C.Core.WinRMDataCommunicator.NamedPipe. + c:\windows\system32\inetsrv\w3wp.exe + C:\Windows\syswow64\snmp.exe + C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\BIN\OWSTIMER.EXE + + C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\ParserServer\ParserServer.exe + C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.RpcClientAccess.Service.exe + C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.Store.Service.exe + C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.Store.Worker.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Runtime\1.0\ResourceProfile\contentengine\NodeRunner.exe + + C:\Windows\system32\dns.exe + + C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe + + C:\Program Files\Skype for Business Server 2015\Server\Core\RtcHost.exee + C:\Program Files\Skype for Business Server 2015\OCSMCU\AV Conferencing\AVMCUSvc.exe + C:\Program Files\Skype for Business Server 2015\Server\Health Agent\HealthAgent.exe + C:\Program Files\Skype for Business Server 2015\Server\Core\LysSvc.exe + C:\Program Files\Skype for Business Server 2015\File Transfer Agent\FileTransferAgent.exe + C:\Program Files\Skype for Business Server 2015\Web Conferencing\DataMCUSvc.exe + C:\Program Files\Skype for Business Server 2015\Application Host\OcsAppServerHost.exe + C:\Program Files\Skype for Business Server 2015\Server\Core\ABServer.exe + C:\Program Files\Skype for Business Server 2015\Master Replicator Agent\MasterReplicatorAgent.exe + C:\Program Files\Skype for Business Server 2015\OCSMCU\IM Conferencing\IMMCUSvc.exe + C:\Program Files\Common Files\Skype for Business Server 2015\ClsAgent\ClsAgent.exe + C:\Program Files\Skype for Business Server 2015\Server\Core\ReplicationApp.exe + C:\Program Files\Skype for Business Server 2015\OCSMCU\Application Sharing\ASMCUSvc.exe + C:\Program Files\Skype for Business Server 2015\Server\Replica Replicator Agent\ReplicaReplicatorAgent.exe + + C:\Windows\system32\DFSRs.exee C:\Windows\SystemApps\Microsoft.Windows C:\Windows\system32\SearchProtocolHost.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe @@ -1182,6 +1221,8 @@ C:\Program Files (x86)\Lenovo\System Update\TvsuCommandLauncher.exe C:\Windows\LTSvc\LTSVC.exe + ScreenConnect.WindowsClient.exe + ScreenConnect.ClientService.exe C:\Program Files\OpenVPN\bin\openvpn-gui.exe C:\Program Files\OpenVPN\bin\openvpn.exe C:\Program Files\OpenVPN\bin\openvpnserv.exe From dcedbd30e1955125fabdde8a16a66e19fe9eda2a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 13 Mar 2017 21:02:26 -0400 Subject: [PATCH 150/471] Add Powershell network logging --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 9b834fc6..262b4304 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -297,6 +297,7 @@ C:\Windows\system32\svchost.exe mshta.exe python.exe + powershell.exe psexe pskill psshutdown From af991b2d8d5ae18de4e4062f1e5ce52dd3beaadc Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 13 Mar 2017 21:05:28 -0400 Subject: [PATCH 151/471] Update Readme --- README.md | 169 +----------------------------------------------------- 1 file changed, 1 insertion(+), 168 deletions(-) diff --git a/README.md b/README.md index 4670bf13..ec05f5e0 100644 --- a/README.md +++ b/README.md @@ -50,171 +50,4 @@ sc sdset Sysmon D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;B ### Graylog Configuration ### - -### Sysmon Pipeline Rules ### - -## Stage -1 ## -# sysmon cleanup (gl2_source_fix) # -~~~~ -// This rule is cleaning up the message -// -- It addresses an issue with older filebeat versions, which can have trouble with the 'source' field -// -- The rule will not cause any trouble with filebeat versions that do not have that issue -rule "sysmon cleanup (gl2_source_fix)" -when - is_not_null($message.winlogbeat_fields_gl2_source_collector) -then - set_field("gl2_source_collector", to_string($message.winlogbeat_fields_gl2_source_collector)); - remove_field("winlogbeat_fields_gl2_source_collector"); -end -~~~~ - -# sysmon cleanup # -~~~~ -// Sysmon Installation -// -- Sysmon has to be installed on Windows, and be run with: sysmon –i –accepteula –h md5 –n -l -// -- Transport should be a winlogbeat -// -- Consider using the Graylog Sidecar to manage winlogbeat remotely -rule "sysmon cleanup" -when - // Only run for Sysmon messages - has_field("winlogbeat_source_name") AND contains(to_string($message.winlogbeat_source_name), "Microsoft-Windows-Sysmon") -then - - // Rename some fields to clean up - rename_field("winlogbeat_computer_name", "sysmon_computer_name"); - rename_field("winlogbeat_event_data_Image", "sysmon_data_process"); - rename_field("winlogbeat_event_data_UtcTime", "sysmon_data_utc_time"); - rename_field("winlogbeat_event_id", "sysmon_event_id"); - rename_field("winlogbeat_level", "sysmon_data_level"); - rename_field("winlogbeat_task", "sysmon_task"); - rename_field("winlogbeat_event_data_User", "sysmon_data_user"); - rename_field("winlogbeat_event_data_TargetFilename", "sysmon_data_file_created"); - rename_field("winlogbeat_event_data_CreationUtcTime", "sysmon_data_file_created_time"); - rename_field("winlogbeat_event_data_PreviousCreationUtcTime", "sysmon_data_file_created_time_previous"); - rename_field("winlogbeat_user_name", "sysmon_data_user_name"); - rename_field("winlogbeat_thread_id", "sysmon_thread_id"); - rename_field("winlogbeat_user_domain", "sysmon_user_domain"); - rename_field("winlogbeat_user_identifier", "sysmon_user_identifier"); - rename_field("winlogbeat_user_type", "sysmon_user_type"); - rename_field("winlogbeat_event_data_DestinationHostname", "sysmon_dns_lookup"); - rename_field("winlogbeat_event_data_DestinationIp", "sysmon_dns_lookup_ip"); - rename_field("winlogbeat_event_data_DestinationPort", "sysmon_dest_port"); - rename_field("winlogbeat_event_data_DestinationPortName", "sysmon_dest_port_name"); - rename_field("winlogbeat_event_data_Initiated", "sysmon_con_initiated"); - rename_field("winlogbeat_event_data_Protocol", "sysmon_con_proto"); - rename_field("winlogbeat_event_data_SourceHostname", "sysmon_src_name"); - rename_field("winlogbeat_event_data_SourceIp", "sysmon_src_ip"); - rename_field("winlogbeat_event_data_SourcePort", "sysmon_src_port"); - rename_field("winlogbeat_event_data_SourcePortName", "sysmon_src_port_name"); - rename_field("winlogbeat_event_data_CommandLine", "sysmon_cmd_event"); - rename_field("winlogbeat_event_data_CurrentDirectory", "sysmon_cmd_location"); - rename_field("winlogbeat_event_data_Hashes", "sysmon_cmd_hash"); - rename_field("winlogbeat_event_data_IntegrityLevel", "sysmon_cmd_integrity"); - rename_field("winlogbeat_event_data_LogonId", "sysmon_cmd_logon_id"); - rename_field("winlogbeat_event_data_ParentCommandLine", "sysmon_cmd_parent_cmd"); - rename_field("winlogbeat_event_data_ParentImage", "sysmon_cmd_parent_file"); - rename_field("winlogbeat_event_data_ParentProcessId", "sysmon_cmd_parent_pid"); - rename_field("winlogbeat_event_data_TerminalSessionId", "sysmon_cmd_terminal_pid"); - rename_field("winlogbeat_event_data_LogonGuid", "sysmon_cmd_logon_guid"); - rename_field("winlogbeat_event_data_ParentProcessGuid", "sysmon_cmd_parent_guid"); - rename_field("winlogbeat_event_data_TargetObject", "sysmon_registry_object"); - rename_field("winlogbeat_event_EventType", "sysmon_registry_Type"); - rename_field("winlogbeat_event_data_Details", "sysmon_registry_set"); - rename_field("winlogbeat_event_data_SourceImage", "sysmon_paccess_source_img"); - rename_field("winlogbeat_event_data_SourceProcessGUID", "sysmon_paccess_pguid"); - rename_field("winlogbeat_event_data_SourceProcessId", "sysmon_paccess_pid"); - rename_field("winlogbeat_event_data_SourceThreadId", "sysmon_paccess_threadid"); - rename_field("winlogbeat_event_data_TargetImage", "sysmon_paccess_target_image"); - rename_field("winlogbeat_event_data_TargetProcessGUID", "sysmon_paccess_target_guid"); - rename_field("winlogbeat_event_data_TargetProcessid", "sysmon_paccess_target_pid"); - rename_field("winlogbeat_event_data_DestinationIp_geolocation", "sysmon_dns_lookup_ip_geolocation"); - rename_field("winlogbeat_event_data_PipeName", "sysmon_pipe_name"); - rename_field("winlogbeat_event_data_ProcessId", "sysmon_pipe_pid"); - rename_field("winlogbeat_process_id", "sysmon_img_pid"); - rename_field("winlogbeat_event_data_ImageLoaded", "sysmon_imgloaded"); - rename_field("winlogbeat_event_data_SignatureStatus", "sysmon_signatureStatus"); - rename_field("winlogbeat_event_data_Signed", "sysmon_signed"); - - // Remove clutter. - let fix = regex("^\\{(\\S+)\\}$", to_string($message.winlogbeat_event_data_ProcessGuid)); - set_field("sysmon_data_process_guid", to_string(fix["0"])); - remove_field("winlogbeat_event_data_ProcessGuid"); - - let fix = regex("^\\{(\\S+)\\}$", to_string($message.winlogbeat_provider_guid)); - set_field("sysmon_data_provider_gui", to_string(fix["0"])); - remove_field("winlogbeat_provider_guid"); - - - // Remove unwanted fields - remove_field("name"); - remove_field("tags"); - remove_field("type"); - - // Remove winlogbeats fields we don't need - //remove_field("winlogbeat_event_data_ProcessId"); - //remove_field("winlogbeat_log_name"); - //remove_field("winlogbeat_opcode"); - //remove_field("winlogbeat_process_id"); - //remove_field("winlogbeat_record_number"); - //remove_field("winlogbeat_source_name"); - //remove_field("winlogbeat_tags"); - //remove_field("winlogbeat_type"); - //remove_field("winlogbeat_version"); - //remove_field("winlogbeat_event_data_SourceIsIpv6"); - //remove_field("winlogbeat_event_data_DestinationIsIpv6"); -end -~~~~ - -# Stage 0 # -~~~~ -// Threat Intelligence enrichment -// --- Needs installed Graylog Threat Intel plugin : https://github.com/Graylog2/graylog-plugin-threatintel -rule "sysmon threatintel" -when - // To save CPU cycles, only run if there is something to look up - has_field("sysmon_dns_lookup") OR has_field("sysmon_dns_lookup_ip") OR has_field("sysmon_src_ip") -then - - // look up the requested DNS captured by sysmon - // this will be the most fired rule - let sysmon_dns_lookup_intel = threat_intel_lookup_domain(to_string($message.sysmon_dns_lookup), "sysmon_dns_lookup"); - set_fields(sysmon_dns_lookup_intel); - - // look up the ip from the DNS answer - // if we do not monitor the dns, then this might be nice to have - let sysmon_lookup_ip_answer_intel = threat_intel_lookup_ip(to_string($message.sysmon_dns_lookup_ip), "sysmon_dns_lookup_ip"); - set_fields(sysmon_lookup_ip_answer_intel); - - // look up the requesting IP - // this is useful if dealing with non internal IPs - // so you know if your IP is seen as a problem - let sysmon_src_ip_answer_intel = threat_intel_lookup_ip(to_string($message.sysmon_src_ip), "sysmon_src_ip"); - set_fields(sysmon_src_ip_answer_intel); - - // WHOIS lookup. This is disabled by default. Enable and carefully watch latency and performance. - let sysmon_dns_lookup_ip_whois = whois_lookup_ip(to_string($message.sysmon_dns_lookup_ip), "sysmon_dns_lookup_ip"); - set_fields(sysmon_dns_lookup_ip_whois); - - //AlienVault OTX - let intel = otx_lookup_ip(to_string($message.sysmon_src_ip)); - let intel = otx_lookup_domain(to_string($message.sysmon_dns_lookup_ip)); - set_field("otx_threat_indicated", intel.otx_threat_indicated); - set_field("otx_threat_ids", intel.otx_threat_ids); - set_field("otx_threat_names", intel.otx_threat_names); - -end -~~~~ - -# Stage 1 # -~~~~ -rule "sysmon threatintel inflate" -when - // run only if one of the fields is true - to_bool($message.sysmon_dns_lookup_ip_threat_indicated) OR to_bool($message.sysmon_dns_lookup_threat_indicated) OR to_bool($message.sysmon_src_ip_threat_indicated) OR to_bool($message.otx_threat_indicated) -then - - // This is to make Graylog searches easy - // -- Enables searches like threat_indicated:true - set_field("threat_indicated", true); -end -~~~~ +(https://github.com/ion-storm/Graylog_Sysmon) \ No newline at end of file From 66a59e732e2ceb26102d4ed7f79695ba3d31d473 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 13 Mar 2017 22:37:51 -0400 Subject: [PATCH 152/471] Use pushd in case launching from other drive letter --- Install Sysmon.bat | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Install Sysmon.bat b/Install Sysmon.bat index 43649db0..f79162e0 100644 --- a/Install Sysmon.bat +++ b/Install Sysmon.bat @@ -13,7 +13,7 @@ if "%hour:~1,1%"=="" set hour=0%hour% if "%minute:~1,1%"=="" set minute=0%minute% set tasktime=%hour%:%minute% mkdir C:\ProgramData\sysmon -cd C:\ProgramData\sysmon\ +pushd "C:\ProgramData\sysmon\" echo [+] Downloading Sysmon... @powershell (new-object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon64.exe','C:\ProgramData\sysmon\sysmon64.exe')" echo [+] Downloading Sysmon config... From 4c546f2a9a251b62e7f28d8752228ab29dc27db4 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 17 Mar 2017 13:53:46 -0400 Subject: [PATCH 153/471] Installer Exclusions --- sysmonconfig-export.xml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 262b4304..cf946be1 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -220,7 +220,9 @@ tasklist wmic path win32_operatingsystem get sc queryex type= service - C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe + C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe + C:\Program Files (x86)\StorageCraft\ShadowProtect\ShadowSnap\raw_agent_svc.exe + IscsidscInterface.exe Add-PSSnapin Microsoft.SharePoint.PowerShell find /i "Listening" netstat -an @@ -260,6 +262,10 @@ C:\Program Files (x86)\Fortinet\FortiClient\FCHelper64.exe C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe C:\Program Files (x86)\SyncedTool\bin\agent_gui.exe + sysmonconfig-export.xml + C:\Windows\SYSTEM32\cmd.exe /c "C:\ProgramData\sysmon\Auto_Update.bat" + Install_Sidecar_w_Sysmon.bat + Sysmon actions From 5a45d8919175fcf09e42cd217d086ebdca6c485c Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 17 Mar 2017 13:57:28 -0400 Subject: [PATCH 154/471] exclusion for efolder server --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index cf946be1..13c70066 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -434,6 +434,7 @@ 50646 C:\Program Files (x86)\SmartGit\jre\bin\java.exe C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe + C:\Anchor Server\penv\Scripts\python.exe From 1201e4239fe33867ebfe0406fc6b012b4fac5a7b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 17 Mar 2017 15:18:18 -0400 Subject: [PATCH 155/471] more noise reduction --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 13c70066..4acbe493 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -235,6 +235,8 @@ Get-WmiObject -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType Get-WmiObject -Namespace Root\CimV2\TerminalServices tasklist + vssadmin list writers + vssadmin list writers net view \\localhost | find " Print net view \\localhost | find " Disk C:\Windows\system32\net1 Share From f8360ee25363eab4b3af52a3ddc4d47e23a59821 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 17 Mar 2017 15:30:24 -0400 Subject: [PATCH 156/471] eFolder exclusions --- sysmonconfig-export.xml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 4acbe493..09a42ffe 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -268,6 +268,10 @@ C:\Windows\SYSTEM32\cmd.exe /c "C:\ProgramData\sysmon\Auto_Update.bat" Install_Sidecar_w_Sysmon.bat Sysmon actions + C:\Anchor Server\penv\Scripts\python.exe + C:\Anchor Server\redis\redis-server.exe + C:\Anchor Server\redis\redis-server.exe + C:\PostgreSQL9.1\bin\postgres.exe From 59f102c0713dcf94a9c0752922b58e9caaf57901 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 17 Mar 2017 15:58:49 -0400 Subject: [PATCH 157/471] ProxyBypass, way too much noise, Outlook regularly bypasses proxy settings. --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 09a42ffe..7ab8bed2 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -865,7 +865,6 @@ \Internet Explorer\Toolbar\ \Internet Explorer\Extensions\ \Browser Helper Objects\ - \ProxyBypass {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ From 3d9cb1b121eb2beb532362761314e82f5a41d78b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 17 Mar 2017 22:27:03 -0400 Subject: [PATCH 158/471] switch to contains for anchor server --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 7ab8bed2..e1b8d338 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -440,7 +440,7 @@ 50646 C:\Program Files (x86)\SmartGit\jre\bin\java.exe C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe - C:\Anchor Server\penv\Scripts\python.exe + C:\Anchor Server\penv\Scripts\python.exe @@ -864,8 +864,8 @@ \Internet Explorer\Toolbar\ \Internet Explorer\Extensions\ - \Browser Helper Objects\ + \Browser Helper Objects\ {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ \UrlUpdateInfo From 7074269ef98a42c410da9a26896dc91ec0d15249 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 17 Mar 2017 22:46:27 -0400 Subject: [PATCH 159/471] postgres exclusion --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e1b8d338..1eca16e3 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -540,6 +540,7 @@ C:\Program Files (x86)\AutoSizer\AutoSizer.dll C:\Program Files (x86)\Notepad++ C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe + C:\PostgreSQL9.1\bin\postgres.exe From 31f283519feaafceac9132855df3853e6e21c8c2 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 18 Mar 2017 12:14:58 -0400 Subject: [PATCH 160/471] lower efolder noise --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1eca16e3..429cbcd9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -441,6 +441,8 @@ C:\Program Files (x86)\SmartGit\jre\bin\java.exe C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe C:\Anchor Server\penv\Scripts\python.exe + efolder01 + 2080 From 7c1371bfa8fa1deb432b7f3d66439d433fa7f4d9 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 18 Mar 2017 12:19:55 -0400 Subject: [PATCH 161/471] silence ldap noise --- sysmonconfig-export.xml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 429cbcd9..220cef64 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -424,7 +424,8 @@ .wns.windows.com akamaitechnologies.com llmnr - ldap + ldap + ldap llmnr ssdp ssdp From ac6d7c20c5ca3ddb31406334f38e579a1397fd0f Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 18 Mar 2017 12:22:00 -0400 Subject: [PATCH 162/471] silence ntp --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 220cef64..c3f19f3c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -426,6 +426,8 @@ llmnr ldap ldap + ntp + ntp llmnr ssdp ssdp From 110ee6d35b35c22a9cdee0e19e40e42cb7ea583d Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 18 Mar 2017 17:58:44 -0400 Subject: [PATCH 163/471] Exclude exchange transport --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index c3f19f3c..18844892 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -407,6 +407,7 @@ C:\Windows\System32\dns.exe C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeFrontendTransport.exe true OneDrive.exe Spotify.exe From 7af40f5c335f19f3756b141d7b407e2b839672ff Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 18 Mar 2017 18:12:40 -0400 Subject: [PATCH 164/471] lower shadowprotect & labtech service noise --- sysmonconfig-export.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 18844892..0a0ddf4e 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1058,10 +1058,10 @@ C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe - HKLM\System\CurrentControlSet\Services\LTSvcMon\Start - HKLM\System\CurrentControlSet\Services\LTService\Start + \LTSvcMon\Start + \LTService\Start - HKCR\Wow6432Node\CLSID\{F2C2787D-95AB-40D4-942D-298F5F757874}\InprocServer32 + {F2C2787D-95AB-40D4-942D-298F5F757874} C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\ From a811050d6983f475822c4854a0e18a2ca5b29998 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 18 Mar 2017 18:23:53 -0400 Subject: [PATCH 165/471] Exclude spooled print job file extensions. --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 0a0ddf4e..aab07ea9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -739,6 +739,8 @@ C:\Windows\System32\DriverStore\Temp\ C:\Windows\System32\wbem\Performance\ WRITABLE.TST + .SPL + .SHD C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\ .etl From 83be15c986f0039fa68e0d0550ce4f9c63093200 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 18 Mar 2017 21:24:36 -0400 Subject: [PATCH 166/471] update exclusions --- sysmonconfig-export.xml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index aab07ea9..c9447a43 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -59,6 +59,7 @@ C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows C:\Windows\system32\SearchIndexer.exe + C:\Windows\system32\vssvc.exe C:\Program Files\Windows Defender C:\Windows\System32\CompatTelRunner.exe @@ -236,7 +237,7 @@ Get-WmiObject -Namespace Root\CimV2\TerminalServices tasklist vssadmin list writers - vssadmin list writers + vssadmin list writers net view \\localhost | find " Print net view \\localhost | find " Disk C:\Windows\system32\net1 Share @@ -265,7 +266,7 @@ C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe C:\Program Files (x86)\SyncedTool\bin\agent_gui.exe sysmonconfig-export.xml - C:\Windows\SYSTEM32\cmd.exe /c "C:\ProgramData\sysmon\Auto_Update.bat" + Auto_Update.bat Install_Sidecar_w_Sysmon.bat Sysmon actions C:\Anchor Server\penv\Scripts\python.exe From 9e6e405384fb2ab133e328debc53c35ec7bc716c Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 18 Mar 2017 21:29:06 -0400 Subject: [PATCH 167/471] ignore self --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index c9447a43..123132ff 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -267,6 +267,8 @@ C:\Program Files (x86)\SyncedTool\bin\agent_gui.exe sysmonconfig-export.xml Auto_Update.bat + Sysmon64 + Sysmon Install_Sidecar_w_Sysmon.bat Sysmon actions C:\Anchor Server\penv\Scripts\python.exe From c8f893dac5d9ca769fd141191849800cf08c73e6 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 19 Mar 2017 13:54:17 -0400 Subject: [PATCH 168/471] update exclusions --- sysmonconfig-export.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 123132ff..cc143f2a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -222,7 +222,8 @@ wmic path win32_operatingsystem get sc queryex type= service C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe - C:\Program Files (x86)\StorageCraft\ShadowProtect\ShadowSnap\raw_agent_svc.exe + raw_agent_svc.exe + raw_agent_svc.exe IscsidscInterface.exe Add-PSSnapin Microsoft.SharePoint.PowerShell find /i "Listening" @@ -311,7 +312,6 @@ regsvr32.exe C:\Windows\system32\svchost.exe mshta.exe - python.exe powershell.exe psexe pskill @@ -447,7 +447,7 @@ 50646 C:\Program Files (x86)\SmartGit\jre\bin\java.exe C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe - C:\Anchor Server\penv\Scripts\python.exe + penv\Scripts\python.exe efolder01 2080 From 1925219eb70c673a08f1fc2f6ec014ee62ec67c1 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 20 Mar 2017 13:52:21 -0400 Subject: [PATCH 169/471] Add Quickbooks pipe exclusion --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index cc143f2a..6d6cc40d 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1272,6 +1272,7 @@ C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgrhv.exe C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmware-vmrc.exe + SQLAnywhereLRM From 7cd0c83e5b81cd5a3b3d59913c87a1ba94c972bd Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 20 Mar 2017 13:55:57 -0400 Subject: [PATCH 170/471] SQL Pipe Exclusions --- sysmonconfig-export.xml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6d6cc40d..8e1adf69 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1273,6 +1273,10 @@ C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmware-vmrc.exe SQLAnywhereLRM + pgsignal + MICROSOFT##WID\tsql\query + TSVCPIPE- + From f1223c602329d91dc1ea892743b18f891099bfd9 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 20 Mar 2017 13:59:25 -0400 Subject: [PATCH 171/471] Exchange filecreate exclusion --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 8e1adf69..ec8aeef5 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -742,6 +742,7 @@ C:\Windows\System32\DriverStore\Temp\ C:\Windows\System32\wbem\Performance\ WRITABLE.TST + .SQM .SPL .SHD From a1213ea443b8183f8f676e1aa99a6e9e2fffaf8f Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 20 Mar 2017 14:16:32 -0400 Subject: [PATCH 172/471] Exchange Exclusions --- sysmonconfig-export.xml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ec8aeef5..f9b39acb 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -411,6 +411,10 @@ C:\Windows\System32\dns.exe C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeFrontendTransport.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\EdgeTransport.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeSubmission.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeFrontendTransport.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeDelivery.exe true OneDrive.exe Spotify.exe From cb1916e0fb82c25c186027bd46075fc31ac84341 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 20 Mar 2017 14:20:23 -0400 Subject: [PATCH 173/471] gotomeeting exclusion --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f9b39acb..37d7d9bb 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -454,6 +454,7 @@ penv\Scripts\python.exe efolder01 2080 + g2mcomm.exe From c867e4306da38e7ce9c777cbf3e3c0ccddd95957 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Mar 2017 09:15:49 -0400 Subject: [PATCH 174/471] too much noise from helpdesk using mmc --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 37d7d9bb..146283fa 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -332,7 +332,6 @@ tftp.exe wmic.exe net.exe - C:\windows\system32\mmc.exe nbtstat.exe dsquery.exe driverquery.exe From 2065dea453e078f26abb704acc30e42ac7eba81a Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Mar 2017 13:28:11 -0400 Subject: [PATCH 175/471] additional exclusions and fixes --- sysmonconfig-export.xml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 146283fa..eb6c336d 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -223,8 +223,9 @@ sc queryex type= service C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe raw_agent_svc.exe - raw_agent_svc.exe + raw_agent_svc.exe IscsidscInterface.exe + IscsidscInterface.exe Add-PSSnapin Microsoft.SharePoint.PowerShell find /i "Listening" netstat -an @@ -276,6 +277,7 @@ C:\Anchor Server\redis\redis-server.exe C:\Anchor Server\redis\redis-server.exe C:\PostgreSQL9.1\bin\postgres.exe + C:\PostgreSQL9.1\bin\postgres.exe From ae116f3de17a0ca978b441e451a76651116df542 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Mar 2017 14:01:24 -0400 Subject: [PATCH 176/471] Add Additional UAC thanks to Florian Roth --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index eb6c336d..357a1a1a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -980,8 +980,10 @@ \batfile\shell\open\command \piffile\shell\open\command \exefile\shell\open\command + Classes\exefile\shell\runas\command\isolatedCommand \piffile\shell\open\command \regfile\shell\open\command + \mscfile\shell\open\command \InprocServer32 HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ From 3d6e45f2f051bbcd2735b36ed70c1e84902199ff Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Mar 2017 14:05:53 -0400 Subject: [PATCH 177/471] title: Suspicious Program Location with Network Connections status: experimental description: Detects programs with network connections running in suspicious files system locations reference: https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo Credit: Florian Roth date: 2017/03/19 --- sysmonconfig-export.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 357a1a1a..1454fca3 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -303,6 +303,11 @@ C:\Users C:\ProgramData C:\Windows\Temp + C:\Perflogs\ + config\systemprofile\ + \Windows\Fonts\ + \Windows\IME\ + \Windows\addins\ at.exe certutil.exe From dc28c8c7faf3ea2ea7c1552c94f0fd9c25291c02 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Mar 2017 14:20:18 -0400 Subject: [PATCH 178/471] title: Suspicious Typical Malware Back Connect Ports status: experimental description: Detects programs that connect to typical malware back connetc ports based on statistical analysis from two different sandbox system databases reference: https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo author: Florian Roth date: 2017/03/19 --- sysmonconfig-export.xml | 55 +++++++++++++++++++++++++++++++++++++++-- 1 file changed, 53 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1454fca3..be41d166 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -306,7 +306,7 @@ C:\Perflogs\ config\systemprofile\ \Windows\Fonts\ - \Windows\IME\ + \Windows\IME\ \Windows\addins\ at.exe @@ -410,7 +410,57 @@ 3128 9001 9030 - 53 + 4443 + 2448 + 8143 + 1777 + 1443 + 243 + 65535 + 13506 + 3360 + 200 + 198 + 49180 + 13507 + 3360 + 6625 + 4444 + 4438 + 1904 + 13505 + 13504 + 12102 + 9631 + 5445 + 2443 + 777 + 13394 + 13145 + 12103 + 5552 + 3939 + 3675 + 666 + 473 + 5649 + 4455 + 4433 + 1817 + 100 + 65520 + 1960 + 1515 + 743 + 700 + 14154 + 14103 + 14102 + 12322 + 10101 + 7210 + 4040 + 9943 @@ -511,6 +561,7 @@ C:\Windows\System32\samlib.dll C:\Windows\System32\vaultcli.dll WMINet_Utils.dll + \Temp\ From 7237476c94badc54e9b1b701eed84db0ba6e1f70 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Mar 2017 16:18:30 -0400 Subject: [PATCH 179/471] test load with 80/443 --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index be41d166..1f2e9d37 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -391,6 +391,8 @@ tor-gateways.de hiddenservice.net + 80 + 443 3389 3540 22 From a5bf0f53dd569890a51e1ffb4612ebdab0b55167 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Mar 2017 16:24:49 -0400 Subject: [PATCH 180/471] I want to see when everything Updates, can use graylog to filter it out. --- sysmonconfig-export.xml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1f2e9d37..ba7f8594 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -267,12 +267,6 @@ C:\Program Files (x86)\Fortinet\FortiClient\FCHelper64.exe C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe C:\Program Files (x86)\SyncedTool\bin\agent_gui.exe - sysmonconfig-export.xml - Auto_Update.bat - Sysmon64 - Sysmon - Install_Sidecar_w_Sysmon.bat - Sysmon actions C:\Anchor Server\penv\Scripts\python.exe C:\Anchor Server\redis\redis-server.exe C:\Anchor Server\redis\redis-server.exe From 281170e6427b0ce5925b3a220213ac3eef717a03 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Mar 2017 16:56:14 -0400 Subject: [PATCH 181/471] lets test log all web browsing connectivity for graylog threat detection --- sysmonconfig-export.xml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ba7f8594..824513f2 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -302,6 +302,12 @@ \Windows\Fonts\ \Windows\IME\ \Windows\addins\ + chrome.exe + iexplore.exe + firefox.exe + MicrosoftEdgeCP.exe + MicrosoftEdge.exe + explorer.exe at.exe certutil.exe From 55f23ea1c9f342f8aedadcbe6172a037d8ed7762 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Mar 2017 17:03:21 -0400 Subject: [PATCH 182/471] exclude Labtech connectivity --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 824513f2..101ef6a2 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -513,6 +513,8 @@ efolder01 2080 g2mcomm.exe + C:\Program Files (x86)\LabTech Client\LTClient.exe + C:\Windows\LTSvc\LTSVC.exe From 62254ac33434d3574730eefe7b37bf7b36c3bd03 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Mar 2017 17:04:17 -0400 Subject: [PATCH 183/471] Exclude webroot calling home --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 101ef6a2..9e05094c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -515,6 +515,7 @@ g2mcomm.exe C:\Program Files (x86)\LabTech Client\LTClient.exe C:\Windows\LTSvc\LTSVC.exe + C:\Program Files (x86)\Webroot\WRSA.exe From bcf3103e9089edfbbacbcf09e1f561209092398b Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Mar 2017 17:05:42 -0400 Subject: [PATCH 184/471] exclude search protocol host --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 9e05094c..47d0a9be 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -473,6 +473,7 @@ C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeSubmission.exe C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeFrontendTransport.exe C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeDelivery.exe + C:\Windows\SysWOW64\SearchProtocolHost.exe true OneDrive.exe Spotify.exe From 34f3ff619468395cd0594c1c6a3f78d17c609466 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 21 Mar 2017 17:06:35 -0400 Subject: [PATCH 185/471] add smartgit exclusion --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 47d0a9be..974764dc 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -517,6 +517,7 @@ C:\Program Files (x86)\LabTech Client\LTClient.exe C:\Windows\LTSvc\LTSVC.exe C:\Program Files (x86)\Webroot\WRSA.exe + C:\Program Files (x86)\SmartGit\ From 5215027b7facf5063a6b24f0c8825c00f9732a93 Mon Sep 17 00:00:00 2001 From: def ccon Date: Fri, 24 Mar 2017 09:27:48 -0400 Subject: [PATCH 186/471] Localservice didnt have enough rights, SYSTEM ensures file gets updated. --- Install Sysmon.bat | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Install Sysmon.bat b/Install Sysmon.bat index f79162e0..fb5a3034 100644 --- a/Install Sysmon.bat +++ b/Install Sysmon.bat @@ -23,6 +23,6 @@ sysmon64.exe -accepteula -i sysmonconfig-export.xml sc failure Sysmon actions= restart/10000/restart/10000// reset= 120 echo [+] Sysmon Successfully Installed! echo [+] Creating Auto Update Task set to Hourly.. -SchTasks /Create /RU "NT AUTHORITY\LOCALSERVICE" /RL HIGHEST /SC HOURLY /TN Update_Sysmon_Rules /TR C:\ProgramData\sysmon\Auto_Update.bat /ST %tasktime% +SchTasks /Create /RU SYSTEM /RL HIGHEST /SC HOURLY /TN Update_Sysmon_Rules /TR C:\ProgramData\sysmon\Auto_Update.bat /F /ST %tasktime% timeout /t 10 exit \ No newline at end of file From 35d79d57970a05ab49e7a00f952114a712b07418 Mon Sep 17 00:00:00 2001 From: def ccon Date: Fri, 24 Mar 2017 17:02:05 -0400 Subject: [PATCH 187/471] exchange exclusion --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 974764dc..c8d483dc 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -114,6 +114,7 @@ C:\Program Files\Microsoft\Exchange Server\V15\Bin\Microsoft.Exchange.Diagnostics.Service.exe C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe + C:\Program Files\Microsoft\Exchange Server\V14\Scripts\CheckDatabaseRedundancy.ps1 C:\Windows\System32\ddpcli.exe From 96f0409a6dbf09b5de44428a60e34b1e2843b4d6 Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 28 Mar 2017 13:21:20 -0400 Subject: [PATCH 188/471] exclusions --- sysmonconfig-export.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index c8d483dc..e0dc8610 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -89,6 +89,7 @@ C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k GPSvcGroup + C:\Windows\System32\svchost.exe -k tapisrv C:\WINDOWS\System32\svchost.exe -k wsappx C:\Windows\System32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted @@ -220,6 +221,7 @@ find /i "Listening" netstat -an tasklist + interface tcp show global wmic path win32_operatingsystem get sc queryex type= service C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe @@ -519,6 +521,7 @@ C:\Windows\LTSvc\LTSVC.exe C:\Program Files (x86)\Webroot\WRSA.exe C:\Program Files (x86)\SmartGit\ + DSPro\Programs\pr001Celery98.exe From 313108838f36c4113d8ae5c346665e82fcb35f5d Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 29 Mar 2017 15:58:18 -0400 Subject: [PATCH 189/471] no longer needed, check other repo --- Graylog_Content_Pack/new_content_pack.json | 1 - 1 file changed, 1 deletion(-) delete mode 100644 Graylog_Content_Pack/new_content_pack.json diff --git a/Graylog_Content_Pack/new_content_pack.json b/Graylog_Content_Pack/new_content_pack.json deleted file mode 100644 index ba945195..00000000 --- a/Graylog_Content_Pack/new_content_pack.json +++ /dev/null @@ -1 +0,0 @@ -{"name":"Sysmon Threat Intelligence","description":"Threat intelligence with Sysmon","category":"threat intel, dfir, sysmon","inputs":[],"streams":[],"outputs":[],"dashboards":[{"title":"Sysmon Threat Intelligence","description":"Windows Information Board","dashboard_widgets":[{"description":"Task (registered 24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_task","show_pie_chart":false,"query":"_exists_:sysmon_task","show_data_table":true},"col":4,"row":3,"height":2,"width":1},{"description":"Target Location (24h)","type":"org.graylog.plugins.map.widget.strategy.MapWidgetStrategy","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_dns_lookup_ip_geolocation","query":"_exists_:sysmon_dns_lookup_ip_geolocation"},"col":2,"row":1,"height":2,"width":2},{"description":"Integrity (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_cmd_integrity","show_pie_chart":false,"query":"_exists_:sysmon_cmd_integrity","show_data_table":true},"col":4,"row":5,"height":2,"width":1},{"description":"DNS Lookup (24h)","type":"QUICKVALUES","cache_time":100,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_dns_lookup","show_pie_chart":false,"query":"_exists_:sysmon_dns_lookup","show_data_table":true},"col":1,"row":4,"height":3,"width":1},{"description":"Event ID (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_event_id","show_pie_chart":true,"query":"_exists_:sysmon_event_id","show_data_table":false},"col":1,"row":2,"height":2,"width":1},{"description":"Programs (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_data_process","show_pie_chart":false,"query":"_exists_:sysmon_data_process","show_data_table":true},"col":2,"row":3,"height":3,"width":1},{"description":"Threat Lookups (24h)","type":"SEARCH_RESULT_COUNT","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"lower_is_better":false,"trend":true,"query":"_exists_:sysmon_task AND _exists_:sysmon_dns_lookup_ip_threat_indicated"},"col":4,"row":1,"height":1,"width":1},{"description":"User Acting (24h)","type":"QUICKVALUES","cache_time":1000,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_user_type","show_pie_chart":false,"query":"_exists_: sysmon_user_type","show_data_table":true},"col":4,"row":2,"height":1,"width":1},{"description":"Threat Indicated (24h)","type":"SEARCH_RESULT_COUNT","cache_time":10,"configuration":{"timerange":{"type":"relative","range":86400},"lower_is_better":true,"trend":true,"query":"_exists_:sysmon_task AND sysmon_src_ip_threat_indicated:true"},"col":1,"row":1,"height":1,"width":1},{"description":"Unidentified Files Created","type":"QUICKVALUES","cache_time":10,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_data_file_created","show_pie_chart":false,"query":"_exists_:sysmon_data_file_created","show_data_table":true},"col":5,"row":1,"height":3,"width":1},{"description":"Registry Change Locations","type":"QUICKVALUES","cache_time":10,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_registry_object","show_pie_chart":false,"query":"_exists_:sysmon_registry_object","show_data_table":true},"col":5,"row":4,"height":3,"width":1},{"description":"Top Command Line Events","type":"QUICKVALUES","cache_time":10,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_cmd_event","show_pie_chart":false,"query":"_exists_:sysmon_cmd_event","show_data_table":true},"col":3,"row":3,"height":3,"width":1},{"description":"Alternate Data Streams Detected","type":"QUICKVALUES","cache_time":10,"configuration":{"timerange":{"type":"relative","range":86400},"field":"sysmon_data_file_created","show_pie_chart":false,"query":"_exists_:sysmon_data_file_created AND sysmon_task:\"File stream created (rule: FileCreateStreamHash)\"","show_data_table":true},"col":2,"row":6,"height":3,"width":1}]}],"grok_patterns":[]} \ No newline at end of file From cf252ee57fe8e77737964134f477690500063043 Mon Sep 17 00:00:00 2001 From: def ccon Date: Fri, 31 Mar 2017 08:43:25 -0400 Subject: [PATCH 190/471] exclusions --- sysmonconfig-export.xml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e0dc8610..672850c2 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -251,6 +251,8 @@ C:\Windows\LTSvc\LTSvcMon.exe -sLTService C:\Windows\LTSvc\LTSvcMon.exe C:\Windows\LTSvc\LTTray.exe + Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall + interface tcp show global ScreenConnect.WindowsClient.exe C:\Program Files (x86)\SmartGit @@ -1057,6 +1059,11 @@ \FriendlyName HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} + SOFTWARE\Classes\Wow6432Node\CLSID\{955C0D7D-042E-4034-9D54-EBD52477A6DB}\ + SOFTWARE\Classes\Wow6432Node\CLSID\{BEACC58F-E643-4e97-B19E-95F6EE3500FA}\ + SOFTWARE\Classes\Wow6432Node\CLSID\{07598BD3-ABBE-4bee-959F-7B90253EADFF}\ + SOFTWARE\Classes\Wow6432Node\CLSID\{31240348-66EE-4F14-A42A-39F373A834C7}\ + SOFTWARE\Classes\Wow6432Node\CLSID\{8C8EC235-0786-4DAD-A957-1A6CD76C28F5}\ From 650fc77750bfc794600470e92193bcb0974ff52a Mon Sep 17 00:00:00 2001 From: def ccon Date: Fri, 31 Mar 2017 10:05:48 -0400 Subject: [PATCH 191/471] pipe exclusions --- sysmonconfig-export.xml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 672850c2..7d02aff3 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1235,7 +1235,7 @@ - \lsass + lsass \SQLLocal\RTCLOCAL \M.E.C.Core.WinRMDataCommunicator.NamedPipe. @@ -1359,7 +1359,10 @@ pgsignal MICROSOFT##WID\tsql\query TSVCPIPE- - + BB4BB19A178C25D1 + SQLAnywhereLRM + SQLLocal + DropboxPipe_ From 90582eb4a71d25fec56d16ba3240dff61343f779 Mon Sep 17 00:00:00 2001 From: def ccon Date: Fri, 31 Mar 2017 10:12:20 -0400 Subject: [PATCH 192/471] pipe exclusions --- sysmonconfig-export.xml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 7d02aff3..076c9d70 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1267,6 +1267,7 @@ C:\Program Files\Skype for Business Server 2015\Server\Core\ReplicationApp.exe C:\Program Files\Skype for Business Server 2015\OCSMCU\Application Sharing\ASMCUSvc.exe C:\Program Files\Skype for Business Server 2015\Server\Replica Replicator Agent\ReplicaReplicatorAgent.exe + C:\Program Files\Skype for Business Server 2015\Server\Core\RtcHost.exe C:\Windows\system32\DFSRs.exee C:\Windows\SystemApps\Microsoft.Windows @@ -1357,12 +1358,22 @@ C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmware-vmrc.exe SQLAnywhereLRM pgsignal + postgres.exe MICROSOFT##WID\tsql\query TSVCPIPE- BB4BB19A178C25D1 SQLAnywhereLRM SQLLocal DropboxPipe_ + c:\windows\system32\inetsrv\w3wp.exe + C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\mfcesd.exe + C:\Pfx Engagement\WM\PFXEngagement.exe + C:\Pfx Engagement\WM\PfxEngagement.exe + C:\Pfx Engagement\WM\Pfx.KnowledgeCoach.SharedServices.exe + C:\Program Files (x86)\Micro Focus\COBOL Server 2012\bin\mfds.exe + ScreenConnect.WindowsClient.exe + ScreenConnect.ClientService.exe + QBW32.EXE From cfd4f2089a2bb4e273d29ff1e57b8e5a64515017 Mon Sep 17 00:00:00 2001 From: def ccon Date: Fri, 31 Mar 2017 11:05:21 -0400 Subject: [PATCH 193/471] silence domain login scripts --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 076c9d70..4547617a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -60,6 +60,7 @@ %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\vssvc.exe + net use C:\Program Files\Windows Defender C:\Windows\System32\CompatTelRunner.exe From 17934779552e21224c7ccffd57c38df6dc37a2d8 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 12 Apr 2017 10:47:42 -0400 Subject: [PATCH 194/471] Fix Webroot threat detection --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 4547617a..c5974061 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -999,8 +999,8 @@ HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR - HKLM\SOFTWARE\WOW6432Node\WRData\Threats\Active - HKLM\SOFTWARE\WOW6432Node\WRData\Threats\History + \WRData\Threats\Active + \WRData\Threats\History HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL From 9284c0caff438e109bcd7955153c5f5d9a8ff05d Mon Sep 17 00:00:00 2001 From: def ccon Date: Tue, 8 Aug 2017 08:41:01 -0400 Subject: [PATCH 195/471] update --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index c5974061..669403a0 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -725,6 +725,8 @@ .appref-ms .rdp .vbs + .*proj + .sln C:\Users\Default C:\Windows\System32\Drivers C:\Windows\SysWOW64\Drivers From 873e28c1d81235bfd54efec0599b0c28deedec07 Mon Sep 17 00:00:00 2001 From: def ccon Date: Wed, 13 Sep 2017 10:08:59 -0400 Subject: [PATCH 196/471] Initial WMI Filtering --- sysmonconfig-export.xml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 669403a0..6f8eecc5 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -26,9 +26,11 @@ NOTE: "Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path. "ProcessGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual process launches. "LoginGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual user sessions. + + FILTER REFERENCE: is,is not,contains,excludes,begin with,end with,less than,more than,image --> - + sha256,imphash @@ -1378,6 +1380,11 @@ ScreenConnect.ClientService.exe QBW32.EXE - + + + + + + From c2023f7b5643606c0ce5dfe7ae9e0605813d95f1 Mon Sep 17 00:00:00 2001 From: def ccon Date: Mon, 18 Sep 2017 14:05:01 -0400 Subject: [PATCH 197/471] Exclude: Trusted Driver/Library Loads. --- sysmonconfig-export.xml | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6f8eecc5..ee1c9bf2 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -546,6 +546,7 @@ microsoft + Microsoft Windows windows Intel Lenovo @@ -559,7 +560,16 @@ Logitech Asmedia SteelSeries - Fortinet + Fortinet + Webroot + NoVirusThanks Company Srl + Invincea + ShoreTel + Synology + Citrix + SonicWall + Sophos + OpenVPN @@ -614,7 +624,23 @@ Fortinet --> - C:\Windows\System32\backgroundTaskHost.exe + microsoft + Microsoft Windows + windows + Intel + Lenovo + Synaptic + Nvidia + Broadcom + AMD + VMware + Realtek + Micro-Star + Logitech + Asmedia + SteelSeries + Fortinet C:\Windows\System32\backgroundTaskHost.exe + Webroot C:\Windows\System32\backgroundTaskHost.exe C:\Windows\System32\mmc.exe C:\Program Files (x86)\SmartGit syntevo\SmartGit From d15a85f9e7979ef9d5adc34c432886cc3210ff72 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 4 Dec 2017 09:48:38 -0500 Subject: [PATCH 198/471] Misc updates --- sysmonconfig-export.xml | 73 ++++++++++++++++++++++++++++++++++++----- 1 file changed, 64 insertions(+), 9 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ee1c9bf2..5ca43ea8 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -281,7 +281,6 @@ C:\PostgreSQL9.1\bin\postgres.exe C:\PostgreSQL9.1\bin\postgres.exe - @@ -581,12 +580,12 @@ C:\windows\system32\fxsst.dll C:\Windows\System32\wbem\oci.dll - C:\Windows\System32\WinSCard.dll - C:\Windows\System32\cryptdll.dll - C:\Windows\System32\hid.dll - C:\Windows\System32\samlib.dll - C:\Windows\System32\vaultcli.dll - WMINet_Utils.dll + + + + + + \Temp\ @@ -639,11 +638,19 @@ Logitech Asmedia SteelSeries - Fortinet C:\Windows\System32\backgroundTaskHost.exe - Webroot C:\Windows\System32\backgroundTaskHost.exe + Fortinet + C:\Windows\System32\backgroundTaskHost.exe + Webroot + C:\Windows\System32\backgroundTaskHost.exe C:\Windows\System32\mmc.exe + C:\Windows\System32\SearchFilterHost.exe + C:\Windows\System32\SearchProtocolHost.exe + samlib.dll C:\Program Files (x86)\SmartGit syntevo\SmartGit + Labtech Client + CrystalDecisions + ShoreWare C:\Windows\System32\backgroundTaskHost.exe C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe C:\Program Files @@ -729,17 +736,29 @@ \Content.Outlook\ \Downloads\ .dll + .ocx .sys .application .appref-ms .bat .cmd + .com + .btm .cmdline .docm .exe .hta + .ws + .wsf + .wsh .pptm .ps1 + .ps1xml + .psc1 + .psd1 + .psm1 + .pssc + .cdxml .sys .reg .docm @@ -753,6 +772,9 @@ .appref-ms .rdp .vbs + .vb + .vbsript + .vbe .*proj .sln C:\Users\Default @@ -769,6 +791,23 @@ C:\Windows\System32\Tasks .cmdline C:\Windows\System32\ + + .ICL + .FON + .FOT + .ico + .lnk + .eml + .msg + .msg + .SCT + .SCR + .SHB + .SHS + .PAF + .JSE + .gadget + .cpl help_decrypt help_restore @@ -1058,6 +1097,8 @@ HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange SOFTWARE\Classes\Wow6432Node\CLSID\{31240348-66EE-4F14-A42A-39F373A834C7}\ SOFTWARE\Classes\Wow6432Node\CLSID\{8C8EC235-0786-4DAD-A957-1A6CD76C28F5}\ + HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll @@ -1349,16 +1391,29 @@ qtsingleapp-enpass- qtsingleapp-enpass- + + eo.ipc. + + C:\Program Files\Windows Firewall Control\wfc.exe Everything Service anchor_gui_agent + + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files (x86)\Lenovo\System Update\SUService.exe C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe C:\Program Files\Lenovo\HOTKEY\shtctky.exe + C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE C:\Windows\System32\LPlatSvc.exe + C:\PROGRA~1\Lenovo\HOTKEY\TPOSD.EXE + C:\Program Files (x86)\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe C:\Program Files (x86)\Lenovo\System Update\TvsuCommandLauncher.exe + + C:\Program Files (x86)\Fortinet\FortiClient\FortiSSLVPNdaemon.exe + + c:\program files (x86)\sophos\sophos ssl vpn client\bin\openvpnserv.exe C:\Windows\LTSvc\LTSVC.exe ScreenConnect.WindowsClient.exe From d7eb8c9be7b621a286a4e6497a9bef3dc51b2575 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 4 Dec 2017 10:26:28 -0500 Subject: [PATCH 199/471] Misc Updates --- sysmonconfig-export.xml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 5ca43ea8..482c4745 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -577,7 +577,7 @@ false Invalid Unavailable - C:\windows\system32\fxsst.dll + C:\windows\system32\fxsst.dll C:\Windows\System32\wbem\oci.dll @@ -623,6 +623,8 @@ Fortinet --> + Valid + C:\Windows\System32\samlib.dll microsoft Microsoft Windows windows @@ -747,6 +749,7 @@ .cmdline .docm .exe + .msc .hta .ws .wsf @@ -775,6 +778,8 @@ .vb .vbsript .vbe + .js + .jse .*proj .sln C:\Users\Default @@ -808,6 +813,7 @@ .JSE .gadget .cpl + .inf help_decrypt help_restore From c948ae1db58cb86be7b6d32285b46cab09fadb3b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 25 Jan 2018 08:03:33 -0500 Subject: [PATCH 200/471] Misc updates --- sysmonconfig-export.xml | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 482c4745..6e107541 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -30,8 +30,8 @@ FILTER REFERENCE: is,is not,contains,excludes,begin with,end with,less than,more than,image --> - - sha256,imphash + + SHA256,IMPHASH @@ -285,6 +285,7 @@ C:\Users + C:\ProgramData OneDrive.exe @@ -537,6 +538,9 @@ C:\Users + C:\ProgramData + C:\Windows\Temp + Sysmon.exe @@ -624,7 +628,8 @@ Valid - C:\Windows\System32\samlib.dll + System32\samlib.dll + System32\cryptdll.dlll microsoft Microsoft Windows windows @@ -929,6 +934,7 @@ Google\Chrome\User Data\Safe Browsing\UrlCsdWhitelist.store_new Google\Chrome\User Data\Safe Browsing\UrlCsdDownloadWhitelist.store_new Google\Chrome\User Data\Safe Browsing\CertCsdDownloadWhitelist.store_new + .default\prefs-1.js @@ -948,6 +954,8 @@ + SysmonDrv + HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Parameters\Rules \CurrentVersion\Run \Group Policy\Scripts \Windows\System\Scripts @@ -1244,11 +1252,14 @@ - + + .default\prefs-1.js + + Content.Outlook Downloads Temp\7z @@ -1405,7 +1416,7 @@ Everything Service anchor_gui_agent - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe + Adobe\ARM\1.0\AdobeARM.exe C:\Program Files (x86)\Lenovo\System Update\SUService.exe C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe @@ -1424,6 +1435,9 @@ C:\Windows\LTSvc\LTSVC.exe ScreenConnect.WindowsClient.exe ScreenConnect.ClientService.exe + + N-able Technologies\Windows Agent\bin\agent.exe + N-able Technologies\AVDefender\EPIntegrationService.exe C:\Program Files\OpenVPN\bin\openvpn-gui.exe C:\Program Files\OpenVPN\bin\openvpn.exe C:\Program Files\OpenVPN\bin\openvpnserv.exe From cb360262380758c4cbd547c3c4447c5635aac0d8 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 25 Jan 2018 09:19:52 -0500 Subject: [PATCH 201/471] Massive Update --- sysmonconfig-export.xml | 332 ++++++++++++++++++++++++++++++++-------- 1 file changed, 265 insertions(+), 67 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6e107541..60ae92a6 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5,41 +5,72 @@ Master project: https://github.com/SwiftOnSecurity/sysmon-config Master license: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text. - Fork version: 100 + Fork version: 150 Fork author: ionstorm Fork project: https://github.com/ion-storm/sysmon-config Fork license: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text. - REQUIRED: Sysmon version 6.00 or higher (due to changes in registry syntax) - https://technet.microsoft.com/en-us/sysinternals/bb545021.aspx + REQUIRED: Sysmon version 7.01 or higher (due to changes in registry syntax and bug-fixes) + https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon + Note that 6.03 and 7.01 have critical fixes for filtering, it's recommended you stay updated. - NOTE: Although this is stable and inclusive, you should periodically check for new versions to ensure best coverage. + NOTE: To collect Sysmon logs centrally for free, see https://aka.ms/WEF. Will need to run command to allow log access to the Network Service: + wevtutil.exe sl Microsoft-Windows-Sysmon/Operational /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;NS) - NOTE: Do not let the imposing size and complexity of this configuration scare you off building your own or customizing it. - This configuration is based around known high-quality event tracing, and thus looks extremely complicated. - Sysmon configurations only have to be a few lines, but significant effort has been invested in front-loading as - much filtering as possible onto the client. This is to make analysis of intrusions possible by hand, and try to - surface anomalous activity as quickly as possible to any technician armed only with Event Viewer. - - NOTE: There is best-effort support for 32-bit systems, but it's not a test scenario and will require your own tuning. + NOTE: Do not let the size and complexity of this configuration discourage you from customizing this or building your own. + This configuration is based around known, high-signal event tracing, and thus appears complicated, but it's only very + detailed. Significant effort over years has been invested in front-loading as much filtering as possible onto the + client. This is to make analysis of intrusions possible by hand, and to try to surface anomalous activity as quickly + as possible to any technician armed only with Event Viewer. Its purpose is to democratize system monitoring for all organizations. - NOTE: "Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path. - "ProcessGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual process launches. - "LoginGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual user sessions. + NOTE: Sysmon is NOT a whitelist solution or HIDS engine, it is a computer change and event logging tool with very basic exclude rules. + Do NOT ignore everything possible. Sysmon's purpose is providing context during a threat or problem investigation. Legitimate + processes are routinely used by threats - do not blindly exclude them. Additionally, be mindful of process-hollowing / imitation. - FILTER REFERENCE: is,is not,contains,excludes,begin with,end with,less than,more than,image + NOTE: Sysmon is not hardened against an attacker with admin rights. Additionally, this configuration offers an attacker, willing + to study it, many ways to evade some of the logging. If you are in a high-threat environment, you should consider a much broader + log-most approach. However, in the vast majority of cases, an attacker will bumble along through multiple behavioral traps which + this configuration monitors, especially in the first minutes. + + TECHNICAL: + - Run sysmon.exe -? for a briefing on Sysmon configuration. + - Sysmon does not support nested/multi-conditional rules. There are only blanket INCLUDE and EXCLUDE. "Exclude" rules override "Include" rules. + - If you only specify exclude for a filtering subsection, everything in that subsection is logged by default. + - Some Sysmon monitoring abilities are not meant for general-purpose use due to their large performance impact, such as ProcessAccess. + - Duplicate or overlapping "Include" rules do not result in duplicate events being logged. + - All characters enclosed by XML tags are always interpreted literally. Sysmon does not support wildcards (*), alternate characters, or RegEx. + - In registry events, the value name is appended to the full key path with a "\" delimiter. Default key values are named "\(Default)" + - "Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path. + - "ProcessGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual process launches. Cleared on service restart. + - "LoginGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual user sessions. Cleared on service restart. + - Sysmon does not track which rule caused an event to be logged. + + TECHNICAL: Filter conditions available for use are: is, is not, contains, excludes, begin with, end with, less than, more than, image + - The "image" filter is usable with any field. Same as "is" but can either match the entire string, or only the text after the last "\" in the string. Credit: @mattifestation + + PERFORMANCE: By using "end with" you can save performance by starting a string match at the end of a line, which usually triggers earlier. --> - - SHA256,IMPHASH + + + md5,sha256 + + + + + + - - - + + avoid user-mode executables imitating other process names to avoid logging, or if malware drops files in an existing directory. + Ultimately, you must weigh CPU time checking many detailed rules, against the risk of malware exploiting the blindness created. + Beware of Masquerading, where attackers imitate the names and paths of legitimate tools. Ideally, you'd use both file path and + code signatures to validate, but Sysmon does not support that. Look into Windows Device Guard for whitelisting support. --> + + + AppContainer C:\Windows\system32\DllHost.exe /Processid @@ -86,7 +117,48 @@ C:\Windows\System32\svchost.exe -k swprv C:\Windows\System32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k NetworkServiceNetworkRestricted - C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc + C:\Windows\system32\svchost.exe -k localServiceNoNetwork + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted + C:\Windows\system32\svchost.exe -k netsvcs -p -s NcaSvc + C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC + C:\Windows\system32\svchost.exe -k netsvcs -s BITS + C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc + C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc + C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc + C:\Windows\system32\svchost.exe -k netsvcs -s SENS + C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv + C:\Windows\system32\svchost.exe -k netsvcs -s Themes + C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt + C:\Windows\system32\svchost.exe -k netsvcs -s gpsvc + C:\Windows\system32\svchost.exe -k netsvcs + C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc + C:\Windows\system32\svchost.exe -k networkService -s Dnscache + C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation + C:\Windows\system32\svchost.exe -k networkService -s NlaSvc + C:\Windows\system32\svchost.exe -k networkService -s TermService + C:\Windows\system32\svchost.exe -k networkService + C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k rPCSS + C:\Windows\system32\svchost.exe -k secsvcs + C:\Windows\system32\svchost.exe -k swprv + C:\Windows\system32\svchost.exe -k unistackSvcGroup + C:\Windows\system32\svchost.exe -k utcsvc + C:\Windows\system32\svchost.exe -k wbioSvcGroup + C:\Windows\system32\svchost.exe -k werSvcGroup + C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC + C:\Windows\system32\svchost.exe -k wsappx C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\svchost.exe -k NetworkService @@ -114,7 +186,13 @@ C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE + C:\Program Files\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE + C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXE + C:\Program Files (x86)\Microsoft Office\Office15\MSOSYNC.EXE + C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe + + C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Microsoft\Exchange Server\V15\Bin\Microsoft.Exchange.Diagnostics.Service.exe C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe @@ -136,6 +214,15 @@ C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe + + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe + + C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\LogTransport2.exe + + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe @@ -152,6 +239,8 @@ C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe + + C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe @@ -170,6 +259,10 @@ C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe + C:\Program Files\Dell\SupportAssist\pcdrcui.exe + C:\Program Files\Dell\SupportAssist\koala.exe + "-outc=C:\ProgramData\Dell\CommandUpdate\inventory.xml" "-logc=C:\ProgramData\Dell\CommandUpdate\scanerrs.xml" "-lang=en" "-enc=UTF-16" C:\Program Files (x86)\Lenovo\System Update\ConfigService.exe @@ -281,13 +374,19 @@ C:\PostgreSQL9.1\bin\postgres.exe C:\PostgreSQL9.1\bin\postgres.exe - + + + + C:\Users C:\ProgramData + + C:\Windows\system32\backgroundTaskHost.exe + TrustedInstaller.exe OneDrive.exe vivaldi.exe chrome.exe @@ -295,13 +394,16 @@ setup - - + + + + + + + + - - - - + C:\Users C:\ProgramData C:\Windows\Temp @@ -325,6 +427,7 @@ rundll32.exe notepad.exe regsvr32.exe + regsvcs.exe C:\Windows\system32\svchost.exe mshta.exe powershell.exe @@ -334,6 +437,7 @@ psservice PsPasswd java.exe + msbuild.exe installutil.exe msiexec.exe reg.exe @@ -350,10 +454,13 @@ nbtstat.exe dsquery.exe driverquery.exe + infDefaultInstall.exe sc.exe auditpol.exe qwinsta.exe rwinsta.exe + + tor.exe githubusercontent.com github.com @@ -471,6 +578,10 @@ 7210 4040 9943 + + 7777 + 9943 + 666 @@ -527,13 +638,19 @@ C:\Program Files (x86)\Webroot\WRSA.exe C:\Program Files (x86)\SmartGit\ DSPro\Programs\pr001Celery98.exe + g2ax_comm_expert.exe + g2mcomm.exe + AppData\Local\Microsoft\Teams\current\Teams.exe - + + - + + + @@ -543,7 +660,12 @@ Sysmon.exe - + + + + - + + + + false @@ -669,7 +794,11 @@ C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe C:\PostgreSQL9.1\bin\postgres.exe - + + + + - - + + + + Disabled by default since including even one entry here activates this component. Reward/performance/rule maintenance decision. + Encourage you to experiment with this feature yourself. [ https://attack.mitre.org/wiki/Technique/T1067 ] --> - - + + + + + - + + + + + \Start Menu @@ -785,8 +922,11 @@ .vbe .js .jse - .*proj + proj .sln + .xls + .ppt + .rft C:\Users\Default C:\Windows\System32\Drivers C:\Windows\SysWOW64\Drivers @@ -799,6 +939,7 @@ C:\Windows\SysWOW64\WindowsPowerShell C:\Windows\Tasks\ C:\Windows\System32\Tasks + C:\Windows\AppPatch\Custom .cmdline C:\Windows\System32\ @@ -901,6 +1042,11 @@ .SQM .SPL .SHD + C:\Program Files (x86)\EMET 5.5\EMET_Service.exe + C:\Windows\system32\mobsync.exe + C:\Windows\Installer\ + + C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\ .etl @@ -935,20 +1081,31 @@ Google\Chrome\User Data\Safe Browsing\UrlCsdDownloadWhitelist.store_new Google\Chrome\User Data\Safe Browsing\CertCsdDownloadWhitelist.store_new .default\prefs-1.js + + C:\Windows\System32\Tasks\Adobe Acrobat Update Task + C:\Windows\System32\Tasks\Adobe Flash Player Updater - - + + + + + - - - - + + + + - - - - + + + + + + + + + @@ -978,7 +1135,6 @@ HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath HKLM\Software\Microsoft\Command Processor\AutoRun @@ -986,6 +1142,8 @@ HKLU\Software\Microsoft\Command Processor\AutoRun HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + UserInitMprLogonScript \Explorer\FileExts\ \shell\install\command\ @@ -1008,6 +1166,8 @@ \CurrentVersion\Shell HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad + \ShowSuperHidden + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ @@ -1018,13 +1178,20 @@ HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ \ProxyServer + Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy + \DisableSecuritySettingsCheck + \3\1206 + \3\2500 + \3\1809 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders + HKLM\SOFTWARE\Microsoft\Netsh HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + EnableFirewall HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ @@ -1057,6 +1224,10 @@ HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 + CurrentVersion\Windows\Load + CurrentVersion\Windows\Run + CurrentVersion\Winlogon\Shell + CurrentVersion\Winlogon\System HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff @@ -1105,6 +1276,7 @@ HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify + \HideSCAHealth HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware @@ -1151,10 +1323,17 @@ SOFTWARE\Classes\Wow6432Node\CLSID\{31240348-66EE-4F14-A42A-39F373A834C7}\ SOFTWARE\Classes\Wow6432Node\CLSID\{8C8EC235-0786-4DAD-A957-1A6CD76C28F5}\ HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + HKLM\SOFTWARE\Microsoft\Tracing\RASAPI32 + + Office Test\ + @@ -1250,12 +1429,15 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnotice - - + + + [ https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/ ] + ADS's are used by browsers and email clients to mark files as originating from the Internet or other foreign sources. + [ https://textslashplain.com/2016/04/04/downloads-and-the-mark-of-the-web/ ] --> + + + .default\prefs-1.js @@ -1314,11 +1496,17 @@ .inf - + + + + - + + + + @@ -1481,11 +1669,21 @@ ScreenConnect.ClientService.exe QBW32.EXE - - - - - + + + + + + + + + + + + + From c4506a3b5897605fe635a5567364bd6d2df266d5 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 25 Jan 2018 09:40:26 -0500 Subject: [PATCH 202/471] more updates --- sysmonconfig-export.xml | 55 ++++++++++++++++++++++++++++++++--------- 1 file changed, 43 insertions(+), 12 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 60ae92a6..8858626e 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -801,16 +801,15 @@ - - C:\Windows\System32\wbem\WmiPrvSE.exe - C:\Windows\System32\svchost.exe - C:\Windows\System32\wininit.exe - C:\Windows\System32\csrss.exe - C:\Windows\System32\services.exe - C:\Windows\System32\winlogon.exe - C:\Windows\System32\audiodg.exe - C:\windows\system32\kernel32.dll + + C:\Windows\system32\wbem\WmiPrvSE.exe + C:\Windows\system32\svchost.exe + C:\Windows\system32\wininit.exe + C:\Windows\system32\csrss.exe + C:\Windows\system32\services.exe + C:\Windows\system32\winlogon.exe + C:\Windows\system32\audiodg.exe + C:\Windows\system32\kernel32.dll Google\Chrome\Application\chrome.exe FireSvc.exe C:\Program Files (x86)\Webroot\WRSA.exe @@ -824,6 +823,10 @@ Encourage you to experiment with this feature yourself. [ https://attack.mitre.org/wiki/Technique/T1067 ] --> + + + + @@ -1335,7 +1338,7 @@ - + Office\root\integration\integrator.exe C:\WINDOWS\system32\backgroundTaskHost.exe @@ -1354,8 +1357,10 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ Toolbar\WebBrowser Toolbar\WebBrowser\ITBar7Height + Toolbar\WebBrowser\ITBar7Layout Toolbar\ShellBrowser\ITBar7Layout Internet Explorer\Toolbar\Locked + Toolbar\WebBrowser\{47833539-D0C5-4125-9FA8-0819E2EAAC93} ShellBrowser \CurrentVersion\Run \CurrentVersion\RunOnce @@ -1403,9 +1408,32 @@ \UserChoice\ProgId \UserChoice\Hash \OpenWithList\MRUList + } 0xFFFF + + HKLM\System\CurrentControlSet\Control\Lsa\Audit\SpecialGroups + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0 + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\PSScriptOrder + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\SOM-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\GPO-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\IsPowershell + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\ExecTime + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0 + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\PSScriptOrder + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\SOM-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\GPO-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\IsPowershell + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\ExecTime + \safer\codeidentifiers\0\HASHES\{ + + + + + } 0xFFFF C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe HKLM\System\CurrentControlSet\Services\DeviceAssociationService\Start HKLM\System\CurrentControlSet\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\ @@ -1427,6 +1455,8 @@ C:\Windows\SysWOW64\SearchProtocolHost.exe HKLM\System\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnotice + HKCR\VLC. + HKCR\iTunes. @@ -1445,6 +1475,7 @@ Content.Outlook Downloads Temp\7z + Startup .vb .application .appref-ms From 4f4553909fe541f0b432f5694320a5bcee94685d Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 26 Jan 2018 10:13:31 -0500 Subject: [PATCH 203/471] Noise Reduction --- sysmonconfig-export.xml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 8858626e..105f0075 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -191,6 +191,7 @@ C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office15\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe + C:\Windows\splwow64.exe C:\Program Files\Windows Media Player\wmpnscfg.exe @@ -349,6 +350,7 @@ C:\Windows\LTSvc\LTTray.exe Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall interface tcp show global + nslookup.exe ScreenConnect.WindowsClient.exe C:\Program Files (x86)\SmartGit @@ -803,6 +805,7 @@ C:\Windows\system32\wbem\WmiPrvSE.exe + C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\system32\svchost.exe C:\Windows\system32\wininit.exe C:\Windows\system32\csrss.exe @@ -813,6 +816,7 @@ Google\Chrome\Application\chrome.exe FireSvc.exe C:\Program Files (x86)\Webroot\WRSA.exe + controls\cef\ConnectWise.exe @@ -1087,6 +1091,8 @@ C:\Windows\System32\Tasks\Adobe Acrobat Update Task C:\Windows\System32\Tasks\Adobe Flash Player Updater + + C:\Program Files (x86)\ConnectWise\PSA.net\ConnectWise.exe @@ -1328,6 +1334,7 @@ HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) HKLM\SOFTWARE\Microsoft\Tracing\RASAPI32 @@ -1360,7 +1367,9 @@ Toolbar\WebBrowser\ITBar7Layout Toolbar\ShellBrowser\ITBar7Layout Internet Explorer\Toolbar\Locked - Toolbar\WebBrowser\{47833539-D0C5-4125-9FA8-0819E2EAAC93} + Toolbar\WebBrowser\{47833539-D0C5-4125-9FA8-0819E2EAAC93} + Toolbar\WebBrowser\{724D43A0-0D85-11D4-9908-00400523E39A} + Toolbar\WebBrowser\ITBar7Layout ShellBrowser \CurrentVersion\Run \CurrentVersion\RunOnce @@ -1457,6 +1466,8 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnotice HKCR\VLC. HKCR\iTunes. + + \Software\NITRO\PRO From 15a51fa88c774b3d6e3e7528f94444caea565de4 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 13 Feb 2018 08:32:45 -0500 Subject: [PATCH 204/471] Update Auto_Update.bat --- Auto_Update.bat | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Auto_Update.bat b/Auto_Update.bat index 1e5aac6c..39d3b0cc 100644 --- a/Auto_Update.bat +++ b/Auto_Update.bat @@ -1,5 +1,5 @@ @echo on cd C:\ProgramData\sysmon\ -@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" sysmon64 -c sysmonconfig-export.xml -exit \ No newline at end of file +exit From 305b45ec31c561fac79d744cb1d60b862959db5b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 16 Feb 2018 21:54:06 -0500 Subject: [PATCH 205/471] add ads exclusions --- sysmonconfig-export.xml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 105f0075..22327537 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -779,6 +779,12 @@ C:\Windows\System32\mmc.exe C:\Windows\System32\SearchFilterHost.exe C:\Windows\System32\SearchProtocolHost.exe + C:\Windows\System32\winspool.drv + C:\Windows\System32\wshqos. + C:\Windows\System32\wow64.dll + C:\Windows\System32\clusapi.dll + C:\Windows\System32\cryptdll.dll + C:\Windows\System32\wow64win.dll samlib.dll C:\Program Files (x86)\SmartGit syntevo\SmartGit From f5e918e6aa4ae70bfb64519fcce0f9b1d90ee9b1 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 16 Feb 2018 22:02:11 -0500 Subject: [PATCH 206/471] add sysmon exclusion --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 22327537..df114639 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -779,6 +779,7 @@ C:\Windows\System32\mmc.exe C:\Windows\System32\SearchFilterHost.exe C:\Windows\System32\SearchProtocolHost.exe + C:\Windows\sysmon64.exe C:\Windows\System32\winspool.drv C:\Windows\System32\wshqos. C:\Windows\System32\wow64.dll From 74e5f40cff2a81ad556c6faeef7f01a9d68c41cb Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 16 Feb 2018 22:15:36 -0500 Subject: [PATCH 207/471] ImageLoad causing too much load in production for now --- sysmonconfig-export.xml | 99 +---------------------------------------- 1 file changed, 2 insertions(+), 97 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index df114639..7fc159a6 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -704,105 +704,10 @@ - - false - Invalid - Unavailable - C:\windows\system32\fxsst.dll - C:\Windows\System32\wbem\oci.dll - - - - - - - - \Temp\ - - - - - - - - - - - - - - - - + - System32\cryptdll.dlll - microsoft - Microsoft Windows - windows - Intel - Lenovo - Synaptic - Nvidia - Broadcom - AMD - VMware - Realtek - Micro-Star - Logitech - Asmedia - SteelSeries - Fortinet - C:\Windows\System32\backgroundTaskHost.exe - Webroot - C:\Windows\System32\backgroundTaskHost.exe - C:\Windows\System32\mmc.exe - C:\Windows\System32\SearchFilterHost.exe - C:\Windows\System32\SearchProtocolHost.exe - C:\Windows\sysmon64.exe - C:\Windows\System32\winspool.drv - C:\Windows\System32\wshqos. - C:\Windows\System32\wow64.dll - C:\Windows\System32\clusapi.dll - C:\Windows\System32\cryptdll.dll - C:\Windows\System32\wow64win.dll - samlib.dll - C:\Program Files (x86)\SmartGit - syntevo\SmartGit - Labtech Client - CrystalDecisions - ShoreWare - C:\Windows\System32\backgroundTaskHost.exe - C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe - C:\Program Files - C:\Windows\assembly\NativeImages - C:\Program Files\WindowsApps - - C:\Program Files (x86)\AutoSizer\AutoSizer.dll - C:\Program Files (x86)\Notepad++ - C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe - C:\PostgreSQL9.1\bin\postgres.exe - + --> lsass \SQLLocal\RTCLOCAL + \spoolss \M.E.C.Core.WinRMDataCommunicator.NamedPipe. c:\windows\system32\inetsrv\w3wp.exe From 7fbbb0230c1829d668eb52bcfd0f460f2d665ef6 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 17 Feb 2018 14:04:58 -0500 Subject: [PATCH 209/471] typo and media filexts exclusions --- sysmonconfig-export.xml | 45 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 44 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index fb00036f..38bdc95a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1312,7 +1312,7 @@ HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit - + \services\clr_optimization_v2.0.50727_32\Start \services\clr_optimization_v2.0.50727_64\Start \services\clr_optimization_v4.0.30319_32\Start @@ -1330,6 +1330,49 @@ \UserChoice\Hash \OpenWithList\MRUList } 0xFFFF + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jxr + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2 + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2 + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2 + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2 + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf HKLM\System\CurrentControlSet\Control\Lsa\Audit\SpecialGroups SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts From e87ff3fb668d956c3ba16d1af046ab614db57fec Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 17 Feb 2018 14:12:48 -0500 Subject: [PATCH 210/471] Add Toshiba Print Driver exclusion --- sysmonconfig-export.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 38bdc95a..f72a333f 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1005,6 +1005,11 @@ C:\Windows\System32\Tasks\Adobe Flash Player Updater C:\Program Files (x86)\ConnectWise\PSA.net\ConnectWise.exe + + C:\Program Files\Datto\Datto Windows Agent\DattoBackupAgent.exe + + C:\Windows\System32\config\systemprofile\TOSHIBA\ + From ea195dfcabad1ded0cc8a8d26d1e363c0efc0363 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 20 Feb 2018 12:00:46 -0500 Subject: [PATCH 211/471] more toshiba exclusions --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f72a333f..15c06661 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1009,7 +1009,7 @@ C:\Program Files\Datto\Datto Windows Agent\DattoBackupAgent.exe C:\Windows\System32\config\systemprofile\TOSHIBA\ - + TOSHIBA\eSTUDIOX\UNIDRV From 47811f36b58e861a884724fde78fbd0acb345e34 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 23 Feb 2018 11:09:47 -0500 Subject: [PATCH 212/471] Removed Sysmon config changes because I update the config hourly, creates too much spam. Additional Exclusions to cut down on spam --- sysmonconfig-export.xml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 15c06661..f7ae01ee 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -588,6 +588,7 @@ C:\Windows\System32\dns.exe + C:\Windows\System32\find.exe C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeFrontendTransport.exe C:\Program Files\Microsoft\Exchange Server\V15\Bin\EdgeTransport.exe @@ -1037,8 +1038,6 @@ - SysmonDrv - HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Parameters\Rules \CurrentVersion\Run \Group Policy\Scripts \Windows\System\Scripts @@ -1428,6 +1427,8 @@ HKCR\iTunes. \Software\NITRO\PRO + + HKLM\SOFTWARE\Wow6432Node\WRData\Status From 34669c5cc8821e6635c1ab92292d3d7039182811 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 23 Feb 2018 11:38:42 -0500 Subject: [PATCH 213/471] More Labtech Exclusions --- sysmonconfig-export.xml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f7ae01ee..2b560199 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -312,9 +312,15 @@ C:\Windows\LTSvc\LTSVC.exe -sLTService C:\Windows\LTSvc\LTSVC.exe + C:\Windows\LTSvc\ find /i "Listening" netstat -an tasklist + nslookup + nbtstat.exe + dsquery + sc query + sc query find /i "Listening" netstat -an tasklist @@ -375,6 +381,7 @@ C:\Anchor Server\redis\redis-server.exe C:\PostgreSQL9.1\bin\postgres.exe C:\PostgreSQL9.1\bin\postgres.exe + C:\ProgramData\sysmon\sysmon64.exe From 0a04f334637a94db8ffeb5b21a292e0f33cbef4c Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 24 Feb 2018 14:56:07 -0500 Subject: [PATCH 214/471] ImageLoad causing too much load in production for now (reverted from commit 74e5f40cff2a81ad556c6faeef7f01a9d68c41cb) Added Exclusions to prevent high cpu load --- Install Sysmon.bat | 4 +- sysmonconfig-export.xml | 99 ++++++++++++++++++++++++++++++++++++++++- 2 files changed, 99 insertions(+), 4 deletions(-) diff --git a/Install Sysmon.bat b/Install Sysmon.bat index fb5a3034..c6cc844c 100644 --- a/Install Sysmon.bat +++ b/Install Sysmon.bat @@ -17,8 +17,8 @@ pushd "C:\ProgramData\sysmon\" echo [+] Downloading Sysmon... @powershell (new-object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon64.exe','C:\ProgramData\sysmon\sysmon64.exe')" echo [+] Downloading Sysmon config... -@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" -@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/Auto_Update.bat','C:\ProgramData\sysmon\Auto_Update.bat')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/Auto_Update.bat','C:\ProgramData\sysmon\Auto_Update.bat')" sysmon64.exe -accepteula -i sysmonconfig-export.xml sc failure Sysmon actions= restart/10000/restart/10000// reset= 120 echo [+] Sysmon Successfully Installed! diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 2b560199..354437eb 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -712,10 +712,105 @@ - + Invalid + Unavailable + C:\windows\system32\fxsst.dll + C:\Windows\System32\wbem\oci.dll + + + + + + + + \Temp\ + + + + + + + + + + + + + + + + - --> + Valid + System32\samlib.dll + System32\cryptdll.dlll + microsoft + Microsoft Windows + windows + Intel + Lenovo + Synaptic + Nvidia + Broadcom + AMD + VMware + Realtek + Micro-Star + Logitech + Asmedia + SteelSeries + Fortinet + C:\Windows\System32\backgroundTaskHost.exe + Webroot + C:\Windows\System32\backgroundTaskHost.exe + C:\Windows\System32\mmc.exe + C:\Windows\System32\SearchFilterHost.exe + C:\Windows\System32\SearchProtocolHost.exe + C:\Windows\sysmon64.exe + C:\Windows\System32\winspool.drv + C:\Windows\System32\wshqos. + C:\Windows\System32\wow64.dll + C:\Windows\System32\clusapi.dll + C:\Windows\System32\cryptdll.dll + C:\Windows\System32\wow64win.dll + samlib.dll + C:\Program Files (x86)\SmartGit + syntevo\SmartGit + Labtech Client + CrystalDecisions + ShoreWare + C:\Windows\System32\backgroundTaskHost.exe + C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe + C:\Program Files + C:\Windows\assembly\NativeImages + C:\Program Files\WindowsApps + + C:\Program Files (x86)\AutoSizer\AutoSizer.dll + C:\Program Files (x86)\Notepad++ + C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe + C:\PostgreSQL9.1\bin\postgres.exe + C:\windows\system32\fxsst.dll C:\Windows\System32\wbem\oci.dll - - - - - - - \Temp\ - - - - - - - - - - - - - - - - Valid @@ -788,18 +747,23 @@ C:\Windows\System32\SearchFilterHost.exe C:\Windows\System32\SearchProtocolHost.exe C:\Windows\sysmon64.exe + C:\Windows\sysmon64.exe + C:\Windows\System32\conhost.exe C:\Windows\System32\winspool.drv C:\Windows\System32\wshqos. C:\Windows\System32\wow64.dll C:\Windows\System32\clusapi.dll C:\Windows\System32\cryptdll.dll C:\Windows\System32\wow64win.dll + C:\Windows\System32\wow64.dll + C:\Windows\System32\spool\ samlib.dll C:\Program Files (x86)\SmartGit syntevo\SmartGit Labtech Client CrystalDecisions ShoreWare + C:\Program Files\Microsoft SQL Server\100\Shared\dbghelp.dll C:\Windows\System32\backgroundTaskHost.exe C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe C:\Program Files @@ -810,6 +774,23 @@ C:\Program Files (x86)\Notepad++ C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe C:\PostgreSQL9.1\bin\postgres.exe + C:\Windows\System32\VSSVC. + C:\Windows\System32\conhost.exe + C:\Windows\System32\NETSTAT.EXE + C:\Windows\System32\inetsrv\w3wp.exe + C:\Windows\System32\tasklist.exe + C:\Windows\System32\nslookup.exe + C:\Windows\System32\find.exe + C:\cs\tools\php\php-cgi.exe + C:\Windows\System32\nbtstat.exe + C:\Windows\System32\dsquery.exe + C:\Windows\System32\netsh.exe + C:\Windows\System32\taskeng.exe + C:\ProgramData\sysmon\sysmon64.exe + SQL Server + SQL Server + Exchange Server + Exchange Server From a6401694778b18bfc10067b2858e2cc182f73051 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 24 Feb 2018 15:05:46 -0500 Subject: [PATCH 216/471] add svchost imgloaded exclusion --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 228a1217..3048cc35 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -776,6 +776,7 @@ C:\PostgreSQL9.1\bin\postgres.exe C:\Windows\System32\VSSVC. C:\Windows\System32\conhost.exe + C:\Windows\System32\svchost.exe C:\Windows\System32\NETSTAT.EXE C:\Windows\System32\inetsrv\w3wp.exe C:\Windows\System32\tasklist.exe From d1ace347d8533e04eed18d5d8b71861d83512f3f Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 24 Feb 2018 15:19:11 -0500 Subject: [PATCH 217/471] more exclusions for imgload --- sysmonconfig-export.xml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 3048cc35..92db4ac1 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -756,6 +756,13 @@ C:\Windows\System32\cryptdll.dll C:\Windows\System32\wow64win.dll C:\Windows\System32\wow64.dll + C:\Windows\System32\pcwum.dll + C:\Windows\System32\kernel32.dll + C:\Windows\System32\user32.dll + C:\Windows\System32\cryptdll.dll + C:\Windows\System32\dns.exe + C:\Windows\System32\zvprtmon5.dll + C:\Windows\System32\termsrv.dll C:\Windows\System32\spool\ samlib.dll C:\Program Files (x86)\SmartGit From 21d0962e31ddda5db57e902c4f780abebd1fe349 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 24 Feb 2018 15:48:23 -0500 Subject: [PATCH 218/471] more imgloaded exclusions --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 92db4ac1..8defc261 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -747,6 +747,7 @@ C:\Windows\System32\SearchFilterHost.exe C:\Windows\System32\SearchProtocolHost.exe C:\Windows\sysmon64.exe + C:\Windows\System32\inetsrv\w3wp.exe C:\Windows\sysmon64.exe C:\Windows\System32\conhost.exe C:\Windows\System32\winspool.drv From 278e23fa7de6b6340f6bc03517a9d2b64c52bd50 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 24 Feb 2018 15:57:51 -0500 Subject: [PATCH 219/471] Add testing Company/Product condition filtering --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 8defc261..162f5877 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -740,6 +740,8 @@ Asmedia SteelSeries Fortinet + Microsoft + Microsoft C:\Windows\System32\backgroundTaskHost.exe Webroot C:\Windows\System32\backgroundTaskHost.exe From c4c6cac7731449122f54a42d94086c6f19c8664a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 27 Feb 2018 10:42:12 -0500 Subject: [PATCH 220/471] Add SQL Server Pipename exclusion --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 162f5877..5a2f60f3 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1627,6 +1627,7 @@ C:\Windows\system32\dns.exe + \sql\query C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Program Files\Skype for Business Server 2015\Server\Core\RtcHost.exee From 0ad4b9971f5dfd82add7a2e6b4a8b1a21314d70a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 8 Mar 2018 09:36:44 -0500 Subject: [PATCH 221/471] silence epmap traffic --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 5a2f60f3..7fc23c07 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -622,6 +622,8 @@ llmnr ldap ldap + epmap + epmap ntp ntp llmnr From 5852d77035b542c5c4e0eca767124c813d554fbf Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 8 Mar 2018 09:44:16 -0500 Subject: [PATCH 222/471] add port 135 exclude --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 7fc23c07..70d5cb56 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -624,6 +624,8 @@ ldap epmap epmap + 135 + 135 ntp ntp llmnr From 84ce0c34e5bbe796488bc0026f5663fc2111a53a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 9 Mar 2018 12:40:30 -0500 Subject: [PATCH 223/471] Enable RDP History Tracking --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 70d5cb56..2337c929 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1274,6 +1274,8 @@ HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR + + HKCU\Software\Microsoft\Terminal Server Client \WRData\Threats\Active From bd3688bd816f7d2f673339eac21c33399624c60b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 9 Mar 2018 12:56:32 -0500 Subject: [PATCH 224/471] remove HKCU --- sysmonconfig-export.xml | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 2337c929..1039d5a5 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1241,23 +1241,23 @@ HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce HKLM\Software\Microsoft\Windows\CurrentVersion\RunService HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load + \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + \Software\Microsoft\Windows NT\CurrentVersion\Windows\load HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 CurrentVersion\Windows\Load CurrentVersion\Windows\Run CurrentVersion\Winlogon\Shell CurrentVersion\Winlogon\System - HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon - HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff + \Software\Policies\Microsoft\Windows\System\Scripts\Logon + \Software\Policies\Microsoft\Windows\System\Scripts\Logoff HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown - HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff - HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup @@ -1272,20 +1272,20 @@ SubnetMask PersistentRoutes - HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU + \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR - HKCU\Software\Microsoft\Terminal Server Client + \Software\Microsoft\Terminal Server Client \WRData\Threats\Active \WRData\Threats\History - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL + \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL - HKCU\Software\Microsoft\Internet Explorer\DOMStorage\ - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage + \Software\Microsoft\Internet Explorer\DOMStorage\ + \Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ + \Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA @@ -1313,16 +1313,16 @@ - HKCU\Software\Classes\mscfile\shell\open\command + \Software\Classes\mscfile\shell\open\command HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot @@ -1515,10 +1515,10 @@ C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\ - HKCU\Software\Policies\Microsoft\SystemCertificates\ + \Software\Policies\Microsoft\SystemCertificates\ HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\ - HKCU\SOFTWARE\Microsoft\EnterpriseCertificates\ + \SOFTWARE\Microsoft\EnterpriseCertificates\ HKLM\SOFTWARE\Microsoft\SystemCertificates\ C:\Windows\SysWOW64\SearchProtocolHost.exe HKLM\System\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports From 6bbb856a481cffcbab638e3f40a8b27095387b40 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 13 Mar 2018 01:12:02 -0400 Subject: [PATCH 225/471] Remove Duplicates --- sysmonconfig-export.xml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1039d5a5..b8f3b8b8 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -173,7 +173,6 @@ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe - C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe @@ -320,7 +319,6 @@ nbtstat.exe dsquery sc query - sc query find /i "Listening" netstat -an tasklist @@ -639,7 +637,6 @@ 5357 3544 3702 - 3702 50646 C:\Program Files (x86)\SmartGit\jre\bin\java.exe C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe @@ -968,7 +965,6 @@ .lnk .eml .msg - .msg .SCT .SCR .SHB @@ -1744,7 +1740,6 @@ C:\Program Files (x86)\SmartGit\git\mingw32\bin\git.exe C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git.exe C:\Program Files (x86)\SmartGit\bin\smartgit.exe - C:\Program Files (x86)\SmartGit\bin\smartgit.exe Anonymous Pipe C:\Program Files (x86)\Fortinet\FortiClient\FortiESNAC.exe C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe @@ -1767,7 +1762,6 @@ c:\windows\system32\inetsrv\w3wp.exe C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\mfcesd.exe C:\Pfx Engagement\WM\PFXEngagement.exe - C:\Pfx Engagement\WM\PfxEngagement.exe C:\Pfx Engagement\WM\Pfx.KnowledgeCoach.SharedServices.exe C:\Program Files (x86)\Micro Focus\COBOL Server 2012\bin\mfds.exe ScreenConnect.WindowsClient.exe From 34c6c164fabaff413c7add3802baac66f5a33ebe Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 14 Mar 2018 10:23:48 -0400 Subject: [PATCH 226/471] cleanup --- sysmonconfig-export.xml | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b8f3b8b8..64478cbe 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1180,11 +1180,6 @@ \Classes\AllFilesystemObjects\ \Classes\Directory\ \Classes\Drive\ - \Classes\Folder\ - \ContextMenuHandlers\ - \CurrentVersion\Shell - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad \ShowSuperHidden HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers @@ -1227,7 +1222,7 @@ {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ \UrlUpdateInfo - \InstallSource + \InstallSource HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ @@ -1338,11 +1333,6 @@ \FriendlyName HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} - SOFTWARE\Classes\Wow6432Node\CLSID\{955C0D7D-042E-4034-9D54-EBD52477A6DB}\ - SOFTWARE\Classes\Wow6432Node\CLSID\{BEACC58F-E643-4e97-B19E-95F6EE3500FA}\ - SOFTWARE\Classes\Wow6432Node\CLSID\{07598BD3-ABBE-4bee-959F-7B90253EADFF}\ - SOFTWARE\Classes\Wow6432Node\CLSID\{31240348-66EE-4F14-A42A-39F373A834C7}\ - SOFTWARE\Classes\Wow6432Node\CLSID\{8C8EC235-0786-4DAD-A957-1A6CD76C28F5}\ HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom @@ -1473,6 +1463,11 @@ Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf + SOFTWARE\Classes\Wow6432Node\CLSID\{955C0D7D-042E-4034-9D54-EBD52477A6DB}\ + SOFTWARE\Classes\Wow6432Node\CLSID\{BEACC58F-E643-4e97-B19E-95F6EE3500FA}\ + SOFTWARE\Classes\Wow6432Node\CLSID\{07598BD3-ABBE-4bee-959F-7B90253EADFF}\ + SOFTWARE\Classes\Wow6432Node\CLSID\{31240348-66EE-4F14-A42A-39F373A834C7}\ + SOFTWARE\Classes\Wow6432Node\CLSID\{8C8EC235-0786-4DAD-A957-1A6CD76C28F5}\ HKLM\System\CurrentControlSet\Control\Lsa\Audit\SpecialGroups SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts From 8f1524d15152e0539c23b47dff76a841149e50a2 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Mar 2018 11:46:24 -0400 Subject: [PATCH 227/471] processaccess test --- sysmonconfig-export.xml | 42 +++++++++-------------------------------- 1 file changed, 9 insertions(+), 33 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 64478cbe..4cfd97b5 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -843,45 +843,21 @@ - - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + C:\Program Files (x86)\Webroot\WRSA.exe + C:\Program Files\Windows Defender\MsMpEng.exe + C:\Program Files\Windows Defender\MsMpEng.exe + C:\Windows\Sysmon.exe - - + C:\Program Files (x86)\ScreenConnect Client + From b4a632eaa94aa85004733e21ae903eb74d2c6565 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Mar 2018 11:49:39 -0400 Subject: [PATCH 228/471] sysmon exclusion --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 4cfd97b5..6e5c6f2e 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -855,6 +855,8 @@ C:\Program Files\Windows Defender\MsMpEng.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\Windows\Sysmon.exe + C:\Windows\Sysmon64.exe + C:\Windows\Sysmon64.exe C:\Program Files (x86)\ScreenConnect Client From 2ce2cfd7afd81d24e836027cbf4f611be53984a3 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Mar 2018 12:53:57 -0400 Subject: [PATCH 229/471] mimikatz detection --- sysmonconfig-export.xml | 47 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6e5c6f2e..231c06e8 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -845,12 +845,52 @@ + :\Windows\System32\lsass.exe + :\Windows\System32\winlogon.exe + Microsoft Office + powershell.exe + verclsid.exe + UNKNOWN + VBE + CorperfmontExt.dll + + 0x40 + 0x101000 + 0x1000 + 0x1400 + 0x100000 + 0x3200 + 0x101400 + 0x101001 + + + taskmgr + :\Windows\System32\wbem\wmiprvse.exe + \EMET_Service.exe + \EMET_GUI.exe + \procexp64.exe + processhacker + \Bin\FMS.exe + \Exchange Server\ + SQL + :\Windows\System32\smss.exe + :\Windows\system32\csrss.exe + :\Windows\system32\wininit.exe + \Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Webroot\WRSA.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\Program Files\Windows Defender\MsMpEng.exe @@ -858,7 +898,12 @@ C:\Windows\Sysmon64.exe C:\Windows\Sysmon64.exe - C:\Program Files (x86)\ScreenConnect Client + ScreenConnect + + :\Windows\system32\sppsvc.exe + :\Windows\system32\sdiagnhost.exe + + UNKNOWN(00007F From 81ce48dd0a786a8e811e9d9e7127baaab0c4ee19 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Mar 2018 13:00:32 -0400 Subject: [PATCH 230/471] sysmon exclusion (reverted from commit b4a632eaa94aa85004733e21ae903eb74d2c6565) --- sysmonconfig-export.xml | 2 -- 1 file changed, 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 231c06e8..e458b4f0 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -895,8 +895,6 @@ C:\Program Files\Windows Defender\MsMpEng.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\Windows\Sysmon.exe - C:\Windows\Sysmon64.exe - C:\Windows\Sysmon64.exe ScreenConnect From 11b3db7eb69204f7446acab75b3e3e0aa77e1450 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Mar 2018 13:07:15 -0400 Subject: [PATCH 231/471] revert --- sysmonconfig-export.xml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e458b4f0..9db0c642 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -845,14 +845,6 @@ - :\Windows\System32\lsass.exe - :\Windows\System32\winlogon.exe - Microsoft Office - powershell.exe - verclsid.exe - UNKNOWN - VBE - CorperfmontExt.dll - C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\ParserServer\ParserServer.exe - C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.RpcClientAccess.Service.exe - C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.Store.Service.exe - C:\Program Files\Microsoft\Exchange Server\V15\bin\Microsoft.Exchange.Store.Worker.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Runtime\1.0\ResourceProfile\contentengine\NodeRunner.exe + Exchange Server C:\Windows\system32\dns.exe @@ -1775,6 +1771,11 @@ ScreenConnect.WindowsClient.exe ScreenConnect.ClientService.exe QBW32.EXE + EXCEL.EXE + ADCUpdate.exe + Hydrous.Host.exe + TNSLSNR.exe + ShoreWare Server From ea06a5b21ef770ae3059406c043a3df75902ca9a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Mar 2018 15:48:45 -0400 Subject: [PATCH 233/471] revert (reverted from commit 11b3db7eb69204f7446acab75b3e3e0aa77e1450) just monitor lsass and winlogon --- sysmonconfig-export.xml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1ca9b01a..9f4c225c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -845,6 +845,14 @@ + :\Windows\System32\lsass.exe + :\Windows\System32\winlogon.exe + Microsoft Office + powershell.exe + verclsid.exe + UNKNOWN + VBE + CorperfmontExt.dll ScreenConnect @@ -900,6 +901,7 @@ :\Windows\system32\sdiagnhost.exe UNKNOWN(00007F + ShadowProtect From 941938240162baca1617ce3e526ce886cdfe00b1 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Mar 2018 15:56:07 -0400 Subject: [PATCH 236/471] add additional exclusions --- sysmonconfig-export.xml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1decd108..34a14d38 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -890,6 +890,7 @@ :\Windows\system32\wininit.exe \Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Webroot\WRSA.exe + C:\Program Files\Webroot\WRSA.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\Windows\Sysmon.exe @@ -902,6 +903,14 @@ UNKNOWN(00007F ShadowProtect + ShadowProtect + C:\Windows\sysWOW64\wbem\wmiprvse.exe + C:\Windows\system32\msiexec.exe + C:\Windows\system32\svchost.exe + + C:\Hlthpnt\bin\IM.exe + + From b3db166a9737f0b7069668ca2bdd22c17061ca36 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Mar 2018 15:57:11 -0400 Subject: [PATCH 237/471] exclusions --- sysmonconfig-export.xml | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 34a14d38..1bd82eb0 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -876,6 +876,9 @@ 0x101001 + C:\Windows\sysWOW64\wbem\wmiprvse.exe + C:\Windows\system32\msiexec.exe + C:\Windows\system32\svchost.exe taskmgr :\Windows\System32\wbem\wmiprvse.exe \EMET_Service.exe @@ -903,14 +906,8 @@ UNKNOWN(00007F ShadowProtect - ShadowProtect - C:\Windows\sysWOW64\wbem\wmiprvse.exe - C:\Windows\system32\msiexec.exe - C:\Windows\system32\svchost.exe - C:\Hlthpnt\bin\IM.exe - - + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe From 1323a4677699ea285d2127e1a97ccb419518a1a7 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Mar 2018 16:01:27 -0400 Subject: [PATCH 238/471] add additional legit exclusions --- sysmonconfig-export.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1bd82eb0..bbc8c7d4 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -908,6 +908,9 @@ ShadowProtect C:\Hlthpnt\bin\IM.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe + C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe + C:\ProgramData\WebEx\webex\ + Dropbox\Update\DropboxUpdate.exe From 6880c641992e188c4cdf91ec2330bfae7369ed39 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Mar 2018 16:05:16 -0400 Subject: [PATCH 239/471] add labtech from paccess --- sysmonconfig-export.xml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index bbc8c7d4..e2f9ed36 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -907,10 +907,11 @@ UNKNOWN(00007F ShadowProtect C:\Hlthpnt\bin\IM.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe + Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe + Common Files\Adobe\AdobeGCClient\AGSService.exe C:\ProgramData\WebEx\webex\ Dropbox\Update\DropboxUpdate.exe + LTSvc\LTSVC.exe From daaa5dd8142ca80c53ed57f18005d00dc166cdbb Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Mar 2018 16:10:51 -0400 Subject: [PATCH 240/471] add trusteer rapport exclusion --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e2f9ed36..839dd888 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -912,6 +912,7 @@ C:\ProgramData\WebEx\webex\ Dropbox\Update\DropboxUpdate.exe LTSvc\LTSVC.exe + \Trusteer\Rapport\bin\RapportMgmtService.exe From c54a65c96a860594958e5aeae7f1535319e2a650 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Mar 2018 16:12:06 -0400 Subject: [PATCH 241/471] adjust wmiprvse.exe --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 839dd888..9c3b2c61 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -880,7 +880,7 @@ C:\Windows\system32\msiexec.exe C:\Windows\system32\svchost.exe taskmgr - :\Windows\System32\wbem\wmiprvse.exe + wbem\wmiprvse.exe \EMET_Service.exe \EMET_GUI.exe \procexp64.exe From d2a3079ceac360fb5fc7b6a6984be472aae4380d Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Mar 2018 16:47:24 -0400 Subject: [PATCH 242/471] add spooler exclusions to paccess --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 9c3b2c61..9ae42457 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -879,6 +879,7 @@ C:\Windows\sysWOW64\wbem\wmiprvse.exe C:\Windows\system32\msiexec.exe C:\Windows\system32\svchost.exe + C:\Windows\system32\spoolsv.exe taskmgr wbem\wmiprvse.exe \EMET_Service.exe From d0f022feb2f2147e74b2240bb106fda3a1a79479 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 19 Mar 2018 08:41:39 -0400 Subject: [PATCH 243/471] Big registry autorun additions --- sysmonconfig-export.xml | 46 +++++++++++++++++++++++++++++++++++------ 1 file changed, 40 insertions(+), 6 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 9ae42457..83f35146 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1172,7 +1172,10 @@ \ServiceDll \ImagePath \Start + HKLM\SYSTEM\Setup\CmdLine + Session Manager\KnownDlls HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors + HKLM\SYSTEM\CurrentControlSet\Control\Print\Providers HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages @@ -1196,6 +1199,19 @@ HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell UserInitMprLogonScript + \CurrentVersion\Font Drivers + Active Setup\Installed Components + Windows CE Services\AutoStartOnConnect + Windows CE Services\AutoStartOnDisconnect + CurrentVersion\Windows\IconServiceLib + Winlogon\AlternateShells\AvailableShells + Terminal Server\Wds\rdpwd\StartupPrograms + SafeBoot\AlternateShell + Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman + HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown + Policies\System\Shell + Desktop\Scrnsave.exe \Explorer\FileExts\ \shell\install\command\ @@ -1204,6 +1220,17 @@ \InprocServer32\(Default) + \PropertySheetHandlers + \CopyHookHandlers + \ColumnHandlers + \ExtShellFolderViews + \ShellServiceObjects + \ShellServiceObjectDelayLoad + \SOFTWARE\Classes\Protocols\Filter + \SOFTWARE\Classes\Protocols\Handler + \Software\Microsoft\Ctf\LangBarAddin + \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components + \SharedTaskScheduler \ContextMenuHandlers\ \CurrentVersion\Shell HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks @@ -1218,6 +1245,7 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ + HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram @@ -1230,11 +1258,16 @@ \3\1206 \3\2500 \3\1809 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders HKLM\SOFTWARE\Microsoft\Netsh + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles @@ -1243,10 +1276,13 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - \Microsoft\Office\Outlook\Addins\ - \Microsoft\Office\Excel\Addins\ - \Microsoft\Office\Word\Addins\ - \Microsoft\Office\Powerpoint\Addins\ + + Office Test\ + \Outlook\Addins\ + \Excel\Addins\ + \Word\Addins\ + \Access\Addins\ + \Powerpoint\Addins\ \Internet Explorer\Toolbar\ \Internet Explorer\Extensions\ @@ -1372,8 +1408,6 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) HKLM\SOFTWARE\Microsoft\Tracing\RASAPI32 - - Office Test\ From f76159ed991ff4fc66e43a142844346933820f78 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 19 Mar 2018 08:48:51 -0400 Subject: [PATCH 244/471] DOMStorage hijack detection is too costly for now until better targetting --- sysmonconfig-export.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 83f35146..ac209708 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1343,9 +1343,9 @@ \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL - \Software\Microsoft\Internet Explorer\DOMStorage\ - \Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ - \Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage + + + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA From 7d8f595dd48af940f5c561bf377a4d8746e4448a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 19 Mar 2018 12:49:52 -0400 Subject: [PATCH 245/471] add ip-api detection --- sysmonconfig-export.xml | 83 +++++++++++++++++++++-------------------- 1 file changed, 42 insertions(+), 41 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ac209708..f908b2ca 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -469,49 +469,50 @@ tor.exe - githubusercontent.com - github.com + githubusercontent.com + github.com - api.ipify.org - whatismyipaddress.com - edns.ip-api.com - checkip.dyndns.org - icanhazip.com - ifconfig.me - ifconfig.co - ipaddress.com - ipinfo.io - goo.gl - git.io - bit.ly - t.co - ow.ly + api.ipify.org + whatismyipaddress.com + edns.ip-api.com + checkip.dyndns.org + icanhazip.com + ifconfig.me + ifconfig.co + ipaddress.com + ipinfo.io + goo.gl + git.io + bit.ly + t.co + ow.ly + ip-api.com - dlinkddns.com - no-ip.com - no-ip.org - no-ip.biz - no-ip.info - noip.com - afraid.org - duckdns.org - changeip.com - ddns.net - hopto.org - zapto.org - servehttp.com - sytes.net + dlinkddns.com + no-ip.com + no-ip.org + no-ip.biz + no-ip.info + noip.com + afraid.org + duckdns.org + changeip.com + ddns.net + hopto.org + zapto.org + servehttp.com + sytes.net - onion.to - onion.cab - onion.sh - onion.nu - onion.direct - tor2web.org - tor2web.fi - tor2web.blutmagie.de - tor-gateways.de - hiddenservice.net + onion.to + onion.cab + onion.sh + onion.nu + onion.direct + tor2web.org + tor2web.fi + tor2web.blutmagie.de + tor-gateways.de + hiddenservice.net 80 443 @@ -1414,7 +1415,7 @@ - + Office\root\integration\integrator.exe C:\WINDOWS\system32\backgroundTaskHost.exe From fda483edf27bd9fe3f11e9f4a7f8ab6c5f9aec1b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 11 Apr 2018 16:28:22 -0400 Subject: [PATCH 246/471] add additional file created fields. --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f908b2ca..e4456f5a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -977,6 +977,8 @@ .ppt .rft C:\Users\Default + \Desktop + \Documents C:\Windows\System32\Drivers C:\Windows\SysWOW64\Drivers C:\Windows\System32\GroupPolicy\Machine\Scripts From 3d228b02e837bd149ee9485778490991d12cc42a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 11 Apr 2018 16:33:29 -0400 Subject: [PATCH 247/471] Persistence using GlobalFlags in Image File Execution Options: [ https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/ --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e4456f5a..8ef47534 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1215,6 +1215,7 @@ HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown Policies\System\Shell Desktop\Scrnsave.exe + SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit \Explorer\FileExts\ \shell\install\command\ From 00ae987fec8a500a8643f384bd2f6cbb50c46865 Mon Sep 17 00:00:00 2001 From: ion-storm Date: Sat, 14 Apr 2018 19:22:09 -0400 Subject: [PATCH 248/471] Updates from @olafhartong's config's (great work btw) --- sysmonconfig-export.xml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 8ef47534..4e0a7b68 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -389,6 +389,7 @@ C:\Users C:\ProgramData + \Temp\ @@ -450,6 +451,8 @@ reg.exe mstsc.exe telnet.exe + SyncAppvPublishingServer.exe + Mavinject.exe ssh.exe putty.exe kitty.exe @@ -1385,7 +1388,11 @@ \SOFTWARE\Microsoft\SystemCertificates HKLM\SYSTEM\CurrentControlSet\Services\CertSvc --> - + + HKLM\SOFTWARE\Microsoft\Cryptography\OID + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID + HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust \Software\Classes\mscfile\shell\open\command HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon From bc11b8411790dc0c8589be2615b5a4e82675ff6e Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 16 Apr 2018 08:54:00 -0400 Subject: [PATCH 249/471] change wmi monitoring to exclude --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 4e0a7b68..e6bd12eb 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1849,7 +1849,7 @@ - + From a7b71eb14b881ea41275ff1d07b674e9d371b055 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 26 Apr 2018 14:47:47 -0400 Subject: [PATCH 250/471] complements of @subTree for noticing this mistake, reverting noise reduction commit. --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e6bd12eb..f779ed41 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -824,7 +824,6 @@ C:\Windows\system32\services.exe C:\Windows\system32\winlogon.exe C:\Windows\system32\audiodg.exe - C:\Windows\system32\kernel32.dll Google\Chrome\Application\chrome.exe FireSvc.exe C:\Program Files (x86)\Webroot\WRSA.exe From 3b954469527dc7756edfdfb74f53175aaf869fe5 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 27 Jun 2018 16:54:28 -0400 Subject: [PATCH 251/471] added samsam ransomware file names --- sysmonconfig-export.xml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f779ed41..ad1197f5 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -978,6 +978,7 @@ .xls .ppt .rft + .SettingContent-ms C:\Users\Default \Desktop \Documents @@ -1049,6 +1050,14 @@ help_recover_instructions _Locky_recover _ReCoVeRy_ + + www.exe + ps.exe + nt.exe + doliohdyjkajd.dll + run2.exe + ping2.exe + .pem .crt From ef9cc7b32cea1900d0968832e2a876575200804c Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 30 Jun 2018 22:26:56 -0400 Subject: [PATCH 252/471] add nable exceptions --- sysmonconfig-export.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ad1197f5..c32ba70b 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -880,9 +880,12 @@ C:\Windows\sysWOW64\wbem\wmiprvse.exe + C:\ProgramData\Microsoft\Windows Defender\platform\ C:\Windows\system32\msiexec.exe C:\Windows\system32\svchost.exe C:\Windows\system32\spoolsv.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe + C:\Program Files\N-able Technologies\AVDefender\EPUpdateService.exe taskmgr wbem\wmiprvse.exe \EMET_Service.exe From 777404d1e222cb09fb31c9ab2dc1a74c5b099d42 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 3 Jul 2018 15:38:15 -0400 Subject: [PATCH 253/471] add exclusions --- sysmonconfig-export.xml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index c32ba70b..1b49b13a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -920,6 +920,9 @@ Dropbox\Update\DropboxUpdate.exe LTSvc\LTSVC.exe \Trusteer\Rapport\bin\RapportMgmtService.exe + Adobe\AdobeGCClient\AGMService.exe + NT-ware Shared\MomAdmSvc\MomAdmSvc.exe + \Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe @@ -1155,6 +1158,10 @@ C:\Windows\System32\config\systemprofile\TOSHIBA\ TOSHIBA\eSTUDIOX\UNIDRV + N-able Technologies\AVDefender\ThreatScanner\Antivirus-NewTemp\bdcore.dll + N-able Technologies\AVDefender\ThreatScanner\Antivirus-NewTemp\scanclient.dll + C:\Program Files (x86)\N-able Technologies\Windows Software Probe\Repository\nagent + C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\ From 813277a11d068513bdd742273d4349cc00653ef6 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 3 Jul 2018 23:49:08 -0400 Subject: [PATCH 254/471] Update sysmon auto-installer for 64bit svc change --- Install Sysmon.bat | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Install Sysmon.bat b/Install Sysmon.bat index c6cc844c..5c0a7572 100644 --- a/Install Sysmon.bat +++ b/Install Sysmon.bat @@ -20,7 +20,7 @@ echo [+] Downloading Sysmon config... @powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" @powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/Auto_Update.bat','C:\ProgramData\sysmon\Auto_Update.bat')" sysmon64.exe -accepteula -i sysmonconfig-export.xml -sc failure Sysmon actions= restart/10000/restart/10000// reset= 120 +sc failure Sysmon64 actions= restart/10000/restart/10000// reset= 120 echo [+] Sysmon Successfully Installed! echo [+] Creating Auto Update Task set to Hourly.. SchTasks /Create /RU SYSTEM /RL HIGHEST /SC HOURLY /TN Update_Sysmon_Rules /TR C:\ProgramData\sysmon\Auto_Update.bat /F /ST %tasktime% From cafb2b1378676df831ed82fb7e6f383db01d110f Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 6 Jul 2018 17:01:13 -0400 Subject: [PATCH 255/471] New Baseline --- Sysmon-config.xml | 1665 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 1665 insertions(+) create mode 100644 Sysmon-config.xml diff --git a/Sysmon-config.xml b/Sysmon-config.xml new file mode 100644 index 00000000..ef0ea29c --- /dev/null +++ b/Sysmon-config.xml @@ -0,0 +1,1665 @@ + + + + + md5,sha256 + + + + + + + + + + + + + + \cmd.exe + \cmd.com + .com + \powershell.exe + \control.exe + \acrord32.exe + \installutil.exe + \reg.exe + \net.exe + \net1.exe + \ipconfig.exe + + + sethc.exe + utilman.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe + + whoami.exe + ipconfig.exe + tasklist.exe + sysinfo.exe + netstat.exe + qprocess.exe + nslookup.exe + net.exe + quser.exe + query.exe + tracert.exe + tree.com + route.exe + runas.exe + reg.exe + taskkill.exe + netsh.exe + klist.exe + wevtutil.exe + taskeng.exe + regsvr32.exe + wmiprvse.exe + hh.exe + cmd.exe + powershell.exe + bash.exe + odbcconf.exe + pcalua.exe + attrib.exe + cmdkey.exe + + sdbinst.exe + + bitsadmin.exe + + eventvwr.exe + fodhelper.exe + + InstallUtil.exe + /logfile= /LogToConsole=false /U + + Mavinject.exe + CMSTP.exe + + MSBuild.exe + regsvcs.exe + regasm.exe + SyncAppvPublishingServer.exe + + control.exe + control.exe /name + rundll32.exe shell32.dll,Control_RunDLL + wsmprovhost.exe + winrm.cmd + + acrobat.exe + acrord32.exe + + chrome.exe + firefox.exe + iexplore.exe + MicrosoftEdgeCP.exe + MicrosoftEdge.exe + vivaldi.exe + waterfox.exe + + java.exe + javaw.exe + + + 2> + > + >> + + + + + + + + C:\Users + C:\ProgramData + \Temp\ + + + + C:\Windows\system32\backgroundTaskHost.exe + TrustedInstaller.exe + OneDrive.exe + vivaldi.exe + chrome.exe + C:\WINDOWS\system32\backgroundTaskHost.exe + setup + + + + + + + + + + + + + C:\Users + C:\ProgramData + C:\Windows\Temp + C:\Perflogs\ + config\systemprofile\ + \Windows\Fonts\ + \Windows\IME\ + \Windows\addins\ + chrome.exe + iexplore.exe + firefox.exe + MicrosoftEdgeCP.exe + MicrosoftEdge.exe + explorer.exe + + at.exe + certutil.exe + cmd.exe + cscript.exe + wscript.exewscript.exe + rundll32.exe + notepad.exe + regsvr32.exe + regsvcs.exe + C:\Windows\system32\svchost.exe + mshta.exe + powershell.exe + psexe + pskill + psshutdown + psservice + PsPasswd + java.exe + msbuild.exe + installutil.exe + msiexec.exe + reg.exe + mstsc.exe + telnet.exe + SyncAppvPublishingServer.exe + Mavinject.exe + ssh.exe + putty.exe + kitty.exe + kitty_portable.exe + psftp.exe + tftp.exe + wmic.exe + net.exe + nbtstat.exe + dsquery.exe + driverquery.exe + infDefaultInstall.exe + sc.exe + auditpol.exe + qwinsta.exe + rwinsta.exe + + tor.exe + + githubusercontent.com + github.com + + api.ipify.org + whatismyipaddress.com + edns.ip-api.com + checkip.dyndns.org + icanhazip.com + ifconfig.me + ifconfig.co + ipaddress.com + ipinfo.io + goo.gl + git.io + bit.ly + t.co + ow.ly + ip-api.com + + dlinkddns.com + no-ip.com + no-ip.org + no-ip.biz + no-ip.info + noip.com + afraid.org + duckdns.org + changeip.com + ddns.net + hopto.org + zapto.org + servehttp.com + sytes.net + + onion.to + onion.cab + onion.sh + onion.nu + onion.direct + tor2web.org + tor2web.fi + tor2web.blutmagie.de + tor-gateways.de + hiddenservice.net + + 80 + 443 + 3389 + 3540 + 22 + 23 + 25 + 139 + + 5800 + 5900 + 1194 + 1701 + 1723 + 1293 + 4500 + 1080 + 8080 + 3128 + 9001 + 9030 + 4443 + 2448 + 8143 + 1777 + 1443 + 243 + 65535 + 13506 + 3360 + 200 + 198 + 49180 + 13507 + 3360 + 6625 + 4444 + 4438 + 1904 + 13505 + 13504 + 12102 + 9631 + 5445 + 2443 + 777 + 13394 + 13145 + 12103 + 5552 + 3939 + 3675 + 666 + 473 + 5649 + 4455 + 4433 + 1817 + 100 + 65520 + 1960 + 1515 + 743 + 700 + 14154 + 14103 + 14102 + 12322 + 10101 + 7210 + 4040 + 9943 + + 7777 + 9943 + 666 + + + + C:\Windows\System32\dns.exe + C:\Windows\System32\find.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeFrontendTransport.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\EdgeTransport.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeSubmission.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeFrontendTransport.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeDelivery.exe + C:\Windows\SysWOW64\SearchProtocolHost.exe + true + OneDrive.exe + Spotify.exe + AppData\Roaming\Dropbox\bin\Dropbox.exe + OneDriveStandaloneUpdater.exe + ConnectWise.exe + ScreenConnect.WindowsClient.exe + AppData\Roaming\Dashlane\Dashlane.exe + AppData\Roaming\Dashlane\DashlanePlugin.exe + Vivaldi\Application\vivaldi.exe + microsoft.com + microsoft.com.akadns.net + microsoft.com.nsatc.net + .search.msn.com + .wns.windows.com + akamaitechnologies.com + llmnr + ldap + ldap + epmap + epmap + 135 + 135 + ntp + ntp + llmnr + ssdp + ssdp + 5353 + netbios-ns + netbios-dgm + 1e100.net + 5228 + 5357 + 3544 + 3702 + 50646 + C:\Program Files (x86)\SmartGit\jre\bin\java.exe + C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe + penv\Scripts\python.exe + efolder01 + 2080 + g2mcomm.exe + C:\Program Files (x86)\LabTech Client\LTClient.exe + C:\Windows\LTSvc\LTSVC.exe + C:\Program Files (x86)\Webroot\WRSA.exe + C:\Program Files (x86)\SmartGit\ + DSPro\Programs\pr001Celery98.exe + g2ax_comm_expert.exe + g2mcomm.exe + AppData\Local\Microsoft\Teams\current\Teams.exe + + + + + + + + + + + + + + C:\Users + C:\ProgramData + C:\Windows\Temp + Sysmon.exe + + + + + + + + + + microsoft + Microsoft Windows + windows + Intel + Lenovo + Synaptic + Nvidia + Broadcom + AMD + VMware + Realtek + Micro-Star + Logitech + Asmedia + SteelSeries + Fortinet + Webroot + NoVirusThanks Company Srl + Invincea + ShoreTel + Synology + Citrix + SonicWall + Sophos + OpenVPN + + + + + + + + + false + Invalid + Unavailable + C:\windows\system32\fxsst.dll + C:\Windows\System32\wbem\oci.dll + \Temp\ + + + Valid + System32\samlib.dll + System32\cryptdll.dlll + microsoft + Microsoft Windows + windows + Intel + Lenovo + Synaptic + Nvidia + Broadcom + AMD + VMware + Realtek + Micro-Star + Logitech + Asmedia + SteelSeries + Fortinet + Microsoft + Microsoft + C:\Windows\System32\backgroundTaskHost.exe + Webroot + C:\Windows\System32\backgroundTaskHost.exe + C:\Windows\System32\mmc.exe + C:\Windows\System32\SearchFilterHost.exe + C:\Windows\System32\SearchProtocolHost.exe + C:\Windows\sysmon64.exe + C:\Windows\System32\inetsrv\w3wp.exe + C:\Windows\sysmon64.exe + C:\Windows\System32\conhost.exe + C:\Windows\System32\winspool.drv + C:\Windows\System32\wshqos. + C:\Windows\System32\wow64.dll + C:\Windows\System32\clusapi.dll + C:\Windows\System32\cryptdll.dll + C:\Windows\System32\wow64win.dll + C:\Windows\System32\wow64.dll + C:\Windows\System32\pcwum.dll + C:\Windows\System32\kernel32.dll + C:\Windows\System32\user32.dll + C:\Windows\System32\cryptdll.dll + C:\Windows\System32\dns.exe + C:\Windows\System32\zvprtmon5.dll + C:\Windows\System32\termsrv.dll + C:\Windows\System32\spool\ + samlib.dll + C:\Program Files (x86)\SmartGit + syntevo\SmartGit + Labtech Client + CrystalDecisions + ShoreWare + C:\Program Files\Microsoft SQL Server\100\Shared\dbghelp.dll + C:\Windows\System32\backgroundTaskHost.exe + C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe + C:\Program Files + C:\Windows\assembly\NativeImages + C:\Program Files\WindowsApps + + C:\Program Files (x86)\AutoSizer\AutoSizer.dll + C:\Program Files (x86)\Notepad++ + C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe + C:\PostgreSQL9.1\bin\postgres.exe + C:\Windows\System32\VSSVC. + C:\Windows\System32\conhost.exe + C:\Windows\System32\svchost.exe + C:\Windows\System32\NETSTAT.EXE + C:\Windows\System32\inetsrv\w3wp.exe + C:\Windows\System32\tasklist.exe + C:\Windows\System32\nslookup.exe + C:\Windows\System32\find.exe + C:\cs\tools\php\php-cgi.exe + C:\Windows\System32\nbtstat.exe + C:\Windows\System32\dsquery.exe + C:\Windows\System32\netsh.exe + C:\Windows\System32\taskeng.exe + C:\ProgramData\sysmon\sysmon64.exe + SQL Server + SQL Server + Exchange Server + Exchange Server + + + + + + + + + C:\Windows\system32\wbem\WmiPrvSE.exe + C:\Windows\SysWOW64\wbem\WmiPrvSE.exe + C:\Windows\system32\svchost.exe + C:\Windows\system32\wininit.exe + C:\Windows\system32\csrss.exe + C:\Windows\system32\services.exe + C:\Windows\system32\winlogon.exe + C:\Windows\system32\audiodg.exe + Google\Chrome\Application\chrome.exe + FireSvc.exe + C:\Program Files (x86)\Webroot\WRSA.exe + controls\cef\ConnectWise.exe + + + + + + + + + + + + + + + + + + + :\Windows\System32\lsass.exe + :\Windows\System32\winlogon.exe + powershell.exe + verclsid.exe + VBE7.dll + CorperfmontExt.dll + + + + + 0x40 + 0x101000 + 0x1000 + 0x1400 + 0x100000 + 0x3200 + 0x101400 + 0x101001 + + + C:\Windows\sysWOW64\wbem\wmiprvse.exe + C:\ProgramData\Microsoft\Windows Defender\platform\ + C:\Windows\system32\msiexec.exe + C:\Windows\system32\svchost.exe + C:\Windows\system32\spoolsv.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe + C:\Program Files\N-able Technologies\AVDefender\EPUpdateService.exe + taskmgr + wbem\wmiprvse.exe + \EMET_Service.exe + \EMET_GUI.exe + \procexp64.exe + processhacker + \Bin\FMS.exe + \Exchange Server\ + SQL + :\Windows\System32\smss.exe + :\Windows\system32\csrss.exe + :\Windows\system32\wininit.exe + \Google\Update\GoogleUpdate.exe + C:\Program Files (x86)\Webroot\WRSA.exe + C:\Program Files\Webroot\WRSA.exe + C:\Program Files\Windows Defender\MsMpEng.exe + C:\Program Files\Windows Defender\MsMpEng.exe + C:\Windows\Sysmon.exe + C:\Windows\Sysmon64.exe + + ScreenConnect + + :\Windows\system32\sppsvc.exe + :\Windows\system32\sdiagnhost.exe + + UNKNOWN(00007F + ShadowProtect + C:\Hlthpnt\bin\IM.exe + Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe + Common Files\Adobe\AdobeGCClient\AGSService.exe + C:\ProgramData\WebEx\webex\ + Dropbox\Update\DropboxUpdate.exe + LTSvc\LTSVC.exe + \Trusteer\Rapport\bin\RapportMgmtService.exe + Adobe\AdobeGCClient\AGMService.exe + NT-ware Shared\MomAdmSvc\MomAdmSvc.exe + \Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe + + + + + + + + + + \Start Menu + \Startup + \Content.Outlook\ + \Downloads\ + .dll + .ocx + .sys + .application + .appref-ms + .bat + .cmd + .com + .btm + .cmdline + .docm + .exe + .msc + .hta + .ws + .wsf + .wsh + .pptm + .ps1 + .ps1xml + .psc1 + .psd1 + .psm1 + .pssc + .cdxml + .sys + .reg + .docm + .xlsm + .xlam + .pptm + .potm + .pptm + .sldm + .scf + .appref-ms + .rdp + .vbs + .vb + .vbsript + .vbe + .js + .jse + proj + .sln + .xls + .ppt + .rft + .SettingContent-ms + C:\Users\Default + \Desktop + \Documents + C:\Windows\System32\Drivers + C:\Windows\SysWOW64\Drivers + C:\Windows\System32\GroupPolicy\Machine\Scripts + C:\Windows\System32\GroupPolicy\User\Scripts + C:\Windows\System32\Tasks + C:\Windows\System32\Wbem + C:\Windows\SysWOW64\Wbem + C:\Windows\System32\WindowsPowerShell + C:\Windows\SysWOW64\WindowsPowerShell + C:\Windows\Tasks\ + C:\Windows\System32\Tasks + C:\Windows\AppPatch\Custom + .cmdline + C:\Windows\System32\ + + .ICL + .FON + .FOT + .ico + .lnk + .eml + .msg + .SCT + .SCR + .SHB + .SHS + .PAF + .JSE + .gadget + .cpl + .inf + + help_decrypt + help_restore + ReadDecryptFilesHere + howto_recover_file + recover_file_ + Recovery_file_ + how_to_decrypt + encryptor_raas_readme_liesmich + _how_recover_ + HOWTO_RESTORE_FILES_ + help_my_files + how_recover + HELP_TO_SAVE_FILES + DECRYPT_INSTRUCTIONS + YOUR_FILES.url + Coin.Locker.txt + _secret_code.txt + Decrypt_readme.txt + INSTUCCIONES_DESCRIFRADO + FILESAREGONE.txt + IAMREADYTOPAY.TXT + HELLOTHERE.TXT + READTHISNOW!!!.txt + SECRETIDHERE.KEY + IHAVEYOURSECRET.KEY + SECRET.KEY + HELPDECRYPT_YOUR_FILES.HTML + RECOVERY_FILES.TXT + RECOVERY_FILE. + HowtoRestore_Files + restorefiles + howrecover+ + recoveryfile + help_recover_instructions + _Locky_recover + _ReCoVeRy_ + + www.exe + ps.exe + nt.exe + doliohdyjkajd.dll + run2.exe + ping2.exe + + + .pem + .crt + .ca-bundle + .cer + .csr + .der + .p7b + .p7r + .p7s + .pfx + .sto + .p12 + .crl + .sst + .key + + .mht + .cpl + .scr + .manifest + .inf + HammerDrillStatus.dll + + + + + C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates\ + \Downloads + \Start Menu + \Start Menu\Programs + \Start Menu\Programs\Startup + + C:\Windows\System32\svchost.exe + C:\Windows\System32\smss.exe + \Microsoft\Windows\INetCache\IE + \Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates + WRITABLE.TST + C:\Windows\System32\wbem\Performance\ + C:\Windows\System32\DriverStore\Temp\ + C:\Windows\System32\wbem\Performance\ + WRITABLE.TST + .SQM + .SPL + .SHD + C:\Program Files (x86)\EMET 5.5\EMET_Service.exe + C:\Windows\system32\mobsync.exe + C:\Windows\Installer\ + + C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask + + C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\ + .etl + .log + C:\WINDOWS\winsxs\amd64_microsoft-windows + Firefox Setup + C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive + C:\Windows\System32\config\netlogon.ftl + \\?\C:\Windows\system32\wbem\WMIADAP.EXE + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + C:\Windows\system32\CompatTelRunner.exe + C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\sqlservr.exe + C:\Windows\System32\smss.exe + C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe + C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe + C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe + + C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe + + C:\Windows\system32\igfxCUIService.exe + + Google\Chrome\User Data\Safe Browsing\UrlUws.store_new + Google\Chrome\User Data\Safe Browsing\UrlMalBin.store_new + Google\Chrome\User Data\Safe Browsing\UrlMalware.store_new + Google\Chrome\User Data\Safe Browsing\UrlSoceng.store_new + Google\Chrome\User Data\Safe Browsing\ChromeExtMalware.store_new + Google\Chrome\User Data\Safe Browsing\ChromeFilenameClientIncident.store_new + Google\Chrome\User Data\Safe Browsing\ChromeUrlClientIncident.store_new + Google\Chrome\User Data\Safe Browsing\IpMalware.store_new + Google\Chrome\User Data\Safe Browsing\UrlSubresourceFilter.store_new + Google\Chrome\User Data\Safe Browsing\UrlCsdWhitelist.store_new + Google\Chrome\User Data\Safe Browsing\UrlCsdDownloadWhitelist.store_new + Google\Chrome\User Data\Safe Browsing\CertCsdDownloadWhitelist.store_new + .default\prefs-1.js + + C:\Windows\System32\Tasks\Adobe Acrobat Update Task + C:\Windows\System32\Tasks\Adobe Flash Player Updater + + C:\Program Files (x86)\ConnectWise\PSA.net\ConnectWise.exe + + C:\Program Files\Datto\Datto Windows Agent\DattoBackupAgent.exe + + C:\Windows\System32\config\systemprofile\TOSHIBA\ + TOSHIBA\eSTUDIOX\UNIDRV + N-able Technologies\AVDefender\ThreatScanner\Antivirus-NewTemp\bdcore.dll + N-able Technologies\AVDefender\ThreatScanner\Antivirus-NewTemp\scanclient.dll + C:\Program Files (x86)\N-able Technologies\Windows Software Probe\Repository\nagent + C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\ + + + + + + + + + + + + + + + + + + + + + + + + + + + + \CurrentVersion\Run + \Group Policy\Scripts + \Windows\System\Scripts + \Microsoft\System\Scripts + \ServiceDll + \ImagePath + \Start + HKLM\SYSTEM\Setup\CmdLine + Session Manager\KnownDlls + HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors + HKLM\SYSTEM\CurrentControlSet\Control\Print\Providers + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages + HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages + HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages + HKLM\HARDWARE\ACPI\DSDT + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet + HKLM\System\CurrentControlSet\Control\Session Manager\Execute + HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute + HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath + HKLM\Software\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLU\Software\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + UserInitMprLogonScript + \CurrentVersion\Font Drivers + Active Setup\Installed Components + Windows CE Services\AutoStartOnConnect + Windows CE Services\AutoStartOnDisconnect + CurrentVersion\Windows\IconServiceLib + Winlogon\AlternateShells\AvailableShells + Terminal Server\Wds\rdpwd\StartupPrograms + SafeBoot\AlternateShell + Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman + HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown + Policies\System\Shell + Desktop\Scrnsave.exe + SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit + + \Explorer\FileExts\ + \shell\install\command\ + \shell\open\command\ + \shell\open\ddeexec\ + + \InprocServer32\(Default) + + \PropertySheetHandlers + \CopyHookHandlers + \ColumnHandlers + \ExtShellFolderViews + \ShellServiceObjects + \ShellServiceObjectDelayLoad + \SOFTWARE\Classes\Protocols\Filter + \SOFTWARE\Classes\Protocols\Handler + \Software\Microsoft\Ctf\LangBarAddin + \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components + \SharedTaskScheduler + \ContextMenuHandlers\ + \CurrentVersion\Shell + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad + \Classes\Folder\ + \Classes\*\ + \Classes\AllFilesystemObjects\ + \Classes\Directory\ + \Classes\Drive\ + \ShowSuperHidden + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ + HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand + + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + + HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ + \ProxyServer + Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy + \DisableSecuritySettingsCheck + \3\1206 + \3\2500 + \3\1809 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders + HKLM\SOFTWARE\Microsoft\Netsh + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers + + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + EnableFirewall + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + + + Office Test\ + \Outlook\Addins\ + \Excel\Addins\ + \Word\Addins\ + \Access\Addins\ + \Powerpoint\Addins\ + + \Internet Explorer\Toolbar\ + \Internet Explorer\Extensions\ + + \Browser Helper Objects\ + {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ + + \UrlUpdateInfo + \InstallSource + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + + HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + HKLM\Software\Microsoft\Windows\CurrentVersion\RunService + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + \Software\Microsoft\Windows NT\CurrentVersion\Windows\load + HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 + CurrentVersion\Windows\Load + CurrentVersion\Windows\Run + CurrentVersion\Winlogon\Shell + CurrentVersion\Winlogon\System + + \Software\Policies\Microsoft\Windows\System\Scripts\Logon + \Software\Policies\Microsoft\Windows\System\Scripts\Logoff + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + Domain + DefaultGateway + DHCPDefaultGateway + DhcpIPAddress + DhcpNameserver + Dhcpserver + DhcpSubnetMask + SubnetMask + PersistentRoutes + + \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU + HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR + + \Software\Microsoft\Terminal Server Client + + + \WRData\Threats\Active + \WRData\Threats\History + + \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL + + + + + + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + + \Security\Level + \Security\Level1Remove + + HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled + HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring + HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride + HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify + \HideSCAHealth + + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange + + + + HKLM\SOFTWARE\Microsoft\Cryptography\OID + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID + HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust + \Software\Classes\mscfile\shell\open\command + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad + \comfile\shell\open\command + \htafile\shell\open\command + \batfile\shell\open\command + \piffile\shell\open\command + \exefile\shell\open\command + Classes\exefile\shell\runas\command\isolatedCommand + \piffile\shell\open\command + \regfile\shell\open\command + \mscfile\shell\open\command + \InprocServer32 + HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + \FriendlyName + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + HKLM\SOFTWARE\Microsoft\Tracing\RASAPI32 + + + + + + + Office\root\integration\integrator.exe + C:\WINDOWS\system32\backgroundTaskHost.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Program Files (x86)\Microsoft Office\Office16\lync.exe + C:\Program Files (x86)\Microsoft Office\Office15\lync.exe + C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe + C:\Program Files\Windows Defender\MsMpEng.exe + Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\ + + HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files- + HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\User_Feed_Synchronization- + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsUpdate + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ + Toolbar\WebBrowser + Toolbar\WebBrowser\ITBar7Height + Toolbar\WebBrowser\ITBar7Layout + Toolbar\ShellBrowser\ITBar7Layout + Internet Explorer\Toolbar\Locked + Toolbar\WebBrowser\{47833539-D0C5-4125-9FA8-0819E2EAAC93} + Toolbar\WebBrowser\{724D43A0-0D85-11D4-9908-00400523E39A} + Toolbar\WebBrowser\ITBar7Layout + ShellBrowser + \CurrentVersion\Run + \CurrentVersion\RunOnce + \CurrentVersion\App Paths + \CurrentVersion\Image File Execution Options + \CurrentVersion\Shell Extensions\Cached + \CurrentVersion\Shell Extensions\Approved + }\PreviousPolicyAreas + \Control\WMI\Autologger\ + HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start + \Lsa\OfflineJoin\CurrentValue + \Components\TrustedInstaller\Events + \Components\TrustedInstaller + \Components\Wlansvc + \Components\Wlansvc\Events + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ + \Directory\shellex + \Directory\shellex\DragDropHandlers + \Drive\shellex + \Drive\shellex\DragDropHandlers + _Classes\AppX + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ + C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit + + \services\clr_optimization_v2.0.50727_32\Start + \services\clr_optimization_v2.0.50727_64\Start + \services\clr_optimization_v4.0.30319_32\Start + \services\clr_optimization_v4.0.30319_64\Start + \services\DeviceAssociationService\Start + \services\BITS\Start + \services\TrustedInstaller\Start + \services\tunnel\Start + \services\UsoSvc\Start + + \OpenWithProgids + \OpenWithList + \UserChoice + \UserChoice\ProgId + \UserChoice\Hash + \OpenWithList\MRUList + } 0xFFFF + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jxr + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2 + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2 + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2 + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2 + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac + Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf + SOFTWARE\Classes\Wow6432Node\CLSID\{955C0D7D-042E-4034-9D54-EBD52477A6DB}\ + SOFTWARE\Classes\Wow6432Node\CLSID\{BEACC58F-E643-4e97-B19E-95F6EE3500FA}\ + SOFTWARE\Classes\Wow6432Node\CLSID\{07598BD3-ABBE-4bee-959F-7B90253EADFF}\ + SOFTWARE\Classes\Wow6432Node\CLSID\{31240348-66EE-4F14-A42A-39F373A834C7}\ + SOFTWARE\Classes\Wow6432Node\CLSID\{8C8EC235-0786-4DAD-A957-1A6CD76C28F5}\ + + HKLM\System\CurrentControlSet\Control\Lsa\Audit\SpecialGroups + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0 + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\PSScriptOrder + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\SOM-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\GPO-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\IsPowershell + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\ExecTime + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0 + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\PSScriptOrder + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\SOM-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\GPO-ID + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\IsPowershell + SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\ExecTime + \safer\codeidentifiers\0\HASHES\{ + + + + + + } 0xFFFF + C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe + C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe + HKLM\System\CurrentControlSet\Services\DeviceAssociationService\Start + HKLM\System\CurrentControlSet\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\ + C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe + C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe + + \LTSvcMon\Start + \LTService\Start + + {F2C2787D-95AB-40D4-942D-298F5F757874} + C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe + + HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\ + \Software\Policies\Microsoft\SystemCertificates\ + HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ + HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\ + \SOFTWARE\Microsoft\EnterpriseCertificates\ + HKLM\SOFTWARE\Microsoft\SystemCertificates\ + C:\Windows\SysWOW64\SearchProtocolHost.exe + HKLM\System\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnotice + HKCR\VLC. + HKCR\iTunes. + + \Software\NITRO\PRO + + HKLM\SOFTWARE\Wow6432Node\WRData\Status + + + + + + + + + + .default\prefs-1.js + + + Content.Outlook + Downloads + Temp\7z + Startup + .vb + .application + .appref-ms + .bat + .cmd + .cmdline + .docm + .exe + .dll + .sys + .hta + .pptm + .ps1 + .sys + .reg + .docm + .xlsm + .xlam + .pptm + .potm + .pptm + .sldm + .scf + .appref-ms + .rdp + .vbs + .js + + .pem + .crt + .ca-bundle + .cer + .csr + .der + .p7b + .p7r + .p7s + .pfx + .sto + .p12 + .crl + .sst + .key + + .mht + .manifest + .cpl + .scr + .inf + + + + + + + + + + + + + + + + + + + + lsass + \SQLLocal\RTCLOCAL + \spoolss + + \M.E.C.Core.WinRMDataCommunicator.NamedPipe. + c:\windows\system32\inetsrv\w3wp.exe + C:\Windows\syswow64\snmp.exe + C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\BIN\OWSTIMER.EXE + + Exchange Server + + C:\Windows\system32\dns.exe + + \sql\query + C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe + + C:\Program Files\Skype for Business Server 2015\Server\Core\RtcHost.exee + C:\Program Files\Skype for Business Server 2015\OCSMCU\AV Conferencing\AVMCUSvc.exe + C:\Program Files\Skype for Business Server 2015\Server\Health Agent\HealthAgent.exe + C:\Program Files\Skype for Business Server 2015\Server\Core\LysSvc.exe + C:\Program Files\Skype for Business Server 2015\File Transfer Agent\FileTransferAgent.exe + C:\Program Files\Skype for Business Server 2015\Web Conferencing\DataMCUSvc.exe + C:\Program Files\Skype for Business Server 2015\Application Host\OcsAppServerHost.exe + C:\Program Files\Skype for Business Server 2015\Server\Core\ABServer.exe + C:\Program Files\Skype for Business Server 2015\Master Replicator Agent\MasterReplicatorAgent.exe + C:\Program Files\Skype for Business Server 2015\OCSMCU\IM Conferencing\IMMCUSvc.exe + C:\Program Files\Common Files\Skype for Business Server 2015\ClsAgent\ClsAgent.exe + C:\Program Files\Skype for Business Server 2015\Server\Core\ReplicationApp.exe + C:\Program Files\Skype for Business Server 2015\OCSMCU\Application Sharing\ASMCUSvc.exe + C:\Program Files\Skype for Business Server 2015\Server\Replica Replicator Agent\ReplicaReplicatorAgent.exe + C:\Program Files\Skype for Business Server 2015\Server\Core\RtcHost.exe + + C:\Windows\system32\DFSRs.exee + C:\Windows\SystemApps\Microsoft.Windows + C:\Windows\system32\SearchProtocolHost.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe + C:\Windows\System32\LxRun.exe + vmware- + \System + \InitShutdown + C:\Windows\System32\wininit.exe + C:\Windows\System32\SearchIndexer.exe + C:\Windows\System32\services.exe + \ntsvcs + \scerpc + C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe + C:\Windows\System32\smss.exe + C:\Windows\System32\spoolsv.exe + \epmapper + \atsvc + \browser + \srvsvc + \Winsock2CatelogChangeListener + ProtectedPrefix\LocalService\FTHPIPE + \W32TIME_ALT + \eventlog + \wkssvc + \TDLN- + \WiFiNetworkManagerTask + \MsFteWds + + \WRSVCPipe + \WRSynUM2 + \wrUrl + C:\Program Files (x86)\Webroot\WRSA.exe + + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + C:\Program Files (x86)\Google\Update\GoogleUpdate.exe + AppData\Local\Google\Chrome\User Data\SwReporter\ + mojo. + crashpad_ + chrome. + GoogleCrashServices + + slack.exe + + booma\ + + qtsingleapp-enpass- + qtsingleapp-enpass- + + eo.ipc. + + C:\Program Files\Windows Firewall Control\wfc.exe + + Everything Service + anchor_gui_agent + + Adobe\ARM\1.0\AdobeARM.exe + + C:\Program Files (x86)\Lenovo\System Update\SUService.exe + C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe + C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe + C:\Program Files\Lenovo\HOTKEY\shtctky.exe + C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE + C:\Windows\System32\LPlatSvc.exe + C:\PROGRA~1\Lenovo\HOTKEY\TPOSD.EXE + C:\Program Files (x86)\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe + C:\Program Files (x86)\Lenovo\System Update\TvsuCommandLauncher.exe + + C:\Program Files (x86)\Fortinet\FortiClient\FortiSSLVPNdaemon.exe + + c:\program files (x86)\sophos\sophos ssl vpn client\bin\openvpnserv.exe + + C:\Windows\LTSvc\LTSVC.exe + ScreenConnect.WindowsClient.exe + ScreenConnect.ClientService.exe + + N-able Technologies\Windows Agent\bin\agent.exe + N-able Technologies\AVDefender\EPIntegrationService.exe + C:\Program Files\OpenVPN\bin\openvpn-gui.exe + C:\Program Files\OpenVPN\bin\openvpn.exe + C:\Program Files\OpenVPN\bin\openvpnserv.exe + C:\Program Files\Synaptics\SynTP\SynTPEnh.exe + C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe + C:\Program Files\Lenovo\HOTKEY\tphkload.exe + C:\Program Files\Lenovo\ + C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe + Graylog-collector-sidecar.exe + C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git-remote-https.exe + C:\Program Files (x86)\SmartGit\git\mingw32\bin\git.exe + C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git.exe + C:\Program Files (x86)\SmartGit\bin\smartgit.exe + Anonymous Pipe + C:\Program Files (x86)\Fortinet\FortiClient\FortiESNAC.exe + C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe + C:\Program Files (x86)\Fortinet\FortiClient\FortiTray.exe + C:\Program Files (x86)\Fortinet\FortiClient\FCDBLog.exe + C:\Program Files (x86)\Enpass\Enpass.exe + C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe + C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgrhv.exe + C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe + C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmware-vmrc.exe + SQLAnywhereLRM + pgsignal + postgres.exe + MICROSOFT##WID\tsql\query + TSVCPIPE- + BB4BB19A178C25D1 + SQLAnywhereLRM + SQLLocal + DropboxPipe_ + c:\windows\system32\inetsrv\w3wp.exe + C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\mfcesd.exe + C:\Pfx Engagement\WM\PFXEngagement.exe + C:\Pfx Engagement\WM\Pfx.KnowledgeCoach.SharedServices.exe + C:\Program Files (x86)\Micro Focus\COBOL Server 2012\bin\mfds.exe + ScreenConnect.WindowsClient.exe + ScreenConnect.ClientService.exe + QBW32.EXE + EXCEL.EXE + ADCUpdate.exe + Hydrous.Host.exe + TNSLSNR.exe + ShoreWare Server + + + + + + + + + + + + + + + + + From 76bc020a982ff2bdc951068f4ff4a172deafc731 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sat, 7 Jul 2018 00:34:08 -0400 Subject: [PATCH 256/471] Big update, more todo, stay tuned --- Sysmon-config.xml | 538 +++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 481 insertions(+), 57 deletions(-) diff --git a/Sysmon-config.xml b/Sysmon-config.xml index ef0ea29c..46ab3d27 100644 --- a/Sysmon-config.xml +++ b/Sysmon-config.xml @@ -51,7 +51,7 @@ PERFORMANCE: By using "end with" you can save performance by starting a string match at the end of a line, which usually triggers earlier. --> - + md5,sha256 @@ -71,100 +71,524 @@ - \cmd.exe - \cmd.com - .com - \powershell.exe - \control.exe - \acrord32.exe - \installutil.exe - \reg.exe - \net.exe - \net1.exe - \ipconfig.exe - sethc.exe - utilman.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe - - whoami.exe - ipconfig.exe - tasklist.exe - sysinfo.exe - netstat.exe - qprocess.exe - nslookup.exe + sethc.exe + utilman.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe + + + whoami.exe + ipconfig.exe + tasklist.exe + sysinfo.exe + netstat.exe + qprocess.exe + nslookup.exe net.exe - quser.exe - query.exe - tracert.exe - tree.com - route.exe - runas.exe + net1.exe + quser.exe + query.exe + tracert.exe + tree.com + route.exe + runas.exe reg.exe - taskkill.exe + taskkill.exe netsh.exe - klist.exe + klist.exe wevtutil.exe taskeng.exe regsvr32.exe - wmiprvse.exe - hh.exe + wmiprvse.exe + psexesvc.exe + Execute processes remotely + psexec.exe + Execute processes remotely + pskill.exe + hh.exe cmd.exe + cmd.exe powershell.exe + powershell.exe + powershell.exe bash.exe - odbcconf.exe + bash.exe + odbcconf.exe pcalua.exe attrib.exe - cmdkey.exe + cmdkey.exe + sdbinst.exe + - bitsadmin.exe + bitsadmin.exe + - eventvwr.exe - fodhelper.exe + eventvwr.exe + fodhelper.exe + InstallUtil.exe /logfile= /LogToConsole=false /U + Mavinject.exe CMSTP.exe + MSBuild.exe regsvcs.exe regasm.exe SyncAppvPublishingServer.exe + control.exe control.exe /name rundll32.exe shell32.dll,Control_RunDLL + + wsmprovhost.exe + wsmprovhost.exe winrm.cmd + certutil.exe -decode + certutil -decode + mshta.exe + wevutil.exe + wevutil cl + schtasks.exe + schtasks.exe + at.exe + at.exe + forfiles.exe + forfiles.exe + pcalua.exe + pcalua.exe + bash.exe + bash.exe + bash.exe + System.Management.Automation + - acrobat.exe - acrord32.exe + acrobat.exe + acrord32.exe + - chrome.exe - firefox.exe - iexplore.exe - MicrosoftEdgeCP.exe - MicrosoftEdge.exe - vivaldi.exe - waterfox.exe + chrome.exe + firefox.exe + iexplore.exe + MicrosoftEdgeCP.exe + MicrosoftEdge.exe + vivaldi.exe + waterfox.exe + - java.exe - javaw.exe - + java.exe + javaw.exe + + + word.exe + excel.exe + POWERPNT.exe + outlook.exe + visio.exe + msaccess.exe + lync.exe + skype.exe + - 2> - > - >> + 2> + < + > + + + & + ; + | + more + \\tsclient + .. + + + COMSPEC + iex + Invoke-Expression + iwr + Invoke-WebRequest + DownloadFile + DownloadString + Net.WebClient + System.Net.WebRequest + System.Net.SecurityProtocolType + Shellcode + FromBase64String + convertto-securestring + VerbosePreference.ToString + + + runtime.interopservices.marshal + VerbosePreference.ToString + -windowstyle h + -windowstyl h + -windowsty h + -windowst h + -windows h + -window h + -windo h + -wind h + -win h + -wi h + -w h + -wi h + -win hi + -win hid + -win hidd + -win hidde + -win hidden + -Nop + -Noni + -ec + -en + ^c^o^m^S^p^E^c^ + C^om^S^pEc + + + + .com + powershell.exe + \temp\ + C:\users + explorer.exe + control.exe + acrord32.exe + installutil.exe + reg.exe + ipconfig.exe + \appdata\ + \programdata\ + \Users + \ProgramData + \Windows\ + \Perflogs\ + \config\systemprofile\ + + \ + + + + AppContainer + C:\Windows\system32\DllHost.exe /Processid + C:\Windows\system32\SearchIndexer.exe /Embedding + C:\Windows\System32\CompatTelRunner.exe + C:\Windows\System32\MusNotification.exe + C:\Windows\System32\MusNotificationUx.exe + C:\Windows\System32\audiodg.exe + C:\Windows\System32\conhost.exe + C:\Windows\System32\powercfg.exe + C:\Windows\System32\wbem\WmiApSrv.exe + C:\Windows\servicing\TrustedInstaller.exe + C:\Windows\system32\sppsvc.exe + C:\Windows\system32\SearchIndexer.exe + C:\Windows\system32\DllHost.exe /Processid + C:\Windows\system32\svchost.exe -k DcomLaunch + \SystemRoot\System32\smss.exe 00000100 0000007c + \SystemRoot\System32\smss.exe 00000100 0000007c + C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe + %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows + C:\Windows\system32\SearchIndexer.exe + C:\Windows\system32\vssvc.exe + net use + + C:\Program Files\Windows Defender + C:\Windows\System32\CompatTelRunner.exe + C:\Windows\System32\wermgr.exe + C:\Windows\SysWOW64\wermgr.exe + C:\Windows\System32\MpSigStub.exe + C:\Windows\SoftwareDistribution\Download\Install\AM_Delta + C:\Windows\SoftwareDistribution\Download\Install\AM_Engine + C:\Windows\SoftwareDistribution\Download\Install\AM_Base + C:\Windows\System32\MusNotification.exe + C:\Windows\System32\MusNotificationUx.exe + C:\Windows\system32\SearchIndexer.exe /Embedding + C:\Windows\System32\svchost.exe -k wsappx + C:\Windows\System32\svchost.exe -k appmodel + C:\Windows\System32\svchost.exe -k UnistackSvcGroup + C:\Windows\System32\svchost.exe -k defragsvc + C:\Windows\System32\svchost.exe -k RPCSS + C:\Windows\System32\svchost.exe -k utcsvc + C:\Windows\System32\svchost.exe -k wbioSvcGroup + C:\Windows\System32\svchost.exe -k DcomLaunch + C:\Windows\System32\svchost.exe -k swprv + C:\Windows\System32\svchost.exe -k imgsvc + C:\Windows\System32\svchost.exe -k NetworkServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc + C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc + C:\Windows\system32\svchost.exe -k localServiceNoNetwork + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost + C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted + C:\Windows\system32\svchost.exe -k netsvcs -p -s NcaSvc + C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC + C:\Windows\system32\svchost.exe -k netsvcs -s BITS + C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc + C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc + C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc + C:\Windows\system32\svchost.exe -k netsvcs -s SENS + C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv + C:\Windows\system32\svchost.exe -k netsvcs -s Themes + C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt + C:\Windows\system32\svchost.exe -k netsvcs -s gpsvc + C:\Windows\system32\svchost.exe -k netsvcs + C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc + C:\Windows\system32\svchost.exe -k networkService -s Dnscache + C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation + C:\Windows\system32\svchost.exe -k networkService -s NlaSvc + C:\Windows\system32\svchost.exe -k networkService -s TermService + C:\Windows\system32\svchost.exe -k networkService + C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted + C:\Windows\system32\svchost.exe -k rPCSS + C:\Windows\system32\svchost.exe -k secsvcs + C:\Windows\system32\svchost.exe -k swprv + C:\Windows\system32\svchost.exe -k unistackSvcGroup + C:\Windows\system32\svchost.exe -k utcsvc + C:\Windows\system32\svchost.exe -k wbioSvcGroup + C:\Windows\system32\svchost.exe -k werSvcGroup + C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC + C:\Windows\system32\svchost.exe -k wsappx + C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted + C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation + C:\Windows\system32\svchost.exe -k NetworkService + C:\Windows\System32\svchost.exe -k netsvcs + C:\WINDOWS\system32\svchost.exe -k GPSvcGroup + C:\Windows\System32\svchost.exe -k tapisrv + C:\WINDOWS\System32\svchost.exe -k wsappx + C:\Windows\System32\svchost.exe -k netsvcs + C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted + C:\Windows\System32\powercfg.exe + + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe + C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe + + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE + C:\Program Files\Microsoft Office\Office16\MSOSYNC.EXE + C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE + C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXE + C:\Program Files (x86)\Microsoft Office\Office15\MSOSYNC.EXE + C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe + C:\Windows\splwow64.exe + + C:\Program Files\Windows Media Player\wmpnscfg.exe + + C:\Program Files\Microsoft\Exchange Server\V15\Bin\Microsoft.Exchange.Diagnostics.Service.exe + C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe + C:\Program Files\Microsoft\Exchange Server\V14\Scripts\CheckDatabaseRedundancy.ps1 + + C:\Windows\System32\ddpcli.exe + + "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= + "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= + C:\Program Files (x86)\Google\Update\ + C:\Program Files (x86)\Google\Update\ + + "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel + "C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel + + AcroRd32.exe" /CR + AcroRd32.exe" --channel= + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe + + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe + + C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\LogTransport2.exe + + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe + + C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe + + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe + + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe + C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe + C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe + + + C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe + + "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ + C:\Program Files\NVIDIA Corporation\ + \NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe + C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamuseragent.exe + C:\Program Files\Realtek\ + C:\Program Files\DellTPad\HidMonitorSvc.exe + "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ + C:\Program Files\Synaptics\SynTP\SynTPEnh.exe + C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe + + C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + + C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe + C:\Program Files\Dell\SupportAssist\pcdrcui.exe + C:\Program Files\Dell\SupportAssist\koala.exe + "-outc=C:\ProgramData\Dell\CommandUpdate\inventory.xml" "-logc=C:\ProgramData\Dell\CommandUpdate\scanerrs.xml" "-lang=en" "-enc=UTF-16" + + + C:\Program Files (x86)\Lenovo\System Update\ConfigService.exe + C:\PROGRA~3\Lenovo\SYSTEM~1\SESSIO~1\REPOSI~1\fwdphb06\fwdphb06_version.exe + C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe + C:\Windows\system32\LPlatSvc.exe + C:\Program Files\Lenovo\HOTKEY\tphkload.exe + C:\Program Files\Lenovo\HOTKEY\micmute.exe + C:\Program Files\Lenovo\InstantOn\InstantOnSrv.exe + C:\Program Files\Lenovo\Lenovo Mouse Suite\Service\PelService.exe + C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe + C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe + C:\Program Files (x86)\Lenovo\System Update\tvsukernel.exe + C:\Program Files (x86)\Lenovo\System Update\UACSdk.exe + C:\Program Files (x86)\Lenovo\System Update\SUService.exe + C:\Program Files\Lenovo\Lenovo Ultraslim Plus Wireless Keyboard & Mouse\Pelico.exe + C:\Program Files\Lenovo\Lenovo Ultraslim Plus Wireless Keyboard & Mouse\LeDaemon.exe + C:\Program Files\Lenovo\Lenovo Mouse Suite\ICO.exe + C:\Program Files\Lenovo\Lenovo Mouse Suite\Service\PelElvDm.exe + C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe + C:\Program Files (x86)\Lenovo\System Update\tvsu.exe + C:\Program Files (x86)\Lenovo\System Update\TvsuCommandLauncher.exe + + C:\Program Files (x86)\SCM\SCM.exe + C:\Program Files (x86)\SCM\SCM_Notice.exe + C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe + C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe + C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe + C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe + + C:\Program Files\Intel\Telemetry 2.0\lrio.exe + C:\Program Files\Intel Driver Update Utility\SUR\SurSvc.exe + C:\Windows\System32\DriverStore\FileRepository\ki120591.inf_amd64_7a2f7b04e15632c2\igfxCUIService.exe + C:\Windows\System32\DriverStore\FileRepository\ki120591.inf_amd64_7a2f7b04e15632c2\igfxEM.exe + + "C:\Windows\sysnative\rundll32.exe" "C:\Windows\system32\WRusr.dll",SynProc + C:\Program Files (x86)\Webroot\WRSA.exe" -ul + "C:\Program Files (x86)\Webroot\WRSA.exe" -service + C:\Program Files (x86)\Webroot\WRSA.exe + + C:\Program Files\Synaptics\SynTP\SynTPEnh.exe + C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe + + + + + C:\Windows\LTSvc\LTSVC.exe -sLTService + C:\Windows\LTSvc\LTSVC.exe + C:\Windows\LTSvc\ + find /i "Listening" + netstat -an + tasklist + nslookup + nbtstat.exe + dsquery + sc query + find /i "Listening" + netstat -an + tasklist + interface tcp show global + wmic path win32_operatingsystem get + sc queryex type= service + C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe + raw_agent_svc.exe + raw_agent_svc.exe + IscsidscInterface.exe + IscsidscInterface.exe + Add-PSSnapin Microsoft.SharePoint.PowerShell + find /i "Listening" + netstat -an + tasklist + wmic path win32_operatingsystem get + sc queryex type= service + C:\Program Files\StorageCraft\ImageManager\ImageManager.exe + Add-PSSnapin Microsoft.SharePoint.PowerShell + Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname + Get-WmiObject -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType + Get-WmiObject -Namespace Root\CimV2\TerminalServices + tasklist + vssadmin list writers + vssadmin list writers + net view \\localhost | find " Print + net view \\localhost | find " Disk + C:\Windows\system32\net1 Share + Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname | format-table -autosize" | find /i "vss writer" | find /i "sql server"" + C:\Program Files (x86)\LabTech Client\LTClient.exe + C:\Windows\LTSvc\LTSvcMon.exe -sLTService + C:\Windows\LTSvc\LTSvcMon.exe + C:\Windows\LTSvc\LTTray.exe + Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall + interface tcp show global + nslookup.exe + + ScreenConnect.WindowsClient.exe + C:\Program Files (x86)\SmartGit + C:\Program Files (x86)\SmartGit + Vivaldi\Application\vivaldi.exe + controls\cef\ConnectWise.exe + + C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe + C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe + C:\Program Files (x86)\SyncedTool\bin\agent_service.exe + C:\Program Files (x86)\Notepad++\notepad++.exe + C:\Program Files\OpenVPN\bin\openvpn-gui.exe + C:\Program Files (x86)\Enpass\Enpass.exe + C:\Program Files (x86)\Enpass\Enpass.exe + C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe + C:\Program Files (x86)\Fortinet\FortiClient\scheduler.exe + C:\Program Files (x86)\Fortinet\FortiClient\FCHelper64.exe + C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe + C:\Program Files (x86)\SyncedTool\bin\agent_gui.exe + C:\Anchor Server\penv\Scripts\python.exe + C:\Anchor Server\redis\redis-server.exe + C:\Anchor Server\redis\redis-server.exe + C:\PostgreSQL9.1\bin\postgres.exe + C:\PostgreSQL9.1\bin\postgres.exe + C:\ProgramData\sysmon\sysmon64.exe From 8cf8291fca4c1d71f430dcb8b0adad60d9035bed Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 9 Jul 2018 09:35:35 -0400 Subject: [PATCH 257/471] Update Mitre Rules. --- Sysmon-config.xml | 311 +++++++++++++++++++++++----------------------- 1 file changed, 155 insertions(+), 156 deletions(-) diff --git a/Sysmon-config.xml b/Sysmon-config.xml index 46ab3d27..4abbf558 100644 --- a/Sysmon-config.xml +++ b/Sysmon-config.xml @@ -73,203 +73,202 @@ - sethc.exe - utilman.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe + sethc.exe + utilman.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe - whoami.exe - ipconfig.exe - tasklist.exe - sysinfo.exe - netstat.exe - qprocess.exe - nslookup.exe - net.exe - net1.exe - quser.exe - query.exe - tracert.exe - tree.com - route.exe - runas.exe - reg.exe - taskkill.exe - netsh.exe - klist.exe - wevtutil.exe - taskeng.exe - regsvr32.exe - wmiprvse.exe - psexesvc.exe - Execute processes remotely - psexec.exe - Execute processes remotely - pskill.exe - hh.exe - cmd.exe - cmd.exe - powershell.exe - powershell.exe - powershell.exe - bash.exe - bash.exe - odbcconf.exe - pcalua.exe - attrib.exe - cmdkey.exe + whoami.exe + ipconfig.exe + tasklist.exe + sysinfo.exe + netstat.exe + qprocess.exe + nslookup.exe + net.exe + net1.exe + quser.exe + query.exe + tracert.exe + tree.com + route.exe + runas.exe + reg.exe + taskkill.exe + netsh.exe + klist.exe + wevtutil.exe + taskeng.exe + regsvr32.exe + wmiprvse.exe + psexesvc.exe + Execute processes remotely + psexec.exe + Execute processes remotely + pskill.exe + hh.exe + cmd.exe + cmd.exe + powershell.exe + powershell.exe + powershell.exe + bash.exe + bash.exe + odbcconf.exe + pcalua.exe + attrib.exe + cmdkey.exe - sdbinst.exe + sdbinst.exe - bitsadmin.exe + bitsadmin.exe - eventvwr.exe - fodhelper.exe + eventvwr.exe + fodhelper.exe - InstallUtil.exe - /logfile= /LogToConsole=false /U + InstallUtil.exe + /logfile= /LogToConsole=false /U - Mavinject.exe - CMSTP.exe + Mavinject.exe + CMSTP.exe - MSBuild.exe - regsvcs.exe - regasm.exe - SyncAppvPublishingServer.exe + MSBuild.exe + regsvcs.exe + regasm.exe + SyncAppvPublishingServer.exe - control.exe - control.exe /name - rundll32.exe shell32.dll,Control_RunDLL + control.exe + control.exe /name + rundll32.exe shell32.dll,Control_RunDLL - wsmprovhost.exe - wsmprovhost.exe - winrm.cmd - certutil.exe -decode - certutil -decode - mshta.exe - wevutil.exe - wevutil cl - schtasks.exe - schtasks.exe - at.exe - at.exe - forfiles.exe - forfiles.exe - pcalua.exe - pcalua.exe - bash.exe - bash.exe - bash.exe - System.Management.Automation + wsmprovhost.exe + wsmprovhost.exe + winrm.cmd + certutil.exe -decode + certutil -decode + mshta.exe + wevutil.exe + wevutil cl + schtasks.exe + schtasks.exe + at.exe + at.exe + forfiles.exe + forfiles.exe + pcalua.exe + pcalua.exe + bash.exe + bash.exe + bash.exe + System.Management.Automation - acrobat.exe - acrord32.exe + acrobat.exe + acrord32.exe - chrome.exe - firefox.exe - iexplore.exe - MicrosoftEdgeCP.exe - MicrosoftEdge.exe - vivaldi.exe - waterfox.exe + chrome.exe + firefox.exe + iexplore.exe + MicrosoftEdgeCP.exe + MicrosoftEdge.exe + vivaldi.exe + waterfox.exe - java.exe - javaw.exe + java.exe + javaw.exe - word.exe - excel.exe - POWERPNT.exe - outlook.exe - visio.exe - msaccess.exe - lync.exe - skype.exe + word.exe + excel.exe + POWERPNT.exe + outlook.exe + visio.exe + msaccess.exe + lync.exe + skype.exe - 2> - < - > + 2> + < + > - & - ; - | - more - \\tsclient - .. + & + ; + | + more + \\tsclient + .. - COMSPEC - iex - Invoke-Expression - iwr - Invoke-WebRequest - DownloadFile - DownloadString - Net.WebClient - System.Net.WebRequest - System.Net.SecurityProtocolType - Shellcode - FromBase64String - convertto-securestring - VerbosePreference.ToString + COMSPEC + iex + Invoke-Expression + iwr + Invoke-WebRequest + DownloadFile + DownloadString + Net.WebClient + System.Net.WebRequest + System.Net.SecurityProtocolType + Shellcode + FromBase64String + convertto-securestring + VerbosePreference.ToString - runtime.interopservices.marshal - VerbosePreference.ToString - -windowstyle h - -windowstyl h - -windowsty h - -windowst h - -windows h - -window h - -windo h - -wind h - -win h - -wi h - -w h - -wi h - -win hi - -win hid - -win hidd - -win hidde - -win hidden - -Nop - -Noni - -ec - -en - ^c^o^m^S^p^E^c^ - C^om^S^pEc + runtime.interopservices.marshal + VerbosePreference.ToString + -windowstyle h + -windowstyl h + -windowsty h + -windowst h + -windows h + -window h + -windo h + -wind h + -win h + -wi h + -w h + -wi h + -win hi + -win hid + -win hidd + -win hidde + -win hidden + -Nop + -Noni + -ec + -en + ^c^o^m^S^p^E^c^ + C^om^S^pEc - .com - powershell.exe - \temp\ - C:\users + .com + \temp\ + C:\users explorer.exe control.exe acrord32.exe installutil.exe - reg.exe - ipconfig.exe - \appdata\ + reg.exe + ipconfig.exe + \appdata\ \programdata\ \Users \ProgramData From 492a2fe9df4f5cf6d8f8de1f6e0f858202be0a26 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 9 Jul 2018 15:33:05 -0400 Subject: [PATCH 258/471] update --- Sysmon-config.xml | 187 +++++++++++++++++++++++++++++++++++++--------- 1 file changed, 151 insertions(+), 36 deletions(-) diff --git a/Sysmon-config.xml b/Sysmon-config.xml index 4abbf558..65bf72b7 100644 --- a/Sysmon-config.xml +++ b/Sysmon-config.xml @@ -82,7 +82,7 @@ AtBroker.exe - whoami.exe + whoami.exe ipconfig.exe tasklist.exe sysinfo.exe @@ -116,12 +116,57 @@ powershell.exe powershell.exe powershell.exe - bash.exe - bash.exe - odbcconf.exe - pcalua.exe - attrib.exe - cmdkey.exe + bash.exe + bash.exe + odbcconf.exe + pcalua.exe + attrib.exe + cmdkey.exe + nltest.exe + nltest.exe + ExtExport + bash -c + bash.exe -c + cmdkey /list + cmdkey.exe /list + certutil.exe -urlcache -split -f + certutil -urlcache -split -f + csc -out: + csc.exe -out: + csc -target:library + csc.exe -target:library + cmdkey /list + cmd.exe /k + cmstp.exe /ni /s + cmstp /ni /s + esentutl.exe /y \\ + esentutl /y \\ + expand \\ + expand.exe \\ + extrac32 \\ + extrac32.exe \\ + ieexec.exe http + ieexec http + diskshadow + rundll32.exe advpack.dll,LaunchINFSection + rundll32 advpack.dll,LaunchINFSection + set + setx + pushd + popd + subst + ren + move + md + del + rd + expand + find + format + format + assoc + cls.exe + doskey.exe sdbinst.exe @@ -134,8 +179,8 @@ fodhelper.exe - InstallUtil.exe - /logfile= /LogToConsole=false /U + InstallUtil.exe + /logfile= /LogToConsole=false /U Mavinject.exe @@ -148,9 +193,9 @@ SyncAppvPublishingServer.exe - control.exe - control.exe /name - rundll32.exe shell32.dll,Control_RunDLL + control.exe + control.exe /name + rundll32.exe shell32.dll,Control_RunDLL wsmprovhost.exe @@ -202,37 +247,39 @@ skype.exe - 2> - < - > + 2> + < + > + ^ + - & - ; - | - more - \\tsclient - .. + & + ; + | + more + \\tsclient + .. COMSPEC - iex - Invoke-Expression - iwr - Invoke-WebRequest - DownloadFile - DownloadString - Net.WebClient - System.Net.WebRequest - System.Net.SecurityProtocolType - Shellcode - FromBase64String - convertto-securestring - VerbosePreference.ToString + iex + Invoke-Expression + iwr + Invoke-WebRequest + DownloadFile + DownloadString + Net.WebClient + System.Net.WebRequest + System.Net.SecurityProtocolType + Shellcode + FromBase64String + convertto-securestring + VerbosePreference.ToString runtime.interopservices.marshal - VerbosePreference.ToString + VerbosePreference.ToString -windowstyle h -windowstyl h -windowsty h @@ -256,7 +303,50 @@ -en ^c^o^m^S^p^E^c^ C^om^S^pEc - + + cscript.exe + wscript.exe + rundll32.exe + notepad.exe + regsvr32.exe + regsvcs.exe + C:\Windows\system32\svchost.exe + mshta.exe + psexe + pskill + psshutdown + psservice + PsPasswd + msbuild.exe + installutil.exe + msiexec.exe + mstsc.exe + telnet.exe + SyncAppvPublishingServer.exe + Mavinject.exe + ssh.exe + putty.exe + kitty.exe + kitty_portable.exe + psftp.exe + tftp.exe + wmic.exe + net.exe + nbtstat.exe + dsquery.exe + driverquery.exe + infDefaultInstall.exe + sc.exe + auditpol.exe + qwinsta.exe + rwinsta.exe + curl.exe + wget.exe + www.exe + awk.exe + sed.exe + + tor.exe .com @@ -724,6 +814,31 @@ tor2web.blutmagie.de tor-gateways.de hiddenservice.net + + shodan + shadow + researchscan + census + linode + sl-reverse + scanhub + .edu + 158.130.6. + 71.6.216. + 137.226.113. + 138.246.252. + 128.32.30. + 208.93.152. + 162.216.46. + 169.229.3. + 155.94.254. + 98.143.148. + 155.94.222. + 134.147.203. + 69.170.62. + 159.203.213. + 209.236.120. + 158.130.6 80 443 From 6325b5ad1f134dc1d7b15607a96c52cc3c236636 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 9 Jul 2018 16:14:17 -0400 Subject: [PATCH 259/471] Update for Sysmon 8.0 --- sysmonconfig-export.xml | 325 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 324 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1b49b13a..65bf72b7 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -51,7 +51,7 @@ PERFORMANCE: By using "end with" you can save performance by starting a string match at the end of a line, which usually triggers earlier. --> - + md5,sha256 @@ -70,6 +70,304 @@ code signatures to validate, but Sysmon does not support that. Look into Windows Device Guard for whitelisting support. --> + + + + sethc.exe + utilman.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe + + + whoami.exe + ipconfig.exe + tasklist.exe + sysinfo.exe + netstat.exe + qprocess.exe + nslookup.exe + net.exe + net1.exe + quser.exe + query.exe + tracert.exe + tree.com + route.exe + runas.exe + reg.exe + taskkill.exe + netsh.exe + klist.exe + wevtutil.exe + taskeng.exe + regsvr32.exe + wmiprvse.exe + psexesvc.exe + Execute processes remotely + psexec.exe + Execute processes remotely + pskill.exe + hh.exe + cmd.exe + cmd.exe + powershell.exe + powershell.exe + powershell.exe + bash.exe + bash.exe + odbcconf.exe + pcalua.exe + attrib.exe + cmdkey.exe + nltest.exe + nltest.exe + ExtExport + bash -c + bash.exe -c + cmdkey /list + cmdkey.exe /list + certutil.exe -urlcache -split -f + certutil -urlcache -split -f + csc -out: + csc.exe -out: + csc -target:library + csc.exe -target:library + cmdkey /list + cmd.exe /k + cmstp.exe /ni /s + cmstp /ni /s + esentutl.exe /y \\ + esentutl /y \\ + expand \\ + expand.exe \\ + extrac32 \\ + extrac32.exe \\ + ieexec.exe http + ieexec http + diskshadow + rundll32.exe advpack.dll,LaunchINFSection + rundll32 advpack.dll,LaunchINFSection + set + setx + pushd + popd + subst + ren + move + md + del + rd + expand + find + format + format + assoc + cls.exe + doskey.exe + + + sdbinst.exe + + + bitsadmin.exe + + + eventvwr.exe + fodhelper.exe + + + InstallUtil.exe + /logfile= /LogToConsole=false /U + + + Mavinject.exe + CMSTP.exe + + + MSBuild.exe + regsvcs.exe + regasm.exe + SyncAppvPublishingServer.exe + + + control.exe + control.exe /name + rundll32.exe shell32.dll,Control_RunDLL + + + wsmprovhost.exe + wsmprovhost.exe + winrm.cmd + certutil.exe -decode + certutil -decode + mshta.exe + wevutil.exe + wevutil cl + schtasks.exe + schtasks.exe + at.exe + at.exe + forfiles.exe + forfiles.exe + pcalua.exe + pcalua.exe + bash.exe + bash.exe + bash.exe + System.Management.Automation + + + acrobat.exe + acrord32.exe + + + chrome.exe + firefox.exe + iexplore.exe + MicrosoftEdgeCP.exe + MicrosoftEdge.exe + vivaldi.exe + waterfox.exe + + + java.exe + javaw.exe + + + word.exe + excel.exe + POWERPNT.exe + outlook.exe + visio.exe + msaccess.exe + lync.exe + skype.exe + + + 2> + < + > + ^ + + + + & + ; + | + more + \\tsclient + .. + + + COMSPEC + iex + Invoke-Expression + iwr + Invoke-WebRequest + DownloadFile + DownloadString + Net.WebClient + System.Net.WebRequest + System.Net.SecurityProtocolType + Shellcode + FromBase64String + convertto-securestring + VerbosePreference.ToString + + + runtime.interopservices.marshal + VerbosePreference.ToString + -windowstyle h + -windowstyl h + -windowsty h + -windowst h + -windows h + -window h + -windo h + -wind h + -win h + -wi h + -w h + -wi h + -win hi + -win hid + -win hidd + -win hidde + -win hidden + -Nop + -Noni + -ec + -en + ^c^o^m^S^p^E^c^ + C^om^S^pEc + + cscript.exe + wscript.exe + rundll32.exe + notepad.exe + regsvr32.exe + regsvcs.exe + C:\Windows\system32\svchost.exe + mshta.exe + psexe + pskill + psshutdown + psservice + PsPasswd + msbuild.exe + installutil.exe + msiexec.exe + mstsc.exe + telnet.exe + SyncAppvPublishingServer.exe + Mavinject.exe + ssh.exe + putty.exe + kitty.exe + kitty_portable.exe + psftp.exe + tftp.exe + wmic.exe + net.exe + nbtstat.exe + dsquery.exe + driverquery.exe + infDefaultInstall.exe + sc.exe + auditpol.exe + qwinsta.exe + rwinsta.exe + curl.exe + wget.exe + www.exe + awk.exe + sed.exe + + tor.exe + + + .com + \temp\ + C:\users + explorer.exe + control.exe + acrord32.exe + installutil.exe + reg.exe + ipconfig.exe + \appdata\ + \programdata\ + \Users + \ProgramData + \Windows\ + \Perflogs\ + \config\systemprofile\ + + \ + AppContainer @@ -516,6 +814,31 @@ tor2web.blutmagie.de tor-gateways.de hiddenservice.net + + shodan + shadow + researchscan + census + linode + sl-reverse + scanhub + .edu + 158.130.6. + 71.6.216. + 137.226.113. + 138.246.252. + 128.32.30. + 208.93.152. + 162.216.46. + 169.229.3. + 155.94.254. + 98.143.148. + 155.94.222. + 134.147.203. + 69.170.62. + 159.203.213. + 209.236.120. + 158.130.6 80 443 From a3ce85f9af048b378e51b449f5f7a12a8f038a0b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 9 Jul 2018 19:34:39 -0400 Subject: [PATCH 260/471] Fix syntax errors --- sysmonconfig-export.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 65bf72b7..ce54a827 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -326,9 +326,9 @@ Mavinject.exe ssh.exe putty.exe - kitty.exe - kitty_portable.exe - psftp.exe + kitty.exe + kitty_portable.exe + psftp.exe tftp.exe wmic.exe net.exe From b97604b7002821852aa278909ed499f254c7bd1c Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 9 Jul 2018 20:38:22 -0400 Subject: [PATCH 261/471] Remove testing config --- Sysmon-config.xml | 2203 --------------------------------------------- 1 file changed, 2203 deletions(-) delete mode 100644 Sysmon-config.xml diff --git a/Sysmon-config.xml b/Sysmon-config.xml deleted file mode 100644 index 65bf72b7..00000000 --- a/Sysmon-config.xml +++ /dev/null @@ -1,2203 +0,0 @@ - - - - - md5,sha256 - - - - - - - - - - - - - - - - sethc.exe - utilman.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe - - - whoami.exe - ipconfig.exe - tasklist.exe - sysinfo.exe - netstat.exe - qprocess.exe - nslookup.exe - net.exe - net1.exe - quser.exe - query.exe - tracert.exe - tree.com - route.exe - runas.exe - reg.exe - taskkill.exe - netsh.exe - klist.exe - wevtutil.exe - taskeng.exe - regsvr32.exe - wmiprvse.exe - psexesvc.exe - Execute processes remotely - psexec.exe - Execute processes remotely - pskill.exe - hh.exe - cmd.exe - cmd.exe - powershell.exe - powershell.exe - powershell.exe - bash.exe - bash.exe - odbcconf.exe - pcalua.exe - attrib.exe - cmdkey.exe - nltest.exe - nltest.exe - ExtExport - bash -c - bash.exe -c - cmdkey /list - cmdkey.exe /list - certutil.exe -urlcache -split -f - certutil -urlcache -split -f - csc -out: - csc.exe -out: - csc -target:library - csc.exe -target:library - cmdkey /list - cmd.exe /k - cmstp.exe /ni /s - cmstp /ni /s - esentutl.exe /y \\ - esentutl /y \\ - expand \\ - expand.exe \\ - extrac32 \\ - extrac32.exe \\ - ieexec.exe http - ieexec http - diskshadow - rundll32.exe advpack.dll,LaunchINFSection - rundll32 advpack.dll,LaunchINFSection - set - setx - pushd - popd - subst - ren - move - md - del - rd - expand - find - format - format - assoc - cls.exe - doskey.exe - - - sdbinst.exe - - - bitsadmin.exe - - - eventvwr.exe - fodhelper.exe - - - InstallUtil.exe - /logfile= /LogToConsole=false /U - - - Mavinject.exe - CMSTP.exe - - - MSBuild.exe - regsvcs.exe - regasm.exe - SyncAppvPublishingServer.exe - - - control.exe - control.exe /name - rundll32.exe shell32.dll,Control_RunDLL - - - wsmprovhost.exe - wsmprovhost.exe - winrm.cmd - certutil.exe -decode - certutil -decode - mshta.exe - wevutil.exe - wevutil cl - schtasks.exe - schtasks.exe - at.exe - at.exe - forfiles.exe - forfiles.exe - pcalua.exe - pcalua.exe - bash.exe - bash.exe - bash.exe - System.Management.Automation - - - acrobat.exe - acrord32.exe - - - chrome.exe - firefox.exe - iexplore.exe - MicrosoftEdgeCP.exe - MicrosoftEdge.exe - vivaldi.exe - waterfox.exe - - - java.exe - javaw.exe - - - word.exe - excel.exe - POWERPNT.exe - outlook.exe - visio.exe - msaccess.exe - lync.exe - skype.exe - - - 2> - < - > - ^ - - - - & - ; - | - more - \\tsclient - .. - - - COMSPEC - iex - Invoke-Expression - iwr - Invoke-WebRequest - DownloadFile - DownloadString - Net.WebClient - System.Net.WebRequest - System.Net.SecurityProtocolType - Shellcode - FromBase64String - convertto-securestring - VerbosePreference.ToString - - - runtime.interopservices.marshal - VerbosePreference.ToString - -windowstyle h - -windowstyl h - -windowsty h - -windowst h - -windows h - -window h - -windo h - -wind h - -win h - -wi h - -w h - -wi h - -win hi - -win hid - -win hidd - -win hidde - -win hidden - -Nop - -Noni - -ec - -en - ^c^o^m^S^p^E^c^ - C^om^S^pEc - - cscript.exe - wscript.exe - rundll32.exe - notepad.exe - regsvr32.exe - regsvcs.exe - C:\Windows\system32\svchost.exe - mshta.exe - psexe - pskill - psshutdown - psservice - PsPasswd - msbuild.exe - installutil.exe - msiexec.exe - mstsc.exe - telnet.exe - SyncAppvPublishingServer.exe - Mavinject.exe - ssh.exe - putty.exe - kitty.exe - kitty_portable.exe - psftp.exe - tftp.exe - wmic.exe - net.exe - nbtstat.exe - dsquery.exe - driverquery.exe - infDefaultInstall.exe - sc.exe - auditpol.exe - qwinsta.exe - rwinsta.exe - curl.exe - wget.exe - www.exe - awk.exe - sed.exe - - tor.exe - - - .com - \temp\ - C:\users - explorer.exe - control.exe - acrord32.exe - installutil.exe - reg.exe - ipconfig.exe - \appdata\ - \programdata\ - \Users - \ProgramData - \Windows\ - \Perflogs\ - \config\systemprofile\ - - \ - - - - AppContainer - C:\Windows\system32\DllHost.exe /Processid - C:\Windows\system32\SearchIndexer.exe /Embedding - C:\Windows\System32\CompatTelRunner.exe - C:\Windows\System32\MusNotification.exe - C:\Windows\System32\MusNotificationUx.exe - C:\Windows\System32\audiodg.exe - C:\Windows\System32\conhost.exe - C:\Windows\System32\powercfg.exe - C:\Windows\System32\wbem\WmiApSrv.exe - C:\Windows\servicing\TrustedInstaller.exe - C:\Windows\system32\sppsvc.exe - C:\Windows\system32\SearchIndexer.exe - C:\Windows\system32\DllHost.exe /Processid - C:\Windows\system32\svchost.exe -k DcomLaunch - \SystemRoot\System32\smss.exe 00000100 0000007c - \SystemRoot\System32\smss.exe 00000100 0000007c - C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe - %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows - C:\Windows\system32\SearchIndexer.exe - C:\Windows\system32\vssvc.exe - net use - - C:\Program Files\Windows Defender - C:\Windows\System32\CompatTelRunner.exe - C:\Windows\System32\wermgr.exe - C:\Windows\SysWOW64\wermgr.exe - C:\Windows\System32\MpSigStub.exe - C:\Windows\SoftwareDistribution\Download\Install\AM_Delta - C:\Windows\SoftwareDistribution\Download\Install\AM_Engine - C:\Windows\SoftwareDistribution\Download\Install\AM_Base - C:\Windows\System32\MusNotification.exe - C:\Windows\System32\MusNotificationUx.exe - C:\Windows\system32\SearchIndexer.exe /Embedding - C:\Windows\System32\svchost.exe -k wsappx - C:\Windows\System32\svchost.exe -k appmodel - C:\Windows\System32\svchost.exe -k UnistackSvcGroup - C:\Windows\System32\svchost.exe -k defragsvc - C:\Windows\System32\svchost.exe -k RPCSS - C:\Windows\System32\svchost.exe -k utcsvc - C:\Windows\System32\svchost.exe -k wbioSvcGroup - C:\Windows\System32\svchost.exe -k DcomLaunch - C:\Windows\System32\svchost.exe -k swprv - C:\Windows\System32\svchost.exe -k imgsvc - C:\Windows\System32\svchost.exe -k NetworkServiceNetworkRestricted - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted - C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc - C:\Windows\system32\svchost.exe -k localServiceNoNetwork - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted - C:\Windows\system32\svchost.exe -k netsvcs -p -s NcaSvc - C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC - C:\Windows\system32\svchost.exe -k netsvcs -s BITS - C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc - C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc - C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc - C:\Windows\system32\svchost.exe -k netsvcs -s SENS - C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv - C:\Windows\system32\svchost.exe -k netsvcs -s Themes - C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt - C:\Windows\system32\svchost.exe -k netsvcs -s gpsvc - C:\Windows\system32\svchost.exe -k netsvcs - C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc - C:\Windows\system32\svchost.exe -k networkService -s Dnscache - C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation - C:\Windows\system32\svchost.exe -k networkService -s NlaSvc - C:\Windows\system32\svchost.exe -k networkService -s TermService - C:\Windows\system32\svchost.exe -k networkService - C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted - C:\Windows\system32\svchost.exe -k rPCSS - C:\Windows\system32\svchost.exe -k secsvcs - C:\Windows\system32\svchost.exe -k swprv - C:\Windows\system32\svchost.exe -k unistackSvcGroup - C:\Windows\system32\svchost.exe -k utcsvc - C:\Windows\system32\svchost.exe -k wbioSvcGroup - C:\Windows\system32\svchost.exe -k werSvcGroup - C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC - C:\Windows\system32\svchost.exe -k wsappx - C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted - C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation - C:\Windows\system32\svchost.exe -k NetworkService - C:\Windows\System32\svchost.exe -k netsvcs - C:\WINDOWS\system32\svchost.exe -k GPSvcGroup - C:\Windows\System32\svchost.exe -k tapisrv - C:\WINDOWS\System32\svchost.exe -k wsappx - C:\Windows\System32\svchost.exe -k netsvcs - C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted - C:\Windows\System32\powercfg.exe - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE - C:\Program Files\Microsoft Office\Office16\MSOSYNC.EXE - C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE - C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXE - C:\Program Files (x86)\Microsoft Office\Office15\MSOSYNC.EXE - C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe - C:\Windows\splwow64.exe - - C:\Program Files\Windows Media Player\wmpnscfg.exe - - C:\Program Files\Microsoft\Exchange Server\V15\Bin\Microsoft.Exchange.Diagnostics.Service.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe - C:\Program Files\Microsoft\Exchange Server\V14\Scripts\CheckDatabaseRedundancy.ps1 - - C:\Windows\System32\ddpcli.exe - - "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= - "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= - C:\Program Files (x86)\Google\Update\ - C:\Program Files (x86)\Google\Update\ - - "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel - "C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel - - AcroRd32.exe" /CR - AcroRd32.exe" --channel= - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe - - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe - - C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\AcroCEF\AcroCEF.exe - C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\LogTransport2.exe - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe - - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe - - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe - - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe - - - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe - - "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ - C:\Program Files\NVIDIA Corporation\ - \NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamuseragent.exe - C:\Program Files\Realtek\ - C:\Program Files\DellTPad\HidMonitorSvc.exe - "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe - - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - - C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe - C:\Program Files\Dell\SupportAssist\pcdrcui.exe - C:\Program Files\Dell\SupportAssist\koala.exe - "-outc=C:\ProgramData\Dell\CommandUpdate\inventory.xml" "-logc=C:\ProgramData\Dell\CommandUpdate\scanerrs.xml" "-lang=en" "-enc=UTF-16" - - - C:\Program Files (x86)\Lenovo\System Update\ConfigService.exe - C:\PROGRA~3\Lenovo\SYSTEM~1\SESSIO~1\REPOSI~1\fwdphb06\fwdphb06_version.exe - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe - C:\Windows\system32\LPlatSvc.exe - C:\Program Files\Lenovo\HOTKEY\tphkload.exe - C:\Program Files\Lenovo\HOTKEY\micmute.exe - C:\Program Files\Lenovo\InstantOn\InstantOnSrv.exe - C:\Program Files\Lenovo\Lenovo Mouse Suite\Service\PelService.exe - C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe - C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe - C:\Program Files (x86)\Lenovo\System Update\tvsukernel.exe - C:\Program Files (x86)\Lenovo\System Update\UACSdk.exe - C:\Program Files (x86)\Lenovo\System Update\SUService.exe - C:\Program Files\Lenovo\Lenovo Ultraslim Plus Wireless Keyboard & Mouse\Pelico.exe - C:\Program Files\Lenovo\Lenovo Ultraslim Plus Wireless Keyboard & Mouse\LeDaemon.exe - C:\Program Files\Lenovo\Lenovo Mouse Suite\ICO.exe - C:\Program Files\Lenovo\Lenovo Mouse Suite\Service\PelElvDm.exe - C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe - C:\Program Files (x86)\Lenovo\System Update\tvsu.exe - C:\Program Files (x86)\Lenovo\System Update\TvsuCommandLauncher.exe - - C:\Program Files (x86)\SCM\SCM.exe - C:\Program Files (x86)\SCM\SCM_Notice.exe - C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe - C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe - C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe - C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe - - C:\Program Files\Intel\Telemetry 2.0\lrio.exe - C:\Program Files\Intel Driver Update Utility\SUR\SurSvc.exe - C:\Windows\System32\DriverStore\FileRepository\ki120591.inf_amd64_7a2f7b04e15632c2\igfxCUIService.exe - C:\Windows\System32\DriverStore\FileRepository\ki120591.inf_amd64_7a2f7b04e15632c2\igfxEM.exe - - "C:\Windows\sysnative\rundll32.exe" "C:\Windows\system32\WRusr.dll",SynProc - C:\Program Files (x86)\Webroot\WRSA.exe" -ul - "C:\Program Files (x86)\Webroot\WRSA.exe" -service - C:\Program Files (x86)\Webroot\WRSA.exe - - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe - C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe - - - - - C:\Windows\LTSvc\LTSVC.exe -sLTService - C:\Windows\LTSvc\LTSVC.exe - C:\Windows\LTSvc\ - find /i "Listening" - netstat -an - tasklist - nslookup - nbtstat.exe - dsquery - sc query - find /i "Listening" - netstat -an - tasklist - interface tcp show global - wmic path win32_operatingsystem get - sc queryex type= service - C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe - raw_agent_svc.exe - raw_agent_svc.exe - IscsidscInterface.exe - IscsidscInterface.exe - Add-PSSnapin Microsoft.SharePoint.PowerShell - find /i "Listening" - netstat -an - tasklist - wmic path win32_operatingsystem get - sc queryex type= service - C:\Program Files\StorageCraft\ImageManager\ImageManager.exe - Add-PSSnapin Microsoft.SharePoint.PowerShell - Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname - Get-WmiObject -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType - Get-WmiObject -Namespace Root\CimV2\TerminalServices - tasklist - vssadmin list writers - vssadmin list writers - net view \\localhost | find " Print - net view \\localhost | find " Disk - C:\Windows\system32\net1 Share - Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname | format-table -autosize" | find /i "vss writer" | find /i "sql server"" - C:\Program Files (x86)\LabTech Client\LTClient.exe - C:\Windows\LTSvc\LTSvcMon.exe -sLTService - C:\Windows\LTSvc\LTSvcMon.exe - C:\Windows\LTSvc\LTTray.exe - Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall - interface tcp show global - nslookup.exe - - ScreenConnect.WindowsClient.exe - C:\Program Files (x86)\SmartGit - C:\Program Files (x86)\SmartGit - Vivaldi\Application\vivaldi.exe - controls\cef\ConnectWise.exe - - C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe - C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe - C:\Program Files (x86)\SyncedTool\bin\agent_service.exe - C:\Program Files (x86)\Notepad++\notepad++.exe - C:\Program Files\OpenVPN\bin\openvpn-gui.exe - C:\Program Files (x86)\Enpass\Enpass.exe - C:\Program Files (x86)\Enpass\Enpass.exe - C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe - C:\Program Files (x86)\Fortinet\FortiClient\scheduler.exe - C:\Program Files (x86)\Fortinet\FortiClient\FCHelper64.exe - C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe - C:\Program Files (x86)\SyncedTool\bin\agent_gui.exe - C:\Anchor Server\penv\Scripts\python.exe - C:\Anchor Server\redis\redis-server.exe - C:\Anchor Server\redis\redis-server.exe - C:\PostgreSQL9.1\bin\postgres.exe - C:\PostgreSQL9.1\bin\postgres.exe - C:\ProgramData\sysmon\sysmon64.exe - - - - - - - - C:\Users - C:\ProgramData - \Temp\ - - - - C:\Windows\system32\backgroundTaskHost.exe - TrustedInstaller.exe - OneDrive.exe - vivaldi.exe - chrome.exe - C:\WINDOWS\system32\backgroundTaskHost.exe - setup - - - - - - - - - - - - - C:\Users - C:\ProgramData - C:\Windows\Temp - C:\Perflogs\ - config\systemprofile\ - \Windows\Fonts\ - \Windows\IME\ - \Windows\addins\ - chrome.exe - iexplore.exe - firefox.exe - MicrosoftEdgeCP.exe - MicrosoftEdge.exe - explorer.exe - - at.exe - certutil.exe - cmd.exe - cscript.exe - wscript.exewscript.exe - rundll32.exe - notepad.exe - regsvr32.exe - regsvcs.exe - C:\Windows\system32\svchost.exe - mshta.exe - powershell.exe - psexe - pskill - psshutdown - psservice - PsPasswd - java.exe - msbuild.exe - installutil.exe - msiexec.exe - reg.exe - mstsc.exe - telnet.exe - SyncAppvPublishingServer.exe - Mavinject.exe - ssh.exe - putty.exe - kitty.exe - kitty_portable.exe - psftp.exe - tftp.exe - wmic.exe - net.exe - nbtstat.exe - dsquery.exe - driverquery.exe - infDefaultInstall.exe - sc.exe - auditpol.exe - qwinsta.exe - rwinsta.exe - - tor.exe - - githubusercontent.com - github.com - - api.ipify.org - whatismyipaddress.com - edns.ip-api.com - checkip.dyndns.org - icanhazip.com - ifconfig.me - ifconfig.co - ipaddress.com - ipinfo.io - goo.gl - git.io - bit.ly - t.co - ow.ly - ip-api.com - - dlinkddns.com - no-ip.com - no-ip.org - no-ip.biz - no-ip.info - noip.com - afraid.org - duckdns.org - changeip.com - ddns.net - hopto.org - zapto.org - servehttp.com - sytes.net - - onion.to - onion.cab - onion.sh - onion.nu - onion.direct - tor2web.org - tor2web.fi - tor2web.blutmagie.de - tor-gateways.de - hiddenservice.net - - shodan - shadow - researchscan - census - linode - sl-reverse - scanhub - .edu - 158.130.6. - 71.6.216. - 137.226.113. - 138.246.252. - 128.32.30. - 208.93.152. - 162.216.46. - 169.229.3. - 155.94.254. - 98.143.148. - 155.94.222. - 134.147.203. - 69.170.62. - 159.203.213. - 209.236.120. - 158.130.6 - - 80 - 443 - 3389 - 3540 - 22 - 23 - 25 - 139 - - 5800 - 5900 - 1194 - 1701 - 1723 - 1293 - 4500 - 1080 - 8080 - 3128 - 9001 - 9030 - 4443 - 2448 - 8143 - 1777 - 1443 - 243 - 65535 - 13506 - 3360 - 200 - 198 - 49180 - 13507 - 3360 - 6625 - 4444 - 4438 - 1904 - 13505 - 13504 - 12102 - 9631 - 5445 - 2443 - 777 - 13394 - 13145 - 12103 - 5552 - 3939 - 3675 - 666 - 473 - 5649 - 4455 - 4433 - 1817 - 100 - 65520 - 1960 - 1515 - 743 - 700 - 14154 - 14103 - 14102 - 12322 - 10101 - 7210 - 4040 - 9943 - - 7777 - 9943 - 666 - - - - C:\Windows\System32\dns.exe - C:\Windows\System32\find.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeFrontendTransport.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\EdgeTransport.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeSubmission.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeFrontendTransport.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeDelivery.exe - C:\Windows\SysWOW64\SearchProtocolHost.exe - true - OneDrive.exe - Spotify.exe - AppData\Roaming\Dropbox\bin\Dropbox.exe - OneDriveStandaloneUpdater.exe - ConnectWise.exe - ScreenConnect.WindowsClient.exe - AppData\Roaming\Dashlane\Dashlane.exe - AppData\Roaming\Dashlane\DashlanePlugin.exe - Vivaldi\Application\vivaldi.exe - microsoft.com - microsoft.com.akadns.net - microsoft.com.nsatc.net - .search.msn.com - .wns.windows.com - akamaitechnologies.com - llmnr - ldap - ldap - epmap - epmap - 135 - 135 - ntp - ntp - llmnr - ssdp - ssdp - 5353 - netbios-ns - netbios-dgm - 1e100.net - 5228 - 5357 - 3544 - 3702 - 50646 - C:\Program Files (x86)\SmartGit\jre\bin\java.exe - C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe - penv\Scripts\python.exe - efolder01 - 2080 - g2mcomm.exe - C:\Program Files (x86)\LabTech Client\LTClient.exe - C:\Windows\LTSvc\LTSVC.exe - C:\Program Files (x86)\Webroot\WRSA.exe - C:\Program Files (x86)\SmartGit\ - DSPro\Programs\pr001Celery98.exe - g2ax_comm_expert.exe - g2mcomm.exe - AppData\Local\Microsoft\Teams\current\Teams.exe - - - - - - - - - - - - - - C:\Users - C:\ProgramData - C:\Windows\Temp - Sysmon.exe - - - - - - - - - - microsoft - Microsoft Windows - windows - Intel - Lenovo - Synaptic - Nvidia - Broadcom - AMD - VMware - Realtek - Micro-Star - Logitech - Asmedia - SteelSeries - Fortinet - Webroot - NoVirusThanks Company Srl - Invincea - ShoreTel - Synology - Citrix - SonicWall - Sophos - OpenVPN - - - - - - - - - false - Invalid - Unavailable - C:\windows\system32\fxsst.dll - C:\Windows\System32\wbem\oci.dll - \Temp\ - - - Valid - System32\samlib.dll - System32\cryptdll.dlll - microsoft - Microsoft Windows - windows - Intel - Lenovo - Synaptic - Nvidia - Broadcom - AMD - VMware - Realtek - Micro-Star - Logitech - Asmedia - SteelSeries - Fortinet - Microsoft - Microsoft - C:\Windows\System32\backgroundTaskHost.exe - Webroot - C:\Windows\System32\backgroundTaskHost.exe - C:\Windows\System32\mmc.exe - C:\Windows\System32\SearchFilterHost.exe - C:\Windows\System32\SearchProtocolHost.exe - C:\Windows\sysmon64.exe - C:\Windows\System32\inetsrv\w3wp.exe - C:\Windows\sysmon64.exe - C:\Windows\System32\conhost.exe - C:\Windows\System32\winspool.drv - C:\Windows\System32\wshqos. - C:\Windows\System32\wow64.dll - C:\Windows\System32\clusapi.dll - C:\Windows\System32\cryptdll.dll - C:\Windows\System32\wow64win.dll - C:\Windows\System32\wow64.dll - C:\Windows\System32\pcwum.dll - C:\Windows\System32\kernel32.dll - C:\Windows\System32\user32.dll - C:\Windows\System32\cryptdll.dll - C:\Windows\System32\dns.exe - C:\Windows\System32\zvprtmon5.dll - C:\Windows\System32\termsrv.dll - C:\Windows\System32\spool\ - samlib.dll - C:\Program Files (x86)\SmartGit - syntevo\SmartGit - Labtech Client - CrystalDecisions - ShoreWare - C:\Program Files\Microsoft SQL Server\100\Shared\dbghelp.dll - C:\Windows\System32\backgroundTaskHost.exe - C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe - C:\Program Files - C:\Windows\assembly\NativeImages - C:\Program Files\WindowsApps - - C:\Program Files (x86)\AutoSizer\AutoSizer.dll - C:\Program Files (x86)\Notepad++ - C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe - C:\PostgreSQL9.1\bin\postgres.exe - C:\Windows\System32\VSSVC. - C:\Windows\System32\conhost.exe - C:\Windows\System32\svchost.exe - C:\Windows\System32\NETSTAT.EXE - C:\Windows\System32\inetsrv\w3wp.exe - C:\Windows\System32\tasklist.exe - C:\Windows\System32\nslookup.exe - C:\Windows\System32\find.exe - C:\cs\tools\php\php-cgi.exe - C:\Windows\System32\nbtstat.exe - C:\Windows\System32\dsquery.exe - C:\Windows\System32\netsh.exe - C:\Windows\System32\taskeng.exe - C:\ProgramData\sysmon\sysmon64.exe - SQL Server - SQL Server - Exchange Server - Exchange Server - - - - - - - - - C:\Windows\system32\wbem\WmiPrvSE.exe - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe - C:\Windows\system32\svchost.exe - C:\Windows\system32\wininit.exe - C:\Windows\system32\csrss.exe - C:\Windows\system32\services.exe - C:\Windows\system32\winlogon.exe - C:\Windows\system32\audiodg.exe - Google\Chrome\Application\chrome.exe - FireSvc.exe - C:\Program Files (x86)\Webroot\WRSA.exe - controls\cef\ConnectWise.exe - - - - - - - - - - - - - - - - - - - :\Windows\System32\lsass.exe - :\Windows\System32\winlogon.exe - powershell.exe - verclsid.exe - VBE7.dll - CorperfmontExt.dll - - - - - 0x40 - 0x101000 - 0x1000 - 0x1400 - 0x100000 - 0x3200 - 0x101400 - 0x101001 - - - C:\Windows\sysWOW64\wbem\wmiprvse.exe - C:\ProgramData\Microsoft\Windows Defender\platform\ - C:\Windows\system32\msiexec.exe - C:\Windows\system32\svchost.exe - C:\Windows\system32\spoolsv.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe - C:\Program Files\N-able Technologies\AVDefender\EPUpdateService.exe - taskmgr - wbem\wmiprvse.exe - \EMET_Service.exe - \EMET_GUI.exe - \procexp64.exe - processhacker - \Bin\FMS.exe - \Exchange Server\ - SQL - :\Windows\System32\smss.exe - :\Windows\system32\csrss.exe - :\Windows\system32\wininit.exe - \Google\Update\GoogleUpdate.exe - C:\Program Files (x86)\Webroot\WRSA.exe - C:\Program Files\Webroot\WRSA.exe - C:\Program Files\Windows Defender\MsMpEng.exe - C:\Program Files\Windows Defender\MsMpEng.exe - C:\Windows\Sysmon.exe - C:\Windows\Sysmon64.exe - - ScreenConnect - - :\Windows\system32\sppsvc.exe - :\Windows\system32\sdiagnhost.exe - - UNKNOWN(00007F - ShadowProtect - C:\Hlthpnt\bin\IM.exe - Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe - Common Files\Adobe\AdobeGCClient\AGSService.exe - C:\ProgramData\WebEx\webex\ - Dropbox\Update\DropboxUpdate.exe - LTSvc\LTSVC.exe - \Trusteer\Rapport\bin\RapportMgmtService.exe - Adobe\AdobeGCClient\AGMService.exe - NT-ware Shared\MomAdmSvc\MomAdmSvc.exe - \Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe - - - - - - - - - - \Start Menu - \Startup - \Content.Outlook\ - \Downloads\ - .dll - .ocx - .sys - .application - .appref-ms - .bat - .cmd - .com - .btm - .cmdline - .docm - .exe - .msc - .hta - .ws - .wsf - .wsh - .pptm - .ps1 - .ps1xml - .psc1 - .psd1 - .psm1 - .pssc - .cdxml - .sys - .reg - .docm - .xlsm - .xlam - .pptm - .potm - .pptm - .sldm - .scf - .appref-ms - .rdp - .vbs - .vb - .vbsript - .vbe - .js - .jse - proj - .sln - .xls - .ppt - .rft - .SettingContent-ms - C:\Users\Default - \Desktop - \Documents - C:\Windows\System32\Drivers - C:\Windows\SysWOW64\Drivers - C:\Windows\System32\GroupPolicy\Machine\Scripts - C:\Windows\System32\GroupPolicy\User\Scripts - C:\Windows\System32\Tasks - C:\Windows\System32\Wbem - C:\Windows\SysWOW64\Wbem - C:\Windows\System32\WindowsPowerShell - C:\Windows\SysWOW64\WindowsPowerShell - C:\Windows\Tasks\ - C:\Windows\System32\Tasks - C:\Windows\AppPatch\Custom - .cmdline - C:\Windows\System32\ - - .ICL - .FON - .FOT - .ico - .lnk - .eml - .msg - .SCT - .SCR - .SHB - .SHS - .PAF - .JSE - .gadget - .cpl - .inf - - help_decrypt - help_restore - ReadDecryptFilesHere - howto_recover_file - recover_file_ - Recovery_file_ - how_to_decrypt - encryptor_raas_readme_liesmich - _how_recover_ - HOWTO_RESTORE_FILES_ - help_my_files - how_recover - HELP_TO_SAVE_FILES - DECRYPT_INSTRUCTIONS - YOUR_FILES.url - Coin.Locker.txt - _secret_code.txt - Decrypt_readme.txt - INSTUCCIONES_DESCRIFRADO - FILESAREGONE.txt - IAMREADYTOPAY.TXT - HELLOTHERE.TXT - READTHISNOW!!!.txt - SECRETIDHERE.KEY - IHAVEYOURSECRET.KEY - SECRET.KEY - HELPDECRYPT_YOUR_FILES.HTML - RECOVERY_FILES.TXT - RECOVERY_FILE. - HowtoRestore_Files - restorefiles - howrecover+ - recoveryfile - help_recover_instructions - _Locky_recover - _ReCoVeRy_ - - www.exe - ps.exe - nt.exe - doliohdyjkajd.dll - run2.exe - ping2.exe - - - .pem - .crt - .ca-bundle - .cer - .csr - .der - .p7b - .p7r - .p7s - .pfx - .sto - .p12 - .crl - .sst - .key - - .mht - .cpl - .scr - .manifest - .inf - HammerDrillStatus.dll - - - - - C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates\ - \Downloads - \Start Menu - \Start Menu\Programs - \Start Menu\Programs\Startup - - C:\Windows\System32\svchost.exe - C:\Windows\System32\smss.exe - \Microsoft\Windows\INetCache\IE - \Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates - WRITABLE.TST - C:\Windows\System32\wbem\Performance\ - C:\Windows\System32\DriverStore\Temp\ - C:\Windows\System32\wbem\Performance\ - WRITABLE.TST - .SQM - .SPL - .SHD - C:\Program Files (x86)\EMET 5.5\EMET_Service.exe - C:\Windows\system32\mobsync.exe - C:\Windows\Installer\ - - C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask - - C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\ - .etl - .log - C:\WINDOWS\winsxs\amd64_microsoft-windows - Firefox Setup - C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - C:\Windows\System32\config\netlogon.ftl - \\?\C:\Windows\system32\wbem\WMIADAP.EXE - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe - C:\Windows\system32\CompatTelRunner.exe - C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\sqlservr.exe - C:\Windows\System32\smss.exe - C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe - C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe - C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe - - C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe - - C:\Windows\system32\igfxCUIService.exe - - Google\Chrome\User Data\Safe Browsing\UrlUws.store_new - Google\Chrome\User Data\Safe Browsing\UrlMalBin.store_new - Google\Chrome\User Data\Safe Browsing\UrlMalware.store_new - Google\Chrome\User Data\Safe Browsing\UrlSoceng.store_new - Google\Chrome\User Data\Safe Browsing\ChromeExtMalware.store_new - Google\Chrome\User Data\Safe Browsing\ChromeFilenameClientIncident.store_new - Google\Chrome\User Data\Safe Browsing\ChromeUrlClientIncident.store_new - Google\Chrome\User Data\Safe Browsing\IpMalware.store_new - Google\Chrome\User Data\Safe Browsing\UrlSubresourceFilter.store_new - Google\Chrome\User Data\Safe Browsing\UrlCsdWhitelist.store_new - Google\Chrome\User Data\Safe Browsing\UrlCsdDownloadWhitelist.store_new - Google\Chrome\User Data\Safe Browsing\CertCsdDownloadWhitelist.store_new - .default\prefs-1.js - - C:\Windows\System32\Tasks\Adobe Acrobat Update Task - C:\Windows\System32\Tasks\Adobe Flash Player Updater - - C:\Program Files (x86)\ConnectWise\PSA.net\ConnectWise.exe - - C:\Program Files\Datto\Datto Windows Agent\DattoBackupAgent.exe - - C:\Windows\System32\config\systemprofile\TOSHIBA\ - TOSHIBA\eSTUDIOX\UNIDRV - N-able Technologies\AVDefender\ThreatScanner\Antivirus-NewTemp\bdcore.dll - N-able Technologies\AVDefender\ThreatScanner\Antivirus-NewTemp\scanclient.dll - C:\Program Files (x86)\N-able Technologies\Windows Software Probe\Repository\nagent - C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\ - - - - - - - - - - - - - - - - - - - - - - - - - - - - \CurrentVersion\Run - \Group Policy\Scripts - \Windows\System\Scripts - \Microsoft\System\Scripts - \ServiceDll - \ImagePath - \Start - HKLM\SYSTEM\Setup\CmdLine - Session Manager\KnownDlls - HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors - HKLM\SYSTEM\CurrentControlSet\Control\Print\Providers - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages - HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages - HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages - HKLM\HARDWARE\ACPI\DSDT - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet - HKLM\System\CurrentControlSet\Control\Session Manager\Execute - HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute - HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute - HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath - HKLM\Software\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLU\Software\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell - UserInitMprLogonScript - \CurrentVersion\Font Drivers - Active Setup\Installed Components - Windows CE Services\AutoStartOnConnect - Windows CE Services\AutoStartOnDisconnect - CurrentVersion\Windows\IconServiceLib - Winlogon\AlternateShells\AvailableShells - Terminal Server\Wds\rdpwd\StartupPrograms - SafeBoot\AlternateShell - Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman - HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown - Policies\System\Shell - Desktop\Scrnsave.exe - SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit - - \Explorer\FileExts\ - \shell\install\command\ - \shell\open\command\ - \shell\open\ddeexec\ - - \InprocServer32\(Default) - - \PropertySheetHandlers - \CopyHookHandlers - \ColumnHandlers - \ExtShellFolderViews - \ShellServiceObjects - \ShellServiceObjectDelayLoad - \SOFTWARE\Classes\Protocols\Filter - \SOFTWARE\Classes\Protocols\Handler - \Software\Microsoft\Ctf\LangBarAddin - \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components - \SharedTaskScheduler - \ContextMenuHandlers\ - \CurrentVersion\Shell - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad - \Classes\Folder\ - \Classes\*\ - \Classes\AllFilesystemObjects\ - \Classes\Directory\ - \Classes\Drive\ - \ShowSuperHidden - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ - HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand - - HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ - - HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ - \ProxyServer - Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy - \DisableSecuritySettingsCheck - \3\1206 - \3\2500 - \3\1809 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders - HKLM\SOFTWARE\Microsoft\Netsh - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers - - HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - EnableFirewall - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - - - Office Test\ - \Outlook\Addins\ - \Excel\Addins\ - \Word\Addins\ - \Access\Addins\ - \Powerpoint\Addins\ - - \Internet Explorer\Toolbar\ - \Internet Explorer\Extensions\ - - \Browser Helper Objects\ - {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ - - \UrlUpdateInfo - \InstallSource - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - - HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - HKLM\Software\Microsoft\Windows\CurrentVersion\RunService - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - \Software\Microsoft\Windows NT\CurrentVersion\Windows\load - HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 - CurrentVersion\Windows\Load - CurrentVersion\Windows\Run - CurrentVersion\Winlogon\Shell - CurrentVersion\Winlogon\System - - \Software\Policies\Microsoft\Windows\System\Scripts\Logon - \Software\Policies\Microsoft\Windows\System\Scripts\Logoff - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - Domain - DefaultGateway - DHCPDefaultGateway - DhcpIPAddress - DhcpNameserver - Dhcpserver - DhcpSubnetMask - SubnetMask - PersistentRoutes - - \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU - HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR - - \Software\Microsoft\Terminal Server Client - - - \WRData\Threats\Active - \WRData\Threats\History - - \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL - - - - - - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy - - \Security\Level - \Security\Level1Remove - - HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled - HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring - HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride - HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify - \HideSCAHealth - - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange - - - - HKLM\SOFTWARE\Microsoft\Cryptography\OID - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID - HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust - \Software\Classes\mscfile\shell\open\command - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad - \comfile\shell\open\command - \htafile\shell\open\command - \batfile\shell\open\command - \piffile\shell\open\command - \exefile\shell\open\command - Classes\exefile\shell\runas\command\isolatedCommand - \piffile\shell\open\command - \regfile\shell\open\command - \mscfile\shell\open\command - \InprocServer32 - HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ - \FriendlyName - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - HKLM\SOFTWARE\Microsoft\Tracing\RASAPI32 - - - - - - - Office\root\integration\integrator.exe - C:\WINDOWS\system32\backgroundTaskHost.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe - C:\Program Files (x86)\Microsoft Office\Office16\lync.exe - C:\Program Files (x86)\Microsoft Office\Office15\lync.exe - C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe - C:\Program Files\Windows Defender\MsMpEng.exe - Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\ - - HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files- - HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\User_Feed_Synchronization- - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsUpdate - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ - Toolbar\WebBrowser - Toolbar\WebBrowser\ITBar7Height - Toolbar\WebBrowser\ITBar7Layout - Toolbar\ShellBrowser\ITBar7Layout - Internet Explorer\Toolbar\Locked - Toolbar\WebBrowser\{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Toolbar\WebBrowser\{724D43A0-0D85-11D4-9908-00400523E39A} - Toolbar\WebBrowser\ITBar7Layout - ShellBrowser - \CurrentVersion\Run - \CurrentVersion\RunOnce - \CurrentVersion\App Paths - \CurrentVersion\Image File Execution Options - \CurrentVersion\Shell Extensions\Cached - \CurrentVersion\Shell Extensions\Approved - }\PreviousPolicyAreas - \Control\WMI\Autologger\ - HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start - \Lsa\OfflineJoin\CurrentValue - \Components\TrustedInstaller\Events - \Components\TrustedInstaller - \Components\Wlansvc - \Components\Wlansvc\Events - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ - \Directory\shellex - \Directory\shellex\DragDropHandlers - \Drive\shellex - \Drive\shellex\DragDropHandlers - _Classes\AppX - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ - C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe - - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit - - \services\clr_optimization_v2.0.50727_32\Start - \services\clr_optimization_v2.0.50727_64\Start - \services\clr_optimization_v4.0.30319_32\Start - \services\clr_optimization_v4.0.30319_64\Start - \services\DeviceAssociationService\Start - \services\BITS\Start - \services\TrustedInstaller\Start - \services\tunnel\Start - \services\UsoSvc\Start - - \OpenWithProgids - \OpenWithList - \UserChoice - \UserChoice\ProgId - \UserChoice\Hash - \OpenWithList\MRUList - } 0xFFFF - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jxr - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2 - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2 - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2 - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2 - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf - SOFTWARE\Classes\Wow6432Node\CLSID\{955C0D7D-042E-4034-9D54-EBD52477A6DB}\ - SOFTWARE\Classes\Wow6432Node\CLSID\{BEACC58F-E643-4e97-B19E-95F6EE3500FA}\ - SOFTWARE\Classes\Wow6432Node\CLSID\{07598BD3-ABBE-4bee-959F-7B90253EADFF}\ - SOFTWARE\Classes\Wow6432Node\CLSID\{31240348-66EE-4F14-A42A-39F373A834C7}\ - SOFTWARE\Classes\Wow6432Node\CLSID\{8C8EC235-0786-4DAD-A957-1A6CD76C28F5}\ - - HKLM\System\CurrentControlSet\Control\Lsa\Audit\SpecialGroups - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0 - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\PSScriptOrder - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\SOM-ID - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\GPO-ID - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\IsPowershell - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\ExecTime - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0 - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\PSScriptOrder - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\SOM-ID - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\GPO-ID - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\IsPowershell - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\ExecTime - \safer\codeidentifiers\0\HASHES\{ - - - - - - } 0xFFFF - C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe - HKLM\System\CurrentControlSet\Services\DeviceAssociationService\Start - HKLM\System\CurrentControlSet\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\ - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe - C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe - - \LTSvcMon\Start - \LTService\Start - - {F2C2787D-95AB-40D4-942D-298F5F757874} - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe - - HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\ - \Software\Policies\Microsoft\SystemCertificates\ - HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ - HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\ - HKLM\SOFTWARE\Microsoft\SystemCertificates\ - C:\Windows\SysWOW64\SearchProtocolHost.exe - HKLM\System\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnotice - HKCR\VLC. - HKCR\iTunes. - - \Software\NITRO\PRO - - HKLM\SOFTWARE\Wow6432Node\WRData\Status - - - - - - - - - - .default\prefs-1.js - - - Content.Outlook - Downloads - Temp\7z - Startup - .vb - .application - .appref-ms - .bat - .cmd - .cmdline - .docm - .exe - .dll - .sys - .hta - .pptm - .ps1 - .sys - .reg - .docm - .xlsm - .xlam - .pptm - .potm - .pptm - .sldm - .scf - .appref-ms - .rdp - .vbs - .js - - .pem - .crt - .ca-bundle - .cer - .csr - .der - .p7b - .p7r - .p7s - .pfx - .sto - .p12 - .crl - .sst - .key - - .mht - .manifest - .cpl - .scr - .inf - - - - - - - - - - - - - - - - - - - - lsass - \SQLLocal\RTCLOCAL - \spoolss - - \M.E.C.Core.WinRMDataCommunicator.NamedPipe. - c:\windows\system32\inetsrv\w3wp.exe - C:\Windows\syswow64\snmp.exe - C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\BIN\OWSTIMER.EXE - - Exchange Server - - C:\Windows\system32\dns.exe - - \sql\query - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe - - C:\Program Files\Skype for Business Server 2015\Server\Core\RtcHost.exee - C:\Program Files\Skype for Business Server 2015\OCSMCU\AV Conferencing\AVMCUSvc.exe - C:\Program Files\Skype for Business Server 2015\Server\Health Agent\HealthAgent.exe - C:\Program Files\Skype for Business Server 2015\Server\Core\LysSvc.exe - C:\Program Files\Skype for Business Server 2015\File Transfer Agent\FileTransferAgent.exe - C:\Program Files\Skype for Business Server 2015\Web Conferencing\DataMCUSvc.exe - C:\Program Files\Skype for Business Server 2015\Application Host\OcsAppServerHost.exe - C:\Program Files\Skype for Business Server 2015\Server\Core\ABServer.exe - C:\Program Files\Skype for Business Server 2015\Master Replicator Agent\MasterReplicatorAgent.exe - C:\Program Files\Skype for Business Server 2015\OCSMCU\IM Conferencing\IMMCUSvc.exe - C:\Program Files\Common Files\Skype for Business Server 2015\ClsAgent\ClsAgent.exe - C:\Program Files\Skype for Business Server 2015\Server\Core\ReplicationApp.exe - C:\Program Files\Skype for Business Server 2015\OCSMCU\Application Sharing\ASMCUSvc.exe - C:\Program Files\Skype for Business Server 2015\Server\Replica Replicator Agent\ReplicaReplicatorAgent.exe - C:\Program Files\Skype for Business Server 2015\Server\Core\RtcHost.exe - - C:\Windows\system32\DFSRs.exee - C:\Windows\SystemApps\Microsoft.Windows - C:\Windows\system32\SearchProtocolHost.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - C:\Windows\System32\LxRun.exe - vmware- - \System - \InitShutdown - C:\Windows\System32\wininit.exe - C:\Windows\System32\SearchIndexer.exe - C:\Windows\System32\services.exe - \ntsvcs - \scerpc - C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe - C:\Windows\System32\smss.exe - C:\Windows\System32\spoolsv.exe - \epmapper - \atsvc - \browser - \srvsvc - \Winsock2CatelogChangeListener - ProtectedPrefix\LocalService\FTHPIPE - \W32TIME_ALT - \eventlog - \wkssvc - \TDLN- - \WiFiNetworkManagerTask - \MsFteWds - - \WRSVCPipe - \WRSynUM2 - \wrUrl - C:\Program Files (x86)\Webroot\WRSA.exe - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe - AppData\Local\Google\Chrome\User Data\SwReporter\ - mojo. - crashpad_ - chrome. - GoogleCrashServices - - slack.exe - - booma\ - - qtsingleapp-enpass- - qtsingleapp-enpass- - - eo.ipc. - - C:\Program Files\Windows Firewall Control\wfc.exe - - Everything Service - anchor_gui_agent - - Adobe\ARM\1.0\AdobeARM.exe - - C:\Program Files (x86)\Lenovo\System Update\SUService.exe - C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe - C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe - C:\Program Files\Lenovo\HOTKEY\shtctky.exe - C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE - C:\Windows\System32\LPlatSvc.exe - C:\PROGRA~1\Lenovo\HOTKEY\TPOSD.EXE - C:\Program Files (x86)\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe - C:\Program Files (x86)\Lenovo\System Update\TvsuCommandLauncher.exe - - C:\Program Files (x86)\Fortinet\FortiClient\FortiSSLVPNdaemon.exe - - c:\program files (x86)\sophos\sophos ssl vpn client\bin\openvpnserv.exe - - C:\Windows\LTSvc\LTSVC.exe - ScreenConnect.WindowsClient.exe - ScreenConnect.ClientService.exe - - N-able Technologies\Windows Agent\bin\agent.exe - N-able Technologies\AVDefender\EPIntegrationService.exe - C:\Program Files\OpenVPN\bin\openvpn-gui.exe - C:\Program Files\OpenVPN\bin\openvpn.exe - C:\Program Files\OpenVPN\bin\openvpnserv.exe - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe - C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe - C:\Program Files\Lenovo\HOTKEY\tphkload.exe - C:\Program Files\Lenovo\ - C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe - Graylog-collector-sidecar.exe - C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git-remote-https.exe - C:\Program Files (x86)\SmartGit\git\mingw32\bin\git.exe - C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git.exe - C:\Program Files (x86)\SmartGit\bin\smartgit.exe - Anonymous Pipe - C:\Program Files (x86)\Fortinet\FortiClient\FortiESNAC.exe - C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe - C:\Program Files (x86)\Fortinet\FortiClient\FortiTray.exe - C:\Program Files (x86)\Fortinet\FortiClient\FCDBLog.exe - C:\Program Files (x86)\Enpass\Enpass.exe - C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe - C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgrhv.exe - C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe - C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmware-vmrc.exe - SQLAnywhereLRM - pgsignal - postgres.exe - MICROSOFT##WID\tsql\query - TSVCPIPE- - BB4BB19A178C25D1 - SQLAnywhereLRM - SQLLocal - DropboxPipe_ - c:\windows\system32\inetsrv\w3wp.exe - C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\mfcesd.exe - C:\Pfx Engagement\WM\PFXEngagement.exe - C:\Pfx Engagement\WM\Pfx.KnowledgeCoach.SharedServices.exe - C:\Program Files (x86)\Micro Focus\COBOL Server 2012\bin\mfds.exe - ScreenConnect.WindowsClient.exe - ScreenConnect.ClientService.exe - QBW32.EXE - EXCEL.EXE - ADCUpdate.exe - Hydrous.Host.exe - TNSLSNR.exe - ShoreWare Server - - - - - - - - - - - - - - - - - From 0d14c6ad2c8bab5ed44c463520b729368082516e Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 9 Jul 2018 20:43:31 -0400 Subject: [PATCH 262/471] readme --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index ec05f5e0..8e398908 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,6 @@ # Sysmon Threat Intelligence Configuration # +** See the develop Branch for more bleeding edge updates: https://github.com/ion-storm/sysmon-config/tree/develop ** This is a Microsoft Sysinternals Sysmon configuration file template with default high-quality event tracing. The file provided should function as a great starting point for system monitoring in a self-contained package. This configuration and results should give you a good idea of what's possible for Sysmon. From 63c473f0d86f44c43120ca07d44972c6569bef9a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 9 Jul 2018 20:45:21 -0400 Subject: [PATCH 263/471] readme --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 8e398908..5aea6230 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Sysmon Threat Intelligence Configuration # +See the develop Branch for more bleeding edge updates: https://github.com/ion-storm/sysmon-config/tree/develop -** See the develop Branch for more bleeding edge updates: https://github.com/ion-storm/sysmon-config/tree/develop ** This is a Microsoft Sysinternals Sysmon configuration file template with default high-quality event tracing. The file provided should function as a great starting point for system monitoring in a self-contained package. This configuration and results should give you a good idea of what's possible for Sysmon. From 906cf5a2b0aec052ac500410ef8fa2535c31d3a3 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 9 Jul 2018 23:17:17 -0400 Subject: [PATCH 264/471] add N-Central exclusion --- sysmonconfig-export.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ce54a827..966cd79a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -678,6 +678,11 @@ C:\PostgreSQL9.1\bin\postgres.exe C:\PostgreSQL9.1\bin\postgres.exe C:\ProgramData\sysmon\sysmon64.exe + + 56BFB300BA379181CE09C3130775DFBBCAFF9DB764BDC39086C2FEC2547EE900 + + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\bitsadmin.exe + C:\Program Files\N-able Technologies\Windows Agent\bin\bitsadmin.exe From 7295667d716c3166ecf41e91a71035c32e633013 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 9 Jul 2018 23:22:16 -0400 Subject: [PATCH 265/471] add more exclusions --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 966cd79a..927bf03e 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -683,6 +683,7 @@ C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\bitsadmin.exe C:\Program Files\N-able Technologies\Windows Agent\bin\bitsadmin.exe + 3070E798134A11ADB01129F06A36CD924267E6DA95DAB2E3196105264D2BF818 From 30f451ce0550c265aab036c44f15657179e83bcb Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 08:24:09 -0400 Subject: [PATCH 266/471] N-Able Exclusions --- sysmonconfig-export.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 927bf03e..f8b83116 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -683,6 +683,9 @@ C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\bitsadmin.exe C:\Program Files\N-able Technologies\Windows Agent\bin\bitsadmin.exe + C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe + C:\Program Files (x86)\MaaS360\Cloud Extender\EMSAgent.exe 3070E798134A11ADB01129F06A36CD924267E6DA95DAB2E3196105264D2BF818 From e4404f0a8f26f3670d42f91206a2bdcc37345914 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 08:31:06 -0400 Subject: [PATCH 267/471] sysmon exclusions --- sysmonconfig-export.xml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f8b83116..b1110dfe 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -687,6 +687,10 @@ C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe C:\Program Files (x86)\MaaS360\Cloud Extender\EMSAgent.exe 3070E798134A11ADB01129F06A36CD924267E6DA95DAB2E3196105264D2BF818 + + \sysmon\Auto_Update.bat + ion-storm/sysmon-config + From b6b4ecc155cf5baaad0f6780e039f59e617f313c Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 09:20:40 -0400 Subject: [PATCH 268/471] more exclusions --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b1110dfe..f6c4c054 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -689,6 +689,7 @@ 3070E798134A11ADB01129F06A36CD924267E6DA95DAB2E3196105264D2BF818 \sysmon\Auto_Update.bat + \sysmon\Auto_Update.bat ion-storm/sysmon-config From e6173c07635f2748f6867696347b766980431a43 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 09:26:12 -0400 Subject: [PATCH 269/471] exclusions --- sysmonconfig-export.xml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f6c4c054..98d6fc45 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -685,7 +685,11 @@ C:\Program Files\N-able Technologies\Windows Agent\bin\bitsadmin.exe C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe - C:\Program Files (x86)\MaaS360\Cloud Extender\EMSAgent.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AutomationManager.ScriptRunner64.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AutomationManager.ScriptRunner64.exe + C:\Program Files\N-able Technologies\AVDefender\installer\installer.exe + C:\Program Files\N-able Technologies\AVDefender\epupdateservice.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\ShadowProtectDataReader.exe 3070E798134A11ADB01129F06A36CD924267E6DA95DAB2E3196105264D2BF818 \sysmon\Auto_Update.bat From 4f5f3e1909820642db9481e69df741946850a441 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 10:51:24 -0400 Subject: [PATCH 270/471] exclude logon scripts --- sysmonconfig-export.xml | 100 ++++++++++++++++++++-------------------- 1 file changed, 51 insertions(+), 49 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 98d6fc45..946cbce9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -183,14 +183,14 @@ /logfile= /LogToConsole=false /U - Mavinject.exe - CMSTP.exe + Mavinject.exe + CMSTP.exe - MSBuild.exe - regsvcs.exe - regasm.exe - SyncAppvPublishingServer.exe + MSBuild.exe + regsvcs.exe + regasm.exe + SyncAppvPublishingServer.exe control.exe @@ -263,48 +263,48 @@ COMSPEC - iex - Invoke-Expression - iwr - Invoke-WebRequest - DownloadFile - DownloadString - Net.WebClient - System.Net.WebRequest - System.Net.SecurityProtocolType - Shellcode - FromBase64String - convertto-securestring - VerbosePreference.ToString + iex + Invoke-Expression + iwr + Invoke-WebRequest + DownloadFile + DownloadString + Net.WebClient + System.Net.WebRequest + System.Net.SecurityProtocolType + Shellcode + FromBase64String + convertto-securestring + VerbosePreference.ToString - runtime.interopservices.marshal - VerbosePreference.ToString - -windowstyle h - -windowstyl h - -windowsty h - -windowst h - -windows h - -window h - -windo h - -wind h - -win h - -wi h - -w h - -wi h - -win hi - -win hid - -win hidd - -win hidde - -win hidden - -Nop - -Noni - -ec - -en - ^c^o^m^S^p^E^c^ - C^om^S^pEc + runtime.interopservices.marshal + VerbosePreference.ToString + -windowstyle h + -windowstyl h + -windowsty h + -windowst h + -windows h + -window h + -windo h + -wind h + -win h + -wi h + -w h + -wi h + -win hi + -win hid + -win hidd + -win hidde + -win hidden + -Nop + -Noni + -ec + -en + ^c^o^m^S^p^E^c^ + C^om^S^pEc - cscript.exe + cscript.exe wscript.exe rundll32.exe notepad.exe @@ -678,9 +678,9 @@ C:\PostgreSQL9.1\bin\postgres.exe C:\PostgreSQL9.1\bin\postgres.exe C:\ProgramData\sysmon\sysmon64.exe - + 56BFB300BA379181CE09C3130775DFBBCAFF9DB764BDC39086C2FEC2547EE900 - + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\bitsadmin.exe C:\Program Files\N-able Technologies\Windows Agent\bin\bitsadmin.exe C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe @@ -691,11 +691,13 @@ C:\Program Files\N-able Technologies\AVDefender\epupdateservice.exe C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\ShadowProtectDataReader.exe 3070E798134A11ADB01129F06A36CD924267E6DA95DAB2E3196105264D2BF818 - + \sysmon\Auto_Update.bat \sysmon\Auto_Update.bat ion-storm/sysmon-config - + + \netlogon\ + \netlogon\ From 10e37469d1c340a628079f10f8a5d08f94e0dbdb Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 11:54:40 -0400 Subject: [PATCH 271/471] Organize into Tactic's & Techniques --- sysmonconfig-export.xml | 267 +++++++++++++++++++--------------------- 1 file changed, 130 insertions(+), 137 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 946cbce9..2f6e0de9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -72,16 +72,29 @@ - - sethc.exe - utilman.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe - - + + wevtutil.exe + regsvr32.exe + bitsadmin.exe + eventvwr.exe + fodhelper.exe + InstallUtil.exe + /logfile= /LogToConsole=false /U + MSBuild.exe + regsvcs.exe + regasm.exe + SyncAppvPublishingServer.exe + control.exe + control.exe /name + rundll32.exe shell32.dll,Control_RunDLL + mshta.exe + wevutil.exe + wevutil cl + + net user + net localgroup + net group + dsquery.exe whoami.exe ipconfig.exe tasklist.exe @@ -92,32 +105,98 @@ net.exe net1.exe quser.exe - query.exe - tracert.exe - tree.com route.exe - runas.exe reg.exe - taskkill.exe netsh.exe - klist.exe - wevtutil.exe - taskeng.exe - regsvr32.exe - wmiprvse.exe - psexesvc.exe - Execute processes remotely - psexec.exe - Execute processes remotely - pskill.exe - hh.exe + + COMSPEC + COMSPEC cmd.exe cmd.exe powershell.exe powershell.exe powershell.exe + iex + Invoke-Expression + iwr + Invoke-WebRequest + DownloadFile + DownloadString + Net.WebClient + System.Net.WebRequest + System.Net.SecurityProtocolType + Shellcode bash.exe bash.exe + psexesvc.exe + Execute processes remotely + psexec.exe + Execute processes remotely + pskill.exe + forfiles.exe + forfiles.exe + pcalua.exe + pcalua.exe + bash.exe + bash.exe + bash.exe + wsmprovhost.exe + wsmprovhost.exe + winrm.cmd + + sethc.exe + utilman.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe + taskeng.exe + sdbinst.exe + schtasks.exe + schtasks.exe + at.exe + at.exe + System.Management.Automation + + wmiprvse.exe + + FromBase64String + convertto-securestring + VerbosePreference.ToString + runtime.interopservices.marshal + VerbosePreference.ToString + -windowstyle h + -windowstyl h + -windowsty h + -windowst h + -windows h + -window h + -windo h + -wind h + -win h + -wi h + -w h + -wi h + -win hi + -win hid + -win hidd + -win hidde + -win hidden + -Nop + -Noni + -ec + -en + ^c^o^m^S^p^E^c^ + C^om^S^pEc + + query.exe + tracert.exe + tree.com + runas.exe + taskkill.exe + klist.exe + hh.exe odbcconf.exe pcalua.exe attrib.exe @@ -168,56 +247,12 @@ cls.exe doskey.exe - - sdbinst.exe - - - bitsadmin.exe - - - eventvwr.exe - fodhelper.exe - - - InstallUtil.exe - /logfile= /LogToConsole=false /U - Mavinject.exe CMSTP.exe - - MSBuild.exe - regsvcs.exe - regasm.exe - SyncAppvPublishingServer.exe - - - control.exe - control.exe /name - rundll32.exe shell32.dll,Control_RunDLL - - - wsmprovhost.exe - wsmprovhost.exe - winrm.cmd certutil.exe -decode certutil -decode - mshta.exe - wevutil.exe - wevutil cl - schtasks.exe - schtasks.exe - at.exe - at.exe - forfiles.exe - forfiles.exe - pcalua.exe - pcalua.exe - bash.exe - bash.exe - bash.exe - System.Management.Automation acrobat.exe @@ -261,48 +296,6 @@ \\tsclient .. - - COMSPEC - iex - Invoke-Expression - iwr - Invoke-WebRequest - DownloadFile - DownloadString - Net.WebClient - System.Net.WebRequest - System.Net.SecurityProtocolType - Shellcode - FromBase64String - convertto-securestring - VerbosePreference.ToString - - - runtime.interopservices.marshal - VerbosePreference.ToString - -windowstyle h - -windowstyl h - -windowsty h - -windowst h - -windows h - -window h - -windo h - -wind h - -win h - -wi h - -w h - -wi h - -win hi - -win hid - -win hidd - -win hidde - -win hidden - -Nop - -Noni - -ec - -en - ^c^o^m^S^p^E^c^ - C^om^S^pEc cscript.exe wscript.exe @@ -333,7 +326,6 @@ wmic.exe net.exe nbtstat.exe - dsquery.exe driverquery.exe infDefaultInstall.exe sc.exe @@ -831,34 +823,35 @@ onion.direct tor2web.org tor2web.fi + tor2web.io tor2web.blutmagie.de tor-gateways.de hiddenservice.net - shodan - shadow - researchscan - census - linode - sl-reverse - scanhub - .edu - 158.130.6. - 71.6.216. - 137.226.113. - 138.246.252. - 128.32.30. - 208.93.152. - 162.216.46. - 169.229.3. - 155.94.254. - 98.143.148. - 155.94.222. - 134.147.203. - 69.170.62. - 159.203.213. - 209.236.120. - 158.130.6 + shodan + shadow + researchscan + census + linode + sl-reverse + scanhub + .edu + 158.130.6. + 71.6.216. + 137.226.113. + 138.246.252. + 128.32.30. + 208.93.152. + 162.216.46. + 169.229.3. + 155.94.254. + 98.143.148. + 155.94.222. + 134.147.203. + 69.170.62. + 159.203.213. + 209.236.120. + 158.130.6 80 443 From cfca001ce94ac23dc0f6bef56e4750f16261cf46 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 12:53:37 -0400 Subject: [PATCH 272/471] add some mitre registry identifiers --- sysmonconfig-export.xml | 106 ++++++++++++++++++++-------------------- 1 file changed, 53 insertions(+), 53 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 2f6e0de9..8405482d 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -109,13 +109,13 @@ reg.exe netsh.exe - COMSPEC - COMSPEC - cmd.exe - cmd.exe - powershell.exe - powershell.exe - powershell.exe + COMSPEC + COMSPEC + cmd.exe + cmd.exe + powershell.exe + powershell.exe + powershell.exe iex Invoke-Expression iwr @@ -128,11 +128,11 @@ Shellcode bash.exe bash.exe - psexesvc.exe - Execute processes remotely - psexec.exe - Execute processes remotely - pskill.exe + psexesvc.exe + Execute processes remotely + psexec.exe + Execute processes remotely + pskill.exe forfiles.exe forfiles.exe pcalua.exe @@ -853,11 +853,11 @@ 209.236.120. 158.130.6 - 80 - 443 - 3389 + 80 + 443 + 3389 3540 - 22 + 22 23 25 139 @@ -1269,7 +1269,7 @@ \Start Menu - \Startup + \Startup \Content.Outlook\ \Downloads\ .dll @@ -1525,14 +1525,14 @@ - \CurrentVersion\Run - \Group Policy\Scripts - \Windows\System\Scripts - \Microsoft\System\Scripts - \ServiceDll - \ImagePath - \Start - HKLM\SYSTEM\Setup\CmdLine + \CurrentVersion\Run + \Group Policy\Scripts + \Windows\System\Scripts + \Microsoft\System\Scripts + \ServiceDll + \ImagePath + \Start + HKLM\SYSTEM\Setup\CmdLine Session Manager\KnownDlls HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors HKLM\SYSTEM\CurrentControlSet\Control\Print\Providers @@ -1543,29 +1543,29 @@ HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages HKLM\HARDWARE\ACPI\DSDT - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet - HKLM\System\CurrentControlSet\Control\Session Manager\Execute - HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute - HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute - HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath - HKLM\Software\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLU\Software\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell - UserInitMprLogonScript + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet + HKLM\System\CurrentControlSet\Control\Session Manager\Execute + HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute + HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath + HKLM\Software\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLU\Software\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + UserInitMprLogonScript \CurrentVersion\Font Drivers Active Setup\Installed Components Windows CE Services\AutoStartOnConnect Windows CE Services\AutoStartOnDisconnect CurrentVersion\Windows\IconServiceLib Winlogon\AlternateShells\AvailableShells - Terminal Server\Wds\rdpwd\StartupPrograms + Terminal Server\Wds\rdpwd\StartupPrograms SafeBoot\AlternateShell Terminal Server\WinStations\RDP-Tcp\InitialProgram HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman @@ -1661,17 +1661,17 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - HKLM\Software\Microsoft\Windows\CurrentVersion\RunService - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - \Software\Microsoft\Windows NT\CurrentVersion\Windows\load - HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 - CurrentVersion\Windows\Load - CurrentVersion\Windows\Run - CurrentVersion\Winlogon\Shell - CurrentVersion\Winlogon\System + HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + HKLM\Software\Microsoft\Windows\CurrentVersion\RunService + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + \Software\Microsoft\Windows NT\CurrentVersion\Windows\load + HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 + CurrentVersion\Windows\Load + CurrentVersion\Windows\Run + CurrentVersion\Winlogon\Shell + CurrentVersion\Winlogon\System \Software\Policies\Microsoft\Windows\System\Scripts\Logon \Software\Policies\Microsoft\Windows\System\Scripts\Logoff From 54b708df5172306cafe5640c0a8d94b1ac78d2d8 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 13:25:59 -0400 Subject: [PATCH 273/471] misc updates --- sysmonconfig-export.xml | 64 ++++++++++++++++++++--------------------- 1 file changed, 32 insertions(+), 32 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 8405482d..fefb0216 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -73,7 +73,6 @@ - wevtutil.exe regsvr32.exe bitsadmin.exe eventvwr.exe @@ -85,35 +84,35 @@ regasm.exe SyncAppvPublishingServer.exe control.exe - control.exe /name - rundll32.exe shell32.dll,Control_RunDLL - mshta.exe - wevutil.exe - wevutil cl + control.exe /name + rundll32.exe shell32.dll,Control_RunDLL + mshta.exe + wevutil.exe + wevutil cl net user net localgroup net group dsquery.exe - whoami.exe - ipconfig.exe - tasklist.exe - sysinfo.exe - netstat.exe - qprocess.exe - nslookup.exe - net.exe - net1.exe - quser.exe - route.exe - reg.exe - netsh.exe + whoami.exe + ipconfig.exe + tasklist.exe + sysinfo.exe + netstat.exe + qprocess.exe + nslookup.exe + net.exe + net1.exe + quser.exe + route.exe + reg.exe + netsh.exe COMSPEC COMSPEC cmd.exe cmd.exe - powershell.exe + powershell.exe powershell.exe powershell.exe iex @@ -133,16 +132,16 @@ psexec.exe Execute processes remotely pskill.exe - forfiles.exe - forfiles.exe - pcalua.exe - pcalua.exe - bash.exe - bash.exe - bash.exe - wsmprovhost.exe - wsmprovhost.exe - winrm.cmd + forfiles.exe + forfiles.exe + pcalua.exe + pcalua.exe + bash.exe + bash.exe + bash.exe + wsmprovhost.exe + wsmprovhost.exe + winrm.cmd sethc.exe utilman.exe @@ -1269,7 +1268,8 @@ \Start Menu - \Startup + \Startup + \Programs\Startup \Content.Outlook\ \Downloads\ .dll @@ -1526,7 +1526,7 @@ \CurrentVersion\Run - \Group Policy\Scripts + \Group Policy\Scripts \Windows\System\Scripts \Microsoft\System\Scripts \ServiceDll From 6736eddade799db6a8c7b2ab510c55c359c94cbe Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 13:34:53 -0400 Subject: [PATCH 274/471] at.exe fix --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index fefb0216..a043c86d 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -154,8 +154,8 @@ sdbinst.exe schtasks.exe schtasks.exe - at.exe - at.exe + at.exe + at.exe System.Management.Automation wmiprvse.exe From c15c830ae3010bcd18cd1214ec4076c230f61bd2 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 13:37:30 -0400 Subject: [PATCH 275/471] fix cls --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index a043c86d..58fc19d9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -243,7 +243,7 @@ format format assoc - cls.exe + cls.exe doskey.exe From cdbe0988b100fb8c5936e8562bd2e5a29ba70ca2 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 16:04:58 -0400 Subject: [PATCH 276/471] slight tweak for cmd.exe --- sysmonconfig-export.xml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 58fc19d9..ea506a7c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -110,8 +110,8 @@ COMSPEC COMSPEC - cmd.exe - cmd.exe + \cmd.exe + \cmd.exe powershell.exe powershell.exe powershell.exe @@ -310,7 +310,6 @@ psservice PsPasswd msbuild.exe - installutil.exe msiexec.exe mstsc.exe telnet.exe From b04ccf5bc18fd82fcb80042f29bf571e79d35fe7 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 16:21:42 -0400 Subject: [PATCH 277/471] net.exe update --- sysmonconfig-export.xml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ea506a7c..32faee26 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -101,8 +101,8 @@ netstat.exe qprocess.exe nslookup.exe - net.exe - net1.exe + net.exe + net1.exe quser.exe route.exe reg.exe @@ -157,6 +157,9 @@ at.exe at.exe System.Management.Automation + net user /add + net localgroup administrators /add + wmiprvse.exe @@ -382,6 +385,7 @@ C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\vssvc.exe net use + net use C:\Program Files\Windows Defender C:\Windows\System32\CompatTelRunner.exe From 26c8234ff7c0f80c97503ec93ed0b283c3ef5de2 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 16:25:02 -0400 Subject: [PATCH 278/471] end with --> is --- sysmonconfig-export.xml | 46 ++++++++++++++++++++--------------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 32faee26..35aad391 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -73,40 +73,40 @@ - regsvr32.exe - bitsadmin.exe - eventvwr.exe - fodhelper.exe - InstallUtil.exe + regsvr32.exe + bitsadmin.exe + eventvwr.exe + fodhelper.exe + InstallUtil.exe /logfile= /LogToConsole=false /U - MSBuild.exe - regsvcs.exe - regasm.exe - SyncAppvPublishingServer.exe - control.exe + MSBuild.exe + regsvcs.exe + regasm.exe + SyncAppvPublishingServer.exe + control.exe control.exe /name rundll32.exe shell32.dll,Control_RunDLL - mshta.exe - wevutil.exe + mshta.exe + wevutil.exe wevutil cl net user net localgroup net group - dsquery.exe - whoami.exe - ipconfig.exe - tasklist.exe - sysinfo.exe - netstat.exe - qprocess.exe + dsquery.exe + whoami.exe + ipconfig.exe + tasklist.exe + sysinfo.exe + netstat.exe + qprocess.exe nslookup.exe net.exe net1.exe - quser.exe - route.exe - reg.exe - netsh.exe + quser.exe + route.exe + reg.exe + netsh.exe COMSPEC COMSPEC From dd50ab52799dd52ab5899c66178266d0414b7191 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 10 Jul 2018 16:35:06 -0400 Subject: [PATCH 279/471] save some cpu cycles with more "is" --- sysmonconfig-export.xml | 239 ++++++++++++++++++++-------------------- 1 file changed, 120 insertions(+), 119 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 35aad391..cc6c2596 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -100,7 +100,7 @@ sysinfo.exe netstat.exe qprocess.exe - nslookup.exe + nslookup.exe net.exe net1.exe quser.exe @@ -110,11 +110,11 @@ COMSPEC COMSPEC - \cmd.exe - \cmd.exe - powershell.exe + cmd.exe + cmd.exe + powershell.exe powershell.exe - powershell.exe + powershell.exe iex Invoke-Expression iwr @@ -125,35 +125,35 @@ System.Net.WebRequest System.Net.SecurityProtocolType Shellcode - bash.exe - bash.exe - psexesvc.exe + bash.exe + bash.exe + psexesvc.exe Execute processes remotely - psexec.exe + psexec.exe Execute processes remotely - pskill.exe - forfiles.exe - forfiles.exe - pcalua.exe - pcalua.exe - bash.exe - bash.exe - bash.exe - wsmprovhost.exe - wsmprovhost.exe - winrm.cmd + pskill.exe + forfiles.exe + forfiles.exe + pcalua.exe + pcalua.exe + bash.exe + bash.exe + bash.exe + wsmprovhost.exe + wsmprovhost.exe + winrm.cmd - sethc.exe - utilman.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe - taskeng.exe - sdbinst.exe - schtasks.exe - schtasks.exe + sethc.exe + utilman.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe + taskeng.exe + sdbinst.exe + schtasks.exe + schtasks.exe at.exe at.exe System.Management.Automation @@ -161,7 +161,7 @@ net localgroup administrators /add - wmiprvse.exe + wmiprvse.exe FromBase64String convertto-securestring @@ -192,18 +192,18 @@ ^c^o^m^S^p^E^c^ C^om^S^pEc - query.exe - tracert.exe - tree.com - runas.exe - taskkill.exe - klist.exe - hh.exe - odbcconf.exe - pcalua.exe - attrib.exe - cmdkey.exe - nltest.exe + query.exe + tracert.exe + tree.com + runas.exe + taskkill.exe + klist.exe + hh.exe + odbcconf.exe + pcalua.exe + attrib.exe + cmdkey.exe + nltest.exe nltest.exe ExtExport bash -c @@ -247,41 +247,41 @@ format assoc cls.exe - doskey.exe + doskey.exe - Mavinject.exe - CMSTP.exe + Mavinject.exe + CMSTP.exe certutil.exe -decode certutil -decode - acrobat.exe - acrord32.exe + acrobat.exe + acrord32.exe - chrome.exe - firefox.exe - iexplore.exe - MicrosoftEdgeCP.exe - MicrosoftEdge.exe - vivaldi.exe - waterfox.exe + chrome.exe + firefox.exe + iexplore.exe + MicrosoftEdgeCP.exe + MicrosoftEdge.exe + vivaldi.exe + waterfox.exe - java.exe - javaw.exe + java.exe + javaw.exe - word.exe - excel.exe - POWERPNT.exe - outlook.exe - visio.exe - msaccess.exe - lync.exe - skype.exe + word.exe + excel.exe + POWERPNT.exe + outlook.exe + visio.exe + msaccess.exe + lync.exe + skype.exe 2> @@ -345,12 +345,12 @@ .com \temp\ C:\users - explorer.exe - control.exe - acrord32.exe - installutil.exe - reg.exe - ipconfig.exe + explorer.exe + control.exe + acrord32.exe + installutil.exe + reg.exe + ipconfig.exe \appdata\ \programdata\ \Users @@ -366,7 +366,7 @@ AppContainer C:\Windows\system32\DllHost.exe /Processid C:\Windows\system32\SearchIndexer.exe /Embedding - C:\Windows\System32\CompatTelRunner.exe + C:\Windows\System32\CompatTelRunner.exe C:\Windows\System32\MusNotification.exe C:\Windows\System32\MusNotificationUx.exe C:\Windows\System32\audiodg.exe @@ -388,7 +388,7 @@ net use C:\Program Files\Windows Defender - C:\Windows\System32\CompatTelRunner.exe + C:\Windows\System32\CompatTelRunner.exe C:\Windows\System32\wermgr.exe C:\Windows\SysWOW64\wermgr.exe C:\Windows\System32\MpSigStub.exe @@ -502,54 +502,54 @@ AcroRd32.exe" /CR AcroRd32.exe" --channel= - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe - C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\AcroCEF\AcroCEF.exe - C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\LogTransport2.exe + C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\LogTransport2.exe - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe + C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe + C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe + C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe + C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ C:\Program Files\NVIDIA Corporation\ - \NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe + \NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamuseragent.exe C:\Program Files\Realtek\ - C:\Program Files\DellTPad\HidMonitorSvc.exe + C:\Program Files\DellTPad\HidMonitorSvc.exe "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe + C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe C:\Program Files\Dell\SupportAssist\pcdrcui.exe @@ -619,7 +619,7 @@ sc queryex type= service C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe raw_agent_svc.exe - raw_agent_svc.exe + raw_agent_svc.exe IscsidscInterface.exe IscsidscInterface.exe Add-PSSnapin Microsoft.SharePoint.PowerShell @@ -648,11 +648,11 @@ interface tcp show global nslookup.exe - ScreenConnect.WindowsClient.exe + ScreenConnect.WindowsClient.exe C:\Program Files (x86)\SmartGit C:\Program Files (x86)\SmartGit - Vivaldi\Application\vivaldi.exe - controls\cef\ConnectWise.exe + vivaldi.exe + ConnectWise.exe C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe @@ -946,13 +946,13 @@ true OneDrive.exe Spotify.exe - AppData\Roaming\Dropbox\bin\Dropbox.exe + Dropbox.exe OneDriveStandaloneUpdater.exe ConnectWise.exe ScreenConnect.WindowsClient.exe - AppData\Roaming\Dashlane\Dashlane.exe - AppData\Roaming\Dashlane\DashlanePlugin.exe - Vivaldi\Application\vivaldi.exe + Dashlane.exe + DashlanePlugin.exe + vivaldi.exe microsoft.com microsoft.com.akadns.net microsoft.com.nsatc.net @@ -1010,7 +1010,8 @@ C:\Users C:\ProgramData C:\Windows\Temp - Sysmon.exe + Sysmon.exe + Sysmon64.exe @@ -2117,7 +2118,7 @@ chrome. GoogleCrashServices - slack.exe + slack.exe booma\ @@ -2193,10 +2194,10 @@ ScreenConnect.WindowsClient.exe ScreenConnect.ClientService.exe QBW32.EXE - EXCEL.EXE - ADCUpdate.exe - Hydrous.Host.exe - TNSLSNR.exe + EXCEL.EXE + ADCUpdate.exe + Hydrous.Host.exe + TNSLSNR.exe ShoreWare Server From b925dae30fbcfb67924ba05db6499a8f9c00b7df Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 11 Jul 2018 07:45:23 -0400 Subject: [PATCH 280/471] add command line exclusion --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index cc6c2596..ed9816d9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -678,6 +678,7 @@ C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\bitsadmin.exe C:\Program Files\N-able Technologies\Windows Agent\bin\bitsadmin.exe C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe + N-able Technologies\Windows Software Probe\bin\wsp.exe C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AutomationManager.ScriptRunner64.exe C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AutomationManager.ScriptRunner64.exe From c168824efe425a4607f0a028b24b253cbad814a2 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 11 Jul 2018 08:15:49 -0400 Subject: [PATCH 281/471] app exclusions --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ed9816d9..47ddb26d 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -693,6 +693,8 @@ \netlogon\ \netlogon\ + C:\PROGRA~2\SAAZOD\SAAZMSMACTL.EXE + From 7bdcd3253bebfdc201ad322399e78609450389c5 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 11 Jul 2018 10:08:36 -0400 Subject: [PATCH 282/471] exclude taskeng.exe, we already detect task creation, task execution can be noisy and there is an extra need for many exclusions enabling this. --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 47ddb26d..2039eaae 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -461,6 +461,7 @@ C:\Windows\System32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\System32\powercfg.exe + C:\Windows\System32\taskeng.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe From 61db4aa25d63e1c6d4ffe644c372d0aee7050002 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 11 Jul 2018 13:18:12 -0400 Subject: [PATCH 283/471] Add net.exe exclusions and command line additions, net use is too noisy. --- sysmonconfig-export.xml | 37 ++++++++++++++++++++++++++++++++++--- 1 file changed, 34 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 2039eaae..f8723083 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -91,8 +91,29 @@ wevutil cl net user + net user + net.exe user + net.exe user + net1.exe user + net1.exe user net localgroup + net localgroup + net.exe localgroup + net.exe localgroup + net1 localgroup + net1 localgroup net group + net group + net group + net group + net.exe group + net.exe group + net group + net group + net.exe group + net.exe group + net1.exe group + net1.exe group dsquery.exe whoami.exe ipconfig.exe @@ -154,6 +175,8 @@ sdbinst.exe schtasks.exe schtasks.exe + schtasks /create + schtasks.exe /create at.exe at.exe System.Management.Automation @@ -325,7 +348,6 @@ psftp.exe tftp.exe wmic.exe - net.exe nbtstat.exe driverquery.exe infDefaultInstall.exe @@ -695,7 +717,14 @@ \netlogon\ \netlogon\ C:\PROGRA~2\SAAZOD\SAAZMSMACTL.EXE - + + net use + net.exe use + net1 use + net1.exe use + net time + net.exe time + net1 time @@ -729,8 +758,9 @@ C:\Users + \temp\ + $RECYCLE.BIN C:\ProgramData - C:\Windows\Temp C:\Perflogs\ config\systemprofile\ \Windows\Fonts\ @@ -742,6 +772,7 @@ MicrosoftEdgeCP.exe MicrosoftEdge.exe explorer.exe + .exe at.exe certutil.exe From 66adb24bffd4d32c82dc8bc59972dc4eb4712657 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 11 Jul 2018 13:27:19 -0400 Subject: [PATCH 284/471] let no longer flag linode --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f8723083..3669f629 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -869,7 +869,6 @@ shadow researchscan census - linode sl-reverse scanhub .edu From 9fd2df60ca35fbf4305258de0cc470f8fb15bcb6 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 11 Jul 2018 13:54:56 -0400 Subject: [PATCH 285/471] add T1055 --- sysmonconfig-export.xml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 3669f629..27268a10 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1187,6 +1187,10 @@ [ https://attack.mitre.org/wiki/Technique/T1055 ] --> + + LoadLibrary + \ + C:\Windows\system32\wbem\WmiPrvSE.exe @@ -1201,6 +1205,13 @@ FireSvc.exe C:\Program Files (x86)\Webroot\WRSA.exe controls\cef\ConnectWise.exe + C:\Program Files\N-able Technologies\AVDefender\epsecurityservice.exe + C:\Program Files\N-able Technologies\AVDefender\EPSecurityService.exe + C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows SP1\avp.exe + C:\Program Files (x86)\Microsoft Visual Studio\2017\Enterprise\Common7\IDE\Remote Debugger\x64\msvsmon.exe + C:\Windows\System32\rdpclip.exe + C:\Windows\sysmon64.exe + C:\Windows\sysmon.exe From 0a6543144dfe77d876f8bda7188916f18a6ddd5a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 11 Jul 2018 14:37:32 -0400 Subject: [PATCH 286/471] Autorun exclusions --- sysmonconfig-export.xml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 27268a10..5ae748e0 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -2001,6 +2001,26 @@ \Software\NITRO\PRO HKLM\SOFTWARE\Wow6432Node\WRData\Status + + HKLM\System\CurrentControlSet\Services\RapportIaso + HKLM\System\CurrentControlSet\Services\gzflt + HKLM\System\CurrentControlSet\Services\trufos + HKLM\System\CurrentControlSet\Services\wudfsvc + HKLM\System\CurrentControlSet\Services\EFS + HKLM\System\CurrentControlSet\Services\avc3 + HKLM\System\CurrentControlSet\Services\NableRemoteService + HKLM\System\CurrentControlSet\Services\TabletInputService + HKLM\System\CurrentControlSet\Services\AdobeARMservice + HKLM\System\CurrentControlSet\Services\EPUpdateService + HKLM\System\CurrentControlSet\Services\ScreenConnect + HKLM\System\CurrentControlSet\Services\EPSecurityService + HKLM\System\CurrentControlSet\Services\EPIntegrationService + HKLM\System\CurrentControlSet\Services\wrUrlFlt + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WRSVC + HKLM\System\CurrentControlSet\Services\avckf + HKLM\System\CurrentControlSet\services\NableRemoteService + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WRSVC + HKLM\System\CurrentControlSet\Services\BDElam From 09173b2e8bbf0025fb66cb2c32b5106d650b3c6f Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 11 Jul 2018 14:43:28 -0400 Subject: [PATCH 287/471] excludes --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 5ae748e0..e5c59f85 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -171,7 +171,6 @@ DisplaySwitch.exe Narrator.exe AtBroker.exe - taskeng.exe sdbinst.exe schtasks.exe schtasks.exe @@ -725,6 +724,7 @@ net time net.exe time net1 time + C:\Windows\system32\cmd.exe /c UsrLogon.cmd From e629916766c03adf0164b4a91c77f1ea9a986743 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 11 Jul 2018 15:38:14 -0400 Subject: [PATCH 288/471] revert is change --- sysmonconfig-export.xml | 268 +++++++++++++++++++++------------------- 1 file changed, 142 insertions(+), 126 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e5c59f85..727c209f 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -73,21 +73,21 @@ - regsvr32.exe - bitsadmin.exe - eventvwr.exe - fodhelper.exe - InstallUtil.exe + regsvr32.exe + bitsadmin.exe + eventvwr.exe + fodhelper.exe + InstallUtil.exe /logfile= /LogToConsole=false /U - MSBuild.exe - regsvcs.exe - regasm.exe - SyncAppvPublishingServer.exe - control.exe + MSBuild.exe + regsvcs.exe + regasm.exe + SyncAppvPublishingServer.exe + control.exe control.exe /name rundll32.exe shell32.dll,Control_RunDLL - mshta.exe - wevutil.exe + mshta.exe + wevutil.exe wevutil cl net user @@ -121,21 +121,28 @@ sysinfo.exe netstat.exe qprocess.exe - nslookup.exe + dsquery.exe + whoami.exe + ipconfig.exe + tasklist.exe + sysinfo.exe + netstat.exe + qprocess.exe + nslookup.exe net.exe net1.exe - quser.exe - route.exe - reg.exe - netsh.exe + quser.exe + route.exe + reg.exe + netsh.exe COMSPEC COMSPEC - cmd.exe - cmd.exe - powershell.exe + \cmd.exe + \cmd.exe + powershell.exe powershell.exe - powershell.exe + powershell.exe iex Invoke-Expression iwr @@ -146,23 +153,23 @@ System.Net.WebRequest System.Net.SecurityProtocolType Shellcode - bash.exe - bash.exe - psexesvc.exe + bash.exe + bash.exe + psexesvc.exe Execute processes remotely - psexec.exe + psexec.exe Execute processes remotely - pskill.exe - forfiles.exe - forfiles.exe - pcalua.exe - pcalua.exe - bash.exe - bash.exe - bash.exe - wsmprovhost.exe - wsmprovhost.exe - winrm.cmd + pskill.exe + forfiles.exe + forfiles.exe + pcalua.exe + pcalua.exe + bash.exe + bash.exe + bash.exe + wsmprovhost.exe + wsmprovhost.exe + winrm.cmd sethc.exe utilman.exe @@ -176,6 +183,17 @@ schtasks.exe schtasks /create schtasks.exe /create + sethc.exe + utilman.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe + taskeng.exe + sdbinst.exe + schtasks.exe + schtasks.exe at.exe at.exe System.Management.Automation @@ -183,7 +201,7 @@ net localgroup administrators /add - wmiprvse.exe + wmiprvse.exe FromBase64String convertto-securestring @@ -214,18 +232,18 @@ ^c^o^m^S^p^E^c^ C^om^S^pEc - query.exe - tracert.exe - tree.com - runas.exe - taskkill.exe - klist.exe - hh.exe - odbcconf.exe - pcalua.exe - attrib.exe - cmdkey.exe - nltest.exe + query.exe + tracert.exe + tree.com + runas.exe + taskkill.exe + klist.exe + hh.exe + odbcconf.exe + pcalua.exe + attrib.exe + cmdkey.exe + nltest.exe nltest.exe ExtExport bash -c @@ -269,48 +287,47 @@ format assoc cls.exe - doskey.exe + doskey.exe - Mavinject.exe - CMSTP.exe + Mavinject.exe + CMSTP.exe certutil.exe -decode certutil -decode - acrobat.exe - acrord32.exe + acrobat.exe + acrord32.exe - chrome.exe - firefox.exe - iexplore.exe - MicrosoftEdgeCP.exe - MicrosoftEdge.exe - vivaldi.exe - waterfox.exe + chrome.exe + firefox.exe + iexplore.exe + MicrosoftEdgeCP.exe + MicrosoftEdge.exe + vivaldi.exe + waterfox.exe - java.exe - javaw.exe + java.exe + javaw.exe - word.exe - excel.exe - POWERPNT.exe - outlook.exe - visio.exe - msaccess.exe - lync.exe - skype.exe + word.exe + excel.exe + POWERPNT.exe + outlook.exe + visio.exe + msaccess.exe + lync.exe + skype.exe 2> < > ^ - & @@ -366,12 +383,12 @@ .com \temp\ C:\users - explorer.exe - control.exe - acrord32.exe - installutil.exe - reg.exe - ipconfig.exe + explorer.exe + control.exe + acrord32.exe + installutil.exe + reg.exe + ipconfig.exe \appdata\ \programdata\ \Users @@ -387,7 +404,7 @@ AppContainer C:\Windows\system32\DllHost.exe /Processid C:\Windows\system32\SearchIndexer.exe /Embedding - C:\Windows\System32\CompatTelRunner.exe + C:\Windows\System32\CompatTelRunner.exe C:\Windows\System32\MusNotification.exe C:\Windows\System32\MusNotificationUx.exe C:\Windows\System32\audiodg.exe @@ -409,7 +426,7 @@ net use C:\Program Files\Windows Defender - C:\Windows\System32\CompatTelRunner.exe + C:\Windows\System32\CompatTelRunner.exe C:\Windows\System32\wermgr.exe C:\Windows\SysWOW64\wermgr.exe C:\Windows\System32\MpSigStub.exe @@ -524,54 +541,54 @@ AcroRd32.exe" /CR AcroRd32.exe" --channel= - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe - C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\AcroCEF\AcroCEF.exe - C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\LogTransport2.exe + C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\AcroCEF\AcroCEF.exe + C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\LogTransport2.exe - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe + C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe + C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe + C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe + C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe + C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe + C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe + C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe + C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ C:\Program Files\NVIDIA Corporation\ - \NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe + \NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamuseragent.exe C:\Program Files\Realtek\ - C:\Program Files\DellTPad\HidMonitorSvc.exe + C:\Program Files\DellTPad\HidMonitorSvc.exe "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe + C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe + C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe C:\Program Files\Dell\SupportAssist\pcdrcui.exe @@ -641,7 +658,7 @@ sc queryex type= service C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe raw_agent_svc.exe - raw_agent_svc.exe + raw_agent_svc.exe IscsidscInterface.exe IscsidscInterface.exe Add-PSSnapin Microsoft.SharePoint.PowerShell @@ -670,11 +687,11 @@ interface tcp show global nslookup.exe - ScreenConnect.WindowsClient.exe + ScreenConnect.WindowsClient.exe C:\Program Files (x86)\SmartGit C:\Program Files (x86)\SmartGit - vivaldi.exe - ConnectWise.exe + Vivaldi\Application\vivaldi.exe + controls\cef\ConnectWise.exe C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe @@ -980,13 +997,13 @@ true OneDrive.exe Spotify.exe - Dropbox.exe + AppData\Roaming\Dropbox\bin\Dropbox.exe OneDriveStandaloneUpdater.exe ConnectWise.exe ScreenConnect.WindowsClient.exe - Dashlane.exe - DashlanePlugin.exe - vivaldi.exe + AppData\Roaming\Dashlane\Dashlane.exe + AppData\Roaming\Dashlane\DashlanePlugin.exe + Vivaldi\Application\vivaldi.exe microsoft.com microsoft.com.akadns.net microsoft.com.nsatc.net @@ -1044,8 +1061,7 @@ C:\Users C:\ProgramData C:\Windows\Temp - Sysmon.exe - Sysmon64.exe + Sysmon.exe @@ -2183,7 +2199,7 @@ chrome. GoogleCrashServices - slack.exe + slack.exe booma\ @@ -2259,10 +2275,10 @@ ScreenConnect.WindowsClient.exe ScreenConnect.ClientService.exe QBW32.EXE - EXCEL.EXE - ADCUpdate.exe - Hydrous.Host.exe - TNSLSNR.exe + EXCEL.EXE + ADCUpdate.exe + Hydrous.Host.exe + TNSLSNR.exe ShoreWare Server From 78149ff09409adb9b4873605ba1cf3997dbfff14 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 11 Jul 2018 16:09:30 -0400 Subject: [PATCH 289/471] fix git f-up --- sysmonconfig-export.xml | 20 -------------------- 1 file changed, 20 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 727c209f..db593b58 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -121,14 +121,6 @@ sysinfo.exe netstat.exe qprocess.exe - dsquery.exe - whoami.exe - ipconfig.exe - tasklist.exe - sysinfo.exe - netstat.exe - qprocess.exe - nslookup.exe net.exe net1.exe quser.exe @@ -183,23 +175,11 @@ schtasks.exe schtasks /create schtasks.exe /create - sethc.exe - utilman.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe - taskeng.exe - sdbinst.exe - schtasks.exe - schtasks.exe at.exe at.exe System.Management.Automation net user /add net localgroup administrators /add - wmiprvse.exe From 4e14b219ea298c8e3b4860ef315d4f306ba8aac7 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 11 Jul 2018 16:13:30 -0400 Subject: [PATCH 290/471] bring back end with for now --- sysmonconfig-export.xml | 44 ++++++++++++++++++++--------------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index db593b58..1290cbaa 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -114,15 +114,15 @@ net.exe group net1.exe group net1.exe group - dsquery.exe - whoami.exe - ipconfig.exe - tasklist.exe - sysinfo.exe - netstat.exe - qprocess.exe - net.exe - net1.exe + dsquery.exe + whoami.exe + ipconfig.exe + tasklist.exe + sysinfo.exe + netstat.exe + qprocess.exe + net.exe + net1.exe quser.exe route.exe reg.exe @@ -163,20 +163,20 @@ wsmprovhost.exe winrm.cmd - sethc.exe - utilman.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe - sdbinst.exe - schtasks.exe - schtasks.exe + sethc.exe + utilman.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe + sdbinst.exe + schtasks.exe + schtasks.exe schtasks /create schtasks.exe /create - at.exe - at.exe + at.exe + at.exe System.Management.Automation net user /add net localgroup administrators /add @@ -266,7 +266,7 @@ format format assoc - cls.exe + cls.exe doskey.exe From a064ab113dcf5e1c6740707edef7e21ae6ba1bbf Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 08:35:31 -0400 Subject: [PATCH 291/471] remove graylog stuff --- Graylog_Content_Pack/Install_Sidecar.bat | 18 ------------------ .../Install_Sidecar_noprompt.bat | 16 ---------------- 2 files changed, 34 deletions(-) delete mode 100644 Graylog_Content_Pack/Install_Sidecar.bat delete mode 100644 Graylog_Content_Pack/Install_Sidecar_noprompt.bat diff --git a/Graylog_Content_Pack/Install_Sidecar.bat b/Graylog_Content_Pack/Install_Sidecar.bat deleted file mode 100644 index 8f9a1795..00000000 --- a/Graylog_Content_Pack/Install_Sidecar.bat +++ /dev/null @@ -1,18 +0,0 @@ -@echo off -cd %temp% -set /p glg= "[+] What's the Graylog Server name or IP? " -echo [+] Server set to: %glg% -echo [+] Downloading Graylog Sidecar to: %temp%\Sidecar.exe... -@powershell (new-object System.Net.WebClient).DownloadFile('https://github.com/Graylog2/collector-sidecar/releases/download/0.1.0-rc.1/collector_sidecar_installer_0.1.0-rc.1.exe','%temp%\Sidecar.exe')" -start /wait Sidecar.exe /S -SERVERURL=https://%glg%:443/api -TAGS="windows" -echo [+] Executing Script to edit content of sidecar configuration... -@powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('https://gist.githubusercontent.com/ion-storm/39d1e70fde966c6e69e57bcb989c5c8d/raw/e3bf0a7b589a340cc557c14bc0f619372cae8752/sidecar.ps1')" -cd "C:\Program Files\graylog\collector-sidecar\" -echo [+] Installing Graylog Services... -graylog-collector-sidecar.exe -service install -graylog-collector-sidecar.exe -service start -echo [+] Checking Services... -@powershell get-service collector-sidecar -echo [+] Graylog Sidecar Successfully Installed and Configured! -timeout /t 10 -exit \ No newline at end of file diff --git a/Graylog_Content_Pack/Install_Sidecar_noprompt.bat b/Graylog_Content_Pack/Install_Sidecar_noprompt.bat deleted file mode 100644 index c9ac62cc..00000000 --- a/Graylog_Content_Pack/Install_Sidecar_noprompt.bat +++ /dev/null @@ -1,16 +0,0 @@ -@echo off -cd %temp% -echo [+] Downloading Graylog Sidecar to: %temp%\Sidecar.exe... -@powershell (new-object System.Net.WebClient).DownloadFile('https://github.com/Graylog2/collector-sidecar/releases/download/0.1.0-rc.1/collector_sidecar_installer_0.1.0-rc.1.exe','%temp%\Sidecar.exe')" -start /wait Sidecar.exe /S -SERVERURL=https://YOURSERVERIPHERE:443/api -TAGS="windows" -echo [+] Executing Script to edit content of sidecar configuration... -@powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('https://gist.githubusercontent.com/ion-storm/39d1e70fde966c6e69e57bcb989c5c8d/raw/e3bf0a7b589a340cc557c14bc0f619372cae8752/sidecar.ps1')" -cd "C:\Program Files\graylog\collector-sidecar\" -echo [+] Installing Graylog Services... -graylog-collector-sidecar.exe -service install -graylog-collector-sidecar.exe -service start -echo [+] Checking Services... -@powershell get-service collector-sidecar -echo [+] Graylog Sidecar Successfully Installed and Configured! -timeout /t 10 -exit \ No newline at end of file From 4751554802e1f6f3162f5444ee3a1857757b131a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 08:36:32 -0400 Subject: [PATCH 292/471] finish gl removal --- .gitignore | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index b18c28f1..44c9f960 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ -sysmonconfig-export.xml.bak \ No newline at end of file +sysmonconfig-export.xml.bak +/Graylog_Content_Pack/ From 4bdc1cecddd8bcc52eef82fe371b4f7cf391fd7a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 09:05:25 -0400 Subject: [PATCH 293/471] ADD: Ransomware File detection & Alerting --- sysmonconfig-export.xml | 517 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 478 insertions(+), 39 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1290cbaa..c6ea5aab 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -262,11 +262,11 @@ del rd expand - find + find.exe format format assoc - cls.exe + \cls.exe doskey.exe @@ -1040,8 +1040,9 @@ C:\Users C:\ProgramData - C:\Windows\Temp + \Temp\ Sysmon.exe + Sysmon64.exe @@ -1401,42 +1402,480 @@ .cpl .inf - help_decrypt - help_restore - ReadDecryptFilesHere - howto_recover_file - recover_file_ - Recovery_file_ - how_to_decrypt - encryptor_raas_readme_liesmich - _how_recover_ - HOWTO_RESTORE_FILES_ - help_my_files - how_recover - HELP_TO_SAVE_FILES - DECRYPT_INSTRUCTIONS - YOUR_FILES.url - Coin.Locker.txt - _secret_code.txt - Decrypt_readme.txt - INSTUCCIONES_DESCRIFRADO - FILESAREGONE.txt - IAMREADYTOPAY.TXT - HELLOTHERE.TXT - READTHISNOW!!!.txt - SECRETIDHERE.KEY - IHAVEYOURSECRET.KEY - SECRET.KEY - HELPDECRYPT_YOUR_FILES.HTML - RECOVERY_FILES.TXT - RECOVERY_FILE. - HowtoRestore_Files - restorefiles - howrecover+ - recoveryfile - help_recover_instructions - _Locky_recover - _ReCoVeRy_ + help_decrypt + help_restore + ReadDecryptFilesHere + howto_recover_file + recover_file_ + Recovery_file_ + how_to_decrypt + encryptor_raas_readme_liesmich + _how_recover_ + HOWTO_RESTORE_FILES_ + help_my_files + how_recover + HELP_TO_SAVE_FILES + DECRYPT_INSTRUCTIONS + YOUR_FILES.url + Coin.Locker.txt + _secret_code.txt + Decrypt_readme.txt + INSTUCCIONES_DESCRIFRADO + FILESAREGONE.txt + IAMREADYTOPAY.TXT + HELLOTHERE.TXT + READTHISNOW!!!.txt + SECRETIDHERE.KEY + IHAVEYOURSECRET.KEY + SECRET.KEY + HELPDECRYPT_YOUR_FILES.HTML + RECOVERY_FILES.TXT + RECOVERY_FILE. + HowtoRestore_Files + restorefiles + howrecover+ + recoveryfile + help_recover_instructions + _Locky_recover + _ReCoVeRy_ + help_decrypt + help_restore + .CRAB + cerber + _decrypt + -decrypt + decrypt- + decrypt_ + help_decrypt + help_restore_files + HELP_YOUR_FILES + ReadDecryptFilesHere + howto_recover_file + recover_file + Recovery_File_ + HOW_TO_DECRYPT_ + DecryptAllFiles + encryptor_raas_readme_liesmich + _how_recover_ + HOWTO_RESTORE_FILES_ + help_my_files + how_recover + HELP_TO_SAVE_FILES + DECRYPT_INSTRUCTIONS + INSTUCCIONES_DESCRIFRADO + YOUR_FILES.url + Coin.Locker.txt + _secret_code.txt + Decrypt_readme.txt + FILESAREGONE.txt + IAMREADYTOPAY.TXT + HELLOTHERE.TXT + READTHISNOW!!!.txt + SECRETIDHERE.KEY + IHAVEYOURSECRET.KEY + SECRET.KEY + HELPDECRYPT_YOUR_FILES.HTML + RECOVERY_FILES.TXT + RECOVERY_FILE. + HowtoRestore_File + restorefiles_ + howrecover+ recoveryfile_ + recoverfile_ + help_recover_instructions + _ReCoVeRy_+ + _Locky_recover + .zzzzz + aeroware + howto_recover_file + _how_recover_ + HOWTO_RESTORE_FILES + help_my_files + how_recover + HELP_TO_SAVE_FILES + DECRYPT_INSTRUCTIONS + YOUR_FILES.url + Coin.Locker.txt + _secret_code.txt + Decrypt_readme.txt + FILESAREGONE.txt + IAMREADYTOPAY.TXT + HELLOTHERE.TXT + READTHISNOW!!!.txt + SECRETIDHERE.KEY + IHAVEYOURSECRET.KEY + SECRET.KEY + HELPDECRYPT_YOUR_FILES.HTML + RECOVERY_FILES.TXT + restorefiles + howrecover+ + restorefiles + contains(to_string($message.file_created), "howrecover+ + restorefiles + help_recover_instructions + _Locky_recover + _ReCoVeRy_ + !!!READ_TO_UNLOCK!!!.TXT + openforyou@india.com + .warn_wallet + hacks.at.sigaint.org + .MATRIX + Crytp0l0cker + decrypted_files.dat + padcrypt + Vape Launcher.exe + READ_ME_!.txt + .enjey + Aescrypt.exe + PINGY@INDIA.COM + WORMKILLER@INDIA.COM.XTBL + CEBER3 + IF_WANT_FILES_BACK_PLS_READ.html + _HELP_HELP_HELP_ + zXz.html + .zXz + HELP_ME_PLEASE.txt + !_RECOVERY_HELP_!.txt + PLEASE-READIT-IF_YOU-WANT.html + .filegofprencrp + COME_RIPRISTINARE_I_FILE. + fattura_ + _steaveiwalker@india.com_ + COMO_ABRIR_ARQUIVOS.txt + info@kraken.cc_worldcza@email.cz + COMO_RESTAURAR_ARCHIVOS + What happen to my files.txt + ASSISTANCE_IN_RECOVERY + _DECRYPT_ASSISTANCE_ + _HELP_HELP_HELP_ + BTC_DECRYPT_FILES + .TheTrumpLocker + READ-READ-READ + .weencedufiles + .powned + [KASISKI] + INSTRUCCIONES + _USE_TO_FIX_ + .happydayzz + 001-READ-FOR-DECRYPT-FILES + DECRYPT_INFORMATION + Rans0m_N0te_Read_ME + wowwhereismyfiles + decryptional + wowreadfordecryp + HERMES + _DECRYPT_INFO_szesnl + 000-IF-YOU-WANT-DEC-FILES + .evillock + .letmetrydecfiles + .yourransom + .lambda_l0cked + .gefickt + .sigaint.org + .HakunaMatata + .CRYPTOSHIELD + .weareyourfriends + MERRY_I_LOVE_YOU_BRUCE.hta + How decrypt files.hta + unCrypte + decipher_ne + .paytounlock + TRY-READ-ME-TO-DEC + protonmail.ch + LEER_INMEDIATAMENTE + .killedXXX + .doomed + 000-No-PROBLEM-WE-DEC-FILES + .noproblemwedecfiles + WE-MUST-DEC-FILES + powerfulldecrypt + opensourcemail.org + contains(to_string($message.file_created), "READ_ME_TO_DECRYPT_YOU_INFORMA + file0locked + CryptoRansomware + .VBRANSOM + _HELP_Recover_Files_ + .oops + .deria + .RMCM1 + Locked-by-Mafia + -filesencrypted + decrypt_Globe + .hnumkhotep + .decrypt2017 + DecryptFile + .L0CKED + 1025-7152.exe + firstransomware.exe + HELP-ME-ENCED-FILES + helpmeencedfiles + EdgeLocker + .XBTL + .firecrypt + YOUR_FILES_ARE_DEAD + .airacropencrypted! + mail.ru + WHERE-YOUR-FILES + Whereisyourfiles + india.com + _README.hta + _README.jpg + HOW_OPEN_FILES + .gangbang + GJENOPPRETTING_AV_FILER + !!! HOW TO DECRYPT FILES !!! + .braincrypt + INSTRUCTION RESTORE FILE + Survey Locker.exe + Receipt.exe + WindowsApplication1.exe + HWID Lock.exe + VIP72.exe + DALE_FILES.TXT + HOW_TO_RESTORE_YOUR_DATA + RESTORE_CORUPTED_FILES + Cyber SpLiTTer Vbs.exe + 000-PLEASE-READ-WE-HELP + .VforVendetta + popcorn_time.exe + .wallet + OSIRIS- + DesktopOsiris + inbox.ru + .no_more_ransom + .lovewindows + .osiris + .R.i.P + Important!.txt + !_HOW_TO_RESTORE_ + HOW_TO_RESTORE_FILES + _README_ + HOWTO_RECOVER_FILES_ + HELP_RESTORE_FILES_ + ThxForYurTyme + _HOW_TO_Decrypt + _RECOVER_INSTRUCTIONS + rtext.txt + DECRYPTION INSTRUCTIONS. + decrypt explanations. + _WHAT_is.html + _HOWDO_text.html + readme_liesmich_encryptor_raas + _Adatok_visszaallitasahoz_utasitasok + README_TO_RECURE_YOUR_FILES + Your files encrypted by our friends !!!.txt + README HOW TO DECRYPT YOUR FILES.HTML + READ_IT.txt + !Recovery_ + ATTENTION.url + README!!! + email-salazar_slytherin10 + ._AiraCropEncrypted! + README_RECOVER_FILES_ + _HOWDO_text.html + _HOWDO_text.bmp + _HOWDO_text.html + zzzzzzzzzzzzzzzzzyyy + zycrypt. + decrypt your file + _H_e_l_p_RECOVER_INSTRUCTIONS+ + HOW-TO-DECRYPT-FILES.HTML + HOW_TO_DECRYPT.HTML + exit.hhr.obleep + UnblockFiles.vbs + README_DECRYPT_HYDRA_ID_ + DECRYPT_Readme.TXT.ReadMe + Decrypt All Files + HowDecrypt.gif + HELP_YOURFILES.HTML + HOW TO DECRYPT FILES.HTML + BUYUNLOCKCODE + BitCryptorFileList.txt + How_to_decrypt_your_files.jpg + How_to_restore_files.hta + Como descriptografar seus arquivos.txt + !Recovery_ + Read_this_file.txt + ATTENTION!!!.txt + HELP_DECRYPT.lnk + how to decrypt aes files.lnk + restore_files.txt + HowDecrypt.txt + wie_zum_Wiederherstellen_von_Dateien.txt + paycrypt.bmp + maxcrypt.bmp + how_decrypt.gif + how to get data.txt + help_recover_instructions + help-file-decrypt.enc + enigma_encr.txt + enigma.hta + default432643264.jpg + default32643264.bmp + decypt_your_files.html + de_crypt_readme.txt + de_crypt_readme.html + de_crypt_readme.bmp + cryptinfo.txt + crjoker.html + _how_recover + _Locky_recover_instructions.bmp + _H_e_l_p_RECOVER_INSTRUCTIONS + _HELP_instructions.txt + _HELP_instructions.bmp + _DECRYPT_INFO_ + Your files encrypted by our friends !!! txt + Your files are locked !.txt + Your files are locked !!.txt + Your files are locked !!!.txt + Your files are locked !!!!.txt + YOUR_FILES_ARE_LOCKED.txt + YOUR_FILES_ARE_ENCRYPTED.TXT + YOUR_FILES_ARE_ENCRYPTED.HTML + YOUGOTHACKED.TXT + UNLOCK_FILES_INSTRUCTIONS.txt + UNLOCK_FILES_INSTRUCTIONS.html + SIFRE_COZME_TALIMATI.html + SHTODELATVAM.txt + Read Me (How Decrypt) !!!!.txt + RESTORE_FILES_ + READ_THIS_TO_DECRYPT.html + README_HOW_TO_UNLOCK.TXT + README_HOW_TO_UNLOCK.HTML + README_DECRYPT_UMBRE_ID_ + README_DECRYPT_HYRDA_ID_ + READ ME FOR DECRYPT.txt + READ IF YOU WANT YOUR FILES BACK.html + Payment_Instructions.jpg + ONTSLEUTELINGS_INSTRUCTIES.html + OKSOWATHAPPENDTOYOURFILES.TXT + MENSAGEM.txt + KryptoLocker_README.txt + Instructionaga.txt + ISTRUZIONI_DECRITTAZIONE.html + INSTRUCTIONS_DE_DECRYPTAGE.html + INSTRUCCIONES_DESCIFRADO.html + INSTALL_TOR.URL + IMPORTANT.README + IMPORTANT READ ME.txt + Howto_RESTORE_FILES.html + How to decrypt your data.txt + How to decrypt LeChiffre files.html + Help Decrypt.html + Hacked_Read_me_to_decrypt_files.html + HOW_TO_UNLOCK_FILES_README_ + HOW_TO_RESTORE_FILES.html + HOW_DECRYPT.URL + HOW_DECRYPT.TXT + HOW_DECRYPT.HTML + HOWTO_RECOVER_FILES_ + HOW TO DECRYPT FILES.txt + HELP_YOUR_FILES.html + HELP_YOUR_FILES.PNG + HELP_TO_SAVE_FILES.bmp + HELP_RESTORE_FILES_ + HELP_DECRYPT.URL + HELP_DECRYPT.PNG + HELP_DECRYPT.HTML + GetYouFiles.txt + File Decrypt Help.html + FILES_BACK.txt + ENTSCHLUSSELN_HINWEISE.html + DecryptAllFiles + DESIFROVANI_POKYNY.html + DECRYPT_YOUR_FILES.txt + DECRYPT_YOUR_FILES.HTML + DECRYPT_ReadMe1.TXT + DECRYPT_INSTRUCTIONS.html + DECRYPT_INSTRUCTION.URL + DECRYPT_INSTRUCTION.HTML + DECRYPTION_HOWTO.Notepad + Comment débloquer mes fichiers.txt + BUYUNLOCKCODE.txt + AllFilesAreLocked + @ukr.net + .fuckyourdata + .encrypted.locked + .Where_my_files.txt + .RSplited + .KEYZ.KEYH0LES + .How_To_Get_Back.txt + .How_To_Decrypt.txt + .Contact_Here_To_Recover_Your_Files.txt + .31392E30362E32303136_ + # DECRYPT MY FILES #.vbs + # DECRYPT MY FILES #.txt + # DECRYPT MY FILES #.html + !Where_are_my_files!.html + !!!README!!! + !!!-WARNING-!!!.txt + !!!-WARNING-!!!.html + .magic_software_syndicate + maestro@pizzacrypts.info + howtodecryptaesfiles.txt + .SecureCrypted + decrypt-instruct + files_are_encrypted. + decryptmyfiles + help_instructions. + -recover- + de_crypt_readme. + !recover! + recover}- + _help_instruct + _recover_ + +recover+ + warning-!! + decrypt my file + help_file_ + recovery+ + readme_for_decrypt + install_tor + readme_decrypt + howtodecrypt + howto_restore + how_to_recover + how_recover + how_to_decrypt + how to decrypt + help_restore + help_your_file + help_recover + help_decrypt + decrypt_instruct + cryptolocker. + recover_instruction + .hydracrypt_ID + .cryptotorlocker + .one-we_can-help_you + .OMG! + .nochance + .LOL! + .CryptoTorLocker2015! + .{CRYPTENDBLACKDC} + vault.txt + vault.key + recovery_key.txt + vault.hta + message.txt + recovery_file.txt + confirmation.key + enc_files.txt + last_chance.txt + want your files back. + _Locky_recover_instructions.txt + help_recover_instructions + recoverfile + Howto_Restore_FILES.TXT + recoveryfile + _how_recover.txt + .SUPERCRYPT + .helpdecrypt + only-we_can-help_you + .fileiscryptedhard + .blocatto + .8lock8 + ==READ==THIS==PLEASE== + randomname www.exe ps.exe From b64fe9a1acae398780ab3534e3c9f8542a2f2b66 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 09:16:52 -0400 Subject: [PATCH 294/471] add samsam detection --- sysmonconfig-export.xml | 50 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index c6ea5aab..ae52c543 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1876,6 +1876,56 @@ .8lock8 ==READ==THIS==PLEASE== randomname + .weapologize + SORRY-FOR-FILES + PLEASE-READ-WE-HELP. + CHECK-IT-HELP-FILES + HAPPEN-ENCED-FILES + HELP-ME-ENCED-FILES + PLS-DEC-MY-FILES + WE-MUST-DEC-FILES + No-PROBLEM-WE-DEC-FILES + TRY-READ-ME-TO-DEC + IF-YOU-WANT-DEC-FILES + LET-ME-TRY-DEC-FILES + READ-FOR-DECRYPT-FILES + PLEASE-READIT-IF_YOU-WANT + READ-READ-READ + WANT_FILES_BACK + READ-FOR-DECCCC-FILESSS + PLEASE-README-AFFECTED-FILES + _DEC_FILES. + .notfoundrans + .VforVendetta + .theworldisyours + .helpmeencedfiles + .wowwhereismyfiles + .wowreadfordecryp + .powerfulldecrypt + .noproblemwedecfiles + .weareyourfriends + .otherinformation + .letmetrydecfiles + .encryptedyourfiles + .weencedufiles + .filegofprencrp + .iaufkakfhsaraf + .cifgksaffsfyghd + .skjdthghh + .ransom + .breeding123 + .mention9823 + .suppose666 + .moments2900 + .country82000 + .supported2017 + .prosperous666 + .disposed2017 + .myrandsext2017 + .loveransisgood + .areyoulovemyrans + .stubbin + .berkshire www.exe ps.exe From f6dfbebe47da6159049a782ca6caa9b417ba7560 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 10:07:11 -0400 Subject: [PATCH 295/471] Add Crypto Mining pool detection --- sysmonconfig-export.xml | 68 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ae52c543..64257ba5 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -356,6 +356,30 @@ www.exe awk.exe sed.exe + + stratum+tcp + coinhive + minergate + ccminer + cgminer + sgminer + rainbowminer + xmrMiner + poolpassword + poolurl + poolname + ahashpool + poolname + blazepool + blockmasters + blockmasterscoins + hashrefinery + miningpoolhubcoins + nicehash + yiimp + zergpool + zergpoolcoins + zpool tor.exe @@ -885,6 +909,50 @@ 159.203.213. 209.236.120. 158.130.6 + + blazepool + blockmasters + blockmasterscoins + hashrefinery + miningpoolhubcoins + nicehash + yiimp + zergpool + zergpoolcoins + zpool + slushpool + minexmr + minergate + monero + prohash + dwarfpool + nanopool.org + mixpools.org + viaxmr.com + hashvault.pro + moriaxmr.com + suprnova.cc + mixpools.org + monero + usxmrpool + xmrpool + poolto.be + mineXMR + prohash.net + mine.bz + mypool.online + bohemianpool + mineXMR + iwanttoearn.money + pool.xmr + crypto-pool + miners.pro + minercircle.com + monero.lindon-pool.win + teracycle.net + ratchetmining.com + cryptmonero + mineXMR 80 443 From 6a76cf78a34b49e6166d8c920e533f492bbcea5c Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 12:53:25 -0400 Subject: [PATCH 296/471] add exclusions --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 64257ba5..04176bde 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -746,6 +746,8 @@ net.exe time net1 time C:\Windows\system32\cmd.exe /c UsrLogon.cmd + C:\Program Files (x86)\MaaS360\Cloud Extender\EMSAgent.exe + C:\Program Files\Octopus Deploy\Tentacle\Tentacle.exe From 7ea5f6466ca86a029cd5d20b3c77a0a6a7e67c87 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 14:31:43 -0400 Subject: [PATCH 297/471] add Hack command line events/Privilege Escalation --- sysmonconfig-export.xml | 234 +++++++++++++++++++++++++++++++--------- 1 file changed, 181 insertions(+), 53 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 04176bde..8a50f501 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -213,7 +213,7 @@ C^om^S^pEc query.exe - tracert.exe + tracert.exe tree.com runas.exe taskkill.exe @@ -316,7 +316,135 @@ more \\tsclient .. - + + wmic shadowcopy delete + telnet + -dumpcr + putty + bash.exe + pssh + sdelete + shareenum + sekurlsa + reg SAVE + Invoke-DllInjection + Invoke-Shellcode + Invoke-WmiCommand + Get-GPPPassword + Get-Keystrokes + Get-TimedScreenshot + Get-VaultCredential + Invoke-CredentialInjection + mimikatz + Invoke-NinjaCopy + Invoke-TokenManipulation + Out-Minidump + VolumeShadowCopyTools + Invoke-ReflectivePEInjection + Invoke-UserHunter + Find-GPOLocation + Invoke-ACLScanner + Invoke-DowngradeAccount + Get-ServiceUnquoted + Get-ServiceFilePermission + Get-ServicePermission + Invoke-ServiceAbuse + Install-ServiceBinary + Get-RegAutoLogon + Get-VulnAutoRun + Get-VulnSchTask + Get-UnattendedInstallFile + Get-WebConfig + Get-ApplicationHost + Get-RegAlwaysInstallElevated + Get-Unconstrained + Add-RegBackdoor + Add-ScrnSaveBackdoor + Gupt-Backdoor + Invoke-ADSBackdoor + Enabled-DuplicateToken + Invoke-PsUaCme + Remove-Update + Check-VM + Get-LSASecret + Get-PassHashes + Show-TargetScreen + Port-Scan + netscan + psscan + Invoke-PoshRatHttp + Invoke-PowerShellTCP + Invoke-PowerShellWMI + Add-Exfiltration + Add-Persistence + Do-Exfiltration + Start-CaptureServer + Invoke-DllInjection + Invoke-ReflectivePEInjection + Invoke-ShellCode + Get-ChromeDump + Get-ClipboardContents + Get-FoxDump + Get-IndexedItem + Get-Keystrokes + Get-Screenshot + Invoke-Inveigh + Invoke-NetRipper + Invoke-NinjaCopy + Out-Minidump + Invoke-EgressCheck + Invoke-PSInject + Invoke-RunAs + MailRaider + New-HoneyHash + Set-MacAttribute + Get-VaultCredential + Invoke-DCSync + Invoke-PowerDump + Invoke-TokenManipulation + Exploit-Jboss + Invoke-ThunderStruck + Invoke-VoiceTroll + Set-Wallpaper + Invoke-InveighRelay + Invoke-PsExec + Invoke-SSHCommand + Get-SecurityPackages + Install-SSP + Invoke-BackdoorLNK + PowerBreach + Get-GPPPassword + Get-SiteListPassword + Get-System + BypassUAC + Invoke-Tater + PowerUp + PowerView + Get-RickAstley + Find-Fruit + HTTP-Login + Find-TrustedDocuments + Invoke-Paranoia + Invoke-WinEnum + Invoke-ARPScan + Invoke-ReverseDNSLookup + smbscanner + Invoke-FruityC2 + Invoke-Stager + process call create + root\\default + FilterToConsumerBinding + root\\subscription + Win32_TaskService + Win32_TaskService + stratum+tcp + -donate-level= + Wmiclass + WmiCl'+'as'+'s + ntdsutil + mimiauth + Powersploit + Mimikittenz cscript.exe wscript.exe @@ -2591,59 +2719,59 @@ .default\prefs-1.js - Content.Outlook - Downloads - Temp\7z - Startup - .vb - .application - .appref-ms - .bat - .cmd - .cmdline - .docm - .exe - .dll - .sys - .hta - .pptm - .ps1 - .sys - .reg - .docm - .xlsm - .xlam - .pptm - .potm - .pptm - .sldm - .scf - .appref-ms - .rdp - .vbs - .js + Content.Outlook + Downloads + Temp\7z + Startup + .vb + .application + .appref-ms + .bat + .cmd + .cmdline + .docm + .exe + .dll + .sys + .hta + .pptm + .ps1 + .sys + .reg + .docm + .xlsm + .xlam + .pptm + .potm + .pptm + .sldm + .scf + .appref-ms + .rdp + .vbs + .js - .pem - .crt - .ca-bundle - .cer - .csr - .der - .p7b - .p7r - .p7s - .pfx - .sto - .p12 - .crl - .sst - .key + .pem + .crt + .ca-bundle + .cer + .csr + .der + .p7b + .p7r + .p7s + .pfx + .sto + .p12 + .crl + .sst + .key - .mht - .manifest - .cpl - .scr - .inf + .mht + .manifest + .cpl + .scr + .inf From 0f76fed602a0c7df7f3040af70f889f20709d254 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 14:45:08 -0400 Subject: [PATCH 298/471] Update version --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 8a50f501..3766e380 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5,12 +5,12 @@ Master project: https://github.com/SwiftOnSecurity/sysmon-config Master license: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text. - Fork version: 150 + Fork version: 300 Fork author: ionstorm Fork project: https://github.com/ion-storm/sysmon-config Fork license: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text. - REQUIRED: Sysmon version 7.01 or higher (due to changes in registry syntax and bug-fixes) + REQUIRED: Sysmon version 8.00 or higher (due to changes in registry syntax and bug-fixes) https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon Note that 6.03 and 7.01 have critical fixes for filtering, it's recommended you stay updated. From 5837fd3b101d2cd663d21d03337e9c059da0f869 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 15:21:26 -0400 Subject: [PATCH 299/471] too much noise, however will restore non-exe network connections with right exclusions --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 3766e380..2552e26c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -923,7 +923,7 @@ MicrosoftEdgeCP.exe MicrosoftEdge.exe explorer.exe - .exe + at.exe certutil.exe From da1e5960176da2871caadb77c233d3c27dff2e35 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 15:26:53 -0400 Subject: [PATCH 300/471] include unknown process detection --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 2552e26c..df529355 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -924,6 +924,7 @@ MicrosoftEdge.exe explorer.exe + unknown process at.exe certutil.exe From 18cd82d515d4537868dc66b1c35ada3d191185f8 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 15:34:11 -0400 Subject: [PATCH 301/471] exclude dns lookups --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index df529355..f1f91b38 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1224,8 +1224,8 @@ g2ax_comm_expert.exe g2mcomm.exe AppData\Local\Microsoft\Teams\current\Teams.exe + 53 - From 6080f878444b5d435458573574ff1c5ae43493de Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 16:15:54 -0400 Subject: [PATCH 302/471] exclude inetcache from ads --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f1f91b38..e27e7d90 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -2718,6 +2718,7 @@ .default\prefs-1.js + \Microsoft\Windows\INetCache\ Content.Outlook From 40907398b9d0e20db36b0c240e18806e34c31b4f Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 16:17:33 -0400 Subject: [PATCH 303/471] more ie cache spam --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e27e7d90..e51a5e18 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -2719,6 +2719,7 @@ .default\prefs-1.js \Microsoft\Windows\INetCache\ + \Microsoft\Windows\Temporary Internet Files\Content.IE5 Content.Outlook From 53e7cc5054c5b88d6c75f1060fa718f5ca87420e Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 16:19:37 -0400 Subject: [PATCH 304/471] exclude ff spam --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e51a5e18..e51ac1a9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -2718,6 +2718,7 @@ .default\prefs-1.js + \Mozilla\Firefox\Profiles\ \Microsoft\Windows\INetCache\ \Microsoft\Windows\Temporary Internet Files\Content.IE5 From 4f59a110eaf0dd2a9049eb80d0755a19c491df0a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 16:44:43 -0400 Subject: [PATCH 305/471] Add Space in between = and http to allow event viewer to create http link --- sysmonconfig-export.xml | 106 ++++++++++++++++++++-------------------- 1 file changed, 53 insertions(+), 53 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e51ac1a9..f7014f53 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -115,7 +115,7 @@ net1.exe group net1.exe group dsquery.exe - whoami.exe + whoami.exe ipconfig.exe tasklist.exe sysinfo.exe @@ -213,7 +213,7 @@ C^om^S^pEc query.exe - tracert.exe + tracert.exe tree.com runas.exe taskkill.exe @@ -2723,59 +2723,59 @@ \Microsoft\Windows\Temporary Internet Files\Content.IE5 - Content.Outlook - Downloads - Temp\7z - Startup - .vb - .application - .appref-ms - .bat - .cmd - .cmdline - .docm - .exe - .dll - .sys - .hta - .pptm - .ps1 - .sys - .reg - .docm - .xlsm - .xlam - .pptm - .potm - .pptm - .sldm - .scf - .appref-ms - .rdp - .vbs - .js + Content.Outlook + Downloads + Temp\7z + Startup + .vb + .application + .appref-ms + .bat + .cmd + .cmdline + .docm + .exe + .dll + .sys + .hta + .pptm + .ps1 + .sys + .reg + .docm + .xlsm + .xlam + .pptm + .potm + .pptm + .sldm + .scf + .appref-ms + .rdp + .vbs + .js - .pem - .crt - .ca-bundle - .cer - .csr - .der - .p7b - .p7r - .p7s - .pfx - .sto - .p12 - .crl - .sst - .key + .pem + .crt + .ca-bundle + .cer + .csr + .der + .p7b + .p7r + .p7s + .pfx + .sto + .p12 + .crl + .sst + .key - .mht - .manifest - .cpl - .scr - .inf + .mht + .manifest + .cpl + .scr + .inf From eb1d876aee33dd5002a9bae095cd45d2944cb935 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 12 Jul 2018 22:17:59 -0400 Subject: [PATCH 306/471] more updates --- sysmonconfig-export.xml | 47 +++++++++++++++++++++++++++++++++++++++-- 1 file changed, 45 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f7014f53..99e6369a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -135,6 +135,8 @@ powershell.exe powershell.exe powershell.exe + powershell.exe -Version + powershell -Version iex Invoke-Expression iwr @@ -249,8 +251,12 @@ ieexec.exe http ieexec http diskshadow - rundll32.exe advpack.dll,LaunchINFSection - rundll32 advpack.dll,LaunchINFSection + + advpack.dll,LaunchINFSection + mshtml,RunHTMLApplication + /s /n /u /i:http: + mshtml,RunHTMLApplication + bginfo.bgi /popup /nolicprompt set setx pushd @@ -318,6 +324,8 @@ .. wmic shadowcopy delete + wbadmin delete catalog + /set {default} recoveryenabled no telnet -dumpcr putty @@ -445,6 +453,37 @@ mimiauth Powersploit Mimikittenz + + AdjustTokenPrivileges + IMAGE_NT_OPTIONAL_HDR64_MAGIC + Management.Automation.RuntimeException + Microsoft.Win32.UnsafeNativeMethods + ReadProcessMemory.Invoke + Runtime.InteropServices + SE_PRIVILEGE_ENABLED + System.Security.Cryptography + System.Runtime.InteropServices + LSA_UNICODE_STRING + MiniDumpWriteDump + PAGE_EXECUTE_READ + Net.Sockets.SocketFlags + Reflection.Assembly + SECURITY_DELEGATION + TOKEN_ADJUST_PRIVILEGES + TOKEN_ALL_ACCESS + TOKEN_ASSIGN_PRIMARY + TOKEN_DUPLICATE + TOKEN_ELEVATION + TOKEN_IMPERSONATE + TOKEN_INFORMATION_CLASS + TOKEN_PRIVILEGES + TOKEN_QUERY + Metasploit + Mimikatz + + usn deletejournal + ^h^t^t^p + h"t"t"p cscript.exe wscript.exe @@ -2509,6 +2548,10 @@ + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic + From cf080833df2e3c00c58a218e36e4eb8fb5af92d2 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 13 Jul 2018 08:15:27 -0400 Subject: [PATCH 307/471] end with at.exe needs end with \at.exe to not flag apps like acrobat --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 99e6369a..b833c73d 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -177,8 +177,8 @@ schtasks.exe schtasks /create schtasks.exe /create - at.exe - at.exe + \at.exe + \at.exe System.Management.Automation net user /add net localgroup administrators /add From 64593beadfd67e78a1ba9d14b86ee8cd79d3d56d Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 13 Jul 2018 08:29:55 -0400 Subject: [PATCH 308/471] Windows firewall modifications --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b833c73d..b4ff34a7 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -568,6 +568,7 @@ \Perflogs\ \config\systemprofile\ + netsh advfirewall firewall \ From c08faac7dc2bcdcdb62a317442a389520aea7ff2 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 13 Jul 2018 08:39:58 -0400 Subject: [PATCH 309/471] ransomware detection false positive removal --- sysmonconfig-export.xml | 131 +++++++++++++++++++--------------------- 1 file changed, 63 insertions(+), 68 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b4ff34a7..69f41099 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1676,10 +1676,9 @@ recoveryfile help_recover_instructions _Locky_recover - _ReCoVeRy_ help_decrypt help_restore - .CRAB + .CRAB cerber _decrypt -decrypt @@ -1752,12 +1751,11 @@ restorefiles help_recover_instructions _Locky_recover - _ReCoVeRy_ !!!READ_TO_UNLOCK!!!.TXT openforyou@india.com .warn_wallet hacks.at.sigaint.org - .MATRIX + .MATRIX Crytp0l0cker decrypted_files.dat padcrypt @@ -1771,7 +1769,6 @@ IF_WANT_FILES_BACK_PLS_READ.html _HELP_HELP_HELP_ zXz.html - .zXz HELP_ME_PLEASE.txt !_RECOVERY_HELP_!.txt PLEASE-READIT-IF_YOU-WANT.html @@ -1787,14 +1784,14 @@ _DECRYPT_ASSISTANCE_ _HELP_HELP_HELP_ BTC_DECRYPT_FILES - .TheTrumpLocker + .TheTrumpLocker READ-READ-READ - .weencedufiles - .powned + .weencedufiles + .powned [KASISKI] INSTRUCCIONES _USE_TO_FIX_ - .happydayzz + .happydayzz 001-READ-FOR-DECRYPT-FILES DECRYPT_INFORMATION Rans0m_N0te_Read_ME @@ -1804,54 +1801,54 @@ HERMES _DECRYPT_INFO_szesnl 000-IF-YOU-WANT-DEC-FILES - .evillock - .letmetrydecfiles - .yourransom - .lambda_l0cked - .gefickt - .sigaint.org - .HakunaMatata - .CRYPTOSHIELD - .weareyourfriends + .evillock + .letmetrydecfiles + .yourransom + .lambda_l0cked + .gefickt + .sigaint.org + .HakunaMatata + .CRYPTOSHIELD + .weareyourfriends MERRY_I_LOVE_YOU_BRUCE.hta How decrypt files.hta unCrypte decipher_ne - .paytounlock + .paytounlock TRY-READ-ME-TO-DEC protonmail.ch LEER_INMEDIATAMENTE - .killedXXX - .doomed + .killedXXX + .doomed 000-No-PROBLEM-WE-DEC-FILES - .noproblemwedecfiles + .noproblemwedecfiles WE-MUST-DEC-FILES powerfulldecrypt opensourcemail.org contains(to_string($message.file_created), "READ_ME_TO_DECRYPT_YOU_INFORMA file0locked CryptoRansomware - .VBRANSOM + .VBRANSOM _HELP_Recover_Files_ - .oops - .deria - .RMCM1 + .oops + .deria + .RMCM1 Locked-by-Mafia -filesencrypted decrypt_Globe - .hnumkhotep - .decrypt2017 + .hnumkhotep + .decrypt2017 DecryptFile - .L0CKED + .L0CKED 1025-7152.exe firstransomware.exe HELP-ME-ENCED-FILES helpmeencedfiles EdgeLocker - .XBTL - .firecrypt + .XBTL + .firecrypt YOUR_FILES_ARE_DEAD - .airacropencrypted! + .airacropencrypted! mail.ru WHERE-YOUR-FILES Whereisyourfiles @@ -1859,10 +1856,10 @@ _README.hta _README.jpg HOW_OPEN_FILES - .gangbang + .gangbang GJENOPPRETTING_AV_FILER !!! HOW TO DECRYPT FILES !!! - .braincrypt + .braincrypt INSTRUCTION RESTORE FILE Survey Locker.exe Receipt.exe @@ -1874,16 +1871,15 @@ RESTORE_CORUPTED_FILES Cyber SpLiTTer Vbs.exe 000-PLEASE-READ-WE-HELP - .VforVendetta + .VforVendetta popcorn_time.exe - .wallet OSIRIS- DesktopOsiris inbox.ru - .no_more_ransom - .lovewindows - .osiris - .R.i.P + .no_more_ransom + .lovewindows + .osiris + .R.i.P Important!.txt !_HOW_TO_RESTORE_ HOW_TO_RESTORE_FILES @@ -1893,7 +1889,6 @@ ThxForYurTyme _HOW_TO_Decrypt _RECOVER_INSTRUCTIONS - rtext.txt DECRYPTION INSTRUCTIONS. decrypt explanations. _WHAT_is.html @@ -1908,7 +1903,7 @@ ATTENTION.url README!!! email-salazar_slytherin10 - ._AiraCropEncrypted! + ._AiraCropEncrypted! README_RECOVER_FILES_ _HOWDO_text.html _HOWDO_text.bmp @@ -2032,15 +2027,15 @@ BUYUNLOCKCODE.txt AllFilesAreLocked @ukr.net - .fuckyourdata - .encrypted.locked - .Where_my_files.txt - .RSplited - .KEYZ.KEYH0LES - .How_To_Get_Back.txt - .How_To_Decrypt.txt - .Contact_Here_To_Recover_Your_Files.txt - .31392E30362E32303136_ + .fuckyourdata + .encrypted.locked + .Where_my_files.txt + .RSplited + .KEYZ.KEYH0LES + .How_To_Get_Back.txt + .How_To_Decrypt.txt + .Contact_Here_To_Recover_Your_Files.txt + .31392E30362E32303136_ # DECRYPT MY FILES #.vbs # DECRYPT MY FILES #.txt # DECRYPT MY FILES #.html @@ -2048,10 +2043,10 @@ !!!README!!! !!!-WARNING-!!!.txt !!!-WARNING-!!!.html - .magic_software_syndicate + .magic_software_syndicate maestro@pizzacrypts.info howtodecryptaesfiles.txt - .SecureCrypted + .SecureCrypted decrypt-instruct files_are_encrypted. decryptmyfiles @@ -2083,14 +2078,14 @@ decrypt_instruct cryptolocker. recover_instruction - .hydracrypt_ID - .cryptotorlocker - .one-we_can-help_you - .OMG! - .nochance - .LOL! - .CryptoTorLocker2015! - .{CRYPTENDBLACKDC} + .hydracrypt_ID + .cryptotorlocker + .one-we_can-help_you + .OMG! + .nochance + .LOL! + .CryptoTorLocker2015! + .{CRYPTENDBLACKDC} vault.txt vault.key recovery_key.txt @@ -2107,15 +2102,15 @@ Howto_Restore_FILES.TXT recoveryfile _how_recover.txt - .SUPERCRYPT - .helpdecrypt - only-we_can-help_you - .fileiscryptedhard - .blocatto - .8lock8 + .SUPERCRYPT + .helpdecrypt + only-we_can-help_you + .fileiscryptedhard + .blocatto + .8lock8 ==READ==THIS==PLEASE== randomname - .weapologize + .weapologize SORRY-FOR-FILES PLEASE-READ-WE-HELP. CHECK-IT-HELP-FILES From 45571e590624d400664ae27e4cffa4eb27c996e1 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 13 Jul 2018 09:14:59 -0400 Subject: [PATCH 310/471] exclusions and tweaks. --- sysmonconfig-export.xml | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 69f41099..6e863fae 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -121,8 +121,8 @@ sysinfo.exe netstat.exe qprocess.exe - net.exe - net1.exe + \net.exe + \net1.exe quser.exe route.exe reg.exe @@ -2266,6 +2266,16 @@ N-able Technologies\AVDefender\ThreatScanner\Antivirus-NewTemp\scanclient.dll C:\Program Files (x86)\N-able Technologies\Windows Software Probe\Repository\nagent C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\ + C:\Program Files (x86)\MaaS360\Cloud Extender\EMSAgent.exe + C:\Program Files\graylog\collector-sidecar\winlogbeat.exe + C:\Program Files\N-able Technologies\Endpoint Update Server\bin\EPUpdateServer.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\AVDefender\Installer.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AutomationManager.ScriptRunner64.exe + C:\Program Files (x86)\StorageCraft\ShadowProtect\ShadowSnap\raw_agent_svc.exe + C:\Windows\system32\printfilterpipelinesvc.exe + C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Bin\updateservice.exe + \Runtime\1.0\NodeRunner.exe + From 3311184c35173655e7f3ab77df3712d6a6f973b0 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 13 Jul 2018 10:29:30 -0400 Subject: [PATCH 311/471] exclude domain login scripts --- sysmonconfig-export.xml | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6e863fae..8a486e6b 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -83,7 +83,7 @@ regsvcs.exe regasm.exe SyncAppvPublishingServer.exe - control.exe + \control.exe control.exe /name rundll32.exe shell32.dll,Control_RunDLL mshta.exe @@ -124,8 +124,8 @@ \net.exe \net1.exe quser.exe - route.exe - reg.exe + \route.exe + \reg.exe netsh.exe COMSPEC @@ -558,7 +558,7 @@ control.exe acrord32.exe installutil.exe - reg.exe + \reg.exe ipconfig.exe \appdata\ \programdata\ @@ -594,8 +594,13 @@ %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\vssvc.exe + net.exe use net use - net use + net1 use + net.exe time + net time + net1 time + gpscript.exe C:\Program Files\Windows Defender C:\Windows\System32\CompatTelRunner.exe From 535b3b4dab651087675cf6b8d7017f2e23717b37 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 13 Jul 2018 20:58:57 -0400 Subject: [PATCH 312/471] add unknown process detection & updates notes/comments --- sysmonconfig-export.xml | 146 ++++++++++++++++++++-------------------- 1 file changed, 74 insertions(+), 72 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 8a486e6b..a3d10562 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -73,6 +73,8 @@ + unknown process + unknown process regsvr32.exe bitsadmin.exe eventvwr.exe @@ -1130,82 +1132,82 @@ cryptmonero mineXMR - 80 + 80 443 - 3389 + 3389 3540 - 22 - 23 - 25 - 139 + 22 + 23 + 25 + 139 - 5800 - 5900 - 1194 - 1701 - 1723 - 1293 - 4500 - 1080 - 8080 - 3128 - 9001 - 9030 - 4443 - 2448 - 8143 - 1777 - 1443 - 243 - 65535 - 13506 - 3360 - 200 - 198 - 49180 - 13507 - 3360 - 6625 - 4444 - 4438 - 1904 - 13505 - 13504 - 12102 - 9631 - 5445 - 2443 - 777 - 13394 - 13145 - 12103 - 5552 - 3939 - 3675 - 666 - 473 - 5649 - 4455 - 4433 - 1817 - 100 - 65520 - 1960 - 1515 - 743 - 700 - 14154 - 14103 - 14102 - 12322 - 10101 - 7210 - 4040 - 9943 + 5800 + 5900 + 1194 + 1701 + 1723 + 1293 + 4500 + 1080 + 8080 + 3128 + 9001 + 9030 + 4443 + 2448 + 8143 + 1777 + 1443 + 243 + 65535 + 13506 + 3360 + 200 + 198 + 49180 + 13507 + 3360 + 6625 + 4444 + 4438 + 1904 + 13505 + 13504 + 12102 + 9631 + 5445 + 2443 + 777 + 13394 + 13145 + 12103 + 5552 + 3939 + 3675 + 666 + 473 + 5649 + 4455 + 4433 + 1817 + 100 + 65520 + 1960 + 1515 + 743 + 700 + 14154 + 14103 + 14102 + 12322 + 10101 + 7210 + 4040 + 9943 - 7777 - 9943 - 666 + 7777 + 9943 + 666 From 0eb2d75fbe6b18c7b1827d5f5230290cd5077276 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 13 Jul 2018 21:38:17 -0400 Subject: [PATCH 313/471] Update comments, remove excess comments --- sysmonconfig-export.xml | 68 +++++++++-------------------------------- 1 file changed, 14 insertions(+), 54 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index a3d10562..6d2c7cff 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -10,45 +10,7 @@ Fork project: https://github.com/ion-storm/sysmon-config Fork license: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text. - REQUIRED: Sysmon version 8.00 or higher (due to changes in registry syntax and bug-fixes) - https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon - Note that 6.03 and 7.01 have critical fixes for filtering, it's recommended you stay updated. - - NOTE: To collect Sysmon logs centrally for free, see https://aka.ms/WEF. Will need to run command to allow log access to the Network Service: - wevtutil.exe sl Microsoft-Windows-Sysmon/Operational /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;NS) - - NOTE: Do not let the size and complexity of this configuration discourage you from customizing this or building your own. - This configuration is based around known, high-signal event tracing, and thus appears complicated, but it's only very - detailed. Significant effort over years has been invested in front-loading as much filtering as possible onto the - client. This is to make analysis of intrusions possible by hand, and to try to surface anomalous activity as quickly - as possible to any technician armed only with Event Viewer. Its purpose is to democratize system monitoring for all organizations. - - NOTE: Sysmon is NOT a whitelist solution or HIDS engine, it is a computer change and event logging tool with very basic exclude rules. - Do NOT ignore everything possible. Sysmon's purpose is providing context during a threat or problem investigation. Legitimate - processes are routinely used by threats - do not blindly exclude them. Additionally, be mindful of process-hollowing / imitation. - - NOTE: Sysmon is not hardened against an attacker with admin rights. Additionally, this configuration offers an attacker, willing - to study it, many ways to evade some of the logging. If you are in a high-threat environment, you should consider a much broader - log-most approach. However, in the vast majority of cases, an attacker will bumble along through multiple behavioral traps which - this configuration monitors, especially in the first minutes. - - TECHNICAL: - - Run sysmon.exe -? for a briefing on Sysmon configuration. - - Sysmon does not support nested/multi-conditional rules. There are only blanket INCLUDE and EXCLUDE. "Exclude" rules override "Include" rules. - - If you only specify exclude for a filtering subsection, everything in that subsection is logged by default. - - Some Sysmon monitoring abilities are not meant for general-purpose use due to their large performance impact, such as ProcessAccess. - - Duplicate or overlapping "Include" rules do not result in duplicate events being logged. - - All characters enclosed by XML tags are always interpreted literally. Sysmon does not support wildcards (*), alternate characters, or RegEx. - - In registry events, the value name is appended to the full key path with a "\" delimiter. Default key values are named "\(Default)" - - "Image" is a technical term for a compiled binary file like an EXE or DLL. Also, it can match just the filename, or entire path. - - "ProcessGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual process launches. Cleared on service restart. - - "LoginGuid" is randomly generated, assigned, and tracked by Sysmon to assist in tracing individual user sessions. Cleared on service restart. - - Sysmon does not track which rule caused an event to be logged. - - TECHNICAL: Filter conditions available for use are: is, is not, contains, excludes, begin with, end with, less than, more than, image - - The "image" filter is usable with any field. Same as "is" but can either match the entire string, or only the text after the last "\" in the string. Credit: @mattifestation - - PERFORMANCE: By using "end with" you can save performance by starting a string match at the end of a line, which usually triggers earlier. + REQUIRED: Sysmon version 8.00 or higher, it's recommended you stay updated. --> @@ -61,15 +23,13 @@ - - - + @@ -928,7 +888,7 @@ - + C:\Users C:\ProgramData @@ -952,7 +912,7 @@ - + C:\Users @@ -1281,7 +1241,7 @@ - + C:\Users @@ -1297,7 +1257,7 @@ [ https://attack.mitre.org/wiki/Technique/T1014 ] --> - + @@ -1332,7 +1292,7 @@ - + false Invalid @@ -1429,7 +1389,7 @@ - + LoadLibrary \ @@ -1465,7 +1425,7 @@ Encourage you to experiment with this feature yourself. [ https://attack.mitre.org/wiki/Technique/T1067 ] --> - + @@ -1473,7 +1433,7 @@ - + :\Windows\System32\lsass.exe :\Windows\System32\winlogon.exe @@ -1557,7 +1517,7 @@ - + \Start Menu \Startup @@ -2771,7 +2731,7 @@ [ https://textslashplain.com/2016/04/04/downloads-and-the-mark-of-the-web/ ] --> - + .default\prefs-1.js \Mozilla\Firefox\Profiles\ @@ -2838,14 +2798,14 @@ - + - + From df625331a3f775cd028f59c2999d3654928e1d2b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 13 Jul 2018 21:58:01 -0400 Subject: [PATCH 314/471] Removed Custom Exclusions for Labtech & Solarwinds N-Central for master branch, you may want to exclude this commit if you use these products. --- sysmonconfig-export.xml | 71 ----------------------------------------- 1 file changed, 71 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6d2c7cff..e9f40474 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -776,56 +776,13 @@ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe - - - - C:\Windows\LTSvc\LTSVC.exe -sLTService - C:\Windows\LTSvc\LTSVC.exe - C:\Windows\LTSvc\ - find /i "Listening" - netstat -an - tasklist - nslookup - nbtstat.exe - dsquery - sc query - find /i "Listening" - netstat -an - tasklist - interface tcp show global - wmic path win32_operatingsystem get - sc queryex type= service C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe raw_agent_svc.exe raw_agent_svc.exe IscsidscInterface.exe IscsidscInterface.exe - Add-PSSnapin Microsoft.SharePoint.PowerShell - find /i "Listening" - netstat -an - tasklist - wmic path win32_operatingsystem get - sc queryex type= service - C:\Program Files\StorageCraft\ImageManager\ImageManager.exe - Add-PSSnapin Microsoft.SharePoint.PowerShell - Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname - Get-WmiObject -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType - Get-WmiObject -Namespace Root\CimV2\TerminalServices - tasklist - vssadmin list writers - vssadmin list writers - net view \\localhost | find " Print - net view \\localhost | find " Disk - C:\Windows\system32\net1 Share - Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname | format-table -autosize" | find /i "vss writer" | find /i "sql server"" - C:\Program Files (x86)\LabTech Client\LTClient.exe C:\Windows\LTSvc\LTSvcMon.exe -sLTService - C:\Windows\LTSvc\LTSvcMon.exe - C:\Windows\LTSvc\LTTray.exe - Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall interface tcp show global - nslookup.exe - ScreenConnect.WindowsClient.exe C:\Program Files (x86)\SmartGit C:\Program Files (x86)\SmartGit @@ -852,18 +809,6 @@ C:\ProgramData\sysmon\sysmon64.exe 56BFB300BA379181CE09C3130775DFBBCAFF9DB764BDC39086C2FEC2547EE900 - - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\bitsadmin.exe - C:\Program Files\N-able Technologies\Windows Agent\bin\bitsadmin.exe - C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe - N-able Technologies\Windows Software Probe\bin\wsp.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AutomationManager.ScriptRunner64.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AutomationManager.ScriptRunner64.exe - C:\Program Files\N-able Technologies\AVDefender\installer\installer.exe - C:\Program Files\N-able Technologies\AVDefender\epupdateservice.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\ShadowProtectDataReader.exe - 3070E798134A11ADB01129F06A36CD924267E6DA95DAB2E3196105264D2BF818 \sysmon\Auto_Update.bat \sysmon\Auto_Update.bat @@ -871,8 +816,6 @@ \netlogon\ \netlogon\ - C:\PROGRA~2\SAAZOD\SAAZMSMACTL.EXE - net use net.exe use net1 use @@ -1223,8 +1166,6 @@ efolder01 2080 g2mcomm.exe - C:\Program Files (x86)\LabTech Client\LTClient.exe - C:\Windows\LTSvc\LTSVC.exe C:\Program Files (x86)\Webroot\WRSA.exe C:\Program Files (x86)\SmartGit\ DSPro\Programs\pr001Celery98.exe @@ -1408,8 +1349,6 @@ FireSvc.exe C:\Program Files (x86)\Webroot\WRSA.exe controls\cef\ConnectWise.exe - C:\Program Files\N-able Technologies\AVDefender\epsecurityservice.exe - C:\Program Files\N-able Technologies\AVDefender\EPSecurityService.exe C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows SP1\avp.exe C:\Program Files (x86)\Microsoft Visual Studio\2017\Enterprise\Common7\IDE\Remote Debugger\x64\msvsmon.exe C:\Windows\System32\rdpclip.exe @@ -1471,8 +1410,6 @@ C:\Windows\system32\msiexec.exe C:\Windows\system32\svchost.exe C:\Windows\system32\spoolsv.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe - C:\Program Files\N-able Technologies\AVDefender\EPUpdateService.exe taskmgr wbem\wmiprvse.exe \EMET_Service.exe @@ -2679,9 +2616,6 @@ HKLM\System\CurrentControlSet\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\ C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe - - \LTSvcMon\Start - \LTService\Start {F2C2787D-95AB-40D4-942D-298F5F757874} C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe @@ -2915,13 +2849,8 @@ C:\Program Files (x86)\Fortinet\FortiClient\FortiSSLVPNdaemon.exe c:\program files (x86)\sophos\sophos ssl vpn client\bin\openvpnserv.exe - - C:\Windows\LTSvc\LTSVC.exe ScreenConnect.WindowsClient.exe ScreenConnect.ClientService.exe - - N-able Technologies\Windows Agent\bin\agent.exe - N-able Technologies\AVDefender\EPIntegrationService.exe C:\Program Files\OpenVPN\bin\openvpn-gui.exe C:\Program Files\OpenVPN\bin\openvpn.exe C:\Program Files\OpenVPN\bin\openvpnserv.exe From 335bf0945e6cb4c32e570e31193bbacc085c3a4f Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 15 Jul 2018 00:27:45 -0400 Subject: [PATCH 315/471] Update alerts --- sysmonconfig-export.xml | 68 ++++++++++++++++++++--------------------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e9f40474..0d65204f 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -142,39 +142,39 @@ \at.exe \at.exe System.Management.Automation - net user /add - net localgroup administrators /add + net user /add + net localgroup administrators /add - wmiprvse.exe + wmiprvse.exe - FromBase64String + FromBase64String convertto-securestring VerbosePreference.ToString - runtime.interopservices.marshal - VerbosePreference.ToString - -windowstyle h - -windowstyl h - -windowsty h - -windowst h - -windows h - -window h - -windo h - -wind h - -win h - -wi h - -w h - -wi h - -win hi - -win hid - -win hidd - -win hidde - -win hidden - -Nop - -Noni + runtime.interopservices.marshal + VerbosePreference.ToString + -windowstyle h + -windowstyl h + -windowsty h + -windowst h + -windows h + -window h + -windo h + -wind h + -win h + -wi h + -w h + -wi h + -win hi + -win hid + -win hidd + -win hidde + -win hidden + -Nop + -Noni -ec -en - ^c^o^m^S^p^E^c^ - C^om^S^pEc + ^c^o^m^S^p^E^c^ + C^om^S^pEc query.exe tracert.exe @@ -190,12 +190,12 @@ nltest.exe nltest.exe ExtExport - bash -c - bash.exe -c + bash -c + bash.exe -c cmdkey /list cmdkey.exe /list - certutil.exe -urlcache -split -f - certutil -urlcache -split -f + certutil.exe -urlcache -split -f + certutil -urlcache -split -f csc -out: csc.exe -out: csc -target:library @@ -210,9 +210,9 @@ expand.exe \\ extrac32 \\ extrac32.exe \\ - ieexec.exe http - ieexec http - diskshadow + ieexec.exe http + ieexec http + diskshadow advpack.dll,LaunchINFSection mshtml,RunHTMLApplication From 08099669c35328b2b6b035a00fcff805c2da38aa Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 15 Jul 2018 12:45:27 -0400 Subject: [PATCH 316/471] revert, ref: https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 0d65204f..50ec0128 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -562,7 +562,6 @@ net.exe time net time net1 time - gpscript.exe C:\Program Files\Windows Defender C:\Windows\System32\CompatTelRunner.exe From bac76c18533db43875c31f6cd00e51831baf73c3 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 16 Jul 2018 11:35:26 -0400 Subject: [PATCH 317/471] ignore chrome noise --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 50ec0128..9f1c2aa9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -825,6 +825,7 @@ C:\Windows\system32\cmd.exe /c UsrLogon.cmd C:\Program Files (x86)\MaaS360\Cloud Extender\EMSAgent.exe C:\Program Files\Octopus Deploy\Tentacle\Tentacle.exe + chrome.nativeMessaging.out From 1c3a63de8dbd7e0a627081c35d486b4ad44aab88 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 15 Jul 2018 00:27:45 -0400 Subject: [PATCH 318/471] Update alerts --- sysmonconfig-export.xml | 68 ++++++++++++++++++++--------------------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6d2c7cff..f19e75f9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -142,39 +142,39 @@ \at.exe \at.exe System.Management.Automation - net user /add - net localgroup administrators /add + net user /add + net localgroup administrators /add - wmiprvse.exe + wmiprvse.exe - FromBase64String + FromBase64String convertto-securestring VerbosePreference.ToString - runtime.interopservices.marshal - VerbosePreference.ToString - -windowstyle h - -windowstyl h - -windowsty h - -windowst h - -windows h - -window h - -windo h - -wind h - -win h - -wi h - -w h - -wi h - -win hi - -win hid - -win hidd - -win hidde - -win hidden - -Nop - -Noni + runtime.interopservices.marshal + VerbosePreference.ToString + -windowstyle h + -windowstyl h + -windowsty h + -windowst h + -windows h + -window h + -windo h + -wind h + -win h + -wi h + -w h + -wi h + -win hi + -win hid + -win hidd + -win hidde + -win hidden + -Nop + -Noni -ec -en - ^c^o^m^S^p^E^c^ - C^om^S^pEc + ^c^o^m^S^p^E^c^ + C^om^S^pEc query.exe tracert.exe @@ -190,12 +190,12 @@ nltest.exe nltest.exe ExtExport - bash -c - bash.exe -c + bash -c + bash.exe -c cmdkey /list cmdkey.exe /list - certutil.exe -urlcache -split -f - certutil -urlcache -split -f + certutil.exe -urlcache -split -f + certutil -urlcache -split -f csc -out: csc.exe -out: csc -target:library @@ -210,9 +210,9 @@ expand.exe \\ extrac32 \\ extrac32.exe \\ - ieexec.exe http - ieexec http - diskshadow + ieexec.exe http + ieexec http + diskshadow advpack.dll,LaunchINFSection mshtml,RunHTMLApplication From fe5d06e82a26c99561ac629a98b49dfd44e53c21 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Sun, 15 Jul 2018 12:45:27 -0400 Subject: [PATCH 319/471] revert, ref: https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f19e75f9..bdeb421b 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -562,7 +562,6 @@ net.exe time net time net1 time - gpscript.exe C:\Program Files\Windows Defender C:\Windows\System32\CompatTelRunner.exe From 1a9a4ba722902ef09c9d09826e792c5da4a45f38 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 16 Jul 2018 11:35:26 -0400 Subject: [PATCH 320/471] ignore chrome noise --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index bdeb421b..06ef07c7 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -882,6 +882,7 @@ C:\Windows\system32\cmd.exe /c UsrLogon.cmd C:\Program Files (x86)\MaaS360\Cloud Extender\EMSAgent.exe C:\Program Files\Octopus Deploy\Tentacle\Tentacle.exe + chrome.nativeMessaging.out From 093e84a4c873b586a334112cdbbaccabd2ff64ad Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 17 Jul 2018 12:38:46 -0400 Subject: [PATCH 321/471] Detect Remote Desktop Shadow connection --- sysmonconfig-export.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 06ef07c7..14e52540 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -146,6 +146,8 @@ net localgroup administrators /add wmiprvse.exe + /shadow + /noConsentPrompt FromBase64String convertto-securestring From f1922b45c4487d350792b3afef21887cf561d9f8 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 17 Jul 2018 21:15:25 -0400 Subject: [PATCH 322/471] add MitreRef=T1050,Technique=New Service,Tactic=Persistence/Privilege Escalation,Alert=Service added via Command Line --- sysmonconfig-export.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 14e52540..821bc525 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -144,6 +144,9 @@ System.Management.Automation net user /add net localgroup administrators /add + sc create + sc.exe create + new-service wmiprvse.exe /shadow From a677e63f6280a9b2736005895f003b8f5084b6ac Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 17 Jul 2018 21:46:59 -0400 Subject: [PATCH 323/471] add detection for Cobalt Strike's payload using netsh.exe helper DLLs --- sysmonconfig-export.xml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 821bc525..d0ad4f0c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -176,6 +176,7 @@ -win hidden -Nop -Noni + -encodedc -ec -en ^c^o^m^S^p^E^c^ @@ -1305,6 +1306,8 @@ C:\windows\system32\fxsst.dll C:\Windows\System32\wbem\oci.dll \Temp\ + NetshHelperBeacon + netsh.exe Valid @@ -2376,7 +2379,7 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders - HKLM\SOFTWARE\Microsoft\Netsh + HKLM\SOFTWARE\Microsoft\Netsh HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers From 9c263c7ed11079e01eb4f92eb368c46b42fb9c2f Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 17 Jul 2018 21:59:23 -0400 Subject: [PATCH 324/471] add "MitreRef=T1099,Technique=Timestomp,Tactic=Defense Evasion,Alert=Timestomp/File creation time retroactively changed!" --- sysmonconfig-export.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index d0ad4f0c..af46d3b4 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -896,9 +896,9 @@ - C:\Users - C:\ProgramData - \Temp\ + C:\Users + C:\ProgramData + \Temp\ From b788031f6bac896c280bf444eda3594cce6e7ead Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 17 Jul 2018 22:12:04 -0400 Subject: [PATCH 325/471] Enable Alerting on more autoruns, and add MitreRef=T1209,Technique=Time Provider Keys,Tactic=Persistence --- sysmonconfig-export.xml | 33 +++++++++++++++++---------------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index af46d3b4..8a96dba8 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -2286,6 +2286,7 @@ \ImagePath \Start HKLM\SYSTEM\Setup\CmdLine + HKLM\System\CurrentControlSet\Services\W32Time\TimeProviders\ Session Manager\KnownDlls HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors HKLM\SYSTEM\CurrentControlSet\Control\Print\Providers @@ -2296,22 +2297,22 @@ HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages HKLM\HARDWARE\ACPI\DSDT - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet - HKLM\System\CurrentControlSet\Control\Session Manager\Execute - HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute - HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute - HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath - HKLM\Software\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLU\Software\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell - UserInitMprLogonScript + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet + HKLM\System\CurrentControlSet\Control\Session Manager\Execute + HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute + HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath + HKLM\Software\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLU\Software\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + UserInitMprLogonScript \CurrentVersion\Font Drivers Active Setup\Installed Components Windows CE Services\AutoStartOnConnect From c40e20d0df167aa981f7cfaba1b8d21a1f9e8bee Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 13 Aug 2018 09:08:37 -0400 Subject: [PATCH 326/471] update installers --- Auto_Update.bat | 2 +- Install Sysmon.bat | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Auto_Update.bat b/Auto_Update.bat index 39d3b0cc..c7fe1299 100644 --- a/Auto_Update.bat +++ b/Auto_Update.bat @@ -1,5 +1,5 @@ @echo on cd C:\ProgramData\sysmon\ -@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://smartsync.omegapa.com/1/files/share/44/dev/omega-sysmon/sysmonconfig-export.xml/a0e2616fc58e1c','C:\ProgramData\sysmon\sysmonconfig-export.xml')" sysmon64 -c sysmonconfig-export.xml exit diff --git a/Install Sysmon.bat b/Install Sysmon.bat index 5c0a7572..74e16906 100644 --- a/Install Sysmon.bat +++ b/Install Sysmon.bat @@ -17,7 +17,7 @@ pushd "C:\ProgramData\sysmon\" echo [+] Downloading Sysmon... @powershell (new-object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon64.exe','C:\ProgramData\sysmon\sysmon64.exe')" echo [+] Downloading Sysmon config... -@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://smartsync.omegapa.com/1/files/share/44/dev/omega-sysmon/sysmonconfig-export.xml/a0e2616fc58e1c','C:\ProgramData\sysmon\sysmonconfig-export.xml')" @powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/Auto_Update.bat','C:\ProgramData\sysmon\Auto_Update.bat')" sysmon64.exe -accepteula -i sysmonconfig-export.xml sc failure Sysmon64 actions= restart/10000/restart/10000// reset= 120 From 0b33e076e77b61b2f65c9572cd0f82336258ec89 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 13 Aug 2018 09:12:52 -0400 Subject: [PATCH 327/471] remove space --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 8a96dba8..463a4c1a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -2982,7 +2982,6 @@ - From 75d53da3c9ece1171662c58f81fe6eafcc7f476e Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 15 Aug 2018 09:51:26 -0400 Subject: [PATCH 328/471] Push updates from @olafhartong for pipe events --- sysmonconfig-export.xml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 463a4c1a..1de16e03 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -2815,6 +2815,23 @@ + + \isapi_http + \isapi_dg + \isapi_dg2 + \isapi_http + \sdlrpc + \ahexec + \winsession + \lsassw + \46a676ab7f179e511e30dd2dc41bd388 + \9f81f59bc58452127884ce513865ed20 + \e710f28d59aa529d6792ca6ff0ca1b34 + \rpchlp_3 + \NamePipe_MoreWindows + \pcheap_reuse + \ + From d2f9872869faaf818acacb29cbfd7bbecc2f16d3 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 21 Aug 2018 01:41:02 -0400 Subject: [PATCH 329/471] Big update/alerting/cleanup etc --- sysmonconfig-export.xml | 716 ++++++++++++++++++++++++---------------- 1 file changed, 425 insertions(+), 291 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1de16e03..cccf84fa 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -15,7 +15,7 @@ - md5,sha256 + md5,imphash,sha256 @@ -36,69 +36,71 @@ unknown process unknown process regsvr32.exe - bitsadmin.exe + bitsadmin.exe eventvwr.exe fodhelper.exe - InstallUtil.exe - /logfile= /LogToConsole=false /U - MSBuild.exe - regsvcs.exe - regasm.exe - SyncAppvPublishingServer.exe - \control.exe - control.exe /name - rundll32.exe shell32.dll,Control_RunDLL - mshta.exe + InstallUtil.exe + /logfile= /LogToConsole=false /U + MSBuild.exe + regsvcs.exe + regasm.exe + SyncAppvPublishingServer.exe + \control.exe + control.exe /name + rundll32.exe shell32.dll,Control_RunDLL + mshta.exe wevutil.exe - wevutil cl + wevutil cl - net user - net user - net.exe user - net.exe user - net1.exe user - net1.exe user - net localgroup - net localgroup - net.exe localgroup - net.exe localgroup - net1 localgroup - net1 localgroup - net group - net group - net group - net group - net.exe group - net.exe group - net group - net group - net.exe group - net.exe group - net1.exe group - net1.exe group - dsquery.exe - whoami.exe + net user + net user + net.exe user + net.exe user + net1 user + net1 user + net1.exe user + net1.exe user + net localgroup + net localgroup + net.exe localgroup + net.exe localgroup + net1 localgroup + net1 localgroup + net group + net group + net group + net group + net.exe group + net.exe group + net group + net group + net.exe group + net.exe group + net1.exe group + net1.exe group + dsadd + dsmod + dsquery.exe + dsmod.exe + dsadd.exe + whoami.exe ipconfig.exe - tasklist.exe - sysinfo.exe - netstat.exe - qprocess.exe - \net.exe - \net1.exe - quser.exe - \route.exe - \reg.exe - netsh.exe + tasklist.exe + sysinfo.exe + netstat.exe + qprocess.exe + quser.exe + \route.exe + reg query + reg.exe query + netsh.exe - COMSPEC - COMSPEC - \cmd.exe - \cmd.exe - powershell.exe - powershell.exe - powershell.exe + COMSPEC + COMSPEC powershell.exe -Version - powershell -Version + powershell + powershell + powershell -Version iex Invoke-Expression iwr @@ -109,23 +111,20 @@ System.Net.WebRequest System.Net.SecurityProtocolType Shellcode - bash.exe - bash.exe - psexesvc.exe - Execute processes remotely - psexec.exe - Execute processes remotely - pskill.exe - forfiles.exe - forfiles.exe + bash.exe + bash.exe + psexesvc.exe + Execute processes remotely + psexec.exe + Execute processes remotely + pskill.exe + forfiles.exe + forfiles.exe pcalua.exe pcalua.exe - bash.exe - bash.exe - bash.exe - wsmprovhost.exe - wsmprovhost.exe - winrm.cmd + wsmprovhost.exe + wsmprovhost.exe + winrm.cmd sethc.exe utilman.exe @@ -134,27 +133,27 @@ DisplaySwitch.exe Narrator.exe AtBroker.exe - sdbinst.exe - schtasks.exe - schtasks.exe - schtasks /create - schtasks.exe /create - \at.exe - \at.exe - System.Management.Automation - net user /add - net localgroup administrators /add - sc create - sc.exe create - new-service + sdbinst.exe + schtasks.exe + schtasks.exe + schtasks /create + schtasks.exe /create + \at.exe + \at.exe + System.Management.Automation + net user /add + net localgroup administrators /add + sc create + sc.exe create + new-service wmiprvse.exe - /shadow - /noConsentPrompt + /shadow + /noConsentPrompt FromBase64String - convertto-securestring - VerbosePreference.ToString + convertto-securestring + VerbosePreference.ToString runtime.interopservices.marshal VerbosePreference.ToString -windowstyle h @@ -182,27 +181,27 @@ ^c^o^m^S^p^E^c^ C^om^S^pEc - query.exe - tracert.exe - tree.com - runas.exe - taskkill.exe - klist.exe - hh.exe - odbcconf.exe - pcalua.exe - attrib.exe - cmdkey.exe - nltest.exe - nltest.exe - ExtExport + query.exe + tracert.exe + tree.com + runas.exe + taskkill.exe + klist.exe + hh.exe + odbcconf.exe + pcalua.exe + attrib.exe + cmdkey.exe + nltest.exe + nltest.exe + ExtExport bash -c bash.exe -c - cmdkey /list - cmdkey.exe /list + cmdkey /list + cmdkey.exe /list certutil.exe -urlcache -split -f certutil -urlcache -split -f - csc -out: + csc -out: csc.exe -out: csc -target:library csc.exe -target:library @@ -280,7 +279,7 @@ 2> < - > + > ^ @@ -301,17 +300,17 @@ pssh sdelete shareenum - sekurlsa - reg SAVE + sekurlsa + reg SAVE Invoke-DllInjection Invoke-Shellcode Invoke-WmiCommand - Get-GPPPassword + Get-GPPPassword Get-Keystrokes Get-TimedScreenshot - Get-VaultCredential + Get-VaultCredential Invoke-CredentialInjection - mimikatz + mimikatz Invoke-NinjaCopy Invoke-TokenManipulation Out-Minidump @@ -353,7 +352,7 @@ Invoke-PowerShellWMI Add-Exfiltration Add-Persistence - Do-Exfiltration + Do-Exfiltration Start-CaptureServer Invoke-DllInjection Invoke-ReflectivePEInjection @@ -389,25 +388,33 @@ Install-SSP Invoke-BackdoorLNK PowerBreach - Get-GPPPassword + Get-GPPPassword Get-SiteListPassword Get-System BypassUAC Invoke-Tater - PowerUp + PowerUp PowerView Get-RickAstley Find-Fruit HTTP-Login Find-TrustedDocuments Invoke-Paranoia - Invoke-WinEnum + Invoke-WinEnum Invoke-ARPScan Invoke-ReverseDNSLookup smbscanner Invoke-FruityC2 Invoke-Stager process call create + call set priority + call terminate + product get name + bios, get serialNumber + onboarddevice get + useraccount where name + nteventlog where filename + cleareventlog root\\default FilterToConsumerBinding root\\subscription @@ -418,9 +425,9 @@ Wmiclass WmiCl'+'as'+'s ntdsutil - mimiauth - Powersploit - Mimikittenz + mimiauth + Powersploit + Mimikittenz AdjustTokenPrivileges IMAGE_NT_OPTIONAL_HDR64_MAGIC @@ -453,7 +460,7 @@ ^h^t^t^p h"t"t"p - cscript.exe + script:http wscript.exe rundll32.exe notepad.exe @@ -464,11 +471,11 @@ psexe pskill psshutdown - psservice - PsPasswd + psservice + PsPasswd msbuild.exe - msiexec.exe - mstsc.exe + msiexec.exe + mstsc.exe telnet.exe SyncAppvPublishingServer.exe Mavinject.exe @@ -477,20 +484,20 @@ kitty.exe kitty_portable.exe psftp.exe - tftp.exe - wmic.exe + tftp.exe + wmic.exe nbtstat.exe - driverquery.exe + driverquery.exe infDefaultInstall.exe sc.exe auditpol.exe qwinsta.exe rwinsta.exe - curl.exe - wget.exe - www.exe - awk.exe - sed.exe + curl.exe + wget.exe + www.exe + awk.exe + sed.exe stratum+tcp coinhive @@ -538,6 +545,14 @@ netsh advfirewall firewall \ + DisableRealtimeMonitoring + --disable-http2 --disable-quic + 291ff87948e45914424cec9510c297da + 304772c80b157a916c7041f2f15939fb + 5E022694C0DBD1FBBC263D608E577949 + 71345b139166482acaa568ac8816c7bc + 1b60021baedc3f9201bcdb40e9b87f62 + c7c8d584758854bbe0d8e64ef53ae1a8 @@ -685,6 +700,9 @@ AcroRd32.exe" /CR AcroRd32.exe" --channel= + "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /o /eo /l /b /id + C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /o /eo /l /b /ac /id + "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /o /eo /l /b /id C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe @@ -922,35 +940,36 @@ C:\Users - \temp\ - $RECYCLE.BIN + \temp\ + $RECYCLE.BIN C:\ProgramData C:\Perflogs\ config\systemprofile\ \Windows\Fonts\ \Windows\IME\ - \Windows\addins\ + \Windows\addins\ chrome.exe iexplore.exe firefox.exe MicrosoftEdgeCP.exe MicrosoftEdge.exe explorer.exe - - unknown process + + unknown process - at.exe - certutil.exe - cmd.exe - cscript.exe - wscript.exewscript.exe + at.exe + schtasks.exe + certutil.exe + cmd.exe + cscript.exe + wscript.exewscript.exe rundll32.exe notepad.exe regsvr32.exe regsvcs.exe C:\Windows\system32\svchost.exe - mshta.exe - powershell.exe + mshta.exe + powershell.exe psexe pskill psshutdown @@ -959,49 +978,74 @@ java.exe msbuild.exe installutil.exe - msiexec.exe - reg.exe + msiexec.exe + reg.exe mstsc.exe - telnet.exe + telnet.exe SyncAppvPublishingServer.exe Mavinject.exe - ssh.exe - putty.exe - kitty.exe - kitty_portable.exe - psftp.exe - tftp.exe + ssh.exe + putty.exe + kitty.exe + kitty_portable.exe + psftp.exe + tftp.exe wmic.exe net.exe - nbtstat.exe + nbtstat.exe dsquery.exe driverquery.exe infDefaultInstall.exe - sc.exe + sc.exe auditpol.exe - qwinsta.exe + qwinsta.exe rwinsta.exe - tor.exe + tor.exe + 185.41.154.130 + 37.252.190.176 + 82.118.17.235 + 83.163.164.15 + 69.163.34.173 + 159.89.151.231 + 212.47.246.229 + 84.40.112.70 + 2.137.16.245 + 199.249.223.62 + 185.22.172.237 + 88.99.216.194 + 185.13.39.197 + 162.247.72.201 + 174.127.217.73 + - githubusercontent.com - github.com + githubusercontent.com + github.com - api.ipify.org - whatismyipaddress.com - edns.ip-api.com - checkip.dyndns.org - icanhazip.com - ifconfig.me - ifconfig.co - ipaddress.com - ipinfo.io - goo.gl - git.io - bit.ly - t.co - ow.ly - ip-api.com + api.ipify.org + whatismyipaddress.com + edns.ip-api.com + checkip.dyndns.org + icanhazip.com + ifconfig.me + ifconfig.co + ipaddress.com + ipinfo.io + ident.me + api.ip.sb + www.myexternalip.com + ip.anysrc.net + wtfismyip.com + myexternalip.com + api.ip.sb + ipecho.net + checkip.amazonaws.com + goo.gl + git.io + bit.ly + t.co + ow.ly + ip-api.com dlinkddns.com no-ip.com @@ -1109,71 +1153,71 @@ 5800 5900 - 1194 - 1701 - 1723 + 1194 + 1701 + 1723 1293 - 4500 + 4500 1080 8080 3128 - 9001 - 9030 - 4443 - 2448 - 8143 - 1777 - 1443 - 243 - 65535 - 13506 - 3360 - 200 - 198 - 49180 - 13507 - 3360 - 6625 - 4444 - 4438 - 1904 - 13505 - 13504 - 12102 - 9631 - 5445 - 2443 - 777 - 13394 - 13145 - 12103 - 5552 - 3939 - 3675 - 666 - 473 - 5649 - 4455 - 4433 - 1817 - 100 - 65520 - 1960 - 1515 - 743 - 700 - 14154 - 14103 - 14102 - 12322 - 10101 - 7210 - 4040 - 9943 + 9001 + 9030 + 4443 + 2448 + 8143 + 1777 + 1443 + 243 + 65535 + 13506 + 3360 + 200 + 198 + 49180 + 13507 + 3360 + 6625 + 4444 + 4438 + 1904 + 13505 + 13504 + 12102 + 9631 + 5445 + 2443 + 777 + 13394 + 13145 + 12103 + 5552 + 3939 + 3675 + 666 + 473 + 5649 + 4455 + 4433 + 1817 + 100 + 65520 + 1960 + 1515 + 743 + 700 + 14154 + 14103 + 14102 + 12322 + 10101 + 7210 + 4040 + 9943 - 7777 - 9943 - 666 + 7777 + 9943 + 666 @@ -1185,6 +1229,88 @@ C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeSubmission.exe C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeFrontendTransport.exe C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeDelivery.exe + + + + aps.windows.com + arc.msn.com + arc.msn.com.nsatc.net + atson.telemetry.microsoft.com + au.download.windowsupdate.com + b.akamaiedge.net + bing.com + cdn.onenote.net + client-office365-tas.msedge.net + config.edge.skype.com + csp.digicert.com + ctldl.windowsupdate.com + cy2.licensing.md.mp.microsoft.com.akadns.net + cy2.settings.data.microsoft.com.akadns.net + displaycatalog.mp.microsoft.com + download.windowsupdate.com + e3.delivery.dsp.mp.microsoft.com.nsatc.net + e-msedge.net + emdl.ws.microsoft.com + ettings-win.data.microsoft.com + fe2.update.microsoft.com + fe3.delivery.dsp.mp.microsoft.com.nsatc.net + fe3.delivery.mp.microsoft.com + g.akamaiedge.net + g.live.com + g.msn.com.nsatc.net + geo-prod.do.dsp.mp.microsoft.com + geo-prod.dodsp.mp.microsoft.com.nsatc.net + ile-service.weather.microsoft.com + ip5.afdorigin-prod-am02.afdogw.com + ipv4.login.msa.akadns6.net + licensing.mp.microsoft.com + m3p.wns.notify.windows.com.akadns.net + modern.watson.data.microsoft.com.akadns.net + msn.com.nsatc.net + ocation-inference-westus.cloudapp.net + ocos-office365-s2s.msedge.net + ocsp.digicert.com + odern.watson.data.microsoft.com.akadns.net + oneclient.sfx.ms + pv4.login.msa.akadns6.net + query.prod.cms.rt.microsoft.com + ris.api.iris.microsoft.com + ris.api.iris.microsoft.com.akadns.net + s-msedge.net + settings.data.microsoft.com + sfe.trafficshaping.dsp.mp.microsoft.com + sls.update.microsoft.com + storecatalogrevocation.storequality.microsoft.com + storeedgefd.dsx.mp.microsoft.com + telecommand.telemetry.microsoft.com.akadns.net + tile-service.weather.microsoft.com + tlu.dl.delivery.mp.microsoft.com + tsfe.trafficshaping.dsp.mp.microsoft.com + vip5.afdorigin-prod-am02.afdogw.com + vip5.afdorigin-prod-ch02.afdogw.com + windowsupdate.com + y2.displaycatalog.md.mp.microsoft.com.akadns.net + y2.licensing.md.mp.microsoft.com.akadns.net + y2.settings.data.microsoft.com.akadns.net + msedge.net + windows.net + msn.com + virtualearth.net + bingforbusiness.com + outlook.com + lync.com + cloudapp.net + microsoft.com + ec2-34-204-73-148.compute-1.amazonaws.com + ec2-52-201-35-219.compute-1.amazonaws.com + ec2-34-230-137-236.compute-1.amazonaws.com + ec2-52-45-9-47.compute-1.amazonaws.com + ec2-52-71-74-246.compute-1.amazonaws.com + ec2-54-89-54-171.compute-1.amazonaws.com + eset.com + n-able.com + www.agentexchange.com + map2.hwcdn.net C:\Windows\SysWOW64\SearchProtocolHost.exe true OneDrive.exe @@ -1222,16 +1348,33 @@ 5357 3544 3702 + 3702 50646 - C:\Program Files (x86)\SmartGit\jre\bin\java.exe - C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe + 53 + 53 + 67 + 67 + 1812 + 1812 + 49154 + 49154 + 59241 + 59241 + 52176 + 52176 + 49209 + 49209 + 6007 + 6007 + C:\Program Files (x86)\SmartGit\jre\bin\java.exe + C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe penv\Scripts\python.exe efolder01 2080 g2mcomm.exe - C:\Program Files (x86)\LabTech Client\LTClient.exe - C:\Windows\LTSvc\LTSVC.exe - C:\Program Files (x86)\Webroot\WRSA.exe + C:\Program Files (x86)\LabTech Client\LTClient.exe + C:\Windows\LTSvc\LTSVC.exe + C:\Program Files (x86)\Webroot\WRSA.exe C:\Program Files (x86)\SmartGit\ DSPro\Programs\pr001Celery98.exe g2ax_comm_expert.exe @@ -1308,6 +1451,7 @@ \Temp\ NetshHelperBeacon netsh.exe + rmnsoft.dll Valid @@ -1399,7 +1543,7 @@ - LoadLibrary + LoadLibrary \ @@ -1461,7 +1605,6 @@ PROCESS_VM_WRITE (0x0020) PROCESS_VM_READ (0x0010) PROCESS_VM_OPERATION (0x0008) - 0x1410 (potential memory read) is common activity. E.g. by taskmgr.exe. We only want to capture this against lsass.exe and winlogon.exe, but this logic is in the subscription. --> 0x40 @@ -1472,7 +1615,6 @@ 0x3200 0x101400 0x101001 - C:\Windows\sysWOW64\wbem\wmiprvse.exe C:\ProgramData\Microsoft\Windows Defender\platform\ @@ -1654,11 +1796,7 @@ help_decrypt help_restore .CRAB - cerber - _decrypt - -decrypt - decrypt- - decrypt_ + .cerber help_decrypt help_restore_files HELP_YOUR_FILES @@ -1773,7 +1911,7 @@ wowwhereismyfiles decryptional wowreadfordecryp - HERMES + .HERMES _DECRYPT_INFO_szesnl 000-IF-YOU-WANT-DEC-FILES .evillock @@ -1800,7 +1938,7 @@ WE-MUST-DEC-FILES powerfulldecrypt opensourcemail.org - contains(to_string($message.file_created), "READ_ME_TO_DECRYPT_YOU_INFORMA + READ_ME_TO_DECRYPT_YOU_INFORMA file0locked CryptoRansomware .VBRANSOM @@ -1824,7 +1962,7 @@ .firecrypt YOUR_FILES_ARE_DEAD .airacropencrypted! - mail.ru + @mail.ru WHERE-YOUR-FILES Whereisyourfiles india.com @@ -1858,7 +1996,6 @@ Important!.txt !_HOW_TO_RESTORE_ HOW_TO_RESTORE_FILES - _README_ HOWTO_RECOVER_FILES_ HELP_RESTORE_FILES_ ThxForYurTyme @@ -2026,7 +2163,6 @@ files_are_encrypted. decryptmyfiles help_instructions. - -recover- de_crypt_readme. !recover! recover}- @@ -2136,12 +2272,12 @@ .stubbin .berkshire - www.exe - ps.exe - nt.exe - doliohdyjkajd.dll - run2.exe - ping2.exe + \www.exe + \ps.exe + \nt.exe + \doliohdyjkajd.dll + \run2.exe + \ping2.exe .pem @@ -2160,7 +2296,7 @@ .sst .key - .mht + .mht .cpl .scr .manifest @@ -2250,14 +2386,12 @@ C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Bin\updateservice.exe \Runtime\1.0\NodeRunner.exe - - @@ -2278,7 +2412,7 @@ - \CurrentVersion\Run + \CurrentVersion\Run \Group Policy\Scripts \Windows\System\Scripts \Microsoft\System\Scripts @@ -2286,7 +2420,6 @@ \ImagePath \Start HKLM\SYSTEM\Setup\CmdLine - HKLM\System\CurrentControlSet\Services\W32Time\TimeProviders\ Session Manager\KnownDlls HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors HKLM\SYSTEM\CurrentControlSet\Control\Print\Providers @@ -2297,29 +2430,29 @@ HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages HKLM\HARDWARE\ACPI\DSDT - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet - HKLM\System\CurrentControlSet\Control\Session Manager\Execute - HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute - HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute - HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath - HKLM\Software\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLU\Software\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell - UserInitMprLogonScript + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet + HKLM\System\CurrentControlSet\Control\Session Manager\Execute + HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute + HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath + HKLM\Software\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLU\Software\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + UserInitMprLogonScript \CurrentVersion\Font Drivers Active Setup\Installed Components Windows CE Services\AutoStartOnConnect Windows CE Services\AutoStartOnDisconnect CurrentVersion\Windows\IconServiceLib Winlogon\AlternateShells\AvailableShells - Terminal Server\Wds\rdpwd\StartupPrograms + Terminal Server\Wds\rdpwd\StartupPrograms SafeBoot\AlternateShell Terminal Server\WinStations\RDP-Tcp\InitialProgram HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman @@ -2380,7 +2513,7 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders - HKLM\SOFTWARE\Microsoft\Netsh + HKLM\SOFTWARE\Microsoft\Netsh HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers @@ -2533,9 +2666,7 @@ HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic - - @@ -2569,6 +2700,7 @@ \CurrentVersion\Image File Execution Options \CurrentVersion\Shell Extensions\Cached \CurrentVersion\Shell Extensions\Approved + \PreviousPolicyAreas }\PreviousPolicyAreas \Control\WMI\Autologger\ HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start @@ -2741,12 +2873,6 @@ - - .default\prefs-1.js - \Mozilla\Firefox\Profiles\ - \Microsoft\Windows\INetCache\ - \Microsoft\Windows\Temporary Internet Files\Content.IE5 - Content.Outlook Downloads @@ -2801,6 +2927,16 @@ .cpl .scr .inf + 291ff87948e45914424cec9510c297da + 304772c80b157a916c7041f2f15939fb + 5E022694C0DBD1FBBC263D608E577949 + 88ce6c0affcdbdc82abe53957dddfa12 + + + .default\prefs-1.js + \Mozilla\Firefox\Profiles\ + \Microsoft\Windows\INetCache\ + \Microsoft\Windows\Temporary Internet Files\Content.IE5 @@ -2942,7 +3078,6 @@ c:\program files (x86)\sophos\sophos ssl vpn client\bin\openvpnserv.exe - C:\Windows\LTSvc\LTSVC.exe ScreenConnect.WindowsClient.exe ScreenConnect.ClientService.exe @@ -2961,7 +3096,6 @@ C:\Program Files (x86)\SmartGit\git\mingw32\bin\git.exe C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git.exe C:\Program Files (x86)\SmartGit\bin\smartgit.exe - Anonymous Pipe C:\Program Files (x86)\Fortinet\FortiClient\FortiESNAC.exe C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe C:\Program Files (x86)\Fortinet\FortiClient\FortiTray.exe From ba0d6d04f4a143f238f1f2b31f5e9cb9ef3168a2 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 21 Aug 2018 11:22:33 -0400 Subject: [PATCH 330/471] remove incorrect url not reflecting github changes --- Auto_Update.bat | 2 +- Install Sysmon.bat | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Auto_Update.bat b/Auto_Update.bat index c7fe1299..39d3b0cc 100644 --- a/Auto_Update.bat +++ b/Auto_Update.bat @@ -1,5 +1,5 @@ @echo on cd C:\ProgramData\sysmon\ -@powershell (new-object System.Net.WebClient).DownloadFile('https://smartsync.omegapa.com/1/files/share/44/dev/omega-sysmon/sysmonconfig-export.xml/a0e2616fc58e1c','C:\ProgramData\sysmon\sysmonconfig-export.xml')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" sysmon64 -c sysmonconfig-export.xml exit diff --git a/Install Sysmon.bat b/Install Sysmon.bat index 74e16906..5c0a7572 100644 --- a/Install Sysmon.bat +++ b/Install Sysmon.bat @@ -17,7 +17,7 @@ pushd "C:\ProgramData\sysmon\" echo [+] Downloading Sysmon... @powershell (new-object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon64.exe','C:\ProgramData\sysmon\sysmon64.exe')" echo [+] Downloading Sysmon config... -@powershell (new-object System.Net.WebClient).DownloadFile('https://smartsync.omegapa.com/1/files/share/44/dev/omega-sysmon/sysmonconfig-export.xml/a0e2616fc58e1c','C:\ProgramData\sysmon\sysmonconfig-export.xml')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" @powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/Auto_Update.bat','C:\ProgramData\sysmon\Auto_Update.bat')" sysmon64.exe -accepteula -i sysmonconfig-export.xml sc failure Sysmon64 actions= restart/10000/restart/10000// reset= 120 From 00fc760607969e9ba4654b6f1bd8472c41c22013 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 23 Aug 2018 23:19:14 -0400 Subject: [PATCH 331/471] updates --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index cccf84fa..184174c7 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -91,8 +91,8 @@ qprocess.exe quser.exe \route.exe - reg query - reg.exe query + reg query + reg.exe query netsh.exe COMSPEC From 5108626ea73c52b2fd2a886b78c070d4504c0ab7 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 30 Aug 2018 21:36:37 -0400 Subject: [PATCH 332/471] add some mitre references --- sysmonconfig-export.xml | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 184174c7..42b717ca 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -243,7 +243,8 @@ doskey.exe - Mavinject.exe + Mavinject.exe + /INJECTRUNNING CMSTP.exe certutil.exe -decode @@ -892,7 +893,7 @@ \sysmon\Auto_Update.bat ion-storm/sysmon-config - \netlogon\ + \netlogon\ \netlogon\ C:\PROGRA~2\SAAZOD\SAAZMSMACTL.EXE @@ -1142,14 +1143,14 @@ cryptmonero mineXMR - 80 - 443 + 80 + 443 3389 3540 - 22 - 23 - 25 - 139 + 22 + 23 + 25 + 139 5800 5900 @@ -2519,7 +2520,7 @@ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - EnableFirewall + EnableFirewall HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ @@ -2616,7 +2617,7 @@ HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange + C:\Windows\Prefetch + C:\Windows\System32\drivers \Start Menu \Startup \Programs\Startup \Content.Outlook\ \Downloads\ + $RECYCLE.BIN + \Microsoft\Office\Recent .dll .ocx .sys @@ -1738,6 +1742,10 @@ C:\Windows\SysWOW64\WindowsPowerShell C:\Windows\Tasks\ C:\Windows\System32\Tasks + C:\Windows\SysWow64\Tasks + C:\Windows\Minidump + Microsoft\Windows\WER\ + MEMORY.dmp C:\Windows\AppPatch\Custom .cmdline C:\Windows\System32\ @@ -2466,6 +2474,7 @@ \shell\install\command\ \shell\open\command\ \shell\open\ddeexec\ + SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ \InprocServer32\(Default) From 0cde79da36c28661903328bc40416d5ceb07aa4f Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 13 Dec 2018 19:17:46 -0500 Subject: [PATCH 334/471] merge in a few changes and cleanup --- sysmonconfig-export.xml | 57 +++++------------------------------------ 1 file changed, 7 insertions(+), 50 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index a1057a6b..cc152f31 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -800,56 +800,6 @@ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe - - - - C:\Windows\LTSvc\LTSVC.exe -sLTService - C:\Windows\LTSvc\LTSVC.exe - C:\Windows\LTSvc\ - find /i "Listening" - netstat -an - tasklist - nslookup - nbtstat.exe - dsquery - sc query - find /i "Listening" - netstat -an - tasklist - interface tcp show global - wmic path win32_operatingsystem get - sc queryex type= service - C:\Program Files (x86)\StorageCraft\ImageManager\ImageManager.exe - raw_agent_svc.exe - raw_agent_svc.exe - IscsidscInterface.exe - IscsidscInterface.exe - Add-PSSnapin Microsoft.SharePoint.PowerShell - find /i "Listening" - netstat -an - tasklist - wmic path win32_operatingsystem get - sc queryex type= service - C:\Program Files\StorageCraft\ImageManager\ImageManager.exe - Add-PSSnapin Microsoft.SharePoint.PowerShell - Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname - Get-WmiObject -Query 'SELECT LicensingType FROM Win32_TerminalServiceSetting').LicensingType - Get-WmiObject -Namespace Root\CimV2\TerminalServices - tasklist - vssadmin list writers - vssadmin list writers - net view \\localhost | find " Print - net view \\localhost | find " Disk - C:\Windows\system32\net1 Share - Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall\* | select-object displayname | format-table -autosize" | find /i "vss writer" | find /i "sql server"" - C:\Program Files (x86)\LabTech Client\LTClient.exe - C:\Windows\LTSvc\LTSvcMon.exe -sLTService - C:\Windows\LTSvc\LTSvcMon.exe - C:\Windows\LTSvc\LTTray.exe - Get-ItemProperty HKLM:\software\microsoft\windows\currentversion\uninstall - interface tcp show global - nslookup.exe - ScreenConnect.WindowsClient.exe C:\Program Files (x86)\SmartGit C:\Program Files (x86)\SmartGit @@ -1546,6 +1496,7 @@ LoadLibrary \ + 0B80 @@ -2311,6 +2262,7 @@ .manifest .inf HammerDrillStatus.dll + PSReadLine\ConsoleHost_history.txt @@ -2585,10 +2537,12 @@ DHCPDefaultGateway DhcpIPAddress DhcpNameserver + Nameserver Dhcpserver DhcpSubnetMask SubnetMask PersistentRoutes + }\Category \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR @@ -2687,8 +2641,11 @@ C:\Program Files (x86)\Microsoft Office\Office15\lync.exe C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe C:\Program Files\Windows Defender\MsMpEng.exe + \Microsoft\Exchange Server Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\ + HKLM\SOFTWARE\Microsoft\ExchangeServer\ + HKLM\CLUSTER\ExchangeActiveManager HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files- HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\User_Feed_Synchronization- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator From 0e4d97bdcc27cfb36aee167e73dd9671f9134bfc Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 13 Dec 2018 19:38:02 -0500 Subject: [PATCH 335/471] readme update regarding Sysmon 8.02 breaking changes. This config needs 8.00 --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index 5aea6230..a0bd94bf 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,9 @@ # Sysmon Threat Intelligence Configuration # See the develop Branch for more bleeding edge updates: https://github.com/ion-storm/sysmon-config/tree/develop +This config is based off of the OR logic in sysmon 8.00, sysmon 8.02 breaks this functionality, Mark Cook and Mark Russinovich will be +making some changes to allow my config to work in future sysmon releases. For now stay on 8.00, 8.02 has breaking changes. + This is a Microsoft Sysinternals Sysmon configuration file template with default high-quality event tracing. The file provided should function as a great starting point for system monitoring in a self-contained package. This configuration and results should give you a good idea of what's possible for Sysmon. From af223866d9b8a9c5ea45b5cdd6ce518320dbff3e Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 13 Dec 2018 21:40:07 -0500 Subject: [PATCH 336/471] optimizations, stay on 8.00 --- sysmonconfig-export.xml | 227 ++++++++++++++++++++++++---------------- 1 file changed, 139 insertions(+), 88 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index cc152f31..fa962810 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -35,22 +35,65 @@ unknown process unknown process - regsvr32.exe - bitsadmin.exe - eventvwr.exe - fodhelper.exe - InstallUtil.exe + regsvr32.exe + bitsadmin.exe + eventvwr.exe + fodhelper.exe + InstallUtil.exe /logfile= /LogToConsole=false /U - MSBuild.exe - regsvcs.exe - regasm.exe - SyncAppvPublishingServer.exe - \control.exe + MSBuild.exe + regsvcs.exe + regasm.exe + SyncAppvPublishingServer.exe + control.exe control.exe /name rundll32.exe shell32.dll,Control_RunDLL - mshta.exe - wevutil.exe + mshta.exe + mshta.exe + wevutil.exe wevutil cl + C:\Windows\Fonts\ + C:\Windows\Fonts\ + \htdocs\ + C:\Windows\Media\ + C:\Users\Public\ + C:\Windows\system32\config\systemprofile\ + C:\Windows\addins\ + C:\Windows\Debug\ + C:\Users\NetworkService\ + C:\PerfLogs\ + C:\Users\Default\ + C:\Windows\Help\ + C:\Intel\Logs\ + C:\Windows\repair\ + C:\$Recycle.bin\ + C:\Windows\security\ + \wwwroot\ + \htdocs\ + C:\Windows\Media\ + C:\Windows\addins\ + C:\ProgramData + C:\Windows\system32\config\systemprofile\ + C:\Users\NetworkService\ + C:\Windows\Debug\ + C:\Temp + C:\Windows\Temp + C:\PerfLogs\ + C:\Users\Default\ + C:\Windows\Help\ + C:\Intel\Logs\ + C:\Windows\repair\ + C:\$Recycle.bin\ + C:\Users\Public\ + C:\Windows\security\ + C:\Users + C:\Windows\Fonts\ + \wwwroot\ + MpCmdRun.exe + PsKill.exe + DisableIOAVProtection + RemoveDefinitions + Add-MpPreference net user net user @@ -80,23 +123,31 @@ net1.exe group dsadd dsmod - dsquery.exe - dsmod.exe - dsadd.exe - whoami.exe - ipconfig.exe - tasklist.exe - sysinfo.exe - netstat.exe - qprocess.exe - quser.exe - \route.exe + dsquery.exe + dsmod.exe + dsadd.exe + whoami.exe + ipconfig.exe + tasklist.exe + sysinfo.exe + netstat.exe + qprocess.exe + quser.exe + route.exe reg query reg.exe query - netsh.exe + netsh.exe + wscript.exe + pcalua.exe + cscript.exe + wscript.exe + pcalua.exe + cscript.exe COMSPEC COMSPEC + powershell.exe + powershell_ise.exe powershell.exe -Version powershell powershell @@ -111,35 +162,34 @@ System.Net.WebRequest System.Net.SecurityProtocolType Shellcode - bash.exe - bash.exe - psexesvc.exe + bash.exe + bash.exe + psexesvc.exe Execute processes remotely - psexec.exe + psexec.exe Execute processes remotely - pskill.exe - forfiles.exe - forfiles.exe - pcalua.exe - pcalua.exe - wsmprovhost.exe - wsmprovhost.exe + pskill.exe + forfiles.exe + forfiles.exe + pcalua.exe + wsmprovhost.exe + wsmprovhost.exe winrm.cmd - sethc.exe - utilman.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe - sdbinst.exe - schtasks.exe - schtasks.exe + sethc.exe + utilman.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe + sdbinst.exe + schtasks.exe + schtasks.exe schtasks /create schtasks.exe /create - \at.exe - \at.exe + at.exe + at.exe System.Management.Automation net user /add net localgroup administrators /add @@ -147,7 +197,7 @@ sc.exe create new-service - wmiprvse.exe + wmiprvse.exe /shadow /noConsentPrompt @@ -181,17 +231,17 @@ ^c^o^m^S^p^E^c^ C^om^S^pEc - query.exe - tracert.exe + query.exe + tracert.exe tree.com - runas.exe - taskkill.exe - klist.exe - hh.exe - odbcconf.exe - pcalua.exe - attrib.exe - cmdkey.exe + runas.exe + taskkill.exe + klist.exe + hh.exe + odbcconf.exe + pcalua.exe + attrib.exe + cmdkey.exe nltest.exe nltest.exe ExtExport @@ -239,43 +289,43 @@ format format assoc - \cls.exe - doskey.exe + cls.exe + doskey.exe - Mavinject.exe + Mavinject.exe /INJECTRUNNING - CMSTP.exe + CMSTP.exe certutil.exe -decode certutil -decode - acrobat.exe - acrord32.exe + acrobat.exe + acrord32.exe - chrome.exe - firefox.exe - iexplore.exe - MicrosoftEdgeCP.exe - MicrosoftEdge.exe - vivaldi.exe - waterfox.exe + chrome.exe + firefox.exe + iexplore.exe + MicrosoftEdgeCP.exe + MicrosoftEdge.exe + vivaldi.exe + waterfox.exe - java.exe - javaw.exe + java.exe + javaw.exe - word.exe - excel.exe - POWERPNT.exe - outlook.exe - visio.exe - msaccess.exe - lync.exe - skype.exe + word.exe + excel.exe + POWERPNT.exe + outlook.exe + visio.exe + msaccess.exe + lync.exe + skype.exe 2> @@ -429,6 +479,8 @@ mimiauth Powersploit Mimikittenz + -ma lsass.exe + ProcDump.exe AdjustTokenPrivileges IMAGE_NT_OPTIONAL_HDR64_MAGIC @@ -462,7 +514,6 @@ h"t"t"p script:http - wscript.exe rundll32.exe notepad.exe regsvr32.exe @@ -530,12 +581,12 @@ .com \temp\ C:\users - explorer.exe - control.exe - acrord32.exe - installutil.exe - \reg.exe - ipconfig.exe + explorer.exe + control.exe + acrord32.exe + installutil.exe + \reg.exe + ipconfig.exe \appdata\ \programdata\ \Users From 18b3b458c75fec66da60a9e24d3c6045783d83e8 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 13 Dec 2018 22:12:11 -0500 Subject: [PATCH 337/471] more optimizations --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index fa962810..95460ef3 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -242,7 +242,7 @@ pcalua.exe attrib.exe cmdkey.exe - nltest.exe + nltest.exe nltest.exe ExtExport bash -c @@ -289,7 +289,7 @@ format format assoc - cls.exe + cls.exe doskey.exe From 08ddc0c3ab6cb06a62e4d950bcef96178eeb49f9 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 25 Jan 2019 11:31:43 -0500 Subject: [PATCH 338/471] Update README.md --- README.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index a0bd94bf..49da7d39 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,7 @@ # Sysmon Threat Intelligence Configuration # See the develop Branch for more bleeding edge updates: https://github.com/ion-storm/sysmon-config/tree/develop -This config is based off of the OR logic in sysmon 8.00, sysmon 8.02 breaks this functionality, Mark Cook and Mark Russinovich will be -making some changes to allow my config to work in future sysmon releases. For now stay on 8.00, 8.02 has breaking changes. +This config is based off of the OR logic in sysmon 8.00 and 8.04, sysmon 8.02 breaks this functionality. Also 8.00 introduced a memory leak that will consume all available memory on your system if you frequently reload the config file. Upgrading to 8.04 is mandatory. This is a Microsoft Sysinternals Sysmon configuration file template with default high-quality event tracing. @@ -54,4 +53,4 @@ sc sdset Sysmon D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;B ### Graylog Configuration ### -(https://github.com/ion-storm/Graylog_Sysmon) \ No newline at end of file +(https://github.com/ion-storm/Graylog_Sysmon) From c7c362710dbd94b21f3b543011e3dd7903332e1a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 1 Sep 2022 17:19:45 -0400 Subject: [PATCH 339/471] Merge in Sysmon ATT&CK Changes Update to Sysmon v14 compatibility. --- sysmonconfig-export.xml | 8346 +++++++++++++++++++++++++-------------- 1 file changed, 5365 insertions(+), 2981 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 95460ef3..79fd3ea8 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1,1247 +1,2409 @@ + + md5,sha256,imphash + + + + + + + + + TEMP\nessus_;nessus_task_list + TEMP\nessus_;nessus_task_list + + + rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe + advanced_port_scanner.exe;rcpping.exe;nc.exe;nc64.exe;netcat.exe;ncat.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe + Network Scanner;Advanced IP Scanner + + + adfind + adfind + -gcb -sc;/gcb /sc;-f (objectcategory=;/f (objectcategory=;trustdmp + + + + + + + + + + - Fork version: 300 - Fork author: ionstorm - Fork project: https://github.com/ion-storm/sysmon-config - Fork license: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text. + + + + + /serverlevelplugindll + + + add;sslcert;http + + http del sslcert + + + - REQUIRED: Sysmon version 8.00 or higher, it's recommended you stay updated. ---> + + + + + + + + + + + + + + wmic.exe + process;call;create + + + wmic.exe + call set priority;call terminate;product get name;bios, get serialNumber;BIOS GET SERIALNUMBER;onboarddevice get;useraccount where name;useraccount get;path win32_networkadapter where index=;process list;useraccount get /ALL;useraccount list;qfe get description,installedOn /format:csv;process get caption,executablepath,commandline;service get name,displayname,pathname,startmode;share list;win32_share + + + + \cmd.exe;WindowsTerminal;powershell + explorer.exe + + + cmd.exe + powershell.exe;powershell_ise.exe + Get-ItemProperty HKLM:\software\wow6432node\microsoft\windows\currentversion\uninstall\ + mysql server + select-object displayversion,displayname + + + cscript.exe;wscript.exe + powershell.exe;powershell_ise.exe + + + cscript.exe;wscript.exe + powershell.exe;powershell_ise.exe + + + powershell.exe;powershell_ise.exe + mshta.exe + + + wscript.exe;cscript.exe + IEX;Net.WebClient;ospp.vbs;powershell;slmgr.vbs;spiceworks_upload + + + wscript.exe + .jse + .js + .vba + .vbe + + + cscript.exe + .js + .jse + .vba + .vbe + + + mshta vbscript:CreateObject("Wscript.Shell");mshta vbscript:Execute("Execute;mshta vbscript:CreateObject("Wscript.Shell").Run("mshta.exe;javascript:a= + .jpg;.png;.lnk;.xls;.doc;.zip;.sct;.hta + + + C:\Windows\Temp\hpqhvind.exe;C:\ProgramData\DRM\;Test.exe + C:\ProgramData\DRM;wmplayer.exe;C:\ProgramData\DRM\CLR\CLR.EXE + + + regedit.exe + explorer.exe + + + explorer.exe + + + svchost.exe;spoolsv.exe;taskhostw.exe;userinit.exe;smss.exe;csrss.exe;wininit.exe;winlogon.exe;lsass.exe;logonui.exe;services.exe + C:\windows\System32\;C:\windows\syswow64\ + wininit.exe;winlogon.exe;services.exe;dwm.exe;System;smss.exe;svchost.exe + + + \spoolsv.exe;\PrintIsolationHost.exe + C:\Windows\System32\spoolsv.exe;\GPLGS\gswin32c.exe;C:\Windows\System32\spool\drivers\;\bin\gswin64c.exe;C:\PROGRA~2\CUTEPD~1\;C:\Windows\EEFPrinter.exe + C:\Windows\system32\spool\DRIVERS + Brother Industries;Thomson Reuters + + COMSPEC + ScriptFile + AppData\Local\Temp\7z + AppData\Local\Temp\Temp1_ + \AppData\Local\Temp\Rar$ + + + powershell.exe;powershell_ise.exe + C:\users\ + Microsoft VS Code\Code.exe + \Deployment tool extract\setupodt.exe + + Shellcode + + ipy.exe + python.exe + + -agentpath: + -agentlib: + + + + + iexplore.exe;chrome.exe;firefox.exe;browser_broker.exe;vivaldi.exe;microsoftedge.exe;microsoftedgecp.exe;brave.exe;vivaldi.exe + tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe + apt-config + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe + tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe + .cmd;- + C:\Windows\system32\spool\DRIVERS\ + PhotoViewer.dll + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe + C:\Users\ + .exe + Zoom Video + Firefox + Microsoft Edge + Microsoft Teams + GrammarlyAddInSetupe + Teams.exe + Zoom.exe + browser_broker.exe + chrome.exe + edge.exe + firefox.exe + iexplore.exe + vivaldi.exe + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe + C:\ProgramData\ + Firefox + Microsoft Edge + Microsoft Teams + Zoom Video + + + acrobat.exe;acrord32.exe + tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe + + + apache;w3wp.exe;php-cgi.exe;nginx.exe;httpd.exe;tomcat;php.exe + arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe + + + cmd.exe + ping 127.0.0.1 + c:\windows\system32\inetsrv\ + + + sqlservr + arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe + + + winword.exe;powerpnt.exe;excel.exe + control.exe + input.dll + + + msdt.exe + msdt.exe + BrowseForFile=;PCWDiagnostic + /af;-af + + + msdt.exe + pcwrun.exe + PCWDiagnostic + /af;-af + + + msdt.exe + /cab;-cab + .diagcab + + + powershell.exe;pwsh.exe;cmd.exe;mshta.exe;cscript.exe;wscript.exe;wsl.exe;rundll32.exe;regsvr32.exe + msdt.exe + + EQNEDT32.EXE + + winword.exe;excel.exe;powerpnt.exe + FLTLDR.EXE + + + /dde;-dde + + + + schtasks.exe + /create;-create;/change;-change + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ + + taskeng.exe + + schtasks.exe + /Run;-run + Sentinel\AutoRepair + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ + + schtasks.exe + at.exe + at.exe + + C:\Windows\System32\svchost.exe + netsvcs;-p;-s;Schedule + netsvcs;-p;-s;Schedule + + + + + + net.exe;net1.exe;net2.exe + stop + tvsu_tmp + + + net.exe;net1.exe;net2.exe + start + tvsu_tmp + + + wmiprvse.exe;mmc.exe;explorer.exe;services.exe + &1;cmd.exe;\\127.0.0.1\;/Q /c + + + wmiprvse.exe;mmc.exe;explorer.exe;services.exe + &1;cmd.exe;\\127.0.0.1\;-Q -c + + + schtasks;Create;ONLOGON;TN;Updater;TR;powershell + + + sc.exe + create + \NIC_Emulex_Firmware\;C:\Windows\Temp\ExchangeSetup\ + + + cmd.exe;powershell.exe + services.exe + + new-service + psexesvc.exe + + Execute processes remotely + psexe + PsExec Service + PsExec Launched + + psexec.exe + pskill.exe + pskill - - - md5,imphash,sha256 - + + + && type + > + cmd.exe" /c cd + + + ntdsutil;/set {default} recoveryenabled no;telnet ;-dumpcr;putty;bash.exe;pssh;shareenum;sekurlsa;reg save;reg save;psscan;shellexec;vbscript:createobject;/output:clipboard;root\\default;root\\subscription;Wmiclass;WmiCl'+'as'+'s + + + ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy + ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy + + --disable-http2 --disable-quic + /Client/Login?id= + JABzA + + + 2f40abbb4f78e77745f0e657a19903fc953cc664;478dc5a5f934c62a9246f7d1fc275868f568bc07;37b4496e650b3994312c838435013560b3ca8571;37b4496e650b3994312c838435013560b3ca8571;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;807d86da63f0db1fc746d1f0b05bc357;849a2b0dc80aeca3d175c139efe5221c;86A4CAC227078B9C95C560C8F0370BF0;98908ce6f80ecc48628c8d2bf5b2a50c;a4b42c2c95d1f2ff12171a01c86cd64f;4abe604916c04fe3dd8b9cb3d501d3f;eac3e3ece94bc84e922ec077efb15edd;128CECC59C91C0D0574BC1075FE7CB40;88777aacd5f16599547926a4c9202862;0f49621b06f2cdaac8850c6e9581a594;17a36ac3e31f3a18936552aff2c80249;322cb39bc049aa69136925137906d855;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;3d129263f6a48647f103a04446fb0c2f;37cd353621b0f4fc6981b50071c94f01;1b60021baedc3f9201bcdb40e9b87f62;71345b139166482acaa568ac8816c7bc;5E022694C0DBD1FBBC263D608E577949;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc5733c013378fa418d13773f5bfe6f1;c579341f86f7e962719c7113943bb6e4;d326e629a90e78825645963b35e53a6a;5E022694C0DBD1FBBC263D608E577949;53841a0c6a3ff92976db08bfdf95e083;dc7e564809d6c2a2f3457c3c9b91f22b;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b;FE2CA1BE3BDA2A757036A89E54CC02DB;FE2CA1BE3BDA2A757036A89E54CC02DB + + 22d142f11cf2a30ea4953e1fffb0fa7e;2317d65da4639f4246de200650a70753;27612cb03c89158225ca201721ea1aad;412956675fbc3f8c51f438c1abc100eb;daf2da52475fd8981b19ec3c321a983c;490a140093b5870a47edc29f33542fd2;51a7068640af42c3a7c1b94f1c11ab9d;533340c54bd25256873b3dca34d7f74e;684eca6b62d69ce899a3ec3bb04d0a5b;69a19abf5ba56ee07cdd3425b07cf8bf;6cfd131fef548fcd60fbcdb59317df8e;72dc98449b45a7f1ccdef27d51e31e91;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;80c37e062aa4c94697f287352acf2e9d;815f1f8a7bc1e6f94cb5c416e381a110;a43d3b31575846fa4c3992b4143a06da;08e82dc7bae524884b7dc2134942aadb;7bcd736a2394fc49f3e27b3987cce640;57314359df11ffdf476f809671ec0275;b72737b464e50aa3664321e8e001ff32;ce8ce92fb6565181572dce00d69c24f8;5985087678414143d33ffc6e8863b887;84730a6e426fbd3cf6b821c59674c8a0;d5377dc1821c935302c065ad8432c0d2;d8f1356bebda9e77f480a6a60eab36bb;92f8e3f0f1f7cc49fad797a62a169acd;9003cfaac523e94d5479dc6a10575e60;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;c1e7850da5604e081b9647b58248d7e8;99828721ac1a0e32e4582c3f615d6e57;f559c87b4a14a4be1bd84df6553aaf56;b9c208ea8115232bfd9ec2c62f32d6b8;061089d8cb0ca58e660ce2e433a689b3;0e9afd3a870906ebf34a0b66d8b07435;9c115e9a81d25f9d88e7aaa4313d9a8f;520ee02668a1c7b7c262708e12b1ba6b;7bfba2c69bed6b160261bdbf2b826401;77a745b07d9c453650dd7f683b02b3ed;3a771efb7ba2cd0df247ab570e1408b2;0969b2b399a8d4cd2d751824d0d842b4;fc53f2cd780cd3a01a4299b8445f8511;4e39620afca6f60bb30e031ddc5a4330;bfe3f6a79cad5b9c642bb56f8037c43b;3dfebce4703f30eed713d795b90538b5;9793afcea43110610757bd3b800de517;36db24006e2b492cafb75f2663f241b2;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;649ef1dd4a5411d3afcf108d57ff87af;320b2f1d9551b5d1df4fb19bd9ab253a;3d75c72144d873b3c1c4977fbafe9184;b9cf4301b7b186a75e82a04e87b30fe4;b4e67706103c3b8ee148394ebee3f268;7bfbd72441e1f2ed48fbc0f33be00f24;cdb303f61a47720c7a8c5086e6b2a743;2a6f7ec77ab6bd4297e7b15ae06e2e61;8403a28e0bffa9cc085e7b662d0d5412;3ffd2915d285ad748202469d4a04e1f5;04078ef95a70a04e95bda06cc7bec3fa;235d427f94630575a4ea4bff180ecf5d;8035a8a143765551ca7db4bc5efb5dfd;cacaa3bf3b2801956318251db5e90f3c;1aadf739782afcae6d1c3e4d1f315cbd;c3e255888211d74cc6e3fb66b69bbffb;d9e9f22988d43d73d79db6ee178d70a4;16ab79fb2fd92db0b1f38bedb2f02ed8;8da15a97eaf69ff7ee184fc446f19cf1;ffc7305cb24c1955f9625e525d58aeee;c0e72eb4c9f897410c795c1b360090ef;9ad6fa6fdedb2df8055b3d30bd6f64f1;44619a88a6cff63523163c6a4cf375dd;a571660c9cf1696a2f4689b2007a12c7;81229c1e272218eeda14892fa8425883;0ac48cfa2ff8351365e99c1d26e082ad;afcdf79be1557326c854b6e20cb900a7 + a53a02b997935fd8eedcb5f7abab9b9f + e96a73c7bf33a464c510ede582318bf2 + serialfunc.exe + + e PAA;en PAA;enc PAA;enco PAA;encode PAA;encoded PAA;encodedco PAA;encodedcom PAA;encodedcomm PAA;encodedcomma PAA;encodedcomman PAA;encodedcommand PAA;e IAA;en IAA;enc IAA;enco IAA;encode IAA;encoded IAA;encodedco IAA;encodedcom IAA;encodedcomm IAA;encodedcomma IAA;encodedcomman IAA;encodedcommand IAA;e JAB;en JAB;enc JAB;enco JAB;encode JAB;encoded JAB;encodedco JAB;encodedcom JAB;encodedcomm JAB;encodedcomma JAB;encodedcomman JAB;encodedcommand JAB;e cwBFAFQA;en cwBFAFQA;enc cwBFAFQA;enco cwBFAFQA;encode cwBFAFQA;encoded cwBFAFQA;encodedco cwBFAFQA;encodedcom cwBFAFQA;encodedcomm cwBFAFQA;encodedcomma cwBFAFQA;encodedcomman cwBFAFQA;encodedcommand cwBFAFQA;e SQBFAF;en SQBFAF;enc SQBFAF;enco SQBFAF;encode SQBFAF;encoded SQBFAF;encodedco SQBFAF;encodedcom SQBFAF;encodedcomm SQBFAF;encodedcomma SQBFAF;encodedcomman SQBFAF;encodedcommand SQBFAF;e UwBFAFQA;en UwBFAFQA;enc UwBFAFQA;enco UwBFAFQA;encode UwBFAFQA;encoded UwBFAFQA;encodedco UwBFAFQA;encodedcom UwBFAFQA;encodedcomm UwBFAFQA;encodedcomma UwBFAFQA;encodedcomman UwBFAFQA;encodedcommand UwBFAFQA;e IABpAE4AdgBPAEsAZQAt;en IABpAE4AdgBPAEsAZQAt;enc IABpAE4AdgBPAEsAZQAt;enco IABpAE4AdgBPAEsAZQAt;encode IABpAE4AdgBPAEsAZQAt;encoded IABpAE4AdgBPAEsAZQAt;encodedco IABpAE4AdgBPAEsAZQAt;encodedcom IABpAE4AdgBPAEsAZQAt;encodedcomm IABpAE4AdgBPAEsAZQAt;encodedcomma IABpAE4AdgBPAEsAZQAt;encodedcomman IABpAE4AdgBPAEsAZQAt;encodedcommand IABpAE4AdgBPAEsAZQAt;e SQBmACgAJAB;en SQBmACgAJAB;enc SQBmACgAJAB;enco SQBmACgAJAB;encode SQBmACgAJAB;encoded SQBmACgAJAB;encodedco SQBmACgAJAB;encodedcom SQBmACgAJAB;encodedcomm SQBmACgAJAB;encodedcomma SQBmACgAJAB;encodedcomman SQBmACgAJAB;encodedcommand SQBmACgAJAB;e J;en J;enc J;enco J;encode J;encoded J;encodedco J;encodedcom J;encodedcomm J;encodedcomma J;encodedcomman J;encodedcommand J;e SUVY;en SUVY;enc SUVY;enco SUVY;encode SUVY;encoded SUVY;encodedco SUVY;encodedcom SUVY;encodedcomm SUVY;encodedcomma SUVY;encodedcomman SUVY;encodedcommand SUVY;e aWV4;en aWV4;enc aWV4;enco aWV4;encode aWV4;encoded aWV4;encodedco aWV4;encodedcom aWV4;encodedcomm aWV4;encodedcomma aWV4;encodedcomman aWV4;encodedcommand aWV4;e dmFy;en dmFy;enc dmFy;enco dmFy;encode dmFy;encoded dmFy;encodedco dmFy;encodedcom dmFy;encodedcomm dmFy;encodedcomma dmFy;encodedcomman dmFy;encodedcommand dmFy;e dgBhA;en dgBhA;enc dgBhA;enco dgBhA;encode dgBhA;encoded dgBhA;encodedco dgBhA;encodedcom dgBhA;encodedcomm dgBhA;encodedcomma dgBhA;encodedcomman dgBhA;encodedcommand dgBhA;e R2V0;en R2V0;enc R2V0;enco R2V0;encode R2V0;encoded R2V0;encodedco R2V0;encodedcom R2V0;encodedcomm R2V0;encodedcomma R2V0;encodedcomman R2V0;encodedcommand R2V0;e IAAgAH;en IAAgAH;enc IAAgAH;enco IAAgAH;encode IAAgAH;encoded IAAgAH;encodedco IAAgAH;encodedcom IAAgAH;encodedcomm IAAgAH;encodedcomma IAAgAH;encodedcomman IAAgAH;encodedcommand IAAgAH;e TVq;en TVq;enc TVq;enco TVq;encode TVq;encoded TVq;encodedco TVq;encodedcom TVq;encodedcomm TVq;encodedcomma TVq;encodedcomman TVq;encodedcommand TVq;e aQBIA;en aQBIA;enc aQBIA;enco aQBIA;encode aQBIA;encoded aQBIA;encodedco aQBIA;encodedcom aQBIA;encodedcomm aQBIA;encodedcomma aQBIA;encodedcomman aQBIA;encodedcommand aQBIA;e UEs;en UEs;enc UEs;enco UEs;encode UEs;encoded UEs;encodedco UEs;encodedcom UEs;encodedcomm UEs;encodedcomma UEs;encodedcomman UEs;encodedcommand UEs;e H4s;en H4s;enc H4s;enco H4s;encode H4s;encoded H4s;encodedco H4s;encodedcom H4s;encodedcomm H4s;encodedcomma H4s;encodedcomman H4s;encodedcommand H4s;e dXNpbm;en dXNpbm;enc dXNpbm;enco dXNpbm;encode dXNpbm;encoded dXNpbm;encodedco dXNpbm;encodedcom dXNpbm;encodedcomm dXNpbm;encodedcomma dXNpbm;encodedcomman dXNpbm;encodedcommand dXNpbm;e cwBhA;en cwBhA;enc cwBhA;enco cwBhA;encode cwBhA;encoded cwBhA;encodedco cwBhA;encodedcom cwBhA;encodedcomm cwBhA;encodedcomma cwBhA;encodedcomman cwBhA;encodedcommand cwBhA;JABzA + + + FromBase64String + JAB;SUVY;aWV4;dmFy;dgBhA;R2V0;SQBFAF;TVq;aQBIA;UEs;H4s;dXNpbm;cwBhA + + + /v Word experienced;/v Excel experienced;-v Word experienced;-v Excel experienced + + + JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ;QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA;kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA;IgAoACcAKgAnACkAOwAkA;IAKAAnACoAJwApADsAJA;iACgAJwAqACcAKQA7ACQA + + + e^;^en^;^nc + + + ^ + + + ..\;\.. + + + \cmd.exe /c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe /c del "C:\Users\*\Desktop\*.exe;\cmd.exe -c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe -c del "C:\Users\*\Desktop\*.exe + + ping.exe -n 6 127.0.0.1 &ping.exe /n 6 127.0.0.1 & type + System.Net.Networkinformation.ping + + mofcomp.exe - - - + + + + net.exe;net1.exe;net2.exe + user;group;localgroup + remove;delete;active;del + tvsu_tmp + + + + + + + + + net.exe;net1.exe;net2.exe + user + add + tvsu_tmp + + dsmod.exe + dsadd.exe + + + + + + + + + + + + - - - - - - - - unknown process - unknown process - regsvr32.exe - bitsadmin.exe - eventvwr.exe - fodhelper.exe - InstallUtil.exe - /logfile= /LogToConsole=false /U - MSBuild.exe - regsvcs.exe - regasm.exe - SyncAppvPublishingServer.exe - control.exe - control.exe /name - rundll32.exe shell32.dll,Control_RunDLL - mshta.exe - mshta.exe - wevutil.exe - wevutil cl - C:\Windows\Fonts\ - C:\Windows\Fonts\ - \htdocs\ - C:\Windows\Media\ - C:\Users\Public\ - C:\Windows\system32\config\systemprofile\ - C:\Windows\addins\ - C:\Windows\Debug\ - C:\Users\NetworkService\ - C:\PerfLogs\ - C:\Users\Default\ - C:\Windows\Help\ - C:\Intel\Logs\ - C:\Windows\repair\ - C:\$Recycle.bin\ - C:\Windows\security\ - \wwwroot\ - \htdocs\ - C:\Windows\Media\ - C:\Windows\addins\ - C:\ProgramData - C:\Windows\system32\config\systemprofile\ - C:\Users\NetworkService\ - C:\Windows\Debug\ - C:\Temp - C:\Windows\Temp - C:\PerfLogs\ - C:\Users\Default\ - C:\Windows\Help\ - C:\Intel\Logs\ - C:\Windows\repair\ - C:\$Recycle.bin\ - C:\Users\Public\ - C:\Windows\security\ - C:\Users - C:\Windows\Fonts\ - \wwwroot\ - MpCmdRun.exe - PsKill.exe - DisableIOAVProtection - RemoveDefinitions - Add-MpPreference - - net user - net user - net.exe user - net.exe user - net1 user - net1 user - net1.exe user - net1.exe user - net localgroup - net localgroup - net.exe localgroup - net.exe localgroup - net1 localgroup - net1 localgroup - net group - net group - net group - net group - net.exe group - net.exe group - net group - net group - net.exe group - net.exe group - net1.exe group - net1.exe group - dsadd - dsmod - dsquery.exe - dsmod.exe - dsadd.exe - whoami.exe - ipconfig.exe - tasklist.exe - sysinfo.exe - netstat.exe - qprocess.exe - quser.exe - route.exe - reg query - reg.exe query - netsh.exe - - wscript.exe - pcalua.exe - cscript.exe - wscript.exe - pcalua.exe - cscript.exe - COMSPEC - COMSPEC - powershell.exe - powershell_ise.exe - powershell.exe -Version - powershell - powershell - powershell -Version - iex - Invoke-Expression - iwr - Invoke-WebRequest - DownloadFile - DownloadString - Net.WebClient - System.Net.WebRequest - System.Net.SecurityProtocolType - Shellcode - bash.exe - bash.exe - psexesvc.exe - Execute processes remotely - psexec.exe - Execute processes remotely - pskill.exe - forfiles.exe - forfiles.exe - pcalua.exe - wsmprovhost.exe - wsmprovhost.exe - winrm.cmd - - sethc.exe - utilman.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe - sdbinst.exe - schtasks.exe - schtasks.exe - schtasks /create - schtasks.exe /create - at.exe - at.exe - System.Management.Automation - net user /add - net localgroup administrators /add - sc create - sc.exe create - new-service - - wmiprvse.exe - /shadow - /noConsentPrompt - - FromBase64String - convertto-securestring - VerbosePreference.ToString - runtime.interopservices.marshal - VerbosePreference.ToString - -windowstyle h - -windowstyl h - -windowsty h - -windowst h - -windows h - -window h - -windo h - -wind h - -win h - -wi h - -w h - -wi h - -win hi - -win hid - -win hidd - -win hidde - -win hidden - -Nop - -Noni - -encodedc - -ec - -en - ^c^o^m^S^p^E^c^ - C^om^S^pEc - - query.exe - tracert.exe - tree.com - runas.exe - taskkill.exe - klist.exe - hh.exe - odbcconf.exe - pcalua.exe - attrib.exe - cmdkey.exe - nltest.exe - nltest.exe - ExtExport - bash -c - bash.exe -c - cmdkey /list - cmdkey.exe /list - certutil.exe -urlcache -split -f - certutil -urlcache -split -f - csc -out: - csc.exe -out: - csc -target:library - csc.exe -target:library - cmdkey /list - cmd.exe /k - cmstp.exe /ni /s - cmstp /ni /s - esentutl.exe /y \\ - esentutl /y \\ - expand \\ - expand.exe \\ - extrac32 \\ - extrac32.exe \\ - ieexec.exe http - ieexec http - diskshadow - - advpack.dll,LaunchINFSection - mshtml,RunHTMLApplication - /s /n /u /i:http: - mshtml,RunHTMLApplication - bginfo.bgi /popup /nolicprompt - set - setx - pushd - popd - subst - ren - move - md - del - rd - expand - find.exe - format - format - assoc - cls.exe - doskey.exe - - - Mavinject.exe - /INJECTRUNNING - CMSTP.exe - - certutil.exe -decode - certutil -decode - - - acrobat.exe - acrord32.exe - - - chrome.exe - firefox.exe - iexplore.exe - MicrosoftEdgeCP.exe - MicrosoftEdge.exe - vivaldi.exe - waterfox.exe - - - java.exe - javaw.exe - - - word.exe - excel.exe - POWERPNT.exe - outlook.exe - visio.exe - msaccess.exe - lync.exe - skype.exe - + + + cmd.exe + echo;\pipe\;> + + + cmd.exe + /c;copy;dll;\\;admin$ + + + rundll32.exe + ,;StartW + + + rundll32.exe + ,;update;appdata;temp;/i: + + + rundll32.exe + ,;update;appdata;temp;-i: + + + dllhost.exe + {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} + + + dllhost.exe + {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} + + + + winlogon.exe;services.exe;lsass.exe;csrss.exe;wininit.exe;spoolsv.exe;searchindexer.exe + powershell.exe;pwsh.exe;cmd.exe + AUTHORI;AUTORI + route ; ADD + + + + eventvwr.exe + c:\windows\system32\mmc.exe + + fodhelper.exe + InstallUtil.exe + Invoke-PsUaCme + BypassUAC + PowerUp + computerdefaults.exe + dism.exe + fodhelper.exe + + + NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC + NT AUTHORITY\SYSTEM;СИСТЕМА;NT-AUTORITÄT\SYSTEM;AUTORITE NT\SYSTEM + + c:\windows\system32\svchost.exe -k netsvcs -s Appinfo + runas.exe + + + + + + + + Cmd.Exe + winlogon.exe + utilman.exe + + + Cmd.Exe + winlogon.exe + sethc.exe + + + utilman.exe + C:\Windows\System32\ATBroker.exe;Magnify.exe;C:\Windows\System32\osk.exe + + sethc.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe + + sdbinst.exe + + + cmd.exe /c C:\Windows\Setup\Scripts\SetupComplete.cmd;cmd.exe /c C:\Windows\Setup\Scripts\PartnerSetupComplete.cmd + C:\Windows\Setup + C:\Windows\SysWOW64 + C:\Windows\System32 + C:\Windows\WinSxS + + + consent.exe + http + iexplore.exe + SYSTEM + + + dwm.exe + + + cmd.exe + 7zFM.exe + ;/c;-c + + + cmd.exe + elevation_service.exe + System + + + + + + + + unknown process + \LocalState\rootfs\ + \LocalState\rootfs\ + + + + + + + + + + + + + + + +s;+h + attrib.exe + + + Hidden;Attributes + powershell.exe + + + + + Sysinternals Sysmon + /u;/c;-u;-c + C:\ProgramdData\sysmon\ + + + MpCmdRun.exe + Add-MpPreference;RemoveDefinitions;DisableIOAVProtection + + + PsKill.exe + + Set-MpPreference;Add-MpPreference;Remove-MpPreference;MpCmdRun.exe + RemoveDefinitions;RemoveDynamicSignature;DisableIOAVProtection;DisableRealTimeMonitoring;DisableBehaviorMonitoring;DisableBlockAtFirstSeen;DisableIOAVProtection;DisablePrivacyMode;DisableScriptScanning;DisableRealtimeMonitoring;DisableScanningNetworkFiles;DisableScanningMappedNetworkDrivesForFullScan;DisableRestorePoint;DisableRemovableDriveScanning;SignatureDisableUpdateOnStartupWithoutEngine;DisableIntrusionPreventionSystem;DisableScanOnRealtimeEnable;DisableArchiveScanning;DisableIntrusionPreventionSystem;DisableScriptScanning;DisableOnAccessProtection;ExclusionExtension;ExclusionPath;ExclusionProcess;ThreatDefaultAction;TamperProtection + + interface ipv6 set + interface ipv4 set + taskkill.exe + + firewall delete + firewall add + firewall set opmode disable + Core Networking - Router Solicitation + netsh advfirewall firewall + + + wevtutil.exe + cl + wevtutil im + wevtutil.exe im + ClickToRun + + + fltMC.exe + detach;unload + + + appcmd.exe + DontLog;True + iisetup.exe + + + + bash.exe;wsl.exe;ubuntu.exe;kali.exe + -e;/e;-u root;--exec bash;dev/tcp + + wsl.exe + wsl.exe + wslhost.exe + wslhost.exe + ubuntu.exe + ubuntu.exe + kali.exe + kali.exe + + pcalua.exe + pcalua.exe + bash.exe + bash.exe + forfiles.exe + forfiles.exe + .com + -appvscript + + + + C:\Users\NetworkService\;C:\Users\NetworkService\;HarddiskVolumeShadowCopy;C:\Users\Default\;C:\Users\Public;C:\Users\Guest\;\administrateur\;C:\Windows\Media\;C:\Windows\addins\;tsclient\;\htdocs\;\config\systemprofile\;C:\PerfLogs\;c:\windows\ServiceProfiles\;C:\Intel\Logs\;C:\Windows\repair\;C:\Windows\Help\;$Recycle;C:\Windows\Debug\;C:\Windows\Security\;C:\Windows\Fonts\;\wwwroot\;\Contacts;C:\Windows\vss\ + + + + + reg add hkcu\software\classes\ + reg.exe add hkcu\software\classes\ + C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry + + regedit.exe + : + + + + + + chcp.exe + 936 + 1256 + 864 + 1258 + 855 + 866 + + + powershell.exe + -e ;-en;-enc;-enco;-encod;-encode;-encoded;-encodedc;-encodedco;-encodedcom;-encodedcomm;-encodedcomma;-encodedcomman;-encodedcommand;/e ;/en;/enc;/enco;/encod;/encode;/encoded;/encodedc;/encodedco;/encodedcom;/encodedcomm;/encodedcomma;/encodedcomman;/encodedcommand + + + powershell.exe + -w h;-wi h;-win h;-wind h;-windo h;-window h;-windows h;-windowst h;-windowsty h;-windowstyl h;-windowstyle h;/w h;/wi h;/win h;/wind h;/windo h;/window h;/windows h;/windowst h;/windowsty h;/windowstyl h;/windowstyle h + + + powershell.exe + -noni;/noni + Import-Module FileServerResourceManager + C:\Program Files\LogicMonitor + + + powershell.exe + hextobin;iex;io.filestream;system.text;base64;system.io;io.file;IMAGE_SUBSYSTEM_WINDOWS_GUI;IMAGE_NT_OPTIONAL_HDR32;IMAGE_NT_OPTIONAL_HDR64;DllCharacteristicsType;GetDelegateForFunctionPointer;WriteProcessMemory;ReadProcessMemory;ImpersonateSelf;AdjustTokenPrivileges;NtCreateThreadEx;CreateRemoteThread;io.seek;iwr;-bxor;invoke-expression;remove.to.string;shellcode;System.Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;unicode;-useb;msxml2.serverxmlhttp;wscript.shell;-comobject;frombase64;io.compression;system.convert;io.streamreader;io.memorystream;compression.gzipstream;text.encoding;executioncontext;text.enc;convertto-securestring;runtime.interop;verbosepreference;[[string]]::join + + + powershell.exe + SUVYI;aWV4I;SQBFAFgA;aQBlA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC + + + C^om^S^pEc;^c^o^m^S^p^E^c^;Wscript.Shell;-ComObject;MsXml2.ServerXmlHttp;Remove.ToString;System.Convert;-UseB;[Byte[];^h^t^t^p;h"t"t"p + + IwAjACMAd;IyM=;SUVYI;aWV4I;SQBFAFgA;aQBlAHgA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC + WindowStyle Hidden function;WindowStyle Hidden;windowstyle h;windowstyl h;windowsty h;windowst h;windows h;window h;windo h;wind h;win h;wi h;-w h;/w h;win hi;win hid;win hidd;win hidde;win hidden + ^ + TYPE CON > + copy CON > + FromBase64String;action=create keyvalue=;VerbosePreference.ToString;SecureString;CSharpCodeProvider;runtime.interopservices.marshal;system.globalization.numberstyles;system.reflection.assembly;hextobin;VerbosePreference.ToString;system.text.encoding;io.filestream;io.filestream;io.seekorigin;text.encoding;unicode.getstring;FromBase64;[Convert]::;System.IO.File]::ReadAllText;|iex + + certutil + decode;encode + + + + ping.exe + 0x + + + + csc.exe + \AppData\;\Windows\Temp\ + + + csc.exe + wscript.exe + cscript.exe + mshta.exe + + + mofcomp.exe + .mof + C:\WINDOWS\Installer\MSI + MsMpEng.exe + aspnet_regiis.exe + msiexec.exe + + + csc.exe + out:;target:library + + Microsoft.Workflow.Compiler.exe + + + + System.Management.Automation + + + + + + + InstallUtil.exe + /logfile=;/LogToConsole=false;/U + + + InstallUtil.exe + -logfile=;-LogToConsole=false;-U + + + Mavinject.exe;mavinject64.exe + INJECTRUNNING + + + CMSTP.exe + /ni;/s + + + CMSTP.exe + /ns;/s + + + CMSTP.exe + -ni;-s + + + CMSTP.exe + -ns;-s + + + control;name + rundll32.exe;shell32.dll;Control_RunDLL + + + odbcconf.exe + /S /A {REGSVR;-S -A {REGSVR + + script:http + Register-cimprovider + Scriptrunner.exe -appvscript + bginfo + cbd + runscripthelper.exe surfacecheck + xwizard RunWizard + PresentationHost + driver executeinf + control.exe /name;control.exe -name + Control_RunDLL + SyncAppvPublishingServer.exe + Scriptrunner.exe + ATBroker.exe + Appvlp.exe + InfDefaultInstall.EXE + PresentationHost.exe + RegisterCimProvider2.exe + RegisterCimProvider.exe + ScriptRunner.exe + csi.exe + extexport.exe + msconfig.EXE + rasdlui.exe + tttracer.exe + verclsid.exe + wab.exe + Register-cimprovider.exe + csi.exe + devtoolslauncher.exe LaunchForDeploy + bginfo + devtoolslauncher.exe + wab.exe + wsreset.exe + + cmstp.exe /ni /s;cmstp.exe -ni -s + cmstp /ni /s;cmstp -ni -s + + Mavinject.exe + INJECTRUNNING + + + rundll32.exe + DllRegisterServer + xapauthenticodesip.dll + + + regsvr32.exe + C:\Users;Appdata;Temp + + + regsvr32.exe + C:\Users;Public + + Microsoft(C) Register Server + SyncAppvPublishingServer.exe + control.exe + rasautou.exe + control.exe /name;control.exe -name + Control_RunDLL + + + msiexec.exe + /y;-y + C:\Windows\SysWOW64\DartSock.dll + C:\Windows\SysWOW64\ImageViewer2.OCX + C:\Windows\SysWOW64\SysTray.ocx + C:\Windows\SysWOW64\tdbg6.ocx + C:\Windows\SysWOW64\tdbg7.ocx + C:\Windows\SysWOW64\tdbg7.ocx + C:\Windows\SysWOW64\todg7.ocx + C:\Windows\SysWOW64\todgub7.dll + C:\Windows\SysWOW64\xarraydb.ocx + + + msiexec.exe + /i;-i + http + + + + RUNDLL32.EXE + ,;# + C:\Windows\resources\themes\Aero\AeroLite.msstyles + uxtheme.dll + ImageView_Fullscreen + EDGEHTML.dll + PhotoViewer.dll + \AppData\Local\WebEx\WebEx\ + + + RUNDLL32.EXE + shell32.dll;OpenAs_RunDLL + + + RUNDLL32.EXE + powershell + + + RUNDLL32.EXE + url.dll;OpenURL + + + RUNDLL32.EXE + url.dll;FileProtocolHandler + + + RUNDLL32.EXE + zipfldr.dll;RouteTheCall + + + RUNDLL32.EXE + Shell32.dll;Control_RunDLL + + + RUNDLL32.EXE + javascript: + + + RUNDLL32.EXE + RegisterXLL + + + rundll32.exe + C:\Users;Public + rdpinit.exe + rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe + + + rundll32.exe + C:\Users;Appdata;Temp + ImageView_ + rdpinit.exe + rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe + + advpack.dll;LaunchINFSection + ieadvpack.dll;LaunchINFSection + syssetup.dll;SetupInfObjectInstallAction + setupapi.dll;InstallHinfSection + InstallHinfSection + infDefaultInstall.exe + rundll32.exe "C:\Windows\twain_64.dll" + shdocvw.dll;OpenURL + advpack.dll;RegisterOCX + Zipfldr.dll;RouteTheCall + url.dll;FileProtocolHandler + url.dll;FileProtocolHandler + OpenURLA;file: + OpenURL;file: + + + mshta.exe + cmd.exe;powershell.exe;wscript.exe;cscript.exe;sh.exe;bash.exe;reg.exe;regsvr32.exe;bitsadmin + + + mshta.exe + + RunHTMLApplication + mshtml + vbscript:CreateObject + + odbcconf.exe + + + manage-bde.wsf + + + + + powershell.exe;powershell_ise.exe + msbuild.exe + + + msbuild.exe + regasm + + + msbuild.exe + userinit.exe + + + msbuild.exe + .xml + + + regasm.exe + \conhost.exe + + + msbuild.exe + .lnk + + .csproj + + + + + + + msxsl.exe + msxsl.exe + + + + + + + + + /stext + keylog + keyscan_ + Get-Keystrokes + /scomma + + + + + + sniff + C:\Program Files\Adobe\ + + + tcpdump.exe;tcpdump.c;tshark.exe;tshark.c;windump.exe;windump.c;wireshark.c;wireshark.exe + windump;tshark;tcpdump;windump;wireshark + netsh;trace;start;capture=yes + + + + mimikatz;mimidrv;mimilove;mimilib;sekurlsa;lsadump;dumpcreds;privilege::;token::;logonpasswords;mimikittenz;mimiauth;::;kerberos::;misc::skeleton;privilege::debug;dpapi::cred;vault::cred;lsadump;misc::;Krbtgt;TOKEN::;invoke-mimi + + + cmdkey + + rpcping.exe + nltest.exe + + -ma lsass.exe;Do-Exfiltration;Powersploit;GPPPassword;gpprefdecrypt;gsecdump;hashdump;laZagne;ntds.dit;ppldump;pwdump;pwdumpx;secretsdump;/listcreds:;-listcreds: + + VaultCloseVault + VaultEnumerateItem + VaultFree + VaultGetItem + VaultOpenVault + Vaultcmd + vaultcli.dll + select * from moz_login + Invoke-WinEnum + System.Net.CredentialCache + create shadow + wlan;export;profile;key=clear + dcsync + HKCU /f password;HKCU -f password + HKLM /f password;HKLM -f password + nltest.exe + ProcDump.exe + ProcDump + + + asktgt;asktgs + createnetonly /program:;createnetonly -program: + dump /service:krbtgt;dump -service:krbtgt + harvest /interval:;harvest -interval: + renew /ticket:;renew -ticket: + asreproast + impersonateuser: + kerberoast + ptt /ticket: + klist.exe + hh.exe + + + + appcmd.exe + list;text;password + + + + quser.exe + + net.exe;net1.exe;net2.exe + group;localgroup; user + /domain + SUService + \users + tvsu_tmp + + + net.exe;net1.exe;net2.exe + group;localgroup; user + /domain + SUService + \users + tvsu_tmp + + + sharphound;bloodhound;azurehound;CollectionMethod;encryptzip;randomizefilenames;dumpcomputerstatus + sharphound;bloodhound + sharphound;bloodhound + sharphound;bloodhound + sharphound;bloodhound + sharphound;bloodhound + sharphound;bloodhound + + dscl . list /Groups;dscl . list -Groups + dscl . list /Users;dscl . list -Users + dsquery.exe + query.exe + + + + + + + + + + + tree.com + + + + + + + + + tasklist.exe + qprocess.exe + + reg query + reg.exe query + driverquery.exe + + + tracert.exe + pathping.exe + + + + fltMC.exe + misc::mflt + + AntiVirusProduct + root\SecurityCenter2 + + sysinfo.exe + systeminfo + + + + netsh.exe + get;list;show + + + netsh.exe + get;list;show + + ipconfig.exe + + netstat.exe + arp -a + arp.exe -a + arp -a + + + whoami.exe;whoami1.exe + + + netsh.exe + add;del;set + + + nbtstat + nessus + + + route.exe + print + + + route.exe + ADD;DEL;CHANGE;-f + + qwinsta.exe + rwinsta.exe + + + + + + + + Microsoft Office\root\Office + Microsoft Office\root\Office + automation;Embedding + + + admin$ + davclnt.dll + WebClientGroup + + + + svchost.exe;termsvcs + rdpclip.exe;csrss.exe;wininit.exe + + + dns.exe + werfault.exe;conhost.exe;dnscmd.exe;dns.exe + + + UMWorkerProcess.exe;UMService.exe + perfenabled + + + UMWorkerProcess.exe;UMService.exe + perfenabled + wemgr.exe;werfault.exe + + + \wwwroot\ + + + \Atlassian\Confluence\jre\bin\java.exe + cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin + + + \jre\bin\java.exe + cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin + + \Atlassian\Confluence\jre\bin\java.exe + + + + + + /shadow;-shadow + noConsentPrompt + + + tscon.exe + dest:rdp-tcp: + + + powershell.exe + WmiPrvSE.exe + + + WmiPrvSE.exe + \Users\ + + + NetworkDetective + WmiPrvSE.exe + + + sc.exe + tenable + WmiPrvSE.exe + + + cmd.exe + WmiPrvSE.exe + do_vbsUpload;Spiceworks + + + regsvr32.exe + WmiPrvSE.exe + + + cmd.exe + WmiPrvSE.exe + + + powershell.exe + WmiPrvSE.exe + + + dsa.msc + + + virtmgmt.msc + + + wmiprvse.exe + CompMgmtLauncher.exe + DismHost.exe + Microsoft.NET\Framework + NetEvtFwdr.exe + ServerManager.exe + WerFault.exe + chcp.com + g2mupdate.exe + slack.exe + + winrm.cmd + winrs.exe + winrshost.exe + waitfor.exe + wsmprovhost.exe + winrshost.exe + wsmprovhost.exe + + wmiprvse.exe + mshta.exe + + + ssh.exe;putty.exe;kitty.exe;kitty_portable.exe + + PuTTY suite + + sftp;psftp + + + rundll32.exe + + + rundll32.exe + ..\;, + + + rundll32.exe + ,StartW + + psshutdown + psservice + PsPasswd + mstsc.exe + telnet.exe + tftp.exe + powershellcustomhost + + + -Embedding + c:\windows\system32\mmc.exe + + --execm;atexec + {4991d34b-80a1-4291-83b6-3328366b9097} + {00020812-0000-0000-C000-000000000046} + {40AEEAB6-8FDA-41e3-9A5F-8350D4CFCA91} + {7e0423cd-1119-0928-900c-e6d4a52a0715} + {0006F04A-0000-0000-C000-000000000046} + {048EB43E-2059-422F-95E0-557DA96038AF} + {13709620-C279-11CE-A49E-444553540000} + {c08afd90-f2a1-11d1-8455-00a0c91f3880} + 9BA05972-F6A8-11CF-A442-00A0C90A8F39 + {00021A20-0000-0000-C000-000000000046} + {72C24DD5-D70A-438B-8A42-98424B88AFB8} + {00020906-0000-0000-C000-000000000046} + {cc5bbec3-db4a-4bed-828d-08d78ee3e1ed} + {1b7cd997-e5ff-4932-a7a6-2a9e636da385} + {16d51579-a30b-4c8b-a276-0ff4dc41e755} + rundll32.exe -sta;rundll32.exe /sta;rundll32 -sta;rundll32 /sta + shell32.dll;SHCreateLocalServerRunDll + -k DcomLaunch;/k DcomLaunch + + + + + + + + + + 7z.exe + a -mx9 -r0 -p;a -v500m -mx9 -r0 -p + + + WindowsAudioDevice-Powershell-Cmdlet + SoundRecorder.exe + + + + clip.exe + get-clipboard + + + + + + + + + + New-MailboxExportRequest + + + + screencapture + system.drawing.Imaging + system.drawing.bitmap + system.windows.forms.screen + + + + + + + odHRwczovL;aHR0cDovL;h0dHA6Ly;odHRwOi8v;aHR0cHM6Ly;h0dHBzOi8v + ie_to_edge_stub.exe;chrome.exe;firefox.exe;iexplore.exe;brave.exe;vivaldi.exe;msedge.exe;webex;teams.exe;goto opener.exe;lynx.exe;\Webex\webexAppLauncherLatest.exe;\WebEx\webexAppLauncher.exe;\WebEx\Applications\webexAppLauncher.exe;WebEx\webex.exe + wbx:;/SITE_TOKEN=;msteams: + + + VFZvQUFBQ;RWb0FBQU;UVm9BQUFB;VFZxQUFBR;RWcUFBQU;UVnFBQUFF;VFZwUUFBS;RWcFFBQU;UVnBRQUFJ;VFZxUUFBT;RWcVFBQU;UVnFRQUFN;VFZwVEFRR;RWcFRBUU;UVnBUQVFF + + + powershell.exe + AAAAYInlM;OiCAAAAYInlM;OiJAAAAYInlM;RwBlAHQAL;WwBOAGUAdAAuAFM;W05ldC5TZXJ2aWNl + + + Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք + + + + + + + + certutil.exe + urlcache;split;f + + + DownloadFile;DownloadString;Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;Invoke-Expression;Invoke-WebRequest + powershell.exe;cmd.exe + + + bitsadmin.exe + CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME + util;setieproxy;localsystem;AUTODETECT + + + BITS administration utility + CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME + + + \curl.exe;\wget.exe;\www.exe + + + \curl.exe;\wget.exe;\www.exe + + + certutil + split;f + + + certutil + verifyctl;URL + + start-bitstransfer + expand \\ + expand.exe \\ + ieexec http + ieexec.exe http + powercat + esentutl /y \\;esentutl -y \\ + esentutl.exe /y \\;esentutl.exe -y \\ + extrac32 \\ + extrac32.exe \\ + + + + + + portproxy + tor.exe + + TeamViewer_Desktop.exe + + psexec + + + + + + + winscp.exe;winscp.com;scp.exe;pscp + + + + bitch.exe;bitch.bat;bitch_lasagna.exe;Admin Cracker.exe;BulletsPassView.exe;ChromePass.exe;Dialupass.exe;LSASecretsView.exe;OpenedFilesView.exe;OperaPassView.exe;PasswordFox.exe;ProduKey.exe;RouterPassView.exe;USBDeview.exe;USBStealer.exe;VNCPassView.exe;WebBrowserPassView.exe;WirelessKeyView.exe;WirelessKeyView.exe;empv.exe;netpass.exe;pspv.exe;usbdll.exe;rdpv.exe;WirelessKeyView.exe;lasagna.exe;all -vvv >>;rsync -r + + + CredsLeaker;Windows.Security.Credentials.UI.CredentialPicker;function Leaker;function Await + + + .exe -url https://;dll,Run https://;Invoke-Merlin;-m SimpleHTTPServer;/m SimpleHTTPServer + + + + + -q=txt;/q=txt + nslookup.exe + + + rclone + Rsync for cloud storage + rclone + rclone + \rclone + + + s3browser + s3browser + s3browser + s3browser + + + add-ftp;.UploadFile( + ftp.exe + + + rundll32.exe + davclnt.dll;DavSetCookie + + + + + + + + + + + + bcdedit.exe + safeboot + + + bootcfg.exe + safeboot + + + -startvm;vrun.exe -vm + + + + + vssadmin.exe + delete;resize + + + wmic.exe + shadowcopy;delete + + + wbadmin.exe + SYSTEMSTATEBACKUP;delete + + + wmic.exe + wmic shadowstorage SET MaxSpace= + + + wmic.exe + cleareventlog;call disable;nteventlog where filename + + + diskpart.exe + format;clean;delete;remove + + + manage-bde.exe + changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw + + + manage-bde.wsf + changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw + + format + format + bootstatuspolicy ignoreallfailures + recoveryenabled No + Win32_Shadowcopy + sdelete + delete catalog + wbadmin delete catalog + erase + -nw -exec= + -p -nw + shred + diskshadow + + del ; /f + del ; -f + rmdir ; /s ; /q + rmdir ; -s ; -q + rd ; /s ; /q + rd ; -s ; -q + + + usn deletejournal + + + + + fsutil.exe + deletejournal + usn + + + + + + + + + + AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz + + + ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool + CPU miner;GPU miner;Lime Miner;XMRig CPU miner; miner + + + + b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 + + 87AECF008D87EC86EC8B00A2394B3E6C + FB3F0D0DE8B80EA8CFAB2A025EC6B833 + F4067FBF7FFF6945D0BB485B727B39AA + 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee + e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f + d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b + 53841a0c6a3ff92976db08bfdf95e083 + + + zoommtg + pwd= + + + zoommtg + zc=0 + + + zoommtg + zc=1 + + + msteams: + + + wbx: + + + C:\Users\ + \Downloads\ + + + C:\Users\ + Content.Outlook + + + C:\Users\ + \Desktop\ + + + \awk.exe;\sed.exe + + listena + -s -n -u -i:http: + /s /n /u /i:http: + assoc + del + expand + md + move + rd + ren + set + setx + bginfo.bgi /popup /nolicprompt;bginfo.bgi -popup -nolicprompt + find.exe + grabff + routerscan + pythonEngine.Execute + sesshijack + file:// + HTML Application host + Manager Profile Installer + Microsoft Application Virtualization Injector + Application Compatibility Database Installer + popd.exe + pushd.exe + subst.exe + doskey.exe + cls.exe + \ + auditpol.exe + C:\Windows\system32\svchost.exe -k iissvcs + \ + acrobat.exe + acrord32.exe + java.exe + javaw.exe - 2> - < - > - ^ - + 2> + > + < - & - ; - | - more - \\tsclient - .. - - wmic shadowcopy delete - wbadmin delete catalog - /set {default} recoveryenabled no - telnet - -dumpcr - putty - bash.exe - pssh - sdelete - shareenum - sekurlsa - reg SAVE - Invoke-DllInjection - Invoke-Shellcode - Invoke-WmiCommand - Get-GPPPassword - Get-Keystrokes - Get-TimedScreenshot - Get-VaultCredential - Invoke-CredentialInjection - mimikatz - Invoke-NinjaCopy - Invoke-TokenManipulation - Out-Minidump - VolumeShadowCopyTools - Invoke-ReflectivePEInjection - Invoke-UserHunter - Find-GPOLocation - Invoke-ACLScanner - Invoke-DowngradeAccount - Get-ServiceUnquoted - Get-ServiceFilePermission - Get-ServicePermission - Invoke-ServiceAbuse - Install-ServiceBinary - Get-RegAutoLogon - Get-VulnAutoRun - Get-VulnSchTask - Get-UnattendedInstallFile - Get-WebConfig - Get-ApplicationHost - Get-RegAlwaysInstallElevated - Get-Unconstrained - Add-RegBackdoor - Add-ScrnSaveBackdoor - Gupt-Backdoor - Invoke-ADSBackdoor - Enabled-DuplicateToken - Invoke-PsUaCme - Remove-Update - Check-VM - Get-LSASecret - Get-PassHashes - Show-TargetScreen - Port-Scan - netscan - psscan - Invoke-PoshRatHttp - Invoke-PowerShellTCP - Invoke-PowerShellWMI - Add-Exfiltration - Add-Persistence - Do-Exfiltration - Start-CaptureServer - Invoke-DllInjection - Invoke-ReflectivePEInjection - Invoke-ShellCode - Get-ChromeDump - Get-ClipboardContents - Get-FoxDump - Get-IndexedItem - Get-Keystrokes - Get-Screenshot - Invoke-Inveigh - Invoke-NetRipper - Invoke-NinjaCopy - Out-Minidump - Invoke-EgressCheck - Invoke-PSInject - Invoke-RunAs - MailRaider - New-HoneyHash - Set-MacAttribute - Get-VaultCredential - Invoke-DCSync - Invoke-PowerDump - Invoke-TokenManipulation - Exploit-Jboss - Invoke-ThunderStruck - Invoke-VoiceTroll - Set-Wallpaper - Invoke-InveighRelay - Invoke-PsExec - Invoke-SSHCommand - Get-SecurityPackages - Install-SSP - Invoke-BackdoorLNK - PowerBreach - Get-GPPPassword - Get-SiteListPassword - Get-System - BypassUAC - Invoke-Tater - PowerUp - PowerView - Get-RickAstley - Find-Fruit - HTTP-Login - Find-TrustedDocuments - Invoke-Paranoia - Invoke-WinEnum - Invoke-ARPScan - Invoke-ReverseDNSLookup - smbscanner - Invoke-FruityC2 - Invoke-Stager - process call create - call set priority - call terminate - product get name - bios, get serialNumber - onboarddevice get - useraccount where name - nteventlog where filename - cleareventlog - root\\default - FilterToConsumerBinding - root\\subscription - Win32_TaskService - Win32_TaskService - stratum+tcp - -donate-level= - Wmiclass - WmiCl'+'as'+'s - ntdsutil - mimiauth - Powersploit - Mimikittenz - -ma lsass.exe - ProcDump.exe - - AdjustTokenPrivileges - IMAGE_NT_OPTIONAL_HDR64_MAGIC - Management.Automation.RuntimeException - Microsoft.Win32.UnsafeNativeMethods - ReadProcessMemory.Invoke - Runtime.InteropServices - SE_PRIVILEGE_ENABLED - System.Security.Cryptography - System.Runtime.InteropServices - LSA_UNICODE_STRING - MiniDumpWriteDump - PAGE_EXECUTE_READ - Net.Sockets.SocketFlags - Reflection.Assembly - SECURITY_DELEGATION - TOKEN_ADJUST_PRIVILEGES - TOKEN_ALL_ACCESS - TOKEN_ASSIGN_PRIMARY - TOKEN_DUPLICATE - TOKEN_ELEVATION - TOKEN_IMPERSONATE - TOKEN_INFORMATION_CLASS - TOKEN_PRIVILEGES - TOKEN_QUERY - Metasploit - Mimikatz - - usn deletejournal - ^h^t^t^p - h"t"t"p - - script:http - rundll32.exe - notepad.exe - regsvr32.exe - regsvcs.exe - C:\Windows\system32\svchost.exe - mshta.exe - psexe - pskill - psshutdown - psservice - PsPasswd - msbuild.exe - msiexec.exe - mstsc.exe - telnet.exe - SyncAppvPublishingServer.exe - Mavinject.exe - ssh.exe - putty.exe - kitty.exe - kitty_portable.exe - psftp.exe - tftp.exe - wmic.exe - nbtstat.exe - driverquery.exe - infDefaultInstall.exe - sc.exe - auditpol.exe - qwinsta.exe - rwinsta.exe - curl.exe - wget.exe - www.exe - awk.exe - sed.exe - - stratum+tcp - coinhive - minergate - ccminer - cgminer - sgminer - rainbowminer - xmrMiner - poolpassword - poolurl - poolname - ahashpool - poolname - blazepool - blockmasters - blockmasterscoins - hashrefinery - miningpoolhubcoins - nicehash - yiimp - zergpool - zergpoolcoins - zpool - - tor.exe - - - .com - \temp\ - C:\users - explorer.exe - control.exe - acrord32.exe - installutil.exe - \reg.exe - ipconfig.exe - \appdata\ - \programdata\ - \Users - \ProgramData - \Windows\ - \Perflogs\ - \config\systemprofile\ - - netsh advfirewall firewall - \ - DisableRealtimeMonitoring - --disable-http2 --disable-quic - 291ff87948e45914424cec9510c297da - 304772c80b157a916c7041f2f15939fb - 5E022694C0DBD1FBBC263D608E577949 - 71345b139166482acaa568ac8816c7bc - 1b60021baedc3f9201bcdb40e9b87f62 - c7c8d584758854bbe0d8e64ef53ae1a8 + + C:\Windows\system32\svchost.exe + + cacls + takeown + /x Macro + \pipe\ + /noprofile + /sc ONEVENT + \\VBOXSVR + | more + |more + \\tsclient + %PROCESSOR_ARCHITECTURE% + sysnative + AutoIt + Microsoft Filter Loader + more.com + :\Windows\Microsoft.NET\ + acrord32.exe + gpupdate.exe + :\Windows\Microsoft.NET\ + + + /;\;-;unknown + explorer.exe;rundll32.exe + Appinfo + DcomLaunch + JABzA + RemoteRegistry + comspec + iissvcs + mshta + nessus + rundll32.exe + + + - - AppContainer - C:\Windows\system32\DllHost.exe /Processid - C:\Windows\system32\SearchIndexer.exe /Embedding - C:\Windows\System32\CompatTelRunner.exe - C:\Windows\System32\MusNotification.exe - C:\Windows\System32\MusNotificationUx.exe - C:\Windows\System32\audiodg.exe - C:\Windows\System32\conhost.exe - C:\Windows\System32\powercfg.exe - C:\Windows\System32\wbem\WmiApSrv.exe - C:\Windows\servicing\TrustedInstaller.exe - C:\Windows\system32\sppsvc.exe - C:\Windows\system32\SearchIndexer.exe - C:\Windows\system32\DllHost.exe /Processid - C:\Windows\system32\svchost.exe -k DcomLaunch - \SystemRoot\System32\smss.exe 00000100 0000007c - \SystemRoot\System32\smss.exe 00000100 0000007c - C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe - %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows - C:\Windows\system32\SearchIndexer.exe - C:\Windows\system32\vssvc.exe - net.exe use - net use - net1 use - net.exe time - net time - net1 time - - C:\Program Files\Windows Defender - C:\Windows\System32\CompatTelRunner.exe - C:\Windows\System32\wermgr.exe - C:\Windows\SysWOW64\wermgr.exe - C:\Windows\System32\MpSigStub.exe - C:\Windows\SoftwareDistribution\Download\Install\AM_Delta - C:\Windows\SoftwareDistribution\Download\Install\AM_Engine - C:\Windows\SoftwareDistribution\Download\Install\AM_Base - C:\Windows\System32\MusNotification.exe - C:\Windows\System32\MusNotificationUx.exe - C:\Windows\system32\SearchIndexer.exe /Embedding - C:\Windows\System32\svchost.exe -k wsappx - C:\Windows\System32\svchost.exe -k appmodel - C:\Windows\System32\svchost.exe -k UnistackSvcGroup - C:\Windows\System32\svchost.exe -k defragsvc - C:\Windows\System32\svchost.exe -k RPCSS - C:\Windows\System32\svchost.exe -k utcsvc - C:\Windows\System32\svchost.exe -k wbioSvcGroup - C:\Windows\System32\svchost.exe -k DcomLaunch - C:\Windows\System32\svchost.exe -k swprv - C:\Windows\System32\svchost.exe -k imgsvc - C:\Windows\System32\svchost.exe -k NetworkServiceNetworkRestricted - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted - C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc - C:\Windows\system32\svchost.exe -k localServiceNoNetwork - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted - C:\Windows\system32\svchost.exe -k netsvcs -p -s NcaSvc - C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC - C:\Windows\system32\svchost.exe -k netsvcs -s BITS - C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc - C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc - C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc - C:\Windows\system32\svchost.exe -k netsvcs -s SENS - C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv - C:\Windows\system32\svchost.exe -k netsvcs -s Themes - C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt - C:\Windows\system32\svchost.exe -k netsvcs -s gpsvc - C:\Windows\system32\svchost.exe -k netsvcs - C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc - C:\Windows\system32\svchost.exe -k networkService -s Dnscache - C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation - C:\Windows\system32\svchost.exe -k networkService -s NlaSvc - C:\Windows\system32\svchost.exe -k networkService -s TermService - C:\Windows\system32\svchost.exe -k networkService - C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted - C:\Windows\system32\svchost.exe -k rPCSS - C:\Windows\system32\svchost.exe -k secsvcs - C:\Windows\system32\svchost.exe -k swprv - C:\Windows\system32\svchost.exe -k unistackSvcGroup - C:\Windows\system32\svchost.exe -k utcsvc - C:\Windows\system32\svchost.exe -k wbioSvcGroup - C:\Windows\system32\svchost.exe -k werSvcGroup - C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC - C:\Windows\system32\svchost.exe -k wsappx - C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted - C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation - C:\Windows\system32\svchost.exe -k NetworkService - C:\Windows\System32\svchost.exe -k netsvcs - C:\WINDOWS\system32\svchost.exe -k GPSvcGroup - C:\Windows\System32\svchost.exe -k tapisrv - C:\WINDOWS\System32\svchost.exe -k wsappx - C:\Windows\System32\svchost.exe -k netsvcs - C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted - C:\Windows\System32\powercfg.exe - C:\Windows\System32\taskeng.exe - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE - C:\Program Files\Microsoft Office\Office16\MSOSYNC.EXE - C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE - C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXE - C:\Program Files (x86)\Microsoft Office\Office15\MSOSYNC.EXE - C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe - C:\Windows\splwow64.exe - - C:\Program Files\Windows Media Player\wmpnscfg.exe - - C:\Program Files\Microsoft\Exchange Server\V15\Bin\Microsoft.Exchange.Diagnostics.Service.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe - C:\Program Files\Microsoft\Exchange Server\V14\Scripts\CheckDatabaseRedundancy.ps1 - - C:\Windows\System32\ddpcli.exe - - "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= - "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= - C:\Program Files (x86)\Google\Update\ - C:\Program Files (x86)\Google\Update\ - - "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel - "C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel - - AcroRd32.exe" /CR - AcroRd32.exe" --channel= - "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /o /eo /l /b /id - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /o /eo /l /b /ac /id - "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /o /eo /l /b /id - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe - - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe - - C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\AcroCEF\AcroCEF.exe - C:\Program Files (x86)\Adobe\Acrobat 2015\Acrobat\LogTransport2.exe - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe - - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe - - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe - - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe - - - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe - - "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ - C:\Program Files\NVIDIA Corporation\ - \NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamuseragent.exe - C:\Program Files\Realtek\ - C:\Program Files\DellTPad\HidMonitorSvc.exe - "C:\Program Files\DellTPad\ApMsgFwd.exe" -s{ - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe - - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - - C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe - C:\Program Files\Dell\SupportAssist\pcdrcui.exe - C:\Program Files\Dell\SupportAssist\koala.exe - "-outc=C:\ProgramData\Dell\CommandUpdate\inventory.xml" "-logc=C:\ProgramData\Dell\CommandUpdate\scanerrs.xml" "-lang=en" "-enc=UTF-16" - - - C:\Program Files (x86)\Lenovo\System Update\ConfigService.exe - C:\PROGRA~3\Lenovo\SYSTEM~1\SESSIO~1\REPOSI~1\fwdphb06\fwdphb06_version.exe - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe - C:\Windows\system32\LPlatSvc.exe - C:\Program Files\Lenovo\HOTKEY\tphkload.exe - C:\Program Files\Lenovo\HOTKEY\micmute.exe - C:\Program Files\Lenovo\InstantOn\InstantOnSrv.exe - C:\Program Files\Lenovo\Lenovo Mouse Suite\Service\PelService.exe - C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe - C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe - C:\Program Files (x86)\Lenovo\System Update\tvsukernel.exe - C:\Program Files (x86)\Lenovo\System Update\UACSdk.exe - C:\Program Files (x86)\Lenovo\System Update\SUService.exe - C:\Program Files\Lenovo\Lenovo Ultraslim Plus Wireless Keyboard & Mouse\Pelico.exe - C:\Program Files\Lenovo\Lenovo Ultraslim Plus Wireless Keyboard & Mouse\LeDaemon.exe - C:\Program Files\Lenovo\Lenovo Mouse Suite\ICO.exe - C:\Program Files\Lenovo\Lenovo Mouse Suite\Service\PelElvDm.exe - C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe - C:\Program Files (x86)\Lenovo\System Update\tvsu.exe - C:\Program Files (x86)\Lenovo\System Update\TvsuCommandLauncher.exe - - C:\Program Files (x86)\SCM\SCM.exe - C:\Program Files (x86)\SCM\SCM_Notice.exe - C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe - C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe - C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe - C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe - - C:\Program Files\Intel\Telemetry 2.0\lrio.exe - C:\Program Files\Intel Driver Update Utility\SUR\SurSvc.exe - C:\Windows\System32\DriverStore\FileRepository\ki120591.inf_amd64_7a2f7b04e15632c2\igfxCUIService.exe - C:\Windows\System32\DriverStore\FileRepository\ki120591.inf_amd64_7a2f7b04e15632c2\igfxEM.exe - - "C:\Windows\sysnative\rundll32.exe" "C:\Windows\system32\WRusr.dll",SynProc - C:\Program Files (x86)\Webroot\WRSA.exe" -ul - "C:\Program Files (x86)\Webroot\WRSA.exe" -service - C:\Program Files (x86)\Webroot\WRSA.exe - - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe - C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe - - ScreenConnect.WindowsClient.exe - C:\Program Files (x86)\SmartGit - C:\Program Files (x86)\SmartGit - Vivaldi\Application\vivaldi.exe - controls\cef\ConnectWise.exe - - C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe - C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe - C:\Program Files (x86)\SyncedTool\bin\agent_service.exe - C:\Program Files (x86)\Notepad++\notepad++.exe - C:\Program Files\OpenVPN\bin\openvpn-gui.exe - C:\Program Files (x86)\Enpass\Enpass.exe - C:\Program Files (x86)\Enpass\Enpass.exe - C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe - C:\Program Files (x86)\Fortinet\FortiClient\scheduler.exe - C:\Program Files (x86)\Fortinet\FortiClient\FCHelper64.exe - C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe - C:\Program Files (x86)\SyncedTool\bin\agent_gui.exe - C:\Anchor Server\penv\Scripts\python.exe - C:\Anchor Server\redis\redis-server.exe - C:\Anchor Server\redis\redis-server.exe - C:\PostgreSQL9.1\bin\postgres.exe - C:\PostgreSQL9.1\bin\postgres.exe - C:\ProgramData\sysmon\sysmon64.exe - - 56BFB300BA379181CE09C3130775DFBBCAFF9DB764BDC39086C2FEC2547EE900 - - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\bitsadmin.exe - C:\Program Files\N-able Technologies\Windows Agent\bin\bitsadmin.exe - C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe - N-able Technologies\Windows Software Probe\bin\wsp.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AutomationManager.ScriptRunner64.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AutomationManager.ScriptRunner64.exe - C:\Program Files\N-able Technologies\AVDefender\installer\installer.exe - C:\Program Files\N-able Technologies\AVDefender\epupdateservice.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\ShadowProtectDataReader.exe - 3070E798134A11ADB01129F06A36CD924267E6DA95DAB2E3196105264D2BF818 - - \sysmon\Auto_Update.bat - \sysmon\Auto_Update.bat - ion-storm/sysmon-config - - \netlogon\ - \netlogon\ - C:\PROGRA~2\SAAZOD\SAAZMSMACTL.EXE - - net use - net.exe use - net1 use - net1.exe use - net time - net.exe time - net1 time - C:\Windows\system32\cmd.exe /c UsrLogon.cmd - C:\Program Files (x86)\MaaS360\Cloud Extender\EMSAgent.exe - C:\Program Files\Octopus Deploy\Tentacle\Tentacle.exe - chrome.nativeMessaging.out + + C:\Windows\System32\WerFault.exe + C:\Windows\System32\wbem\WmiPrvSE.exe + - + - - - + - C:\Users - C:\ProgramData - \Temp\ + C:\Users + C:\ProgramData + \Temp\ + \tmp\ + \drivers\ + \Download - + + C:\Windows\system32\backgroundTaskHost.exe - TrustedInstaller.exe - OneDrive.exe - vivaldi.exe - chrome.exe - C:\WINDOWS\system32\backgroundTaskHost.exe - setup + TrustedInstaller.exe + OneDrive.exe + vivaldi.exe + chrome.exe + C:\WINDOWS\system32\backgroundTaskHost.exe + setup + AppData\Local\Microsoft\Teams\current\Teams.exe + \AppData\Local\Microsoft\Edge SxS\Application\msedge.exe - + - - - - - - - + - - C:\Users - \temp\ - $RECYCLE.BIN - C:\ProgramData - C:\Perflogs\ - config\systemprofile\ - \Windows\Fonts\ - \Windows\IME\ - \Windows\addins\ - chrome.exe - iexplore.exe - firefox.exe - MicrosoftEdgeCP.exe - MicrosoftEdge.exe - explorer.exe - - unknown process - - at.exe - schtasks.exe - certutil.exe - cmd.exe - cscript.exe - wscript.exewscript.exe - rundll32.exe - notepad.exe - regsvr32.exe - regsvcs.exe - C:\Windows\system32\svchost.exe - mshta.exe - powershell.exe - psexe - pskill - psshutdown - psservice - PsPasswd - java.exe - msbuild.exe - installutil.exe - msiexec.exe - reg.exe - mstsc.exe - telnet.exe - SyncAppvPublishingServer.exe - Mavinject.exe - ssh.exe - putty.exe - kitty.exe - kitty_portable.exe - psftp.exe - tftp.exe - wmic.exe - net.exe - nbtstat.exe - dsquery.exe - driverquery.exe - infDefaultInstall.exe - sc.exe - auditpol.exe - qwinsta.exe - rwinsta.exe - - tor.exe - 185.41.154.130 - 37.252.190.176 - 82.118.17.235 - 83.163.164.15 - 69.163.34.173 - 159.89.151.231 - 212.47.246.229 - 84.40.112.70 - 2.137.16.245 - 199.249.223.62 - 185.22.172.237 - 88.99.216.194 - 185.13.39.197 - 162.247.72.201 - 174.127.217.73 - - - githubusercontent.com - github.com - - api.ipify.org - whatismyipaddress.com - edns.ip-api.com - checkip.dyndns.org - icanhazip.com - ifconfig.me - ifconfig.co - ipaddress.com - ipinfo.io - ident.me - api.ip.sb - www.myexternalip.com - ip.anysrc.net - wtfismyip.com - myexternalip.com - api.ip.sb - ipecho.net - checkip.amazonaws.com - goo.gl - git.io - bit.ly - t.co - ow.ly - ip-api.com - - dlinkddns.com - no-ip.com - no-ip.org - no-ip.biz - no-ip.info - noip.com - afraid.org - duckdns.org - changeip.com - ddns.net - hopto.org - zapto.org - servehttp.com - sytes.net - - onion.to - onion.cab - onion.sh - onion.nu - onion.direct - tor2web.org - tor2web.fi - tor2web.io - tor2web.blutmagie.de - tor-gateways.de - hiddenservice.net - - shodan - shadow - researchscan - census - sl-reverse - scanhub - .edu - 158.130.6. - 71.6.216. - 137.226.113. - 138.246.252. - 128.32.30. - 208.93.152. - 162.216.46. - 169.229.3. - 155.94.254. - 98.143.148. - 155.94.222. - 134.147.203. - 69.170.62. - 159.203.213. - 209.236.120. - 158.130.6 - - blazepool - blockmasters - blockmasterscoins - hashrefinery - miningpoolhubcoins - nicehash - yiimp - zergpool - zergpoolcoins - zpool - slushpool - minexmr - minergate - monero - prohash - dwarfpool - nanopool.org - mixpools.org - viaxmr.com - hashvault.pro - moriaxmr.com - suprnova.cc - mixpools.org - monero - usxmrpool - xmrpool - poolto.be - mineXMR - prohash.net - mine.bz - mypool.online - bohemianpool - mineXMR - iwanttoearn.money - pool.xmr - crypto-pool - miners.pro - minercircle.com - monero.lindon-pool.win - teracycle.net - ratchetmining.com - cryptmonero - mineXMR - - 80 - 443 - 3389 - 3540 - 22 - 23 - 25 - 139 - - 5800 - 5900 - 1194 - 1701 - 1723 - 1293 - 4500 - 1080 - 8080 - 3128 - 9001 - 9030 - 4443 - 2448 - 8143 - 1777 - 1443 - 243 - 65535 - 13506 - 3360 - 200 - 198 - 49180 - 13507 - 3360 - 6625 - 4444 - 4438 - 1904 - 13505 - 13504 - 12102 - 9631 - 5445 - 2443 - 777 - 13394 - 13145 - 12103 - 5552 - 3939 - 3675 - 666 - 473 - 5649 - 4455 - 4433 - 1817 - 100 - 65520 - 1960 - 1515 - 743 - 700 - 14154 - 14103 - 14102 - 12322 - 10101 - 7210 - 4040 - 9943 - - 7777 - 9943 - 666 + + + census + researchscan + scanhub + shadow + shodan + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + wscript.exe + + + + + + + + at.exe + schtasks.exe + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \temp\ + 127.0.0.1 + + + \wwwroot\ + + \Windows\addins\ + C:\Windows\repair\ + \htdocs\ + C:\Windows\system32\config\systemprofile\ + C:\Intel\Logs\ + C:\Windows\addins\ + C:\Windows\security\ + C:\Windows\Help\ + $RECYCLE.BIN + C:\Windows\Debug\ + C:\Windows\Fonts\ + C:\PerfLogs\ + :\$Recycle.bin\ + :\Users\Default\ + C:\Users\NetworkService\ + C:\Users\Public\ + C:\Windows\Media\ + \Windows\IME\ + C:\ProgramData + + + + + + + + CSC.exe + + + + + + + + + + infDefaultInstall.exe + SyncAppvPublishingServer.exe + + + InstallUtil.exe + + msiexec.exe + + + regasm.exe;regsvcs.exe + + + Mavinject.exe + + + + + + msbuild.exe + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + dsquery.exe + + + + + + + + + + + + + driverquery.exe + + + + nbtstat + + net.exe + net1.exe + + qwinsta.exe + rwinsta.exe + + + + + + + + + + + + true + 3389 + AutomationManager.ScriptRunner64.exe + C:\Program Files (x86)\VMware\VMware Remote Console\vmrc.exe + C:\Program Files\VMware\VMware Remote Console\vmrc.exe + C:\Program Files\WindowsApps\Microsoft.RemoteDesktop_ + CtxLicUsageRecorder.exe + FSAssessment.exe + FSDiscovery.exe + MobaRTE.exe + RDCMan.exe + RSSensor.exe + RTS2App.exe + RTSApp.exe + RemoteDesktopManager64.exe + RemoteDesktopManager.exe + RemoteDesktopManagerFree.exe + Terminals.exe + chrome.exe + mRemote.exe + mRemoteNG.exe + mstsc.exe + spiceworks-finder.exe + svchost.exe + thor64.exe + thor.exe + + + true + 3391 + AutomationManager.ScriptRunner64.exe + C:\Program Files (x86)\VMware\VMware Remote Console\vmrc.exe + C:\Program Files\VMware\VMware Remote Console\vmrc.exe + C:\Program Files\WindowsApps\Microsoft.RemoteDesktop_ + CtxLicUsageRecorder.exe + FSAssessment.exe + FSDiscovery.exe + MobaRTE.exe + RDCMan.exe + RSSensor.exe + RTS2App.exe + RTSApp.exe + RemoteDesktopManager64.exe + RemoteDesktopManager.exe + RemoteDesktopManagerFree.exe + Terminals.exe + chrome.exe + mRemote.exe + mRemoteNG.exe + mstsc.exe + spiceworks-finder.exe + svchost.exe + thor64.exe + thor.exe + + + putty.exe;kitty.exe;kitty_portable.exe + + + wsmprovhost.exe + + + psftp.exe + + reg.exe + psshutdown + PsPasswd + psservice + ssh.exe + psexe + tftp.exe + telnet.exe + mstsc.exe + wmic.exe + sc.exe + pskill + dsquery.exe + plink.exe + vnc.exe + vncviewer.exe + vncservice.exe + omniinet.exe + hpsmhd.exe + + + + + + + + + + + + + + + + + + + + + + + + + + + 50050 + true + + + 25 + \Bin\EdgeTransport.exe;Bin\MSExchangeFrontendTransport.exe + true + + + + + + + + + + + powershell.exe + 0:0:0:0:0:0:0:;127.0.0.1 + + mshta.exe + cmd.exe + certutil.exe + certutil.exe + notepad.exe + regsvcs.exe + regsvr32.exe + rundll32.exe + + + + + + + tor.exe + hiddenservice.net;onion.city;onion.direct;onion.direct;onion.link;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org;onion.to + + + + + + + + + + dns.google;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;doh.opendns.com;.quad9.net;dns.cleanbrowsing.org;dns-family.adguard.com;dns.adguard.com;.233py.com;dnscrypt;dnscrypt-cert.oszx.co;dns.oszx.co;doh.dns.sb;doh.defaultroutes.de;doh.tiarap.org;doh.tiar.app;doh.captnemo.in;.aaflalo.me;doh.appliedprivacy.net;doh.dnswarden.com;commons.host;dns.twnic.tw;ibuki.cgnat.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;.seby.io;rdns.faelix.net;doh.li;.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk;adblock.mydns.network;ibksturm.synology.me;jcdns.fun + + + + + + + privatlab.com + mega.nz;mega.co.nz + .pcloud.com + + + + + + + + + + + + + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool + + + + + C:\Windows\system32\svchost.exe + 3389 + 22 + 21 + 5985 + false + + + C:\Windows\system32\svchost.exe + true + 135 + 445 + 5985 + + + System + svchost.exe + 445 + + + System + svchost.exe;lsass.exe + 389 + + + C:\Windows\System32\lsass.exe + 389 + 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 + EXCH + 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 + false + + + notepad.exe + 127.0.0.1 + + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + 80 + 443 + true + + github + githubusercontent.com + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + 80 + true + + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + 443 + true + + + apache.exe + + + java.exe + + + w3wp.exe + + + \php-cgi.exe;\php.exe + + + setup + + + tomcat + + + unins + + + unknown process + + + explorer.exe + + + inetinfo.exe + + + netcat.exe;nc.exe;nc64.exe;ncat.exe + procdump + psexe + vnc;vncs;vncv + + rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe;advanced_port_scanner.exe;rcpping.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe + + + 0 + 5985 + 5986 + 1293 + 1701 + 1194 + 3540 + 3389 + 22 + 1080 + 3128 + 8080 + 1723 + 23 + 4500 + 9001 + 9030 + 5900 + 5800 + + 0 + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + 443 + true + + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + 80 + true + + 80 + 443 + 636 + 5900 + 443 + + afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com + + + udp + + + System;svchost.exe;oracle.exe;apache.exe;java.exe;php-cgi.exe;w3wp.exe;httpd;ServerManager.exe;unknown process;sql;wscript;cscript;schtasks;at.exe;reg.exe;C:\Windows\System32\find.exe + 127.0.0.1;0:0:0:0:0:0:0:1 + 127.0.0.1;0:0:0:0:0:0:0:1 + + + + C:\Windows\System32\lsass.exe + 88 + + + epmap + llmnr + microsoft-ds + netbios-dgm + ntp + ssdp + epmap + llmnr + microsoft-ds + netbios-dgm + ntp + ssdp + + 53 + 67 + 68 + 1434 + 1812 + 3544 + 3702 + 5228 + 5353 + 5357 + 5989 + 6007 + 49154 + 49209 + 52176 + 59241 + 53 + 67 + 68 + 1812 + 3702 + 6007 + 49154 + 49209 + 50646 + 52176 + 59241 - C:\Windows\System32\dns.exe - C:\Windows\System32\find.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeHMWorker.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeFrontendTransport.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\EdgeTransport.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeSubmission.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeFrontendTransport.exe - C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeDelivery.exe - - - + .bing.com + .cloudapp.net + .lync.com + .microsoft.com + .outlook.com + .search.msn.com + .wns.windows.com aps.windows.com - arc.msn.com arc.msn.com.nsatc.net + arc.msn.com atson.telemetry.microsoft.com au.download.windowsupdate.com b.akamaiedge.net - bing.com - cdn.onenote.net + bingforbusiness.com client-office365-tas.msedge.net config.edge.skype.com csp.digicert.com @@ -1250,8 +2412,8 @@ cy2.settings.data.microsoft.com.akadns.net displaycatalog.mp.microsoft.com download.windowsupdate.com - e3.delivery.dsp.mp.microsoft.com.nsatc.net e-msedge.net + e3.delivery.dsp.mp.microsoft.com.nsatc.net emdl.ws.microsoft.com ettings-win.data.microsoft.com fe2.update.microsoft.com @@ -1267,8 +2429,13 @@ ipv4.login.msa.akadns6.net licensing.mp.microsoft.com m3p.wns.notify.windows.com.akadns.net + microsoft.com.akadns.net + microsoft.com.nsatc.net + microsoft.com modern.watson.data.microsoft.com.akadns.net + msedge.net msn.com.nsatc.net + msn.com ocation-inference-westus.cloudapp.net ocos-office365-s2s.msedge.net ocsp.digicert.com @@ -1276,8 +2443,8 @@ oneclient.sfx.ms pv4.login.msa.akadns6.net query.prod.cms.rt.microsoft.com - ris.api.iris.microsoft.com ris.api.iris.microsoft.com.akadns.net + ris.api.iris.microsoft.com s-msedge.net settings.data.microsoft.com sfe.trafficshaping.dsp.mp.microsoft.com @@ -1290,100 +2457,20 @@ tsfe.trafficshaping.dsp.mp.microsoft.com vip5.afdorigin-prod-am02.afdogw.com vip5.afdorigin-prod-ch02.afdogw.com + virtualearth.net + windows.net windowsupdate.com y2.displaycatalog.md.mp.microsoft.com.akadns.net y2.licensing.md.mp.microsoft.com.akadns.net y2.settings.data.microsoft.com.akadns.net - msedge.net - windows.net - msn.com - virtualearth.net - bingforbusiness.com - outlook.com - lync.com - cloudapp.net - microsoft.com - ec2-34-204-73-148.compute-1.amazonaws.com - ec2-52-201-35-219.compute-1.amazonaws.com - ec2-34-230-137-236.compute-1.amazonaws.com - ec2-52-45-9-47.compute-1.amazonaws.com - ec2-52-71-74-246.compute-1.amazonaws.com - ec2-54-89-54-171.compute-1.amazonaws.com - eset.com - n-able.com - www.agentexchange.com - map2.hwcdn.net - C:\Windows\SysWOW64\SearchProtocolHost.exe - true - OneDrive.exe - Spotify.exe - AppData\Roaming\Dropbox\bin\Dropbox.exe - OneDriveStandaloneUpdater.exe - ConnectWise.exe - ScreenConnect.WindowsClient.exe - AppData\Roaming\Dashlane\Dashlane.exe - AppData\Roaming\Dashlane\DashlanePlugin.exe - Vivaldi\Application\vivaldi.exe - microsoft.com - microsoft.com.akadns.net - microsoft.com.nsatc.net - .search.msn.com - .wns.windows.com - akamaitechnologies.com - llmnr - ldap - ldap - epmap - epmap - 135 - 135 - ntp - ntp - llmnr - ssdp - ssdp - 5353 - netbios-ns - netbios-dgm - 1e100.net - 5228 - 5357 - 3544 - 3702 - 3702 - 50646 - 53 - 53 - 67 - 67 - 1812 - 1812 - 49154 - 49154 - 59241 - 59241 - 52176 - 52176 - 49209 - 49209 - 6007 - 6007 - C:\Program Files (x86)\SmartGit\jre\bin\java.exe - C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe - penv\Scripts\python.exe - efolder01 - 2080 - g2mcomm.exe - C:\Program Files (x86)\LabTech Client\LTClient.exe - C:\Windows\LTSvc\LTSVC.exe - C:\Program Files (x86)\Webroot\WRSA.exe - C:\Program Files (x86)\SmartGit\ - DSPro\Programs\pr001Celery98.exe - g2ax_comm_expert.exe - g2mcomm.exe - AppData\Local\Microsoft\Teams\current\Teams.exe - 53 + EdgeTransport.exe + MSExchangeDelivery.exe + MSExchangeFrontendTransport.exe + MSExchangeHMWorker.exe + MSExchangeSubmission.exe + \ + @@ -1391,1602 +2478,2559 @@ - - + - - C:\Users - C:\ProgramData - \Temp\ - Sysmon.exe - Sysmon64.exe + + C:\Windows\ + \System32\;Syswow64;sysmon.exe;sysmon64.exe;C:\Windows\System32\conhost.exe + + + C:\Windows\system32\ + config\systemprofile\ + + + C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe + + + A:\;B:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;N:\;O:\;P:\;Q:\;R:\;S:\;T:\;U:\;V:\;W:\;X:\;Y:\;Z:\;AA:\;BB:\;CC:\;DD:\;EE:\;FF:\;GG:\;HH:\;II:\;JJ:\;KK:\;LL:\;MM:\;NN:\;OO:\;PP:\;QQ:\;RR:\;SS:\;TT:\;UU:\;VV:\;WW:\;XX:\;YY;ZZ:\ + :\PROGRA~ + :\Program Files + :\Program Files + :\Program Files + :\ProgramData\ + :\Users\ + :\Windows\ + :\inetpub\ + :\$SysReset + :\$WinREAgent + :\inetpub\ + + + \ + + + C:\Users\ + + + C:\ProgramData\ + C:\ProgramData\sysmon\sysmon64.exe;C:\ProgramData\sysmon\sysmon.exe + + + C:\Program Files;C:\PROGRA~ + + + C:\inetpub\ + + + $RECYCLE.BIN + packetbeat.exe;metricbeat.exe;filebeat.exe;winlogbeat.exe;o365beat.exe;graylog-sidecar.exe;graylog-collector-sidecar.exe;splunkd.exe;splunk.exe;syslogng.exe;syslog-ng.exe;nxlog-processor.exe;snarecore.exe;fluentd;td-agent + C:\Windows\system32\config\systemprofile\ + C:\Windows\sysWOW64\config\systemprofile\ + \Temp\ + C:\Users\ - + + + + Microsoft\Teams\current\Teams.exe + \git.exe + Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe + C:\ProgramData\Lenovo\ImController\ + + - - - - + + + + 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e + + + 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5;c948ae14761095e4d76b55d9de86412258be7afd;c996d7971c49252c582171d9380360f2;ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1;10b30bdee43b3a2ec4aa63375577ade650269d25;d2fd132ab7bbc6bbb87a84f026fa0244 + + DumpExt.dll + mimidrv + lsremora + wceaux.dll + npcap + \Temp + :\Users + ChongKim Chan + ? + Revoked + Unavailable + Valid + false + + + - microsoft - Microsoft Windows - windows - Intel - Lenovo - Synaptic - Nvidia - Broadcom - AMD - VMware - Realtek - Micro-Star - Logitech - Asmedia - SteelSeries - Fortinet - Webroot - NoVirusThanks Company Srl - Invincea - ShoreTel - Synology - Citrix - SonicWall - Sophos - OpenVPN - + - - + - false - Invalid - Unavailable - C:\windows\system32\fxsst.dll - C:\Windows\System32\wbem\oci.dll - \Temp\ - NetshHelperBeacon - netsh.exe - rmnsoft.dll + + msdt.exe + sdiageng.dll + + + WINWORD.exe;EXCEL.EXE + VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wshom.ocx + wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll + + + ntkrnlmp.exe + + + \spool\drivers\x64\3\;\spool\drivers\W32X86\3\;\spool\drivers\IA64\3\ + spoolsv.exe;printisolationhost.exe + Valid + Brother Industries;Canon;Sharp;Microsoft Corporation;DYMO;Euro Plus d.o.o;HP Inc;Hewlett-Packard + + + EQNEDT32.EXE + EQNEDT32.EXE + + + ACTIVEDS.DLL;Adsldpc.dll + C:\Users;\Temp\;ProgramData + + + WINWORD.exe;EXCEL.EXE + VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wshom.ocx + wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll;fastprox.dll + + + WINWORD.exe;EXCEL.EXE + VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll + + + WINWORD.exe;EXCEL.EXE + VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll + + + WINWORD.exe;EXCEL.EXE + taskschd.dll + + + wscript.exe;cscript.exe + taskschd.dll + + + wmiprvse.exe + taskschd.dll + + + powershell.exe + msi.dll + + + powershell + amsi.dll + + + powershell + amsi.dll + + + WINWORD.exe;EXCEL.EXE + clr.dll + + + clr.dll;System.Management.ni.dll;Microsoft.Build.Utilities + + + wscript.exe;cscript.exe + msxml;wshom.ocx + + + wscript.exe;cscript.exe + winhttp.dll;mswsock.dll;IPHLPAPI.DLL + + + installutil.exe + CustomMarshalers.dll;CustomMarshalers.ni.dll;System.Management.ni.dll;WMINet_Utils.dll;mswsock.dll + + + System.Management.Automation.ni.dll + C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ + + + System.Management.Automation.dll + C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ + Lenovo.Vantage.AddinHost;\Microsoft.Sara.exe;C:\Program Files\CONEXANT + + + C:\Windows\System32\vaultcli.dll + \svchost.exe;\GameBar.exe;C:\Program Files\WindowsApps;\Microsoft\Teams\current\Teams.exe + + + \\ + + + \Microsoft\Word\Startup\ + .wll + + + \Microsoft\Excel\Startup\ + .xll + + + \Microsoft\Addins\ + .xla + + + tor-lib.dll + + + C:\Windows\System32\WinSCard.dll;C:\Windows\System32\cryptdll.dll;C:\Windows\System32\hid.dll;C:\Windows\System32\samlib.dll;C:\Windows\System32\vaultcli.dll + + + rundll32.exe + vaultcli.dll;wlanapi.dll + combase.dll + cryptdll.dll + imm32.dll + logoncli.dll + netapi32.dll + ntasn1.dll + ntdsapi.dll + samlib.dll + shcore.dll + srvcli.dll + + + odbc32.dll;winhttp.dll;netapi32.dll;SHLWAPI.dll + + + C:\Windows\Explorer.EXE + C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe + + + C:\ProgramData\ + C:\ProgramData\ + .exe + Adobe + C:\ProgramData\Lenovo\ + C:\ProgramData\Microsoft\Windows Defender\ + C:\ProgramData\sysmon\sysmon64.exe + + + C:\Users\Default\;C:\Users\Public\ + .exe + + + 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e + + + C:\Windows\System32\svchost.exe + false + + + Revoked + + + Expired + + + jscript9.dll + mshta.exe + + scrobj.dll + crypt0.dll + C:\Windows\System32\wlanapi.dll + C:\Windows\Microsoft.NET\assembly\GAC_MSIL + + - Valid - System32\samlib.dll - System32\cryptdll.dlll - microsoft - Microsoft Windows - windows - Intel - Lenovo - Synaptic - Nvidia - Broadcom - AMD - VMware - Realtek - Micro-Star - Logitech - Asmedia - SteelSeries - Fortinet - Microsoft - Microsoft - C:\Windows\System32\backgroundTaskHost.exe - Webroot - C:\Windows\System32\backgroundTaskHost.exe - C:\Windows\System32\mmc.exe - C:\Windows\System32\SearchFilterHost.exe - C:\Windows\System32\SearchProtocolHost.exe - C:\Windows\sysmon64.exe - C:\Windows\System32\inetsrv\w3wp.exe - C:\Windows\sysmon64.exe - C:\Windows\System32\conhost.exe - C:\Windows\System32\winspool.drv - C:\Windows\System32\wshqos. - C:\Windows\System32\wow64.dll - C:\Windows\System32\clusapi.dll - C:\Windows\System32\cryptdll.dll - C:\Windows\System32\wow64win.dll - C:\Windows\System32\wow64.dll - C:\Windows\System32\pcwum.dll - C:\Windows\System32\kernel32.dll - C:\Windows\System32\user32.dll - C:\Windows\System32\cryptdll.dll - C:\Windows\System32\dns.exe - C:\Windows\System32\zvprtmon5.dll - C:\Windows\System32\termsrv.dll - C:\Windows\System32\spool\ - samlib.dll - C:\Program Files (x86)\SmartGit - syntevo\SmartGit - Labtech Client - CrystalDecisions - ShoreWare - C:\Program Files\Microsoft SQL Server\100\Shared\dbghelp.dll - C:\Windows\System32\backgroundTaskHost.exe - C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe - C:\Program Files - C:\Windows\assembly\NativeImages - C:\Program Files\WindowsApps - - C:\Program Files (x86)\AutoSizer\AutoSizer.dll - C:\Program Files (x86)\Notepad++ - C:\Program Files (x86)\SyncedTool\bin\autoupdate.exe - C:\PostgreSQL9.1\bin\postgres.exe - C:\Windows\System32\VSSVC. - C:\Windows\System32\conhost.exe - C:\Windows\System32\svchost.exe - C:\Windows\System32\NETSTAT.EXE - C:\Windows\System32\inetsrv\w3wp.exe - C:\Windows\System32\tasklist.exe - C:\Windows\System32\nslookup.exe - C:\Windows\System32\find.exe - C:\cs\tools\php\php-cgi.exe - C:\Windows\System32\nbtstat.exe - C:\Windows\System32\dsquery.exe - C:\Windows\System32\netsh.exe - C:\Windows\System32\taskeng.exe - C:\ProgramData\sysmon\sysmon64.exe - SQL Server - SQL Server - Exchange Server - Exchange Server + + \Microsoft Office\ + \mscorlib.ni.dll + + + \Microsoft Office\ + \sppc.dll + + + C:\Windows\System32\svchost.exe + true + + + Fortinet + Lenovo + Sophos + mscorsvw.exe + C:\Program Files (x86)\Microsoft Office\root\Office15\officebackgroundtaskhandler.exe + C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe + C:\Program Files\Microsoft Office\root\Office15\officebackgroundtaskhandler.exe + C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe + C:\Windows\SysWOW64\SearchProtocolHost.exe + C:\Windows\System32\InstallAgentUserBroker.exe + C:\Windows\System32\RuntimeBroker.exe + C:\Windows\System32\SearchIndexer.exe + C:\Windows\System32\SettingSyncHost.exe + C:\Windows\System32\backgroundTaskHost.exe + C:\Windows\System32\sppsvc.exe + C:\Windows\System32\taskhost.exe + C:\Windows\System32\taskhostw.exe + C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe + C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe + HxTsr.exe + SearchUI.exe + C:\Program Files (x86)\Common Files\BIExcelFunctions1.1\32bit\Sage. + C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Pfx. + C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Adist64.dll + C:\Program Files (x86)\Microsoft Office\Office15\Library\Analysis\ANALYS32.XLL + C:\Program Files (x86)\Microsoft Office\Office16\Library\Analysis\ANALYS32.XLL + C:\Program Files\Microsoft Office\Office15\Library\Analysis\ANALYS32.XLL + C:\Program Files\Microsoft Office\Office16\Library\Analysis\ANALYS32.XLL + C:\Windows\SysWOW64\sppc.dll + Microsoft.Office.Interop.VisOcx.dll + Microsoft.Office.Interop.Word.dll + Microsoft.Vbe.Interop.dll + OFFICE.DLL - + - - - + - LoadLibrary - \ - 0B80 + + + 0x001A0000 + c:\windows\system32\lsass.exe + + + msiexec.exe + + + chrome.exe;firefox.exe;edge.exe;browser_broker.exe;iexplore.exe + + + 0x001A0000 + c:\windows\system32\lsass.exe + + + c:\windows\system32\lsass.exe + c:\windows\system32\rundll32.exe + + + DbgUiRemoteBreakin + nacl64.exe + + + QueryProcessDebugInformationRemote + nacl64.exe + + + isdebuggerpresent + nacl64.exe + + + DebugActiveProcess + nacl64.exe + + + LoadLibrary + C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe + C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe + C:\Windows\ImmersiveControlPanel\SystemSettings.exe + C:\Windows\System32\DriverStore\FileRepository\ + C:\Windows\System32\igfxEM.exe + C:\Windows\System32\igfxHK.exe + Enterprise\Common7\IDE\devenv.exe + + + CreateFileMapping;MapViewOfFile + + + LdrLoadDll + + + CryptAcquireContextA;CryptDecodeObjectEx;CryptImportPublicKeyInfo;CryptEncrypt;CryptGenKey;CryptDecrypt;CryptStringToBinary;CryptBinaryToString;CryptImportKey + + + c:\windows\system32\csrss.exe + CrtlRoutine + + 0B80 + 0C7C + 0C88 + c:\windows\system32\mstsc.exe + + - C:\Windows\system32\wbem\WmiPrvSE.exe - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe - C:\Windows\system32\svchost.exe - C:\Windows\system32\wininit.exe - C:\Windows\system32\csrss.exe - C:\Windows\system32\services.exe - C:\Windows\system32\winlogon.exe - C:\Windows\system32\audiodg.exe - Google\Chrome\Application\chrome.exe - FireSvc.exe - C:\Program Files (x86)\Webroot\WRSA.exe - controls\cef\ConnectWise.exe - C:\Program Files\N-able Technologies\AVDefender\epsecurityservice.exe - C:\Program Files\N-able Technologies\AVDefender\EPSecurityService.exe - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows SP1\avp.exe - C:\Program Files (x86)\Microsoft Visual Studio\2017\Enterprise\Common7\IDE\Remote Debugger\x64\msvsmon.exe - C:\Windows\System32\rdpclip.exe - C:\Windows\sysmon64.exe - C:\Windows\sysmon.exe + C:\Windows\SysWOW64\wbem\WmiPrvSE.exe + C:\Windows\system32\audiodg.exe + C:\Windows\system32\services.exe + C:\Windows\system32\svchost.exe + C:\Windows\system32\wbem\WmiPrvSE.exe + C:\Windows\system32\wininit.exe + C:\Windows\system32\winlogon.exe - + - - - - - - + - + - - - - + - :\Windows\System32\lsass.exe - :\Windows\System32\winlogon.exe - powershell.exe - verclsid.exe - VBE7.dll - CorperfmontExt.dll - + + + C:\Windows\System32\SHELL32.dll+9b5bd + \LocalBridge.exe + + + C:\Windows\System32\wshom.ocx+c8a0;C:\Windows\System32\wshom.ocx+c39d + + + C:\Windows\SYSTEM32\framedynos.dll+2cb3e + C:\Windows\system32\SgrmBroker.exe;C:\Windows\system32\SecurityHealthService.exe;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Windows\system32\services.exe;C:\Windows\system32\wininit.exe;C:\Windows\system32\sppsvc.exe;C:\Windows\System32\smss.exe;C:\Windows\system32\csrss.exe;C:\Windows\System32\svchost.exe + + + C:\Windows\SYSTEM32\framedynos.dll+2b496 + + + C:\Windows\SYSTEM32\dbgcore.DLL+6cfb + + + C:\Windows\System32\KernelBase.dll+de67e + + + ntdll.dll+a0044 + + + clr.dll+6c23;clr.dll+6b38 + + + C:\Windows\\SYSTEM32\ntdll.dll+;|C:\Windows\System32\KERNELBASE.dll+;|UNKNOWN( + ) + + + "UNKNOWN(;)|UNKNOWN( + ) + + + "UNKNOWN + 0x1F0FFF;0x1F1FFF;0x143A;0x1410;0x1010;0x1F2FFF;0x1F3FFF;0x1FFFFF + + + C:\Program Files;\Microsoft Office\Root\Office + \Microsoft Shared\VBA + C:\Program Files (x86)\Intuit\ + + + C:\Windows\system32\lsass.exe + 0x1FFFFF + UNKNOWN + WmiPerfClass.dll + C:\Windows\sysWOW64\wbem\wmiprvse.exe;C:\Windows\system32\wbem\wmiprvse.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe;WmiPerfClass.dll;C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files (x86)\Common Files\Adobe + + + C:\Windows\system32\lsass.exe + C:\Windows\system32\wsmprovhost.exe + + + C:\Windows\system32\lsass.exe + 0x1FFFFF + python27.dll;_ctypes.pyd;KERNELBASE.dll;ntdll.dll + + + C:\Windows\system32\lsass.exe + C:\Windows\SYSTEM32\ntdll.dll+4595c|C:\Windows\system32\KERNELBASE.dll+8185 + + + C:\Windows\system32\lsass.exe + C:\WINDOWS\SYSTEM32\ntdll.dll+ + ) + |C:\WINDOWS\System32\KERNELBASE.dll+;|UNKNOWN( + wow64.dll;)|C;Exchange.Diagnostics;Microsoft.Exchange + C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe;c:\windows\system32\inetsrv\w3wp.exe;MSExchangeHMHost.exe;C:\Windows\sysWOW64\wbem\wmiprvse.exe + + + C:\Windows\system32\winlogon.exe + 0x1F3FFF + C:\Windows\Microsoft.NET;UNKNOWN + + + .exe + C:\Windows\sysmon64.exe;C:\Windows\sysmon64.exe + 0x1C00 + + + C:\Windows\system32\lsass.exe + 0x1F1FFF + UNKNOWN + + + C:\Windows\system32\lsass.exe + 0x1010 + UNKNOWN + + + C:\Windows\system32\lsass.exe + 0x143A + UNKNOWN + + + C:\Windows\system32\lsass.exe + 0x1fffff + dbghelp.dll;dbgcore.dll + + + dbghelp.dll;dbgcore.dll + C:\Windows\system32\lsass.exe + C:\wfx32\ + + + powershell.exe + C:\Programdata\sysmon\sysmon64.exe;C:\Programdata\sysmon\sysmon.exe;C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe;\dismhost.exe + + + getasynckeystate + + + cmlua.dll + + + System.Management.Automation + C:\ProgramData\Microsoft\Windows Defender\platform\ + ctiuser.dll + C:\Program Files\Citrix\ConfigSync\ConfigSyncRun.exe + C:\Program Files\Microsoft\Exchange Server\V14\bin\ExSetupUI.exe + C:\Program Files\Microsoft\Exchange Server\V15\bin\ExSetupUI.exe + C:\Program Files\Microsoft\Exchange Server\V16\bin\ExSetupUI.exe + C:\Windows\SysWOW64\sdiagnhost.exe + C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe + C:\Windows\Temp\ExchangeSetup\ExSetupUI.exe + C:\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe + C:\Program Files\Microsoft Azure Active Directory Connect\AzureADConnect.exe + C:\Windows\system32\HOSTNAME.EXE + C:\Windows\system32\ROUTE.exe + C:\Windows\system32\query.exe + MsMpEng.exe + + + C:\Windows\system32\lsass.exe + comsvcs.dll + + + VBE7.dll;VBEUI.DLL;VBE7INTL.DLL + + + VBE6.dll;VBEUI.DLL;VBE6INTL.DLL + + + Office + verclsid.exe + VBE7.dll;VBEUI.DLL;VBE7INTL.DLL + |UNKNOWN( + 0x1FFFFF + + + C:\Program Files\Microsoft Office\Root\Office + C:\Windows\System32\KERNELBASE.dll+76516 + + + C:\Windows\System32\SHELL32.dll+ae3b9 + C:\WINDOWS\system32\sihost.exe + C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub + + UNKNOWN + + |UNKNOWN( + C:\WINDOWS\SYSTEM32\ntdll.dll+ + |C:\WINDOWS\System32\KERNELBASE.dll+ + ) + 0x1028;0x1fffff + + + winword.exe;excel.exe;powerpnt.exe + :\Windows\Microsoft.NET\Framework64\v2. + UNKNOWN + + + UNKNOWN + 0x147a + + + 0x0800 + + 0x0810 + + 0x0820 + + 0x810 + + 0x820 + cscript.exe + wscript.exe + jjs.exe + dump + mimikatz + CorperfmontExt.dll + + - - 0x40 - 0x101000 - 0x1000 - 0x1400 - 0x100000 - 0x3200 - 0x101400 - 0x101001 + + wmiprvse.exe + lsass.exe + + + lsass.exe + winlogon.exe + - C:\Windows\sysWOW64\wbem\wmiprvse.exe - C:\ProgramData\Microsoft\Windows Defender\platform\ - C:\Windows\system32\msiexec.exe - C:\Windows\system32\svchost.exe - C:\Windows\system32\spoolsv.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe - C:\Program Files\N-able Technologies\AVDefender\EPUpdateService.exe - taskmgr - wbem\wmiprvse.exe - \EMET_Service.exe - \EMET_GUI.exe - \procexp64.exe - processhacker - \Bin\FMS.exe - \Exchange Server\ - SQL - :\Windows\System32\smss.exe - :\Windows\system32\csrss.exe - :\Windows\system32\wininit.exe - \Google\Update\GoogleUpdate.exe - C:\Program Files (x86)\Webroot\WRSA.exe - C:\Program Files\Webroot\WRSA.exe - C:\Program Files\Windows Defender\MsMpEng.exe - C:\Program Files\Windows Defender\MsMpEng.exe - C:\Windows\Sysmon.exe - C:\Windows\Sysmon64.exe - - ScreenConnect + + lsass.exe + C:\Windows\system32\w32tm.exe;C:\Windows\System32\ping.exe;C:\Windows\System32\net.exe;C:\Windows\System32\net1.exe;C:\Windows\SYSTEM32\HOSTNAME.EXE;C:\Programdata\sysmon\sysmon.exe;C:\Programdata\sysmon\sysmon64.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\Program Files (x86)\BeAnywhere Support Express\;C:\Program Files (x86)\CheckPoint\;C:\Program Files (x86)\Common Files\Intuit\QuickBooks\;C:\Program Files (x86)\Fortinet\;C:\Program Files (x86)\Trend Micro\;C:\Program Files\Adobe\Adobe Creative Cloud Experience\;C:\Program Files\CheckPoint\;C:\Program Files\Fortinet\;C:\Program Files\Realtek;C:\Program Files\Trend Micro\;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Program Files (x86)\Lenovo\;snmpd.exe;taskmgr;:\Windows\System32\smss.exe;:\Windows\system32\wininit.exe;\Bin\FMS.exe; \EMET_GUI.exe;\EMET_Service.exe;\Google\Update\GoogleUpdate.exe;\RAAGTAPP.EXE;\controls\cef\ConnectWise.exe;C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe;C:\Program Files\Hewlett-Packard\AMS\service\hpqams.exe;C:\Program Files\Intel\SUR\WILLAMETTE\ESRV\esrv_svc.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\WINDOWS\system32\WerFault.exe;C:\WINDOWS\system32\taskkill.exe;C:\Windows\SysWOW64\WerFault.exe;C:\Windows\System32\snmp.exe;C:\Windows\system32\msiexec.exe;C:\Windows\system32\spoolsv.exe;C:\Windows\system32\svchost.exe + :\Windows\system32\sppsvc.exe :\Windows\system32\sdiagnhost.exe UNKNOWN(00007F - ShadowProtect - C:\Hlthpnt\bin\IM.exe - Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe - Common Files\Adobe\AdobeGCClient\AGSService.exe - C:\ProgramData\WebEx\webex\ - Dropbox\Update\DropboxUpdate.exe - LTSvc\LTSVC.exe - \Trusteer\Rapport\bin\RapportMgmtService.exe - Adobe\AdobeGCClient\AGMService.exe - NT-ware Shared\MomAdmSvc\MomAdmSvc.exe - \Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe + + C:\Windows\SYSTEM32\ntdll.dll + C:\Windows\SYSTEM32\win32u.dll + C:\Windows\SYSTEM32\wow64win.dll + - + - - - - + - C:\Windows\Prefetch - C:\Windows\System32\drivers - \Start Menu - \Startup - \Programs\Startup - \Content.Outlook\ - \Downloads\ - $RECYCLE.BIN - \Microsoft\Office\Recent - .dll - .ocx - .sys - .application - .appref-ms - .bat - .cmd - .com - .btm - .cmdline - .docm - .exe - .msc - .hta - .ws - .wsf - .wsh - .pptm - .ps1 - .ps1xml - .psc1 - .psd1 - .psm1 - .pssc - .cdxml - .sys - .reg - .docm - .xlsm - .xlam - .pptm - .potm - .pptm - .sldm - .scf - .appref-ms - .rdp - .vbs - .vb - .vbsript - .vbe - .js - .jse - proj - .sln - .xls - .ppt - .rft - .SettingContent-ms - C:\Users\Default - \Desktop - \Documents - C:\Windows\System32\Drivers - C:\Windows\SysWOW64\Drivers - C:\Windows\System32\GroupPolicy\Machine\Scripts - C:\Windows\System32\GroupPolicy\User\Scripts - C:\Windows\System32\Tasks - C:\Windows\System32\Wbem - C:\Windows\SysWOW64\Wbem - C:\Windows\System32\WindowsPowerShell - C:\Windows\SysWOW64\WindowsPowerShell - C:\Windows\Tasks\ - C:\Windows\System32\Tasks - C:\Windows\SysWow64\Tasks - C:\Windows\Minidump - Microsoft\Windows\WER\ - MEMORY.dmp - C:\Windows\AppPatch\Custom - .cmdline - C:\Windows\System32\ - - .ICL - .FON - .FOT - .ico - .lnk - .eml - .msg - .SCT - .SCR - .SHB - .SHS - .PAF - .JSE - .gadget - .cpl - .inf - - help_decrypt - help_restore - ReadDecryptFilesHere - howto_recover_file - recover_file_ - Recovery_file_ - how_to_decrypt - encryptor_raas_readme_liesmich - _how_recover_ - HOWTO_RESTORE_FILES_ - help_my_files - how_recover - HELP_TO_SAVE_FILES - DECRYPT_INSTRUCTIONS - YOUR_FILES.url - Coin.Locker.txt - _secret_code.txt - Decrypt_readme.txt - INSTUCCIONES_DESCRIFRADO - FILESAREGONE.txt - IAMREADYTOPAY.TXT - HELLOTHERE.TXT - READTHISNOW!!!.txt - SECRETIDHERE.KEY - IHAVEYOURSECRET.KEY - SECRET.KEY - HELPDECRYPT_YOUR_FILES.HTML - RECOVERY_FILES.TXT - RECOVERY_FILE. - HowtoRestore_Files - restorefiles - howrecover+ - recoveryfile - help_recover_instructions - _Locky_recover - help_decrypt - help_restore - .CRAB - .cerber - help_decrypt - help_restore_files - HELP_YOUR_FILES - ReadDecryptFilesHere - howto_recover_file - recover_file - Recovery_File_ - HOW_TO_DECRYPT_ - DecryptAllFiles - encryptor_raas_readme_liesmich - _how_recover_ - HOWTO_RESTORE_FILES_ - help_my_files - how_recover - HELP_TO_SAVE_FILES - DECRYPT_INSTRUCTIONS - INSTUCCIONES_DESCRIFRADO - YOUR_FILES.url - Coin.Locker.txt - _secret_code.txt - Decrypt_readme.txt - FILESAREGONE.txt - IAMREADYTOPAY.TXT - HELLOTHERE.TXT - READTHISNOW!!!.txt - SECRETIDHERE.KEY - IHAVEYOURSECRET.KEY - SECRET.KEY - HELPDECRYPT_YOUR_FILES.HTML - RECOVERY_FILES.TXT - RECOVERY_FILE. - HowtoRestore_File - restorefiles_ - howrecover+ recoveryfile_ - recoverfile_ - help_recover_instructions - _ReCoVeRy_+ - _Locky_recover - .zzzzz - aeroware - howto_recover_file - _how_recover_ - HOWTO_RESTORE_FILES - help_my_files - how_recover - HELP_TO_SAVE_FILES - DECRYPT_INSTRUCTIONS - YOUR_FILES.url - Coin.Locker.txt - _secret_code.txt - Decrypt_readme.txt - FILESAREGONE.txt - IAMREADYTOPAY.TXT - HELLOTHERE.TXT - READTHISNOW!!!.txt - SECRETIDHERE.KEY - IHAVEYOURSECRET.KEY - SECRET.KEY - HELPDECRYPT_YOUR_FILES.HTML - RECOVERY_FILES.TXT - restorefiles - howrecover+ - restorefiles - contains(to_string($message.file_created), "howrecover+ - restorefiles - help_recover_instructions - _Locky_recover - !!!READ_TO_UNLOCK!!!.TXT - openforyou@india.com - .warn_wallet - hacks.at.sigaint.org - .MATRIX - Crytp0l0cker - decrypted_files.dat - padcrypt - Vape Launcher.exe - READ_ME_!.txt - .enjey - Aescrypt.exe - PINGY@INDIA.COM - WORMKILLER@INDIA.COM.XTBL - CEBER3 - IF_WANT_FILES_BACK_PLS_READ.html - _HELP_HELP_HELP_ - zXz.html - HELP_ME_PLEASE.txt - !_RECOVERY_HELP_!.txt - PLEASE-READIT-IF_YOU-WANT.html - .filegofprencrp - COME_RIPRISTINARE_I_FILE. - fattura_ - _steaveiwalker@india.com_ - COMO_ABRIR_ARQUIVOS.txt - info@kraken.cc_worldcza@email.cz - COMO_RESTAURAR_ARCHIVOS - What happen to my files.txt - ASSISTANCE_IN_RECOVERY - _DECRYPT_ASSISTANCE_ - _HELP_HELP_HELP_ - BTC_DECRYPT_FILES - .TheTrumpLocker - READ-READ-READ - .weencedufiles - .powned - [KASISKI] - INSTRUCCIONES - _USE_TO_FIX_ - .happydayzz - 001-READ-FOR-DECRYPT-FILES - DECRYPT_INFORMATION - Rans0m_N0te_Read_ME - wowwhereismyfiles - decryptional - wowreadfordecryp - .HERMES - _DECRYPT_INFO_szesnl - 000-IF-YOU-WANT-DEC-FILES - .evillock - .letmetrydecfiles - .yourransom - .lambda_l0cked - .gefickt - .sigaint.org - .HakunaMatata - .CRYPTOSHIELD - .weareyourfriends - MERRY_I_LOVE_YOU_BRUCE.hta - How decrypt files.hta - unCrypte - decipher_ne - .paytounlock - TRY-READ-ME-TO-DEC - protonmail.ch - LEER_INMEDIATAMENTE - .killedXXX - .doomed - 000-No-PROBLEM-WE-DEC-FILES - .noproblemwedecfiles - WE-MUST-DEC-FILES - powerfulldecrypt - opensourcemail.org - READ_ME_TO_DECRYPT_YOU_INFORMA - file0locked - CryptoRansomware - .VBRANSOM - _HELP_Recover_Files_ - .oops - .deria - .RMCM1 - Locked-by-Mafia - -filesencrypted - decrypt_Globe - .hnumkhotep - .decrypt2017 - DecryptFile - .L0CKED - 1025-7152.exe - firstransomware.exe - HELP-ME-ENCED-FILES - helpmeencedfiles - EdgeLocker - .XBTL - .firecrypt - YOUR_FILES_ARE_DEAD - .airacropencrypted! - @mail.ru - WHERE-YOUR-FILES - Whereisyourfiles - india.com - _README.hta - _README.jpg - HOW_OPEN_FILES - .gangbang - GJENOPPRETTING_AV_FILER - !!! HOW TO DECRYPT FILES !!! - .braincrypt - INSTRUCTION RESTORE FILE - Survey Locker.exe - Receipt.exe - WindowsApplication1.exe - HWID Lock.exe - VIP72.exe - DALE_FILES.TXT - HOW_TO_RESTORE_YOUR_DATA - RESTORE_CORUPTED_FILES - Cyber SpLiTTer Vbs.exe - 000-PLEASE-READ-WE-HELP - .VforVendetta - popcorn_time.exe - OSIRIS- - DesktopOsiris - inbox.ru - .no_more_ransom - .lovewindows - .osiris - .R.i.P - Important!.txt - !_HOW_TO_RESTORE_ - HOW_TO_RESTORE_FILES - HOWTO_RECOVER_FILES_ - HELP_RESTORE_FILES_ - ThxForYurTyme - _HOW_TO_Decrypt - _RECOVER_INSTRUCTIONS - DECRYPTION INSTRUCTIONS. - decrypt explanations. - _WHAT_is.html - _HOWDO_text.html - readme_liesmich_encryptor_raas - _Adatok_visszaallitasahoz_utasitasok - README_TO_RECURE_YOUR_FILES - Your files encrypted by our friends !!!.txt - README HOW TO DECRYPT YOUR FILES.HTML - READ_IT.txt - !Recovery_ - ATTENTION.url - README!!! - email-salazar_slytherin10 - ._AiraCropEncrypted! - README_RECOVER_FILES_ - _HOWDO_text.html - _HOWDO_text.bmp - _HOWDO_text.html - zzzzzzzzzzzzzzzzzyyy - zycrypt. - decrypt your file - _H_e_l_p_RECOVER_INSTRUCTIONS+ - HOW-TO-DECRYPT-FILES.HTML - HOW_TO_DECRYPT.HTML - exit.hhr.obleep - UnblockFiles.vbs - README_DECRYPT_HYDRA_ID_ - DECRYPT_Readme.TXT.ReadMe - Decrypt All Files - HowDecrypt.gif - HELP_YOURFILES.HTML - HOW TO DECRYPT FILES.HTML - BUYUNLOCKCODE - BitCryptorFileList.txt - How_to_decrypt_your_files.jpg - How_to_restore_files.hta - Como descriptografar seus arquivos.txt - !Recovery_ - Read_this_file.txt - ATTENTION!!!.txt - HELP_DECRYPT.lnk - how to decrypt aes files.lnk - restore_files.txt - HowDecrypt.txt - wie_zum_Wiederherstellen_von_Dateien.txt - paycrypt.bmp - maxcrypt.bmp - how_decrypt.gif - how to get data.txt - help_recover_instructions - help-file-decrypt.enc - enigma_encr.txt - enigma.hta - default432643264.jpg - default32643264.bmp - decypt_your_files.html - de_crypt_readme.txt - de_crypt_readme.html - de_crypt_readme.bmp - cryptinfo.txt - crjoker.html - _how_recover - _Locky_recover_instructions.bmp - _H_e_l_p_RECOVER_INSTRUCTIONS - _HELP_instructions.txt - _HELP_instructions.bmp - _DECRYPT_INFO_ - Your files encrypted by our friends !!! txt - Your files are locked !.txt - Your files are locked !!.txt - Your files are locked !!!.txt - Your files are locked !!!!.txt - YOUR_FILES_ARE_LOCKED.txt - YOUR_FILES_ARE_ENCRYPTED.TXT - YOUR_FILES_ARE_ENCRYPTED.HTML - YOUGOTHACKED.TXT - UNLOCK_FILES_INSTRUCTIONS.txt - UNLOCK_FILES_INSTRUCTIONS.html - SIFRE_COZME_TALIMATI.html - SHTODELATVAM.txt - Read Me (How Decrypt) !!!!.txt - RESTORE_FILES_ - READ_THIS_TO_DECRYPT.html - README_HOW_TO_UNLOCK.TXT - README_HOW_TO_UNLOCK.HTML - README_DECRYPT_UMBRE_ID_ - README_DECRYPT_HYRDA_ID_ - READ ME FOR DECRYPT.txt - READ IF YOU WANT YOUR FILES BACK.html - Payment_Instructions.jpg - ONTSLEUTELINGS_INSTRUCTIES.html - OKSOWATHAPPENDTOYOURFILES.TXT - MENSAGEM.txt - KryptoLocker_README.txt - Instructionaga.txt - ISTRUZIONI_DECRITTAZIONE.html - INSTRUCTIONS_DE_DECRYPTAGE.html - INSTRUCCIONES_DESCIFRADO.html - INSTALL_TOR.URL - IMPORTANT.README - IMPORTANT READ ME.txt - Howto_RESTORE_FILES.html - How to decrypt your data.txt - How to decrypt LeChiffre files.html - Help Decrypt.html - Hacked_Read_me_to_decrypt_files.html - HOW_TO_UNLOCK_FILES_README_ - HOW_TO_RESTORE_FILES.html - HOW_DECRYPT.URL - HOW_DECRYPT.TXT - HOW_DECRYPT.HTML - HOWTO_RECOVER_FILES_ - HOW TO DECRYPT FILES.txt - HELP_YOUR_FILES.html - HELP_YOUR_FILES.PNG - HELP_TO_SAVE_FILES.bmp - HELP_RESTORE_FILES_ - HELP_DECRYPT.URL - HELP_DECRYPT.PNG - HELP_DECRYPT.HTML - GetYouFiles.txt - File Decrypt Help.html - FILES_BACK.txt - ENTSCHLUSSELN_HINWEISE.html - DecryptAllFiles - DESIFROVANI_POKYNY.html - DECRYPT_YOUR_FILES.txt - DECRYPT_YOUR_FILES.HTML - DECRYPT_ReadMe1.TXT - DECRYPT_INSTRUCTIONS.html - DECRYPT_INSTRUCTION.URL - DECRYPT_INSTRUCTION.HTML - DECRYPTION_HOWTO.Notepad - Comment débloquer mes fichiers.txt - BUYUNLOCKCODE.txt - AllFilesAreLocked - @ukr.net - .fuckyourdata - .encrypted.locked - .Where_my_files.txt - .RSplited - .KEYZ.KEYH0LES - .How_To_Get_Back.txt - .How_To_Decrypt.txt - .Contact_Here_To_Recover_Your_Files.txt - .31392E30362E32303136_ - # DECRYPT MY FILES #.vbs - # DECRYPT MY FILES #.txt - # DECRYPT MY FILES #.html - !Where_are_my_files!.html - !!!README!!! - !!!-WARNING-!!!.txt - !!!-WARNING-!!!.html - .magic_software_syndicate - maestro@pizzacrypts.info - howtodecryptaesfiles.txt - .SecureCrypted - decrypt-instruct - files_are_encrypted. - decryptmyfiles - help_instructions. - de_crypt_readme. - !recover! - recover}- - _help_instruct - _recover_ - +recover+ - warning-!! - decrypt my file - help_file_ - recovery+ - readme_for_decrypt - install_tor - readme_decrypt - howtodecrypt - howto_restore - how_to_recover - how_recover - how_to_decrypt - how to decrypt - help_restore - help_your_file - help_recover - help_decrypt - decrypt_instruct - cryptolocker. - recover_instruction - .hydracrypt_ID - .cryptotorlocker - .one-we_can-help_you - .OMG! - .nochance - .LOL! - .CryptoTorLocker2015! - .{CRYPTENDBLACKDC} - vault.txt - vault.key - recovery_key.txt - vault.hta - message.txt - recovery_file.txt - confirmation.key - enc_files.txt - last_chance.txt - want your files back. - _Locky_recover_instructions.txt - help_recover_instructions - recoverfile - Howto_Restore_FILES.TXT - recoveryfile - _how_recover.txt - .SUPERCRYPT - .helpdecrypt - only-we_can-help_you - .fileiscryptedhard - .blocatto - .8lock8 - ==READ==THIS==PLEASE== - randomname - .weapologize - SORRY-FOR-FILES - PLEASE-READ-WE-HELP. - CHECK-IT-HELP-FILES - HAPPEN-ENCED-FILES - HELP-ME-ENCED-FILES - PLS-DEC-MY-FILES - WE-MUST-DEC-FILES - No-PROBLEM-WE-DEC-FILES - TRY-READ-ME-TO-DEC - IF-YOU-WANT-DEC-FILES - LET-ME-TRY-DEC-FILES - READ-FOR-DECRYPT-FILES - PLEASE-READIT-IF_YOU-WANT - READ-READ-READ - WANT_FILES_BACK - READ-FOR-DECCCC-FILESSS - PLEASE-README-AFFECTED-FILES - _DEC_FILES. - .notfoundrans - .VforVendetta - .theworldisyours - .helpmeencedfiles - .wowwhereismyfiles - .wowreadfordecryp - .powerfulldecrypt - .noproblemwedecfiles - .weareyourfriends - .otherinformation - .letmetrydecfiles - .encryptedyourfiles - .weencedufiles - .filegofprencrp - .iaufkakfhsaraf - .cifgksaffsfyghd - .skjdthghh - .ransom - .breeding123 - .mention9823 - .suppose666 - .moments2900 - .country82000 - .supported2017 - .prosperous666 - .disposed2017 - .myrandsext2017 - .loveransisgood - .areyoulovemyrans - .stubbin - .berkshire - - \www.exe - \ps.exe - \nt.exe - \doliohdyjkajd.dll - \run2.exe - \ping2.exe - + + + \TEMP\nessus_ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + solarwinds.businesslayerhost + .exe;.dll;.ps1;.mz;.jpg;.png + + + C:\WINDOWS\SysWOW64\netsetupsvc.dll + + + C:\Windows\SoftwareDistribution + .exe + + + proj + .targets + .build + .props + .tasks + .sln + .cs + + + + + + + .bat + .btm + .cmd + .com + .cmdline + .bas + .bin + C:\Windows\SysWOW64\Wbem + C:\Windows\System32\Wbem + .ws + .wsc + .wsf + .wsh + .pif + + .hta + + IronPython + .py + .pyc + .pyd + + + .cdxml + .ps1 + .ps1xml + .psc1 + .psd1 + .psm1 + .pssc + + + powershell.exe;powershell_ise.exe + + C:\Windows\SysWOW64\WindowsPowerShell + C:\Windows\System32\WindowsPowerShell + c:\Windows\System32\WindowsPowerShell\v1.0\profile + c:\Windows\Syswow64\WindowsPowerShell\v1.0\profile + \UsageLogs\powershell.exe.log + PSReadLine\ConsoleHost_history.txt + + .vbs + .oracle_jre_usage\ + .js + .jse + .vb + .vbe + .vbsript + + + + + Report.wer.tmp + \WER\ + C:\Windows\system32\wermgr.exe + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe + .exe + C:\Users + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe + .dll + C:\Users + + + + + + + + + + + !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;==READ==THIS==PLEASE==;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy + + crackmapexec + \Crypto.Cipher._AES.pyd + \Crypto.Cipher._DES.pyd + \Crypto.Hash._SHA256.pyd + \Crypto.Random.OSRNG.winrandom.pyd + \Crypto.Util.strxor.pyd + \crackmapexec.exe.manifest + \greenlet.pyd + BootStrapDLL.dll + C:\windows\temp\wininit.exe + lazycat;powerkatz;mimikatz;mimidrv;mimilove;mimilib;mimikittenz;mimiauth;invoke-mimi + rdpwrap.dll + winspool.drv + + C:\Windows\System32\Wbem + C:\Windows\SysWOW64\Wbem + C:\WINDOWS\system32\wbem\scrcons.exe + + + + + \Programs\Startup\ + \Startup\ + + + + + + + + + + + + \Word\STARTUP\ + \Microsoft\Templates\ + \Excel\XLSTART\ + .dotm + .XLSB + + + C:\Windows\Tasks\ + + + w3wp.exe + .aspx + \wwwroot\aspnet_client\ + + + w3wp.exe + .php + + + w3wp.exe + .aaa + + + \wwwroot\aspnet_client\ + .aspx;.php + + + \wwwroot\ + \wwwroot\aspnet_client\;jpg + + + .asp + \wwwroot\ + + + .aspx + \wwwroot\ + + \ecp\auth\ + \oab\auth\ + ClientAccess\Owa\ + \owa\auth\ + httpproxy\rpc\ + ClientAccess\ecp\ + \htdocs\ + + + + + + + + + + + + + + + .SPL + spoolsv.exe;printfilterpipelinesvc.exe;printisolationhost.exe;splwow64.exe;msiexec.exe;poqexec.exe + + + spoolsv.exe + .exe + C\:\Windows\System32\spool\;C\:\Windows\Temp\;C\:\Users\ + + + msiexec.exe + \Microsoft\Edge\Application + elevation_service.exe + + + + + + + + + + + + + + + + + + + + + + + + + \LocalState\rootfs\ + + + + C:\PerfLogs\ + C:\Temp\ + C:\Users\Default\ + C:\Users\Public\ + C:\Windows\Temp\ + \AppData\Temp\ + + $Recycle.Bin + $Recycle.Bin + + C:\Windows\ + \config\systemprofile\ + + + C:\Windows\ + \config\systemprofile\ + + + + + + + + + + + + + + + + + .chm + + + + + + + proj + .sln + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + UMWorkerProcess.exe;UMService.exe + . + .log;.cfg;.txt;cleanup;.HealthCheck;\wp.active;.db + + + + + + + + + + + + + + .7z + .7zip + .arj + .s7z + .a + .ace + .ar + .arc + .bin + .cab + .pak + .gz + .img + .iso + .lzm + .lzma + Temp\Rar$ + .rar + RarSFX + .sfx + .sz + .tar + .tar.gz + .xz + .zip + + + + + + + + + + + + + .ost + .eml + .msg + .pst + + + + + + + + + + Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք + + + + + + + Teamviewer.exe + rundll32.exe + mstsc.exe + cmd.exe + ipy.exe + WScript.exe + cscript.exe + mshta.exe + python.exe + wmic.exe + + + + + + + HiddenService + torrc + \tor.exe + tor-gencert + + + + + + + + + + + + + + + + rclone + s3browser + grabff.exe + grabff.exe + + + + + + RESTORE_;_FILES.txt + + + DECRYPT_;_FILES.txt + + + \run.dat;\task.dat;\storage.dat + AppData + Symantec + BlueJeans + + + VBoxRT.dll;VboxC.dll + + + + + + + + + + + + + + Content.IE5;INetCache + .exe;.zip;.ps1;.bat;.rar;.dll + + + MSForms.exd + + + .exe + C:\windows\system32\ + + + .exe + C:\windows\ + \system32\ + + + .dll;.exe + C:\windows\ + C:\Users\ + + + .dll;.exe + C:\Users\ + + + \Microsoft\Word\Startup\ + .wll + + + C:\windows\system32\CodeIntegrity\ + + + \Microsoft\Excel\Startup\ + .xll + + + \Microsoft\Outlook\VbaProject.OTM + + + \Microsoft\Addins\ + .xla + + + .vsto + + + .bat + C:\Windows\ + C:\ProgramData\Lenovo\SystemUpdate\sessionSE\ + + + .dll + C:\Windows\ + + + .sys + C:\Windows\ + + + .exe + C:\Windows\ + C:\Windows\System32\;C:\windows\syswow64\ + + + .exe + C:\Windows\System32\ + + + .exe + C:\Windows\SysWow64\ + + + .theme + + + \Packages\oice_ + + + VirtualboxVM.exe + + notepad++.exe + .lnk:Zone.Identifier + \UsageLogs\cscript.exe.log + \UsageLogs\mshta.exe.log + \UsageLogs\msiexec.exe.log + \UsageLogs\regsvr32.exe.log + \UsageLogs\rundll32.exe.log + \UsageLogs\svchost.exe.log + \UsageLogs\wmic.exe.log + \UsageLogs\wscript.exe.log + \regsvr32.exe.log + \UsageLogs\wsmprovhost.exe.log + .lnk + .url + + .sys + .inf + C:\Windows\SysWOW64\Drivers + C:\Windows\System32\Drivers + \Drivers\ + .drv + + .xlam + .xlsm + .xla + .xll + .xls + .xlsb + .xlsx + .xlt + .xltm + .xlw + \Microsoft\Templates\ + .eml + .msg + .pptm + .potm + .pptm + .pptm + .sldm + \Microsoft\Office\Recent + oleObject + \Downloads\ + \Content.Outlook\ + .docb + .wbk + .ped + .dot + .dotx + .doc + .docm + .docx + + .accdb + .accde + .accdr + .accdt + .mdb + .mde + .msc + .mst + .potx + .ppam + .ppsm + .ppsx + .ppt + .pptm + .pptx + .pub + .sldm + .sldx + .xls + .xps + - .pem - .crt - .ca-bundle - .cer - .csr - .der - .p7b - .p7r - .p7s - .pfx - .sto - .p12 - .crl - .sst - .key - - .mht - .cpl - .scr - .manifest - .inf - HammerDrillStatus.dll - PSReadLine\ConsoleHost_history.txt - - - - - C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates\ - \Downloads - \Start Menu - \Start Menu\Programs - \Start Menu\Programs\Startup - - C:\Windows\System32\svchost.exe - C:\Windows\System32\smss.exe - \Microsoft\Windows\INetCache\IE - \Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\Certificates - WRITABLE.TST - C:\Windows\System32\wbem\Performance\ - C:\Windows\System32\DriverStore\Temp\ - C:\Windows\System32\wbem\Performance\ - WRITABLE.TST - .SQM - .SPL - .SHD - C:\Program Files (x86)\EMET 5.5\EMET_Service.exe - C:\Windows\system32\mobsync.exe - C:\Windows\Installer\ - - C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask - - C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\ - .etl - .log - C:\WINDOWS\winsxs\amd64_microsoft-windows - Firefox Setup - C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - C:\Windows\System32\config\netlogon.ftl - \\?\C:\Windows\system32\wbem\WMIADAP.EXE - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe - C:\Windows\system32\CompatTelRunner.exe - C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn\sqlservr.exe - C:\Windows\System32\smss.exe - C:\Program Files (x86)\MSI\Help Desk\MSI Update Agent.exe - C:\Program Files (x86)\MSI\Dragon Center\Dragon Center.exe - C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe - - C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe - - C:\Windows\system32\igfxCUIService.exe - - Google\Chrome\User Data\Safe Browsing\UrlUws.store_new - Google\Chrome\User Data\Safe Browsing\UrlMalBin.store_new - Google\Chrome\User Data\Safe Browsing\UrlMalware.store_new - Google\Chrome\User Data\Safe Browsing\UrlSoceng.store_new - Google\Chrome\User Data\Safe Browsing\ChromeExtMalware.store_new - Google\Chrome\User Data\Safe Browsing\ChromeFilenameClientIncident.store_new - Google\Chrome\User Data\Safe Browsing\ChromeUrlClientIncident.store_new - Google\Chrome\User Data\Safe Browsing\IpMalware.store_new - Google\Chrome\User Data\Safe Browsing\UrlSubresourceFilter.store_new - Google\Chrome\User Data\Safe Browsing\UrlCsdWhitelist.store_new - Google\Chrome\User Data\Safe Browsing\UrlCsdDownloadWhitelist.store_new - Google\Chrome\User Data\Safe Browsing\CertCsdDownloadWhitelist.store_new - .default\prefs-1.js - - C:\Windows\System32\Tasks\Adobe Acrobat Update Task - C:\Windows\System32\Tasks\Adobe Flash Player Updater - - C:\Program Files (x86)\ConnectWise\PSA.net\ConnectWise.exe - - C:\Program Files\Datto\Datto Windows Agent\DattoBackupAgent.exe - - C:\Windows\System32\config\systemprofile\TOSHIBA\ - TOSHIBA\eSTUDIOX\UNIDRV - N-able Technologies\AVDefender\ThreatScanner\Antivirus-NewTemp\bdcore.dll - N-able Technologies\AVDefender\ThreatScanner\Antivirus-NewTemp\scanclient.dll - C:\Program Files (x86)\N-able Technologies\Windows Software Probe\Repository\nagent - C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\ - C:\Program Files (x86)\MaaS360\Cloud Extender\EMSAgent.exe - C:\Program Files\graylog\collector-sidecar\winlogbeat.exe - C:\Program Files\N-able Technologies\Endpoint Update Server\bin\EPUpdateServer.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\AVDefender\Installer.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AutomationManager.ScriptRunner64.exe - C:\Program Files (x86)\StorageCraft\ShadowProtect\ShadowSnap\raw_agent_svc.exe - C:\Windows\system32\printfilterpipelinesvc.exe - C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Bin\updateservice.exe - \Runtime\1.0\NodeRunner.exe + + .pem + .crt + .ca-bundle + .cer + .csr + .der + .p7b + .p7r + .p7s + .pfx + .sto + .p12 + .crl + .sst + .key + + + + .hlp + ACLUI.DLL.UI + ACLUI.DLL + AFLogVw.exe + AShld.exe + AShldRes.DLL.asr + AShldRes.DLL + AhnI2.dll + CamMute.exe + CommFunc.dll + CommFunc.jax + DESqmWrapper.dll + DESqmWrapper.wrapper + FSPMAPI.dll.fsp + FSPMAPI.dll + Gadget.exe + LoLTWLauncher.exe + Mc.exe + McUtil.dll.ping + McUtil.dll.url + McUtil.dll + MpSvc.dll + MsMpEng.exe + NtUserEx.dat + NtUserEx.dat + NtUserEx.dll + NtUserEx.dll + NvSmart.exe + NvSmartMax.dll + NvSmartMax.dll + NvSmartMaxapp.dll + OInfo11.ISO + OInfo11.ocx + OInfoP11.exe + OleView.exe + OleView.exe + POETWLauncher.exe + RasTls.dll.config + RasTls.dll.msc + RasTls.dll + RasTls.exe + RunHelp.exe + Sidebar.dll.doc + Sidebar.dll + Ushata.dll + Ushata.exe + Ushata.fox + VeetlePlayer.exe + boot.ldr + chrome_frame_helper.dll.rom + chrome_frame_helper.dll + chrome_frame_helper.exe + dvcemumanager.exe + fsguidll.exe + fslapi.dll.gui + fslapi.dll + fsstm.exe + hccutils.dll.res + hccutils.dll + hha.dll.bak + hha.dll + hhc.exe + hkcmd.exe + iviewers.dll + jli.dll + libvlc.dll + mPclient.dll + mcf.ep + mcf.exe + mcupdui.exe + mcut.exe + mcutil.dll.bbc + mcvsmap.exe + msi.dll.dat + msi.dll + msseces.asm + msseces.exe + mtcReport.ktc + rc.dll + rc.exe + rc.hlp + sep_NE.exe + sep_NE.slf + tplcdclr.exe + winmm.dll + wts.chm + credwiz.exe + + ssMUIDLL.dll + aepic.dll + ftllib.dll + userenv.dll + \Terminal Server Client\Cache\ + C:\Windows\Prefetch + \\tsclient + C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ + \Temp\debug.bin + Temp\7z + C:\Windows\AppPatch\Custom + .chm + .cpl + .mht + \Chrome\User Data\Default\Extensions\ + .crx + .appref-ms + .gadget + .JSE + .exe + .scf + Exchange Server\ClientAccess\Owa\ + \Device\HarddiskVolumeShadowCopy + .zip\ + .FON + .FOT + C:\Windows\System32\GroupPolicy\Machine\Scripts + C:\Windows\System32\GroupPolicy\User\Scripts + .iqy + .ico + .isp + .msc + .manifest + MEMORY.dmp + .msi + .cs + .customDestinations-ms + C:\Windows\Minidump + .PAF + .bmc + .rdp + .rtf + .reg + .SHS + .slk + .SCR + .set + .SettingContent-ms + .SHD + .SPL + .scr + HammerDrillStatus.dll + Microsoft\Windows\WER\ + .ICL + .sdb + .SCT + .SHB + Temp\Temp1_ + + \Microsoft\;CLR_v;\UsageLogs\ + .ade + .adp + .application + .appref-ms + .asc + .bmf + .cer + .dmp + .gpg + .htm + .html + .json + .jsp + .key + .mof + .ocx + .p7b + .p12 + .pem + .pfx + .pgp + .php + .ppk + .war + .xml - + - - - - - - - - + + + + + + + + + + + + + - - - - - + + + + + + + + - + + + + + + \Software\Microsoft\Terminal Server Client + DefaultPrinter + + + MountedDevices + Mountpoints2 + Active Setup\Installed Components + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} + + + + + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\ + LoggedOnUser + + LastLoggedOnUser + LastLoggedOnProvider + + + + + + + HKCR\ms-msdt\ + + + HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck +
DWORD (0x00000001)
+ + + + + + + + + SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost + \print\AuthenticationLevel + \AzureAttestService\CoInitializeSecurityParam + C:\$WINDOWS.~BT\ + + + + \AccessVBOM + C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe + + + Security\VBAWarnings + C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe + + + Security\VBAWarnings + C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe + + + EXCEL.exe;WINWORD.exe + {8BD21D32-EC42-11CE-9E0D-00AA006002F3};{5B9D8FC8-4A71-101B-97A6-00000B65C08B} + + + + HKCU\di + + + HKCU\� + + + HKLM\SOFTWARE\Microsoft\AMSI\Providers\ + hklm\software\microsoft\windows script\settings\amsienable + hkcu\software\microsoft\windows script\settings\amsienable + + - - - - - - - \CurrentVersion\Run - \Group Policy\Scripts - \Windows\System\Scripts - \Microsoft\System\Scripts - \ServiceDll - \ImagePath - \Start - HKLM\SYSTEM\Setup\CmdLine - Session Manager\KnownDlls - HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors - HKLM\SYSTEM\CurrentControlSet\Control\Print\Providers - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages - HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages - HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages - HKLM\HARDWARE\ACPI\DSDT - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet - HKLM\System\CurrentControlSet\Control\Session Manager\Execute - HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute - HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute - HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath - HKLM\Software\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLU\Software\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell - UserInitMprLogonScript - \CurrentVersion\Font Drivers - Active Setup\Installed Components - Windows CE Services\AutoStartOnConnect - Windows CE Services\AutoStartOnDisconnect - CurrentVersion\Windows\IconServiceLib - Winlogon\AlternateShells\AvailableShells - Terminal Server\Wds\rdpwd\StartupPrograms - SafeBoot\AlternateShell - Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman - HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown - Policies\System\Shell - Desktop\Scrnsave.exe - SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit + + + + ForcePasswordReset + + + HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC\CurrVal + + + HKLM\SAM\SAM\DOMAINS\Account\Users\ + Last Password Change + + + HKLM\SAM\SAM\DOMAINS\Account\Users\ + Account Expiration + + + HKLM\SAM\SAM\DOMAINS\Account\Users\ + Last Failed Logon + + + HKLM\SAM\SAM\Domains\Builtin\Aliases\00000220\ + + + HKLM\SAM\SAM\Domains\Builtin\Aliases\0000022B\ + + + + SOFTWARE\Microsoft\Wow64\x86\ + + \CurrentVersion\Run + Add_exclusions_here + + \Microsoft\System\Scripts + \Windows\System\Scripts + HKLM\SYSTEM\Setup\CmdLine + + \Start +
DWORD (0x00000000)
+ + + \Start +
DWORD (0x00000001)
+ + + \Start +
DWORD (0x00000002)
+ + + \Start +
DWORD (0x00000003)
+ + + \Start +
DWORD (0x00000004)
+ + \ImagePath + \ServiceDll + \ServiceManifest + hkcu\software\microsoft\windows nt\currentversion\windows\run\ + hkcu\software\microsoft\windows\currentversion\explorer\shell folders\common startup + hkcu\software\microsoft\windows\currentversion\explorer\shell folders\startup + hklm\software\microsoft\command processor\autorun + hkcu\software\microsoft\windows nt\currentversion\accessibility\ATs\\*(1)\StartExe + Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup + + \Print\Monitors + + + + + + + HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ + $ + CreateKey + + + HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ + $ + CreateKey + + + + HKLM\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} + C:\WINDOWS\sysmon64.exe + C:\WINDOWS\sysmon.exe + C:\Programdata\sysmon\sysmon64.exe + + + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe + + + + Session Manager\KnownDlls + + + + + Outlook\Addins + + + Word\Addins + + + Excel\Addins + + + Powerpoint\Addins + + + Software\Microsoft\VSTO\Security\Inclusion\ + + + Software\Microsoft\VSTO\SolutionMetadata\ + + + + + + + + + + + cmmgr32.exe + + + + HKLU\Software\Microsoft\Command Processor\AutoRun + HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute + HKLM\System\CurrentControlSet\Control\Session Manager\Execute + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug + HKLM\Software\Microsoft\Command Processor\AutoRun + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup + UserInitMprLogonScript + HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath + + HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages + + + + + + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ + Debugger;ReportingMode;GlobalFlag;MonitorProcess + + + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options + Debugger;ReportingMode;GlobalFlag;MonitorProcess + + + + + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree + SD + Microsoft\Windows\UpdateOrchestrator + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree + ID + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks + Author + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks + Path + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks + Date + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot + + + + + + + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA +
DWORD (0x00000000)
+ + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin +
DWORD (0x00000000)
+ + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop +
DWORD (0x00000000)
+ + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe + exefile\shell\runas\command\isolatedCommand + + + + + + + + + + + + + \Hidden + + + + HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Parameters + C:\WINDOWS\sysmon64.exe + C:\WINDOWS\sysmon.exe + C:\Programdata\sysmon\sysmon64.exe + + + + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel + MitigationOptions;MitigationAuditOptions + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options + MitigationOptions;MitigationAuditOptions + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmcompute.exe\0\MitigationOptions + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmwp.exe\0\MitigationOptions + msiexec.exe + TiWorker.exe + + + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options + MitigationOptions;MitigationAuditOptions + C:\Program Files\Microsoft Office 15\root\integration\integrator.exe + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acro + + + + DisableTaskMgr + C:\WINDOWS\system32\svchost.exe + C:\windows\SysWOW64\svchost.exe + + + \Security\Level + \Security\Level1Remove + + \HideSCAHealth + HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring + HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride + HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ + \Enabled +
DWORD (0x00000000)
+ + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ + \Enabled +
DWORD (0x00000001)
+ + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ + \Enabled + + + HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging + \EnableScriptBlockLogging +
DWORD (0x00000000)
+ + + HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging + \EnableScriptBlockLogging + DeleteKey;DeleteValue + + + hklm\software\microsoft\windows\currentversion\policies\system\audit + \ProcessCreationIncludeCmdLine_Enabled +
DWORD (0x00000000)
+ + + hklm\software\microsoft\windows\currentversion\policies\system\audit + \ProcessCreationIncludeCmdLine_Enabled + DeleteKey;DeleteValue + + + HKLM\System\CurrentControlSet\Services\Eventlog + \CustomSD + + + HKLM\System\CurrentControlSet\Services\Eventlog + \MaxSize + + + + globallyopenports + + EnableFirewall + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + + + + + + + + + \LastKey + + + SymbolicLinkValue + + + \Software\Microsoft\Windows\CurrentVersion\Explorer + \AppData\;\ProgramData\;\Temp\;C:\users + + + ‮ + + HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg + + + + \Software\Policies\Microsoft\SystemCertificates\;\SOFTWARE\Microsoft\EnterpriseCertificates\;HKLM\SOFTWARE\Microsoft\SystemCertificates\;HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ + C:\WINDOWS\Sysmon64.exe + C:\WINDOWS\Sysmon.exe + C:\WINDOWS\system32\certsrv.exe + C:\WINDOWS\system32\svchost.exe + C:\Windows\SysWOW64\SearchProtocolHost.exe + C:\Windows\system32\SearchProtocolHost.exe + C:\Windows\system32\taskhost.exe + C:\windows\SysWOW64\svchost.exe + + fDenyTSConnections + Terminal Server\WinStations\RDP-Tcp + RDP-tcp\PortNumber + Control\Terminal Server\fSingleSessionPerUser + + + + � + + + Й;ќ;Л;я;К + + + + + + + + HKLM\HARDWARE\ACPI\DSDT + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Account Name + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Display Name + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Email + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP User + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP User + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\MAPI Provider + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 User + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP User + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP Password + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName + SecurityPasswordAES + OptionsPasswordAES + SecurityPasswordExported + PermanentPassword + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + HKLM\SOFTWARE\GitForWindows + + + + + + + + + + + + + + + + + + + + + + + + + HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ + DeleteKey + + + + + + + + + + + \Services\VSS\Diag\(Default) + + + + + + + + HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters + + + HKLM\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters + + + \LastKey + + + \WinStationsDisabled + + + \TSServerDrainMode + + + \TypedURLs + + + HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\disabledcomponents + + + HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage\Bind + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards + + + services\http\parameters\urlaclinf + + + cRecentFiles\c1\ + tDIText + + + \File MRU\Item 1 + + + HKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHash + + + HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + HKLM\Software\Microsoft\Windows\CurrentVersion\RunService + HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + CurrentVersion\Windows\Load + CurrentVersion\Windows\Run + CurrentVersion\Winlogon\Shell + CurrentVersion\Winlogon\System + \Software\Microsoft\Windows NT\CurrentVersion\Windows\load + \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + SOFTWARE\Microsoft\.NETFramework\ETWEnabled + \Group Policy\Scripts + Terminal Server\Wds\rdpwd\StartupPrograms + SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit + Winlogon\AlternateShells\AvailableShells + Policies\System\Shell + Windows CE Services\AutoStartOnConnect + Windows CE Services\AutoStartOnDisconnect + PreferenceMACs\Default\extensions.settings + CurrentVersion\URL + \CurrentVersion\Font Drivers + HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown + CurrentVersion\Windows\IconServiceLib + Active Setup\Installed Components + NullSessionShares + NullSessionPipes + PasswordExpiryNotification + SafeBoot\AlternateShell + Desktop\Scrnsave.exe + \DisplayVersion + \ModifyPath + \Microsoft\Windows\CurrentVersion\Uninstall\ + \UninstallString + Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman - \Explorer\FileExts\ - \shell\install\command\ - \shell\open\command\ - \shell\open\ddeexec\ - SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ + \Explorer\FileExts\ + \shell\install\command\ + \shell\open\command\ + \shell\open\ddeexec\ + \ProfileImagePath - \InprocServer32\(Default) + \InprocServer32\(Default) - \PropertySheetHandlers - \CopyHookHandlers - \ColumnHandlers - \ExtShellFolderViews - \ShellServiceObjects - \ShellServiceObjectDelayLoad - \SOFTWARE\Classes\Protocols\Filter - \SOFTWARE\Classes\Protocols\Handler - \Software\Microsoft\Ctf\LangBarAddin - \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components - \SharedTaskScheduler - \ContextMenuHandlers\ - \CurrentVersion\Shell - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad - \Classes\Folder\ - \Classes\*\ - \Classes\AllFilesystemObjects\ - \Classes\Directory\ - \Classes\Drive\ - \ShowSuperHidden - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers + \Classes\AllFilesystemObjects\ + \Classes\*\ + \Software\Microsoft\Ctf\LangBarAddin + \ContextMenuHandlers\ + \CurrentVersion\Shell + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers + \Classes\Directory\ + \Classes\Drive\ + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + \Classes\Folder\ + \Hidden + \HideFileExt + \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components + \SOFTWARE\Classes\Protocols\Filter + \SOFTWARE\Classes\Protocols\Handler + \SharedTaskScheduler + \ShowSuperHidden + \ColumnHandlers + \CopyHookHandlers + \ExtShellFolderViews + \PropertySheetHandlers + \ShellServiceObjectDelayLoad + \ShellServiceObjects - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ - HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ + HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand - HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ - HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ - \ProxyServer - Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy - \DisableSecuritySettingsCheck - \3\1206 - \3\2500 - \3\1809 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 + \3\1809 + \3\2500 + \3\1206 + \DisableSecuritySettingsCheck + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries + HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ + \ProxyServer + SavedLegacySettings + Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy + EnableConsoleTracing + EnableFileTracing - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders - HKLM\SOFTWARE\Microsoft\Netsh - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ + HKLM\SOFTWARE\Microsoft\Netsh + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ - HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - EnableFirewall + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - Office Test\ - \Outlook\Addins\ - \Excel\Addins\ - \Word\Addins\ - \Access\Addins\ - \Powerpoint\Addins\ + Office Test\ + - \Internet Explorer\Toolbar\ - \Internet Explorer\Extensions\ + \Internet Explorer\Toolbar\ + \Internet Explorer\Extensions\ - \Browser Helper Objects\ - {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ + \Browser Helper Objects\ + {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ - \UrlUpdateInfo - \InstallSource + \UrlUpdateInfo + \InstallSource - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - - HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - HKLM\Software\Microsoft\Windows\CurrentVersion\RunService - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - \Software\Microsoft\Windows NT\CurrentVersion\Windows\load - HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 - CurrentVersion\Windows\Load - CurrentVersion\Windows\Run - CurrentVersion\Winlogon\Shell - CurrentVersion\Winlogon\System + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ + TamperProtection + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - \Software\Policies\Microsoft\Windows\System\Scripts\Logon - \Software\Policies\Microsoft\Windows\System\Scripts\Logoff - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff + \Software\Policies\Microsoft\Windows\System\Scripts\Logoff + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon + \Software\Policies\Microsoft\Windows\System\Scripts\Logon + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - Domain - DefaultGateway - DHCPDefaultGateway - DhcpIPAddress - DhcpNameserver - Nameserver - Dhcpserver - DhcpSubnetMask - SubnetMask - PersistentRoutes - }\Category + Domain + DHCPDefaultGateway + DhcpIPAddress + DhcpNameserver + Dhcpserver + DhcpSubnetMask + Nameserver + \DefaultGateway + PersistentRoutes + }\Category + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + SubnetMask + \Trusted Documents\TrustRecords + Software\Microsoft\VBA\7.1\Common + Software\Microsoft\VBA\7.1\Trusted + \Security\DontTrustInstalledFiles + \Security\Level + \Security\Trusted Locations + Security\ProtectedView\DisableInternetFilesInPV + Security\ProtectedView\DisableAttachmentsInPV + Security\ProtectedView\DisableUnsafeLocationsInPV + Software\WinRAR\ArcHistory + WinZip\mru\ + Recent File List + \Word\Security + \Outlook\Security + \Excel\Security + Outlook\WebView\Inbox + Outlook\Today\UserDefinedUrl + Outlook\WebView\Calendar + \Place MRU + \LinkDate + \DriverVerVersion + \DriverVersion + \LowerCaseLongPath + \Publisher + Compatibility Assistant\Store\ + \BinProductVersion + \Explorer\MountPoints2 - \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU - HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR - - \Software\Microsoft\Terminal Server Client - - - \WRData\Threats\Active - \WRData\Threats\History - - \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL - - - - - - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy - - \Security\Level - \Security\Level1Remove - - HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled - HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring - HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride - HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify - \HideSCAHealth - - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange - - - - HKLM\SOFTWARE\Microsoft\Cryptography\OID - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID - HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust - \Software\Classes\mscfile\shell\open\command - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad - \comfile\shell\open\command - \htafile\shell\open\command - \batfile\shell\open\command - \piffile\shell\open\command - \exefile\shell\open\command - Classes\exefile\shell\runas\command\isolatedCommand - \piffile\shell\open\command - \regfile\shell\open\command - \mscfile\shell\open\command - \InprocServer32 - HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ - \FriendlyName - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll + \ConsentStore\bluetooth + \ConsentStore\contacts + \ConsentStore\hunmanInterfaceDevice + \ConsentStore\location + \ConsentStore\microphone + \ConsentStore\usb\ + \ConsentStore\webcam + \ConsentStore\humanInterfaceDevice + LastVisitedMRU + SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit + \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU + HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR + HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ + HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\Microsoft\Cryptography\OID + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID + \InprocServer32 + HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll + \batfile\shell\open\command + \comfile\shell\open\command + \exefile\shell\open\command + \htafile\shell\open\command + \piffile\shell\open\command + \piffile\shell\open\command + Classes\exefile\shell\runas\command\isolatedCommand + \mscfile\shell\open\command + \FriendlyName + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - HKLM\SOFTWARE\Microsoft\Tracing\RASAPI32 - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + HKLM\SOFTWARE\Microsoft\Tracing\ + - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic + HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 + \Software\AppDataLow\Software\Microsoft\ + Software\Microsoft\Office test\Special\Perf + \CurrentControlSet\Services\NTDS\LsaDbExtPt + \Services\NTDS\DirectoryServiceExtPt + GoToMyPc\FileTransfer\history + GoToMyPc\GuestInvite + Filesharing + DesktopSharing + LogIncomingConnections + LogOutgoingConnections + PermanentPasswordDate + Security_Adminrights + vncviewer\MRU + Autostart_GUI + Meeting_UserName + BuddyLoginName + BuddyLoginTokenID + Always_Online + HKLM\SOFTWARE\Microsoft\CurrentVersion\Policies\System\EnableLinkedConnections + Software\recfg + \Environment + \Keyboard Layout\Preload\ + \Keyboard Layout\Substitutes\ + HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ + \Client\Enabled + \Server\Enabled + Kitty\Sessions + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel + PuTTY\Sessions + Terminal Server Client\Servers + WinSCP 2\Sessions + WinSCP 2\Sessions - - - - Office\root\integration\integrator.exe - C:\WINDOWS\system32\backgroundTaskHost.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe - C:\Program Files (x86)\Microsoft Office\Office16\lync.exe - C:\Program Files (x86)\Microsoft Office\Office15\lync.exe - C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe - C:\Program Files\Windows Defender\MsMpEng.exe - \Microsoft\Exchange Server - Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\ - - HKLM\SOFTWARE\Microsoft\ExchangeServer\ - HKLM\CLUSTER\ExchangeActiveManager - HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files- - HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Schedule\TaskCache\Tree\User_Feed_Synchronization- - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsUpdate - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ - Toolbar\WebBrowser - Toolbar\WebBrowser\ITBar7Height - Toolbar\WebBrowser\ITBar7Layout - Toolbar\ShellBrowser\ITBar7Layout - Internet Explorer\Toolbar\Locked - Toolbar\WebBrowser\{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Toolbar\WebBrowser\{724D43A0-0D85-11D4-9908-00400523E39A} - Toolbar\WebBrowser\ITBar7Layout - ShellBrowser - \CurrentVersion\Run - \CurrentVersion\RunOnce - \CurrentVersion\App Paths - \CurrentVersion\Image File Execution Options - \CurrentVersion\Shell Extensions\Cached - \CurrentVersion\Shell Extensions\Approved - \PreviousPolicyAreas - }\PreviousPolicyAreas - \Control\WMI\Autologger\ - HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start - \Lsa\OfflineJoin\CurrentValue - \Components\TrustedInstaller\Events - \Components\TrustedInstaller - \Components\Wlansvc - \Components\Wlansvc\Events - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ - \Directory\shellex - \Directory\shellex\DragDropHandlers - \Drive\shellex - \Drive\shellex\DragDropHandlers - _Classes\AppX - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ - C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe - - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit - - \services\clr_optimization_v2.0.50727_32\Start - \services\clr_optimization_v2.0.50727_64\Start - \services\clr_optimization_v4.0.30319_32\Start - \services\clr_optimization_v4.0.30319_64\Start - \services\DeviceAssociationService\Start - \services\BITS\Start - \services\TrustedInstaller\Start - \services\tunnel\Start - \services\UsoSvc\Start - - \OpenWithProgids - \OpenWithList - \UserChoice - \UserChoice\ProgId - \UserChoice\Hash - \OpenWithList\MRUList - } 0xFFFF - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jxr - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2 - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2 - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2 - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2 - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac - Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf - SOFTWARE\Classes\Wow6432Node\CLSID\{955C0D7D-042E-4034-9D54-EBD52477A6DB}\ - SOFTWARE\Classes\Wow6432Node\CLSID\{BEACC58F-E643-4e97-B19E-95F6EE3500FA}\ - SOFTWARE\Classes\Wow6432Node\CLSID\{07598BD3-ABBE-4bee-959F-7B90253EADFF}\ - SOFTWARE\Classes\Wow6432Node\CLSID\{31240348-66EE-4F14-A42A-39F373A834C7}\ - SOFTWARE\Classes\Wow6432Node\CLSID\{8C8EC235-0786-4DAD-A957-1A6CD76C28F5}\ - - HKLM\System\CurrentControlSet\Control\Lsa\Audit\SpecialGroups - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0 - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\PSScriptOrder - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\SOM-ID - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\GPO-ID - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\IsPowershell - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\ExecTime - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0 - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\PSScriptOrder - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\SOM-ID - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\GPO-ID - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\IsPowershell - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\ExecTime - \safer\codeidentifiers\0\HASHES\{ - - - - - - } 0xFFFF - C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe - HKLM\System\CurrentControlSet\Services\DeviceAssociationService\Start - HKLM\System\CurrentControlSet\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\ - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe - C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe - - \LTSvcMon\Start - \LTService\Start - - {F2C2787D-95AB-40D4-942D-298F5F757874} - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe - - HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\ - \Software\Policies\Microsoft\SystemCertificates\ - HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ - HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\ - HKLM\SOFTWARE\Microsoft\SystemCertificates\ - C:\Windows\SysWOW64\SearchProtocolHost.exe - HKLM\System\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnotice - HKCR\VLC. - HKCR\iTunes. - - \Software\NITRO\PRO - - HKLM\SOFTWARE\Wow6432Node\WRData\Status - - HKLM\System\CurrentControlSet\Services\RapportIaso - HKLM\System\CurrentControlSet\Services\gzflt - HKLM\System\CurrentControlSet\Services\trufos - HKLM\System\CurrentControlSet\Services\wudfsvc - HKLM\System\CurrentControlSet\Services\EFS - HKLM\System\CurrentControlSet\Services\avc3 - HKLM\System\CurrentControlSet\Services\NableRemoteService - HKLM\System\CurrentControlSet\Services\TabletInputService - HKLM\System\CurrentControlSet\Services\AdobeARMservice - HKLM\System\CurrentControlSet\Services\EPUpdateService - HKLM\System\CurrentControlSet\Services\ScreenConnect - HKLM\System\CurrentControlSet\Services\EPSecurityService - HKLM\System\CurrentControlSet\Services\EPIntegrationService - HKLM\System\CurrentControlSet\Services\wrUrlFlt - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WRSVC - HKLM\System\CurrentControlSet\Services\avckf - HKLM\System\CurrentControlSet\services\NableRemoteService - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WRSVC - HKLM\System\CurrentControlSet\Services\BDElam - - + - - - - - + + - Content.Outlook - Downloads - Temp\7z - Startup - .vb - .application - .appref-ms - .bat - .cmd - .cmdline - .docm - .exe - .dll - .sys - .hta - .pptm - .ps1 - .sys - .reg - .docm - .xlsm - .xlam - .pptm - .potm - .pptm - .sldm - .scf - .appref-ms - .rdp - .vbs - .js - - .pem - .crt - .ca-bundle - .cer - .csr - .der - .p7b - .p7r - .p7s - .pfx - .sto - .p12 - .crl - .sst - .key - - .mht - .manifest - .cpl - .scr - .inf - 291ff87948e45914424cec9510c297da - 304772c80b157a916c7041f2f15939fb - 5E022694C0DBD1FBBC263D608E577949 - 88ce6c0affcdbdc82abe53957dddfa12 + + Content.IE5;INetCache + .exe;.zip;.ps1;.bat;.rar;.vbs;.hta + + + :Zone.Identifier + blob:;about:internet + + + 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e + + + Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf + + + - .default\prefs-1.js + IMPHASH=00000000000000000000000000000000 + AppData\Local\Microsoft\Windows\AppCache\ + \Microsoft\Windows\INetCache\ + \Microsoft\Windows\Temporary Internet Files\Content.IE5 \Mozilla\Firefox\Profiles\ - \Microsoft\Windows\INetCache\ - \Microsoft\Windows\Temporary Internet Files\Content.IE5 + .default\prefs-1.js + Microsoft\Windows\Start Menu\Programs\Startup - + - - - - - + + + + - - - - + + + + - \isapi_http - \isapi_dg - \isapi_dg2 - \isapi_http - \sdlrpc - \ahexec - \winsession - \lsassw - \46a676ab7f179e511e30dd2dc41bd388 - \9f81f59bc58452127884ce513865ed20 - \e710f28d59aa529d6792ca6ff0ca1b34 - \rpchlp_3 - \NamePipe_MoreWindows - \pcheap_reuse - \ + + msagent_;\MSSE-;postex;\status_ + + + \atctl;\userpipe;\iehelper;\sdlrpc;\comnap + + + \PSEXESVC + -stdin + -stdout + + \9f81f59bc58452127884ce513865ed20 + \46a676ab7f179e511e30dd2dc41bd388 + tssmp_endpoint + \NamePipe_MoreWindows + \WCEServicePipe + \ahexec + \cachedumppipe + \csexec + \e710f28d59aa529d6792ca6ff0ca1b34 + \isapi_dg + \isapi_http + \isapi_http + \lsadump + \lsassw + \paexec + \pcheap_reuse + \gruntsvc + \remcom + \rpchlp_3 + \sdlrpc + \winsession + msf-pipe + \atsvc + \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\svcctl;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc + \atctl;\userpipe;\iehelper;\sdlrpc;\comnap + \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester + \pipe\ + + \winreg + Anonymous Pipe + \ + + + ConnectPipe @@ -2994,172 +5038,512 @@ lsass \SQLLocal\RTCLOCAL \spoolss - - \M.E.C.Core.WinRMDataCommunicator.NamedPipe. - c:\windows\system32\inetsrv\w3wp.exe - C:\Windows\syswow64\snmp.exe - C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\BIN\OWSTIMER.EXE + C:\Windows\system32\wbem\wmiprvse.exe + C:\Windows\System32\LxRun.exe + C:\Windows\System32\SearchIndexer.exe + C:\Windows\System32\services.exe + C:\Windows\System32\smss.exe + C:\Windows\System32\spoolsv.exe + C:\Windows\System32\wininit.exe + C:\Windows\system32\DFSRs.exe + C:\Windows\SystemApps\Microsoft.Windows + + C:\Windows\Microsoft.NET\Framework + \ngen.exe + + + C:\Windows\SystemApps\ShellExperienceHost_ + \ShellExperienceHost.exe + + C:\Windows\system32\SearchProtocolHost.exe + \System + ProtectedPrefix\LocalService\FTHPIPE Exchange Server + + C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\BIN\OWSTIMER.EXE + C:\Windows\syswow64\snmp.exe + c:\windows\system32\inetsrv\w3wp.exe + \M.E.C.Core.WinRMDataCommunicator.NamedPipe. - C:\Windows\system32\dns.exe + C:\Windows\system32\dns.exe \sql\query - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe - - C:\Program Files\Skype for Business Server 2015\Server\Core\RtcHost.exee - C:\Program Files\Skype for Business Server 2015\OCSMCU\AV Conferencing\AVMCUSvc.exe - C:\Program Files\Skype for Business Server 2015\Server\Health Agent\HealthAgent.exe - C:\Program Files\Skype for Business Server 2015\Server\Core\LysSvc.exe - C:\Program Files\Skype for Business Server 2015\File Transfer Agent\FileTransferAgent.exe - C:\Program Files\Skype for Business Server 2015\Web Conferencing\DataMCUSvc.exe - C:\Program Files\Skype for Business Server 2015\Application Host\OcsAppServerHost.exe - C:\Program Files\Skype for Business Server 2015\Server\Core\ABServer.exe - C:\Program Files\Skype for Business Server 2015\Master Replicator Agent\MasterReplicatorAgent.exe - C:\Program Files\Skype for Business Server 2015\OCSMCU\IM Conferencing\IMMCUSvc.exe - C:\Program Files\Common Files\Skype for Business Server 2015\ClsAgent\ClsAgent.exe - C:\Program Files\Skype for Business Server 2015\Server\Core\ReplicationApp.exe - C:\Program Files\Skype for Business Server 2015\OCSMCU\Application Sharing\ASMCUSvc.exe - C:\Program Files\Skype for Business Server 2015\Server\Replica Replicator Agent\ReplicaReplicatorAgent.exe - C:\Program Files\Skype for Business Server 2015\Server\Core\RtcHost.exe - - C:\Windows\system32\DFSRs.exee - C:\Windows\SystemApps\Microsoft.Windows - C:\Windows\system32\SearchProtocolHost.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe - C:\Windows\System32\LxRun.exe + C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe + \TDLN- vmware- - \System \InitShutdown - C:\Windows\System32\wininit.exe - C:\Windows\System32\SearchIndexer.exe - C:\Windows\System32\services.exe - \ntsvcs - \scerpc - C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe - C:\Windows\System32\smss.exe - C:\Windows\System32\spoolsv.exe - \epmapper - \atsvc - \browser - \srvsvc - \Winsock2CatelogChangeListener - ProtectedPrefix\LocalService\FTHPIPE + \MsFteWds \W32TIME_ALT + \WiFiNetworkManagerTask + \Winsock2CatelogChangeListener + \browser + \epmapper \eventlog + \ntsvcs + \scerpc \wkssvc - \TDLN- - \WiFiNetworkManagerTask - \MsFteWds - - \WRSVCPipe - \WRSynUM2 - \wrUrl - C:\Program Files (x86)\Webroot\WRSA.exe - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe - AppData\Local\Google\Chrome\User Data\SwReporter\ - mojo. - crashpad_ - chrome. - GoogleCrashServices - - slack.exe - - booma\ - - qtsingleapp-enpass- - qtsingleapp-enpass- - - eo.ipc. - - C:\Program Files\Windows Firewall Control\wfc.exe - - Everything Service - anchor_gui_agent - - Adobe\ARM\1.0\AdobeARM.exe - - C:\Program Files (x86)\Lenovo\System Update\SUService.exe - C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe - C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe - C:\Program Files\Lenovo\HOTKEY\shtctky.exe - C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE - C:\Windows\System32\LPlatSvc.exe - C:\PROGRA~1\Lenovo\HOTKEY\TPOSD.EXE - C:\Program Files (x86)\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe - C:\Program Files (x86)\Lenovo\System Update\TvsuCommandLauncher.exe - - C:\Program Files (x86)\Fortinet\FortiClient\FortiSSLVPNdaemon.exe - - c:\program files (x86)\sophos\sophos ssl vpn client\bin\openvpnserv.exe - - ScreenConnect.WindowsClient.exe - ScreenConnect.ClientService.exe - - N-able Technologies\Windows Agent\bin\agent.exe - N-able Technologies\AVDefender\EPIntegrationService.exe - C:\Program Files\OpenVPN\bin\openvpn-gui.exe - C:\Program Files\OpenVPN\bin\openvpn.exe - C:\Program Files\OpenVPN\bin\openvpnserv.exe - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe - C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe - C:\Program Files\Lenovo\HOTKEY\tphkload.exe - C:\Program Files\Lenovo\ - C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe - Graylog-collector-sidecar.exe - C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git-remote-https.exe - C:\Program Files (x86)\SmartGit\git\mingw32\bin\git.exe - C:\Program Files (x86)\SmartGit\git\mingw32\libexec\git-core\git.exe - C:\Program Files (x86)\SmartGit\bin\smartgit.exe - C:\Program Files (x86)\Fortinet\FortiClient\FortiESNAC.exe - C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe - C:\Program Files (x86)\Fortinet\FortiClient\FortiTray.exe - C:\Program Files (x86)\Fortinet\FortiClient\FCDBLog.exe - C:\Program Files (x86)\Enpass\Enpass.exe - C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe - C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgrhv.exe - C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe - C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmware-vmrc.exe - SQLAnywhereLRM - pgsignal - postgres.exe - MICROSOFT##WID\tsql\query - TSVCPIPE- - BB4BB19A178C25D1 - SQLAnywhereLRM - SQLLocal - DropboxPipe_ - c:\windows\system32\inetsrv\w3wp.exe - C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\mfcesd.exe - C:\Pfx Engagement\WM\PFXEngagement.exe - C:\Pfx Engagement\WM\Pfx.KnowledgeCoach.SharedServices.exe - C:\Program Files (x86)\Micro Focus\COBOL Server 2012\bin\mfds.exe - ScreenConnect.WindowsClient.exe - ScreenConnect.ClientService.exe - QBW32.EXE - EXCEL.EXE - ADCUpdate.exe - Hydrous.Host.exe - TNSLSNR.exe - ShoreWare Server + \ntapvsrq + Anonymous Pipe - + - - - - - + + + + + + + Created - - - - - + + + + + + type: 16;type: 16 + powershell.exe + + + github + powershell.exe + + + powershell;cscript.exe;wscript.exe;mshta.exe;bitsadmin.exe;\cmd.exe + . + + + dropboxapi.com + \Dropbox\Client\Dropbox.exe;\Dropbox\bin\Dropbox.exe;\Oracle\Java\ + + + 1drv + \AppData\Local\Microsoft\OneDrive\OneDrive.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe;\Internet Explorer\iexplore.exe;C:\Windows\System32\AppHostRegistrationVerifier.exe;C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe;C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe;C:\Program Files\Mozilla Firefox\firefox.exe + + + .box.com;upload + + + mega.nz;mega.co.nz + + + privatlab.com + + + thedoccloud.com;deftsecurity.com;websitetheme.com;highdatabase.com;incomeupdate.com;zupertech.com;panhardware.com;databasegalore.com;avsvmcloud.com;freescanonline.com + + + tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat + + + efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet + + + .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com + + + + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.nimpool.io;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool;analytics.blue;estream.to + + graph.microsoft.com + dl.dropboxusercontent.com + api.onedrive.com + zoom.us + teamviewer + Screenconnect + + + census + researchscan + scanhub + shadow + shodan + + .download + .kp + .su + .ss + .xn + .sy + .ve + .xxx + .cn + .click + .club + .ir + .ru + .host + .icu + .pw + .website + .ninja + .rocks + .top + .ua + .xyz + + + kuternull.com;rimrun.com;0ffice36o;asushotfix;infestexe;rahasn.webhop.org;rahasn.akamake.net;rahasn.homewealth.biz;winodwsupdates;israirairlines + + githubusercontent.com;github.com + + api.ipify.org;whatismyipaddress.com;edns.ip-api.com;checkip.dyndns.org;icanhazip.com;ifconfig.me;ifconfig.co;ipaddress.com;ipecho.net;ident.me;api.ip.sb;www.myexternalip.com;ip.anysrc.net;wtfismyip.com;myexternalip.com;ipecho.net;checkip.amazonaws.com;goo.gl;git.io;bit.ly;ow.ly;ip-api.com + + tiny-share.com;paste.ee;pastebin.com + + afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com + darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org + adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk + gc._msdcs. + _ldap._tcp.dc._ + _kerberos._tcp.dc._msdcs. + _ldap._tcp.pdc._msdcs. + wpad + + System;svchost.exe;services.exe;unknown process;\;; + + + + + + C:\Program Files (x86)\Admin Arsenal\ + C:\Program Files (x86)\CheckPoint\ + C:\Program Files (x86)\Fortinet\ + C:\Program Files (x86)\OpenDNS\OpenDNS Connector + C:\Program Files (x86)\Razer\Razer Services\ + C:\Program Files (x86)\Trend Micro\ + C:\Program Files (x86)\VMware + C:\Program Files (x86)\Veeam\ + C:\Program Files\CheckPoint\ + C:\Program Files\Trend Micro\ + Slack.exe + \controls\cef\ConnectWise.exe + git-remote-https.exe + C:\Program Files (x86)\Enpass\Enpass.exe + C:\Program Files (x86)\Fiserv\Vision\VisionGUI.NET.exe + C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe + C:\Program Files (x86)\Lenovo\System Update\Tvsukernel.exe + C:\Program Files\VMware\vCenter Server\jre\bin\java.exe + C:\Program Files\VMware\vCenter Server\python\python.exe + C:\Windows\SysWOW64\SearchProtocolHost.exe + C:\Windows\System32\dsregcmd.exe + C:\Windows\sysmon64.exe + C:\Windows\sysmon.exe + brave-sync.s3.dualstack. + .salesforceliveagent.com + ads-serve.brave.com + + .msftncsi.com + ..localmachine + + -pushp.svc.ms + .b-msedge.net + .bing.com + .hotmail.com + .live.com + .live.net + .microsoft.com + .microsoftonline.com + .microsoftstore.com + .ms-acdc.office.com + .msedge.net + .msn.com + .msocdn.com + .s-microsoft.com + .skype.com + .skype.net + .windows.com + .windows.net.nsatc.net + .windowsupdate.com + .xboxlive.com + login.windows.net + + .activedirectory.windowsazure.com + .msauth.net + .msftauth.net + .opinsights.azure.com + management.azure.com + outlook.office365.com + portal.azure.com + + .mozaws.net + .mozilla.com + .mozilla.net + .mozilla.org + .spotify.com + .spotify.map.fastly.net + googleapis.com + clients1.google.com + clients2.google.com + clients3.google.com + clients4.google.com + clients5.google.com + clients6.google.com + cloudsearch.googleapis.com + id.google.com + safebrowsing.googleapis.com + www.googleapis.com + + .akadns.net + .netflix.com + .typekit.net + aspnetcdn.com + ajax.googleapis.com + cdnjs.cloudflare.com + cdnjs.cloudflare.com + fonts.googleapis.com + + .steamcontent.com + + .disqus.com + .fontawesome.com + disqus.com + + .1rx.io + .2mdn.net + .adadvisor.net + .adap.tv + .addthis.com + .adform.net + .adnxs.com + .adroll.com + .adrta.com + .adsafeprotected.com + .adsrvr.org + .advertising.com + .amazon-adsystem.com + .amazon-adsystem.com + .analytics.yahoo.com + .aol.com + .betrad.com + .bidswitch.net + .casalemedia.com + .chartbeat.net + .cnn.com + .convertro.com + .criteo.com + .criteo.net + .crwdcntrl.net + .demdex.net + .domdex.com + .dotomi.com + .doubleclick.net + .doubleverify.com + .emxdgt.com + .exelator.com + .google-analytics.com + .googleadservices.com + .googlesyndication.com + .googletagmanager.com + .googlevideo.com + .gstatic.com + .gvt1.com + .gvt2.com + .ib-ibi.com + .jivox.com + .mathtag.com + .moatads.com + .moatpixel.com + .mookie1.com + .myvisualiq.net + .netmng.com + .nexac.com + .nexac.com + .openx.net + .optimizely.com + .outbrain.com + .pardot.com + .phx.gbl + .pinterest.com + .pubmatic.com + .quantcount.com + .quantserve.com + .revsci.net + .rfihub.net + .rlcdn.com + .rubiconproject.com + .scdn.co + .scorecardresearch.com + .serving-sys.com + .sharethrough.com + .simpli.fi + .sitescout.com + .smartadserver.com + .snapads.com + .spotxchange.com + .taboola.com + .taboola.map.fastly.net + .tapad.com + .tidaltv.com + .trafficmanager.net + .tremorhub.com + .tribalfusion.com + .turn.com + .twimg.com + .tynt.com + .w55c.net + .ytimg.com + .zorosrv.com + ads.yahoo.com + 1rx.io + adservice.google.com + ampcid.google.com + clientservices.googleapis.com + d29x207vrinatv.cloudfront.net + googleadapis.l.google.com + imasdk.googleapis.com + l.google.com + ml314.com + mtalk.google.com + update.googleapis.com + www.googletagservices.com + + .pscp.tv + + adsniper.ru + cdnvideo.ru + chat.minergate.com + cwsa.minergate.com + forum.minergate.com + leadlab.click + mc.yandex.ru + pool.ntp.org + vmg.host + yandex.ru + .adobe.com + .autodesk.com + .avast.com + .avcdn.net + .cdn.bitdefender.net + .digicert.com + .eset.com + .globalsign.com + .globalsign.net + .intuit.com + .java.com + .macromedia.com + .oracle.com + .quickbooks.com + .usertrust.com + amazontrust.com + ocsp.identrust.com + pki.goog + ads.playground.xyz + citrixupdates.cloud.com + forticlient.fortinet.net + mft10.onbaseonline.com + msocsp.com + ocsp.comodoca.com + ocsp.cybertrust.ne.jp + ocsp.entrust.net + ocsp.entrust.net + ocsp.godaddy.com + ocsp.int-x3.letsencrypt.org + ocsp.intel.com + ocsp.msocsp.com + ocsp.quovadisglobal.com + ocsp.quovadisoffshore.com + ocsp.sectigo.com + ocsp.starfieldtech.com + ocsp.thawte.com + ocsp.trustwave.com + ocsp.verisign.com + pki-goog.l.google.com + pki.intel.com + scrootca1.ocsp.secomtrust.net + scrootca2.ocsp.secomtrust.net + stats.anchor.host + status.rapidssl.com + status.thawte.com + ts-ocsp.ws.symantec.com + upgrade.bitdefender.com + + + + + + + + + + + + + + + + + .;>;unknown;anonymous + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + C:\Program Files (x86)\Symantec\ + C:\Program Files\Google\Chrome\Application\chrome.exe + C:\Program Files\Symantec\ + + + + + + + \BHO\ie_to_edge_stub.exe;\Microsoft\Teams\;\Vivaldi\Application\;Google\Chrome\;Google\Update;BraveSoftware\Brave-Browser\;Edge\Application\;EdgeUpdate\Install\;Program Files\SmartGit\ + + + + + + + + + + + \appdata\local\google\chrome\user data\swreporter\;software_reporter_tool.exe + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + NETWORK SERVICE; LOCAL SERVICE + + + + + + + OUTLOOK.exe;WINWORD.exe;EXCEL.EXE;powerpnt.exe;msaccess.exe;mspub.exe;eqnedt32.exe;visio.exe;wordpad.exe;wordview.exe;msohtmed.exe;lync.exe;teams.exe + :\Program Files\Microsoft Office\;:\Program Files (x86)\Microsoft Office\ + + + w3wp.exe;tomcat;apache;nginx;httpd + whitelist_me_here + + + powershell.exel;powershell_ise.exe + whitelist_me_here + + + .exe + .pdf;.doc;.xls;.doc;.ppt;.txt;.rtf;.htm;.iso;.zip;.rar;.7z + + + psexesvc + psexec + + + wmiprvse.exe + + + C:\Users\Public\ + amdsfhdcd.bin + intuit + + + AcroRd32.exe;notepad.exe;mshta.exe;hh.exe;certutil.exe;certoc.exe;certreq.exe;desktopimgdownldr.exe;esentutl.exe;finger.exe;presentationhost.exe;cscript.exe;wscript.exe;mspaint.exe;RdrCEF.exe + + + - + \ No newline at end of file From 0cae025b4e618204e7c6a9266c0a3001d072310b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 1 Sep 2022 17:31:56 -0400 Subject: [PATCH 340/471] Add Description, Forensic, CVE & False Positive Tag Descriptions --- sysmonconfig-export.xml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 79fd3ea8..9a8f2677 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -12,7 +12,7 @@ Detect Exploitation events with wide CVE Coverage. Risk Scoring of CVE, UEBA, Forensic, MITRE ATT&CK Events. - Tags Added: + Primary Tags: Attack: Mitre ATT&CK Identifier Technique: Mitre ATT&CK Technique Tactic: Mitre ATT&CK Tactic @@ -21,7 +21,12 @@ Level: The level field contains one of five string values. It describes the criticality of a triggered rule. While low and medium level events have an informative character, events with high and critical level should lead to immediate reviews by security analysts. - + Desc: Description of non-alerting UEBA/Behavioral Based Rules + Forensic: Forensic Artifacts + CVE: CVE Vulnerability Identification + FP: False Positive Rate + + Additional Tag Details: Rapid Response Tags: (for EDR/XDR/SIEM Response & Automation) kp=y Kill process with child processes kpp=y Kill Parent Processes & all Child Processes From bb507c2e6c2d42a00f18a2d888970e002d87f82f Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 1 Sep 2022 17:33:41 -0400 Subject: [PATCH 341/471] Update Readme --- README.md | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/README.md b/README.md index 49da7d39..e28c6dfd 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,4 @@ -# Sysmon Threat Intelligence Configuration # -See the develop Branch for more bleeding edge updates: https://github.com/ion-storm/sysmon-config/tree/develop - -This config is based off of the OR logic in sysmon 8.00 and 8.04, sysmon 8.02 breaks this functionality. Also 8.00 introduced a memory leak that will consume all available memory on your system if you frequently reload the config file. Upgrading to 8.04 is mandatory. - -This is a Microsoft Sysinternals Sysmon configuration file template with default high-quality event tracing. - +# Sysmon ATT&CK Configuration # The file provided should function as a great starting point for system monitoring in a self-contained package. This configuration and results should give you a good idea of what's possible for Sysmon.       **[sysmonconfig-export.xml](https://github.com/ion-storm/sysmon-config/blob/master/sysmonconfig-export.xml)** From eb931cf94d85d6871cef14f0c953544f0329146b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 1 Sep 2022 17:40:01 -0400 Subject: [PATCH 342/471] Update Sysmon installer. TODO: Create Powershell installer/updater script. --- Install Sysmon.bat | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Install Sysmon.bat b/Install Sysmon.bat index 5c0a7572..d14c506b 100644 --- a/Install Sysmon.bat +++ b/Install Sysmon.bat @@ -15,12 +15,12 @@ set tasktime=%hour%:%minute% mkdir C:\ProgramData\sysmon pushd "C:\ProgramData\sysmon\" echo [+] Downloading Sysmon... -@powershell (new-object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon64.exe','C:\ProgramData\sysmon\sysmon64.exe')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon.exe','C:\ProgramData\sysmon\sysmon.exe')" echo [+] Downloading Sysmon config... -@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" -@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/Auto_Update.bat','C:\ProgramData\sysmon\Auto_Update.bat')" -sysmon64.exe -accepteula -i sysmonconfig-export.xml -sc failure Sysmon64 actions= restart/10000/restart/10000// reset= 120 +@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/Auto_Update.bat','C:\ProgramData\sysmon\Auto_Update.bat')" +sysmon.exe -accepteula -i sysmonconfig-export.xml +sc failure Sysmon actions= restart/10000/restart/10000// reset= 120 echo [+] Sysmon Successfully Installed! echo [+] Creating Auto Update Task set to Hourly.. SchTasks /Create /RU SYSTEM /RL HIGHEST /SC HOURLY /TN Update_Sysmon_Rules /TR C:\ProgramData\sysmon\Auto_Update.bat /F /ST %tasktime% From 6adec6b4b79c3e6a0a2669a4c388baf334e13348 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 1 Sep 2022 18:04:45 -0400 Subject: [PATCH 343/471] fixed old updater, will convert to powershell in future updates. --- Auto_Update.bat | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Auto_Update.bat b/Auto_Update.bat index 39d3b0cc..25685148 100644 --- a/Auto_Update.bat +++ b/Auto_Update.bat @@ -1,5 +1,5 @@ @echo on cd C:\ProgramData\sysmon\ -@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/develop/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" +@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" sysmon64 -c sysmonconfig-export.xml exit From 173af9bd74ddc456a32be593473a655297453d5c Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 6 Sep 2022 17:55:22 -0400 Subject: [PATCH 344/471] Add some missing Tactics, a few new detections. --- sysmonconfig-export.xml | 153 ++++++++++++++++++++++------------------ 1 file changed, 84 insertions(+), 69 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 9a8f2677..456f6d97 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -180,11 +180,11 @@ C:\Windows\Temp\hpqhvind.exe;C:\ProgramData\DRM\;Test.exe C:\ProgramData\DRM;wmplayer.exe;C:\ProgramData\DRM\CLR\CLR.EXE - + regedit.exe explorer.exe - + explorer.exe @@ -510,9 +510,9 @@ Invoke-PsUaCme BypassUAC PowerUp - computerdefaults.exe - dism.exe - fodhelper.exe + computerdefaults.exe + dism.exe + fodhelper.exe NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC @@ -664,8 +664,8 @@ pcalua.exe pcalua.exe - bash.exe - bash.exe + bash.exe + bash.exe forfiles.exe forfiles.exe .com @@ -764,7 +764,7 @@ - System.Management.Automation + System.Management.Automation @@ -1243,8 +1243,8 @@ - /shadow;-shadow - noConsentPrompt + /shadow;-shadow + noConsentPrompt tscon.exe @@ -1470,8 +1470,8 @@ - portproxy - tor.exe + portproxy + tor.exe TeamViewer_Desktop.exe @@ -1691,12 +1691,12 @@ popd.exe pushd.exe subst.exe - doskey.exe - cls.exe - \ + doskey.exe + cls.exe + \ auditpol.exe C:\Windows\system32\svchost.exe -k iissvcs - \ + \ acrobat.exe acrord32.exe java.exe @@ -1709,8 +1709,8 @@ C:\Windows\system32\svchost.exe - cacls - takeown + cacls + takeown /x Macro \pipe\ /noprofile @@ -1755,12 +1755,12 @@ - C:\Users - C:\ProgramData - \Temp\ - \tmp\ - \drivers\ - \Download + C:\Users + C:\ProgramData + \Temp\ + \tmp\ + \drivers\ + \Download @@ -2080,6 +2080,16 @@ thor64.exe thor.exe + + true + 3389 + 127.0.0.1;0:0:0:0:0:0:0:1 + + + true + 3389 + fe80:0 + putty.exe;kitty.exe;kitty_portable.exe @@ -2590,12 +2600,17 @@ ntkrnlmp.exe - + \spool\drivers\x64\3\;\spool\drivers\W32X86\3\;\spool\drivers\IA64\3\ spoolsv.exe;printisolationhost.exe Valid Brother Industries;Canon;Sharp;Microsoft Corporation;DYMO;Euro Plus d.o.o;HP Inc;Hewlett-Packard + + C:\Windows\ + \Users\Public\;\Desktop\;\Downloads\;\AppData\Local\Temp\;\PerfLogs\;$Recycle;\Fonts\ + \Program Files + EQNEDT32.EXE EQNEDT32.EXE @@ -2889,24 +2904,24 @@ - + C:\Windows\System32\SHELL32.dll+9b5bd \LocalBridge.exe - + C:\Windows\System32\wshom.ocx+c8a0;C:\Windows\System32\wshom.ocx+c39d - + C:\Windows\SYSTEM32\framedynos.dll+2cb3e C:\Windows\system32\SgrmBroker.exe;C:\Windows\system32\SecurityHealthService.exe;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Windows\system32\services.exe;C:\Windows\system32\wininit.exe;C:\Windows\system32\sppsvc.exe;C:\Windows\System32\smss.exe;C:\Windows\system32\csrss.exe;C:\Windows\System32\svchost.exe - + C:\Windows\SYSTEM32\framedynos.dll+2b496 - + C:\Windows\SYSTEM32\dbgcore.DLL+6cfb - + C:\Windows\System32\KernelBase.dll+de67e @@ -2927,7 +2942,7 @@ "UNKNOWN 0x1F0FFF;0x1F1FFF;0x143A;0x1410;0x1010;0x1F2FFF;0x1F3FFF;0x1FFFFF - + C:\Program Files;\Microsoft Office\Root\Office \Microsoft Shared\VBA C:\Program Files (x86)\Intuit\ @@ -3040,11 +3055,11 @@ |UNKNOWN( 0x1FFFFF - + C:\Program Files\Microsoft Office\Root\Office C:\Windows\System32\KERNELBASE.dll+76516 - + C:\Windows\System32\SHELL32.dll+ae3b9 C:\WINDOWS\system32\sihost.exe C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub @@ -3170,22 +3185,22 @@ - .bat - .btm - .cmd - .com - .cmdline - .bas - .bin - C:\Windows\SysWOW64\Wbem - C:\Windows\System32\Wbem - .ws - .wsc - .wsf - .wsh - .pif + .bat + .btm + .cmd + .com + .cmdline + .bas + .bin + C:\Windows\SysWOW64\Wbem + C:\Windows\System32\Wbem + .ws + .wsc + .wsf + .wsh + .pif - .hta + .hta IronPython .py @@ -3212,12 +3227,12 @@ PSReadLine\ConsoleHost_history.txt .vbs - .oracle_jre_usage\ - .js - .jse - .vb - .vbe - .vbsript + .oracle_jre_usage\ + .js + .jse + .vb + .vbe + .vbsript @@ -3268,8 +3283,8 @@ - \Programs\Startup\ - \Startup\ + \Programs\Startup\ + \Startup\ @@ -3412,15 +3427,15 @@ - .chm + .chm - proj - .sln + proj + .sln @@ -4142,12 +4157,12 @@ \ImagePath \ServiceDll \ServiceManifest - hkcu\software\microsoft\windows nt\currentversion\windows\run\ - hkcu\software\microsoft\windows\currentversion\explorer\shell folders\common startup - hkcu\software\microsoft\windows\currentversion\explorer\shell folders\startup - hklm\software\microsoft\command processor\autorun - hkcu\software\microsoft\windows nt\currentversion\accessibility\ATs\\*(1)\StartExe - Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup + hkcu\software\microsoft\windows nt\currentversion\windows\run\ + hkcu\software\microsoft\windows\currentversion\explorer\shell folders\common startup + hkcu\software\microsoft\windows\currentversion\explorer\shell folders\startup + hklm\software\microsoft\command processor\autorun + hkcu\software\microsoft\windows nt\currentversion\accessibility\ATs\\*(1)\StartExe + Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup \Print\Monitors - HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 - \Software\AppDataLow\Software\Microsoft\ + HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 + \Software\AppDataLow\Software\Microsoft\ Software\Microsoft\Office test\Special\Perf \CurrentControlSet\Services\NTDS\LsaDbExtPt \Services\NTDS\DirectoryServiceExtPt @@ -5099,7 +5114,7 @@ - Created + Created From 7f2d1ae9a07d9ec219a2aea0a35d18839d272a30 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 7 Sep 2022 19:59:25 -0400 Subject: [PATCH 345/471] Misc Updates --- sysmonconfig-export.xml | 376 +++++++++++++++++++++++++++++++--------- 1 file changed, 295 insertions(+), 81 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 456f6d97..bc589ddb 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -62,6 +62,13 @@ (1) Some False Positives rate (2) Medium False Positive rate (3) High False Positive rate + + Properly Escape in XML: + < < + > > + " " + ' ' + & & --> md5,sha256,imphash @@ -97,6 +104,10 @@ + + PurpleSharp;xyz123456 + PurpleSharp + @@ -111,9 +122,76 @@ + + C:\Users\ + Content.Outlook + + + .SettingContent-ms + immersivecontrolpanel + + + .doc.exe + .docx.exe + .docx.exe + .xls.exe + .xlsx.exe + .ppt.exe + .pptx.exe + .rtf.exe + .pdf.exe + .txt.exe + .exe + ______.exe + + + Hwp.exe + gbb.exe + + + svchost.exe;termsvcs + rdpclip.exe;csrss.exe;wininit.exe + + + dns.exe + werfault.exe;conhost.exe;dnscmd.exe;dns.exe + + + UMWorkerProcess.exe;UMService.exe + perfenabled + + + UMWorkerProcess.exe;UMService.exe + perfenabled + wemgr.exe;werfault.exe + + + \wwwroot\ + + + \Atlassian\Confluence\jre\bin\java.exe + cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin + + + \jre\bin\java.exe + cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe + + \Atlassian\Confluence\jre\bin\java.exe + + + keytool.exe + cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe + + + bash.exe;cmd.exe;powershell.exe;pwsh.exe + id -Gn `;id /Gn `;id -Gn ';id /Gn ' + + + e=Access&;y=Guest&;&p=;&c=;&k= + @@ -131,10 +209,12 @@ call set priority;call terminate;product get name;bios, get serialNumber;BIOS GET SERIALNUMBER;onboarddevice get;useraccount where name;useraccount get;path win32_networkadapter where index=;process list;useraccount get /ALL;useraccount list;qfe get description,installedOn /format:csv;process get caption,executablepath,commandline;service get name,displayname,pathname,startmode;share list;win32_share + cmd.exe powershell.exe;powershell_ise.exe @@ -184,11 +264,13 @@ regedit.exe explorer.exe + - svchost.exe;spoolsv.exe;taskhostw.exe;userinit.exe;smss.exe;csrss.exe;wininit.exe;winlogon.exe;lsass.exe;logonui.exe;services.exe + svchost.exe;taskhostw.exe;userinit.exe;smss.exe;csrss.exe;wininit.exe;winlogon.exe;lsass.exe;logonui.exe;services.exe C:\windows\System32\;C:\windows\syswow64\ wininit.exe;winlogon.exe;services.exe;dwm.exe;System;smss.exe;svchost.exe @@ -273,7 +355,7 @@ sqlservr - arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe + arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;sh.exe;bash.exe winword.exe;powerpnt.exe;excel.exe @@ -359,6 +441,10 @@ create \NIC_Emulex_Firmware\;C:\Windows\Temp\ExchangeSetup\ + + sc.exe + config;binpath + cmd.exe;powershell.exe services.exe @@ -371,10 +457,19 @@ PsExec Service PsExec Launched + + accepteula + + + Execute processes remotely + -s;/s + psexec.exe pskill.exe pskill - + + C:\WINDOWS\system32\svchost.exe;RPCSS + && type @@ -467,7 +562,7 @@ cmd.exe - echo;\pipe\;> + echo;\pipe\;> cmd.exe @@ -685,6 +780,22 @@ regedit.exe : + + reg.exe + delete + + + regedit.exe + /d;-d + + + HKCU:;HKLM + remove-item + + + HKCU:;HKLM + set-item;new-item + @@ -1034,6 +1145,36 @@ netsh;trace;start;capture=yes + + vssadmin.exe + create;shadow + + + wmic.exe + shadowcopy;call;create + + + wmic.exe + call;create;esentutl;vss + + + win32_shadowcopy;create;clientaccessible + + + mklink;GLOBALROOT;Shadow + + + copy;NTDS\ntds.dit + + + ntdsutil.exe + + + copy;System32\config\SYSTEM + + + reg;save;HKLM + mimikatz;mimidrv;mimilove;mimilib;sekurlsa;lsadump;dumpcreds;privilege::;token::;logonpasswords;mimikittenz;mimiauth;::;kerberos::;misc::skeleton;privilege::debug;dpapi::cred;vault::cred;lsadump;misc::;Krbtgt;TOKEN::;invoke-mimi @@ -1145,6 +1286,54 @@ pathping.exe + + find;385201 + select-string;385201 + + + find;virus + select-string;virus + process;Description;virus + find;cb + select-string;cb + process;Description;cb + find;defender + select-string;defender + process;Description;defender + find;crowdstrike + select-string;crowdstrike + process;Description;crowdstrike + find;sentinel + select-string;sentinel + process;Description;sentinel + find;nessusd + select-string;nessusd + process;Description;nessusd + find;td-agent + select-string;td-agent + process;Description;td-agent + find;cbagentd + select-string;cbagentd + process;Description;cbagentd + find;sysmon + select-string;sysmon + process;Description;sysmon + find;winlogbeat + select-string;winlogbeat + process;Description;winlogbeat + find;winlogbeat + select-string;winlogbeat + process;Description;winlogbeat + find;csfalcon + select-string;csfalcon + process;Description;csfalcon + find;splunk + select-string;splunk + process;Description;splunk + find;sidecar + select-string;sidecar + process;Description;sidecar + fltMC.exe misc::mflt @@ -1174,6 +1363,10 @@ whoami.exe;whoami1.exe + + wmic.exe + get;useraccount + netsh.exe add;del;set @@ -1209,36 +1402,6 @@ WebClientGroup - - svchost.exe;termsvcs - rdpclip.exe;csrss.exe;wininit.exe - - - dns.exe - werfault.exe;conhost.exe;dnscmd.exe;dns.exe - - - UMWorkerProcess.exe;UMService.exe - perfenabled - - - UMWorkerProcess.exe;UMService.exe - perfenabled - wemgr.exe;werfault.exe - - - \wwwroot\ - - - \Atlassian\Confluence\jre\bin\java.exe - cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin - - - \jre\bin\java.exe - cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin - - \Atlassian\Confluence\jre\bin\java.exe - @@ -1302,13 +1465,30 @@ g2mupdate.exe slack.exe - winrm.cmd - winrs.exe - winrshost.exe - waitfor.exe - wsmprovhost.exe - winrshost.exe - wsmprovhost.exe + + wsmprovhost.exe + cmd.exe + sh.exe + bash.exe + wsl.exe + powershell.exe + powershell_ise.exe + schtasks.exe + at.exe + certutil.exe + mshta.exe + whoami.exe + ping.exe + ping.exe + bitsadmin.exe + + winrm.cmd + winrs.exe + winrshost.exe + waitfor.exe + wsmprovhost.exe + winrshost.exe + wsmprovhost.exe wmiprvse.exe mshta.exe @@ -1486,7 +1666,7 @@ - bitch.exe;bitch.bat;bitch_lasagna.exe;Admin Cracker.exe;BulletsPassView.exe;ChromePass.exe;Dialupass.exe;LSASecretsView.exe;OpenedFilesView.exe;OperaPassView.exe;PasswordFox.exe;ProduKey.exe;RouterPassView.exe;USBDeview.exe;USBStealer.exe;VNCPassView.exe;WebBrowserPassView.exe;WirelessKeyView.exe;WirelessKeyView.exe;empv.exe;netpass.exe;pspv.exe;usbdll.exe;rdpv.exe;WirelessKeyView.exe;lasagna.exe;all -vvv >>;rsync -r + bitch.exe;bitch.bat;bitch_lasagna.exe;Admin Cracker.exe;BulletsPassView.exe;ChromePass.exe;Dialupass.exe;LSASecretsView.exe;OpenedFilesView.exe;OperaPassView.exe;PasswordFox.exe;ProduKey.exe;RouterPassView.exe;USBDeview.exe;USBStealer.exe;VNCPassView.exe;WebBrowserPassView.exe;WirelessKeyView.exe;WirelessKeyView.exe;empv.exe;netpass.exe;pspv.exe;usbdll.exe;rdpv.exe;WirelessKeyView.exe;lasagna.exe;all -vvv >>;rsync -r CredsLeaker;Windows.Security.Credentials.UI.CredentialPicker;function Leaker;function Await @@ -1654,10 +1834,6 @@ C:\Users\ \Downloads\ - - C:\Users\ - Content.Outlook - C:\Users\ \Desktop\ @@ -1702,9 +1878,11 @@ java.exe javaw.exe + C:\Windows\system32\svchost.exe @@ -1712,7 +1890,10 @@ cacls takeown /x Macro - \pipe\ + + \pipe\ + > + /noprofile /sc ONEVENT \\VBOXSVR @@ -1729,19 +1910,7 @@ gpupdate.exe :\Windows\Microsoft.NET\ - - /;\;-;unknown - explorer.exe;rundll32.exe - Appinfo - DcomLaunch - JABzA - RemoteRegistry - comspec - iissvcs - mshta - nessus - rundll32.exe - + @@ -2762,7 +2931,27 @@ scrobj.dll crypt0.dll - C:\Windows\System32\wlanapi.dll + + C:\Windows\System32\wlanapi.dll + C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe + C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe + C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience + C:\Windows\ImmersiveControlPanel\SystemSettings.exe + C:\Windows\ImmersiveControlPanel\SystemSettings.exe + C:\Windows\System32\AppHostRegistrationVerifier.exe + C:\Windows\System32\CompatTelRunner.exe + C:\Windows\System32\DeviceCensus.exe + C:\Windows\System32\DriverStore\FileRepository\ + C:\Windows\System32\LogonUI.exe + C:\Windows\System32\MoNotificationUx.exe + C:\Windows\System32\SystemSettingsBroker.exe + C:\Windows\System32\dxgiadaptercache.exe + C:\Windows\System32\netsh.exe + C:\Windows\System32\wlanext.exe + C:\Windows\UUS\amd64\MoUsoCoreWorker.exe + C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_ + C:\Windows\explorer.exe + C:\Windows\Microsoft.NET\assembly\GAC_MSIL @@ -3674,7 +3863,7 @@ \Microsoft\Excel\Startup\ .xll - + \Microsoft\Outlook\VbaProject.OTM @@ -4063,7 +4252,7 @@ SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - \print\AuthenticationLevel + \print\ \AzureAttestService\CoInitializeSecurityParam C:\$WINDOWS.~BT\ @@ -4134,24 +4323,24 @@ \Microsoft\System\Scripts \Windows\System\Scripts HKLM\SYSTEM\Setup\CmdLine - - \Start + + \Start
DWORD (0x00000000)
 - - \Start + + \Start
DWORD (0x00000001)
 - - \Start + + \Start
DWORD (0x00000002)
 - - \Start + + \Start
DWORD (0x00000003)
 - - \Start + + \Start
DWORD (0x00000004)
 \ImagePath @@ -4373,7 +4562,29 @@ C:\windows\SysWOW64\svchost.exe - \Security\Level + + \Security\Level +
DWORD (0x00000001)
+ + + \Security\Level +
DWORD (0x00000002)
+ + + \Security\Level +
DWORD (0x00000003)
+ + + \Security\Level +
DWORD (0x00000004)
+ + + \Outlook\Security + + \Security\Level + + \Word\Security + \Excel\Security \Security\Level1Remove \HideSCAHealth @@ -4385,7 +4596,8 @@ HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange @@ -4467,14 +4679,20 @@ \Software\Policies\Microsoft\SystemCertificates\;\SOFTWARE\Microsoft\EnterpriseCertificates\;HKLM\SOFTWARE\Microsoft\SystemCertificates\;HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ + CreateKey C:\WINDOWS\Sysmon64.exe C:\WINDOWS\Sysmon.exe C:\WINDOWS\system32\certsrv.exe + C:\WINDOWS\system32\CompatTelRunner.exe C:\WINDOWS\system32\svchost.exe C:\Windows\SysWOW64\SearchProtocolHost.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\taskhost.exe C:\windows\SysWOW64\svchost.exe + C:\WINDOWS\System32\DriverStore\FileRepository\asus + C:\ProgramData\Microsoft\Windows Defender\Platform\ + C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe + C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe fDenyTSConnections Terminal Server\WinStations\RDP-Tcp @@ -4644,7 +4862,7 @@ - + HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ DeleteKey @@ -4854,7 +5072,6 @@ Software\Microsoft\VBA\7.1\Common Software\Microsoft\VBA\7.1\Trusted \Security\DontTrustInstalledFiles - \Security\Level \Security\Trusted Locations Security\ProtectedView\DisableInternetFilesInPV Security\ProtectedView\DisableAttachmentsInPV @@ -4862,9 +5079,6 @@ Software\WinRAR\ArcHistory WinZip\mru\ Recent File List - \Word\Security - \Outlook\Security - \Excel\Security Outlook\WebView\Inbox Outlook\Today\UserDefinedUrl Outlook\WebView\Calendar @@ -5502,7 +5716,7 @@ - .;>;unknown;anonymous + .;>;unknown;anonymous C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Symantec\ C:\Program Files\Google\Chrome\Application\chrome.exe From 04a0f1e8c0b8281196135554bd51e2a105e2e5d1 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 8 Sep 2022 11:11:16 -0400 Subject: [PATCH 346/471] Improved COM Object Hijack Detection --- sysmonconfig-export.xml | 64 ++++++++++++++++++++++++++++++++--------- 1 file changed, 50 insertions(+), 14 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index bc589ddb..ce526fa4 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -816,6 +816,11 @@ powershell.exe -w h;-wi h;-win h;-wind h;-windo h;-window h;-windows h;-windowst h;-windowsty h;-windowstyl h;-windowstyle h;/w h;/wi h;/win h;/wind h;/windo h;/window h;/windows h;/windowst h;/windowsty h;/windowstyl h;/windowstyle h + + powershell.exe + -ex;/ex + bypass + powershell.exe -noni;/noni @@ -828,7 +833,7 @@ powershell.exe - SUVYI;aWV4I;SQBFAFgA;aQBlA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC + SUVYI;aWV4I;SQBFAFgA;aQBlA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC;UwB0AGE C^om^S^pEc;^c^o^m^S^p^E^c^;Wscript.Shell;-ComObject;MsXml2.ServerXmlHttp;Remove.ToString;System.Convert;-UseB;[Byte[];^h^t^t^p;h"t"t"p @@ -1007,6 +1012,10 @@ PhotoViewer.dll \AppData\Local\WebEx\WebEx\ + + RUNDLL32.EXE + -sta;/sta + RUNDLL32.EXE shell32.dll;OpenAs_RunDLL @@ -4382,6 +4391,31 @@ C:\Programdata\sysmon\sysmon64.exe + + HKCR\ + (Default) + \shell\open\command\(Default) +
URL:
+ + + HKCU\Software\Classes\ + (Default) + \shell\open\command\(Default) +
URL:
+ + + HKCR\ + \shell\open\command\(Default) +
%1
+ + + HKCU\Software\Classes\ + \shell\open\command\(Default) +
%1
+ + + \shell\open\command\DelegateExecute + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe @@ -4455,6 +4489,17 @@ + + + \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default) +
C:\Users\Public\;$Recyclebin;\temp\;\Desktop\;\Downloads\;\Content.Outlook\;\Microsoft\Office\
+ + + \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default) + + + \ProgID\(Default);\TreatAs\(Default) + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ @@ -4962,11 +5007,7 @@ \Explorer\FileExts\ \shell\install\command\ - \shell\open\command\ - \shell\open\ddeexec\ \ProfileImagePath - - \InprocServer32\(Default) \Classes\AllFilesystemObjects\ \Classes\*\ @@ -5109,16 +5150,8 @@ HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust HKLM\SOFTWARE\Microsoft\Cryptography\OID HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID - \InprocServer32 HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll - \batfile\shell\open\command - \comfile\shell\open\command - \exefile\shell\open\command - \htafile\shell\open\command - \piffile\shell\open\command - \piffile\shell\open\command Classes\exefile\shell\runas\command\isolatedCommand - \mscfile\shell\open\command \FriendlyName HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL @@ -5259,7 +5292,10 @@ --> \winreg Anonymous Pipe - \ + + From c886b2382f4529935ad7caf96a954d5ee141e125 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 8 Sep 2022 17:30:54 -0400 Subject: [PATCH 347/471] add a few new detections --- sysmonconfig-export.xml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ce526fa4..a46317d1 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -688,6 +688,10 @@ + + auditpol + /set;-set;/restore;-restore;/clear;-clear;/remove;-remove;/resourceSACL;-resourceSACL + @@ -1276,6 +1280,12 @@ tree.com + + auditpol + /get;-get;/list;-list;/backup;-backup + + gpresult.exe + get-gpo;get-gpresult;get-gpreg @@ -1879,7 +1889,6 @@ doskey.exe cls.exe \ - auditpol.exe C:\Windows\system32\svchost.exe -k iissvcs \ acrobat.exe From 852190da82667712e058d4ebd65f7557fa76f0c1 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 9 Sep 2022 10:57:49 -0400 Subject: [PATCH 348/471] Add more advanced SilentProcessExit Detection targetting DRWORD's and -s flag from WerFault parent command line. --- sysmonconfig-export.xml | 33 +++++++++++++++++++++++++-------- 1 file changed, 25 insertions(+), 8 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index a46317d1..1704fda6 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -548,6 +548,10 @@ dsadd.exe + + WerFault.exe + -s;/s + @@ -4510,13 +4514,27 @@ \ProgID\(Default);\TreatAs\(Default) - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ - Debugger;ReportingMode;GlobalFlag;MonitorProcess - - - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options - Debugger;ReportingMode;GlobalFlag;MonitorProcess + + \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ + Debugger;ReportingMode;MonitorProcess + + + \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ + GlobalFlag +
DWORD (0x00000200)
+ + + \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ + MonitorProcess + + + \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ + ReportingMode +
DWORD (0x00000001)
+ + + \Microsoft\Windows NT\CurrentVersion\SilentProcessExit + CreateKey @@ -4991,7 +5009,6 @@ SOFTWARE\Microsoft\.NETFramework\ETWEnabled \Group Policy\Scripts Terminal Server\Wds\rdpwd\StartupPrograms - SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit Winlogon\AlternateShells\AvailableShells Policies\System\Shell Windows CE Services\AutoStartOnConnect From e29bdb2f938ef0a9ffdc77f29041c62205295b2b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 9 Sep 2022 12:09:34 -0400 Subject: [PATCH 349/471] add RuntimeExceptionHelperModules detection --- sysmonconfig-export.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1704fda6..5a7d7f1f 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -4536,6 +4536,9 @@ \Microsoft\Windows NT\CurrentVersion\SilentProcessExit CreateKey + + \Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules + From 347778fbe91f3df4314d6ae412a52020e9213715 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 9 Sep 2022 15:00:36 -0400 Subject: [PATCH 350/471] Add suspicious conhost parent process detection --- sysmonconfig-export.xml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 5a7d7f1f..89ccb499 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -209,6 +209,10 @@ call set priority;call terminate;product get name;bios, get serialNumber;BIOS GET SERIALNUMBER;onboarddevice get;useraccount where name;useraccount get;path win32_networkadapter where index=;process list;useraccount get /ALL;useraccount list;qfe get description,installedOn /format:csv;process get caption,executablepath,commandline;service get name,displayname,pathname,startmode;share list;win32_share + + svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe + conhost.exe + + + autochk.exe + \smss.exe;\fontdrvhost.exe;\dwm.exe + + + \consent.exe;\Runtimebroker.exe;\TiWorker.exe + \svchost.exe + + + \consent.exe;\Runtimebroker.exe;\TiWorker.exe + svchost.exe + + + SearchProtocolHost.exe + \SearchIndexer.exe;\dllhost.exe + + + dllhost.exe + \services.exe;\svchost.exe + + + smss.exe + \smss.exe + System + + + csrss.exe + \smss.exe;svchost.exe + + + wininit.exe + \smss.exe + + + winlogon.exe + \smss.exe + + + \lsass.exe;LsaIso.exe + \wininit.exe + + + LogonUI.exe + \wininit.exe;\winlogon.exe + + + services.exe + \wininit.exe + + + svchost.exe + \MsMpEng.exe;\services.exe + + + spoolsv.exe + \services.exe + + + taskhost.exe + \services.exe;\svchost.exe + + + userinit.exe + \dwm.exe;\winlogon.exe + + + \wmiprvse.exe;\wsmprovhost.exe;\winrshost.exe + \svchost.exe + + + \SearchProtocolHost.exe;\taskhost.exe;\csrss.exe + \werfault.exe;\wermgr.exe;\WerFaultSecure.exe + + + autochk.exe + \chkdsk.exe;\doskey.exe;\WerFault.exe + + + smss.exe + \autochk.exe;\smss.exe;\csrss.exe;\wininit.exe;\winlogon.exe;\setupcl.exe;\WerFault.exe + + + wermgr.exe + \WerFaultSecure.exe;\wermgr.exe;\WerFault.exe + + + conhost.exe + \mscorsvw.exe;\wermgr.exe;\WerFault.exe;\WerFaultSecure.exe + System.Management.Automation @@ -926,9 +1019,9 @@ CMSTP.exe -ns;-s - - control;name - rundll32.exe;shell32.dll;Control_RunDLL + + rundll32.exe;shell32.dll;_RunDLL + C:\Windows\ImmersiveControlPanel\SystemSettings.exe odbcconf.exe @@ -3286,6 +3379,7 @@ |C:\WINDOWS\System32\KERNELBASE.dll+ ) 0x1028;0x1fffff + C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\ winword.exe;excel.exe;powerpnt.exe @@ -4343,7 +4437,8 @@ SOFTWARE\Microsoft\Wow64\x86\ - \CurrentVersion\Run + SetValue + \CurrentVersion\Run\ Add_exclusions_here \Microsoft\System\Scripts @@ -4577,6 +4672,10 @@ + + SetValue + \Environment\ + @@ -4984,6 +5083,7 @@ HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage\Bind +
Binary Data
 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards @@ -5198,7 +5298,10 @@ HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318} --> HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 - \Software\AppDataLow\Software\Microsoft\ + + \Software\AppDataLow\Software\Microsoft\ +
.exe;.dll;powershell;wmic
+ Software\Microsoft\Office test\Special\Perf \CurrentControlSet\Services\NTDS\LsaDbExtPt \Services\NTDS\DirectoryServiceExtPt @@ -5218,7 +5321,6 @@ Always_Online HKLM\SOFTWARE\Microsoft\CurrentVersion\Policies\System\EnableLinkedConnections Software\recfg - \Environment \Keyboard Layout\Preload\ \Keyboard Layout\Substitutes\ HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 From 32694c0dbd912760a65ba6c7005c7d9a0b2c837d Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 13 Sep 2022 14:07:25 -0400 Subject: [PATCH 352/471] Add new detections, merge in some of Florian's work, added Author tag for attribution additions. --- sysmonconfig-export.xml | 212 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 199 insertions(+), 13 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f9d11762..475e245a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -25,7 +25,8 @@ Forensic: Forensic Artifacts CVE: CVE Vulnerability Identification FP: False Positive Rate - + Author: Author of rule + Additional Tag Details: Rapid Response Tags: (for EDR/XDR/SIEM Response & Automation) kp=y Kill process with child processes @@ -69,6 +70,10 @@ " " ' ' & & + + Other Notes: + The Rulename field has a hard limit of 255 characters, make the best of the size available, shorten tags and descriptions as needed. + Add exclusions in line enclosed within a Compound rule rather than a global exclusion list. --> md5,sha256,imphash @@ -412,8 +417,10 @@ Sentinel\AutoRepair C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - schtasks.exe - at.exe + + schtasks.exe + + at.exe at.exe C:\Windows\System32\svchost.exe @@ -727,6 +734,16 @@ MpCmdRun.exe Add-MpPreference;RemoveDefinitions;DisableIOAVProtection + + + IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE + + + IMPHASH=19584675D94829987952432E018D5056 + + + IMPHASH=330768a4f172e10acb6287b87289d83b + PsKill.exe @@ -903,30 +920,37 @@ \consent.exe;\Runtimebroker.exe;\TiWorker.exe \svchost.exe + - \consent.exe;\Runtimebroker.exe;\TiWorker.exe svchost.exe + - SearchProtocolHost.exe \SearchIndexer.exe;\dllhost.exe + - dllhost.exe \services.exe;\svchost.exe + - smss.exe \smss.exe System + - csrss.exe + - \smss.exe;svchost.exe wininit.exe + - \smss.exe @@ -947,6 +971,7 @@ svchost.exe + - \MsMpEng.exe;\services.exe @@ -963,6 +988,7 @@ \wmiprvse.exe;\wsmprovhost.exe;\winrshost.exe + - \svchost.exe @@ -1707,7 +1733,8 @@ odHRwczovL;aHR0cDovL;h0dHA6Ly;odHRwOi8v;aHR0cHM6Ly;h0dHBzOi8v ie_to_edge_stub.exe;chrome.exe;firefox.exe;iexplore.exe;brave.exe;vivaldi.exe;msedge.exe;webex;teams.exe;goto opener.exe;lynx.exe;\Webex\webexAppLauncherLatest.exe;\WebEx\webexAppLauncher.exe;\WebEx\Applications\webexAppLauncher.exe;WebEx\webex.exe - wbx:;/SITE_TOKEN=;msteams: + wbx:;/SITE_TOKEN=;msteams:;PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSI + msedgeupdate.dll VFZvQUFBQ;RWb0FBQU;UVm9BQUFB;VFZxQUFBR;RWcUFBQU;UVnFBQUFF;VFZwUUFBS;RWcFFBQU;UVnBRQUFJ;VFZxUUFBT;RWcVFBQU;UVnFRQUFN;VFZwVEFRR;RWcFRBUU;UVnBUQVFF @@ -2903,9 +2930,13 @@ EQNEDT32.EXE EQNEDT32.EXE - - ACTIVEDS.DLL;Adsldpc.dll - C:\Users;\Temp\;ProgramData + + ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll + C:\Users;\Temp\;\ProgramData\ + + + ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll + wscript.exe;cscript.exe;powershell.exe;rundll32.exe;msbuild.exe;msiexec.exe;csc.exe WINWORD.exe;EXCEL.EXE @@ -3072,6 +3103,9 @@ C:\Windows\explorer.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL + + cmd.exe;cmd.exe.mui + @@ -3171,6 +3205,7 @@ C:\Windows\System32\igfxEM.exe C:\Windows\System32\igfxHK.exe Enterprise\Common7\IDE\devenv.exe + C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe CreateFileMapping;MapViewOfFile @@ -3379,17 +3414,20 @@ |C:\WINDOWS\System32\KERNELBASE.dll+ ) 0x1028;0x1fffff - C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\ + C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\ winword.exe;excel.exe;powerpnt.exe - :\Windows\Microsoft.NET\Framework64\v2. - UNKNOWN + :\Windows\Microsoft.NET\Framework64\v2.;UNKNOWN UNKNOWN 0x147a + + C:\Windows\Sysmon64.exe;C:\Windows\Sysmon.exe + 0x1400 + 0x0800 @@ -3710,6 +3748,7 @@ C:\Users\Public\ C:\Windows\Temp\ \AppData\Temp\ + C:\WINDOWS\system32\dxgiadaptercache.exe $Recycle.Bin $Recycle.Bin @@ -4408,6 +4447,11 @@ + + Google\Chrome\Extensions + update_url + SetValue + ForcePasswordReset @@ -4605,9 +4649,11 @@ \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default)
C:\Users\Public\;$Recyclebin;\temp\;\Desktop\;\Downloads\;\Content.Outlook\;\Microsoft\Office\
+
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
 \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default) +
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
 \ProgID\(Default);\TreatAs\(Default) @@ -4637,6 +4683,7 @@ \Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules + C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{;}\EDGEMITMP_;.tmp\setup.exe @@ -4706,6 +4753,11 @@ \Hidden + + SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\ + $ +
DWORD (0x00000000)
+ @@ -4739,6 +4791,11 @@ C:\WINDOWS\system32\svchost.exe C:\windows\SysWOW64\svchost.exe + + HKLM\SYSTEM\CurrentControlSet\ + \Instances\;Altitude + SetValue + \Security\Level @@ -5359,6 +5416,15 @@ Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf + + IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE + + + IMPHASH=19584675D94829987952432E018D5056 + + + IMPHASH=330768a4f172e10acb6287b87289d83b + @@ -5421,7 +5487,10 @@ \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\svcctl;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc \atctl;\userpipe;\iehelper;\sdlrpc;\comnap \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester - \pipe\ + + \pipe\ + CtxSharefilepipe0 + @@ -5600,10 +5669,16 @@ darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk gc._msdcs. - _ldap._tcp.dc._ _kerberos._tcp.dc._msdcs. + _kerberos._udp.dc._msdcs. _ldap._tcp.pdc._msdcs. - wpad + wpad + + _ldap. + C:\Windows\ + unknown process + C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe + + IMPHASH=3A19059BD7688CB88E70005F18EFC439 + IMPHASH=bf6223a49e45d99094406777eb6004ba + IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 + IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 + IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF + IMPHASH=4C1B52A19748428E51B14C278D0F58E3 + IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F + IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A + IMPHASH=672B13F4A0B6F27D29065123FE882DFC + IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F + IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D + IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 + IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 + IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 + IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 + IMPHASH=D21BBC50DCC169D7B4D0F01962793154 + IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 + IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 + IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC + IMPHASH=6118619783FC175BC7EBECFF0769B46E + IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA + IMPHASH=563233BFA169ACC7892451F71AD5850A + IMPHASH=87575CB7A0E0700EB37F2E3668671A08 + IMPHASH=13F08707F759AF6003837A150A371BA1 + IMPHASH=1781F06048A7E58B323F0B9259BE798B + IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 + IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D + IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 + IMPHASH=713C29B396B907ED71A72482759ED757 + IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F + IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E + IMPHASH=8B114550386E31895DFAB371E741123D + IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 + IMPHASH=9D68781980370E00E0BD939EE5E6C141 + IMPHASH=B18A1401FF8F444056D29450FBC0A6CE + IMPHASH=CB567F9498452721D77A451374955F5F + IMPHASH=730073214094CD328547BF1F72289752 + IMPHASH=17B461A082950FC6332228572138B80C + IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 + IMPHASH=819B19D53CA6736448F9325A85736792 + IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E + IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 + IMPHASH=0588081AB0E63BA785938467E1B10CCA + IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C + IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 + IMPHASH=4DA924CF622D039D58BCE71CDF05D242 + IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 + IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF + IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE + IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 + IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 + IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E + IMPHASH=E6F9D5152DA699934B30DAAB206471F6 + IMPHASH=3AD59991CCF1D67339B319B15A41B35D + IMPHASH=FFDD59E0318B85A3E480874D9796D872 + IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 + IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 + IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 + IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 + IMPHASH=0E2216679CA6E1094D63322E3412D650 + IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB + IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 + IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 + IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 + IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F + IMPHASH=767637C23BB42CD5D7397CF58B0BE688 + IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 + IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC + IMPHASH=7D010C6BB6A3726F327F7E239166D127 + IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 + IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F + IMPHASH=5834ED4291BDEB928270428EBBAF7604 + IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 + IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 + IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 + IMPHASH=3DE09703C8E79ED2CA3F01074719906B + IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F + IMPHASH=E96A73C7BF33A464C510EDE582318BF2 + IMPHASH=32089B8851BBF8BC2D014E9F37288C83 + IMPHASH=09D278F9DE118EF09163C6140255C690 + IMPHASH=03866661686829D806989E2FC5A72606 + IMPHASH=E57401FBDADCD4571FF385AB82BD5D6D + IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE + IMPHASH=19584675D94829987952432E018D5056 + IMPHASH=330768A4F172E10ACB6287B87289D83B + + + \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll + + + certutil.exe + certoc.exe + CertReq.exe + + Desktopimgdownldr.exe + esentutl.exe + + finger.exe + presentationhost.exe + + + bitsadmin.exe + C:\Windows;$WINDOWS.;\SoftwareDistribution\ + System + TrustedInstaller;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC + + + \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll + From e8f951649e7dc2d5386ab7f041dae9091b96707b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 13 Sep 2022 14:08:54 -0400 Subject: [PATCH 353/471] remove testing rule --- sysmonconfig-export.xml | 3 --- 1 file changed, 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 475e245a..720ca294 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -3103,9 +3103,6 @@ C:\Windows\explorer.exe C:\Windows\Microsoft.NET\assembly\GAC_MSIL - - cmd.exe;cmd.exe.mui - From eff3c87e8079b68e7ee9837b27787690aafabe08 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 14 Sep 2022 09:48:50 -0400 Subject: [PATCH 354/471] Push noise reduction and additional detection rules. --- sysmonconfig-export.xml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 720ca294..0dd2b07f 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -214,6 +214,11 @@ call set priority;call terminate;product get name;bios, get serialNumber;BIOS GET SERIALNUMBER;onboarddevice get;useraccount where name;useraccount get;path win32_networkadapter where index=;process list;useraccount get /ALL;useraccount list;qfe get description,installedOn /format:csv;process get caption,executablepath,commandline;service get name,displayname,pathname,startmode;share list;win32_share + + C:\Users\;$Recycle;\Temp\;\Downloads\ + \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 + conhost.exe + svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe conhost.exe @@ -1915,7 +1920,7 @@ -p -nw shred diskshadow - + del ; /f del ; -f rmdir ; /s ; /q @@ -3202,6 +3207,7 @@ C:\Windows\System32\igfxEM.exe C:\Windows\System32\igfxHK.exe Enterprise\Common7\IDE\devenv.exe + C:\Program Files (x86)\ASUS\ROG Live Service\FileOperator.exe C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe @@ -3423,6 +3429,9 @@ C:\Windows\Sysmon64.exe;C:\Windows\Sysmon.exe + C:\WINDOWS\system32\wbem\wmiprvse.exe + C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe + C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe 0x1400 @@ -3513,6 +3522,7 @@ C:\Windows\SoftwareDistribution + C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_;.exe .exe @@ -4791,6 +4801,7 @@ HKLM\SYSTEM\CurrentControlSet\ \Instances\;Altitude + HKLM\System\CurrentControlSet\Services\CldFlt\Instances\CldFlt\Altitude SetValue From 8e3aac5411a8573a7861f74197213adc74b601cb Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 14 Sep 2022 17:17:05 -0400 Subject: [PATCH 355/471] Add more Forensic monitoring rules, add rpc execution named pipes and misc fixes/tagging. --- sysmonconfig-export.xml | 72 ++++++++++++++++++++++++++++------------- 1 file changed, 50 insertions(+), 22 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 0dd2b07f..6cc483be 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5322,25 +5322,48 @@ Outlook\Today\UserDefinedUrl Outlook\WebView\Calendar \Place MRU - \LinkDate - \DriverVerVersion - \DriverVersion - \LowerCaseLongPath - \Publisher - Compatibility Assistant\Store\ - \BinProductVersion + \LinkDate + \DriverVerVersion + \DriverVersion + \LowerCaseLongPath + \Publisher + Compatibility Assistant\Store\ + \BinProductVersion + Root\InventoryApplicationShortcut\ + Root\InventoryDriverBinary\ + Root\InventoryDeviceContainer\ + + Root\InventoryApplication\ + ProgramID;Name;Version;Publisher;Language;InstallDate;Source;RootDirPath;HiddenArp;UninstallString;RegistryKeyPath;UserSID;sha256 + + + Root\InventoryApplicationFile\ + ProgramId;FileId;LowerCaseLongPath;Name;OriginalFileName;Publisher;Version;binfileversion;LinkDate;Size;Language;USN;IsPeFile;IsOsComponent;sha256;AppxPackageFullName + + + Root\InventoryApplicationAppV\ + + + Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations + \Explorer\MountPoints2 + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices + + HKLM\System\CurrentControlSet\services\ + \DeleteFlag +
DWORD (0x00000001)
+ - \ConsentStore\bluetooth - \ConsentStore\contacts - \ConsentStore\hunmanInterfaceDevice - \ConsentStore\location - \ConsentStore\microphone - \ConsentStore\usb\ - \ConsentStore\webcam - \ConsentStore\humanInterfaceDevice - LastVisitedMRU - SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit + \ConsentStore\bluetooth + \ConsentStore\contacts + \ConsentStore\hunmanInterfaceDevice + \ConsentStore\location + \ConsentStore\microphone + \ConsentStore\usb\ + \ConsentStore\webcam + \ConsentStore\humanInterfaceDevice + LastVisitedMRU + SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ @@ -5350,14 +5373,14 @@ HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll Classes\exefile\shell\runas\command\isolatedCommand - \FriendlyName + \FriendlyName HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB HKLM\SOFTWARE\Microsoft\Tracing\ \46a676ab7f179e511e30dd2dc41bd388 tssmp_endpoint @@ -5492,7 +5521,7 @@ \winsession msf-pipe \atsvc - \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\svcctl;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc + \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc \atctl;\userpipe;\iehelper;\sdlrpc;\comnap \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester @@ -5562,7 +5591,6 @@ \browser \epmapper \eventlog - \ntsvcs \scerpc \wkssvc \ntapvsrq From 0ab288007ec18b3d81b3e84efbb1b304779d51e8 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 14 Sep 2022 17:18:45 -0400 Subject: [PATCH 356/471] removing services from named pipe exclusion list as this can spawn pipes that execute via rpc. --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6cc483be..0c437378 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5552,7 +5552,6 @@ C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\LxRun.exe C:\Windows\System32\SearchIndexer.exe - C:\Windows\System32\services.exe C:\Windows\System32\smss.exe C:\Windows\System32\spoolsv.exe C:\Windows\System32\wininit.exe From 75a929340c93a7f017b68c55219d34834bf173c5 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 14 Sep 2022 17:33:05 -0400 Subject: [PATCH 357/471] Improve PoisonTap rule to detect rndis drivers loaded via Details. --- sysmonconfig-export.xml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 0c437378..b4fa7006 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5382,9 +5382,11 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB HKLM\SOFTWARE\Microsoft\Tracing\ - + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318} +
ndis;rndis
+ HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 \Software\AppDataLow\Software\Microsoft\ @@ -5552,6 +5554,7 @@ C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\LxRun.exe C:\Windows\System32\SearchIndexer.exe + C:\Windows\System32\services.exe C:\Windows\System32\smss.exe C:\Windows\System32\spoolsv.exe C:\Windows\System32\wininit.exe From 9fa170df84b8a58560d2186aa2089fd41cfe021d Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 14 Sep 2022 17:34:29 -0400 Subject: [PATCH 358/471] remove services whitelist --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b4fa7006..8e9c3cef 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5554,7 +5554,6 @@ C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\LxRun.exe C:\Windows\System32\SearchIndexer.exe - C:\Windows\System32\services.exe C:\Windows\System32\smss.exe C:\Windows\System32\spoolsv.exe C:\Windows\System32\wininit.exe From 234662c09842988b982c04226f14d6cf3e05123d Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 15 Sep 2022 18:07:38 -0400 Subject: [PATCH 359/471] Add UsageLog/ETW Log tampering rules --- sysmonconfig-export.xml | 39 +++++++++++++++++++++++++++++++++++---- 1 file changed, 35 insertions(+), 4 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 8e9c3cef..4bbab408 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -781,6 +781,18 @@ DontLog;True iisetup.exe + + set;NGenAssemblyUsageLog + New-ItemProperty;NGenAssemblyUsageLog + reg;add;dword;NGenAssemblyUsageLog + $env;NGenAssemblyUsageLog + + + set;COMPlus_ETWEnabled + New-ItemProperty;COMPlus_ETWEnabled + reg;add;dword;COMPlus_ETWEnabled + $env;COMPlus_ETWEnabled + bash.exe;wsl.exe;ubuntu.exe;kali.exe @@ -3227,6 +3239,10 @@ 0C7C 0C88 c:\windows\system32\mstsc.exe + + C:\WINDOWS\SYSTEM32\ntdll.dll + EtwEventWrite + @@ -3273,7 +3289,7 @@ ntdll.dll+a0044 - + clr.dll+6c23;clr.dll+6b38 @@ -3417,7 +3433,7 @@ |C:\WINDOWS\System32\KERNELBASE.dll+ ) 0x1028;0x1fffff - C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\ + C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git\ winword.exe;excel.exe;powerpnt.exe @@ -3431,7 +3447,7 @@ C:\Windows\Sysmon64.exe;C:\Windows\Sysmon.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe - C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe + C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe;C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe;C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 0x1400 @@ -4689,7 +4705,7 @@ CreateKey - \Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules + \Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{;}\EDGEMITMP_;.tmp\setup.exe @@ -4899,6 +4915,21 @@ HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + + \Microsoft\.NETFramework\ETWEnabled +
DWORD (0x00000000)
+ + + \Microsoft\.NETFramework\NGenAssemblyUsageLog + + + SetValue + \Environment\NGenAssemblyUsageLog + + + SetValue + \Environment\COMPlus_ETWEnabled + From 3ca57014e49bcd040e3aeca3b13726c69a2348f9 Mon Sep 17 00:00:00 2001 From: cyberkryption Date: Sun, 18 Sep 2022 12:52:59 +0100 Subject: [PATCH 360/471] Updated Level 0 background events All common background forensic events have same name field structure --- sysmonconfig-cyberkryption.xml | 6208 ++++++++++++++++++++++++++++++++ 1 file changed, 6208 insertions(+) create mode 100644 sysmonconfig-cyberkryption.xml diff --git a/sysmonconfig-cyberkryption.xml b/sysmonconfig-cyberkryption.xml new file mode 100644 index 00000000..540c518d --- /dev/null +++ b/sysmonconfig-cyberkryption.xml @@ -0,0 +1,6208 @@ + + + md5,sha256,imphash + + + + + + + + + TEMP\nessus_;nessus_task_list + TEMP\nessus_;nessus_task_list + + + rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe + advanced_port_scanner.exe;rcpping.exe;nc.exe;nc64.exe;netcat.exe;ncat.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe + Network Scanner;Advanced IP Scanner + + + adfind + adfind + -gcb -sc;/gcb /sc;-f (objectcategory=;/f (objectcategory=;trustdmp + + + + + + + + + + + + + + PurpleSharp;xyz123456 + PurpleSharp + + + + + /serverlevelplugindll + + + add;sslcert;http + + http del sslcert + + + + + + + C:\Users\ + Content.Outlook + + + .SettingContent-ms + immersivecontrolpanel + + + .doc.exe + .docx.exe + .docx.exe + .xls.exe + .xlsx.exe + .ppt.exe + .pptx.exe + .rtf.exe + .pdf.exe + .txt.exe + .exe + ______.exe + + + Hwp.exe + gbb.exe + + + + + svchost.exe;termsvcs + rdpclip.exe;csrss.exe;wininit.exe + + + dns.exe + werfault.exe;conhost.exe;dnscmd.exe;dns.exe + + + UMWorkerProcess.exe;UMService.exe + perfenabled + + + UMWorkerProcess.exe;UMService.exe + perfenabled + wemgr.exe;werfault.exe + + + \wwwroot\ + + + \Atlassian\Confluence\jre\bin\java.exe + cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin + + + \jre\bin\java.exe + cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe + + \Atlassian\Confluence\jre\bin\java.exe + + + keytool.exe + cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe + + + bash.exe;cmd.exe;powershell.exe;pwsh.exe + id -Gn `;id /Gn `;id -Gn ';id /Gn ' + + + + e=Access&;y=Guest&;&p=;&c=;&k= + + + + + + + + + + + wmic.exe + process;call;create + + + wmic.exe + call set priority;call terminate;product get name;bios, get serialNumber;BIOS GET SERIALNUMBER;onboarddevice get;useraccount where name;useraccount get;path win32_networkadapter where index=;process list;useraccount get /ALL;useraccount list;qfe get description,installedOn /format:csv;process get caption,executablepath,commandline;service get name,displayname,pathname,startmode;share list;win32_share + + + + C:\Users\;$Recycle;\Temp\;\Downloads\ + \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 + conhost.exe + + + svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe + conhost.exe + + + conhost.exe + :\Windows\splwow64.exe;:\Windows\System32\WerFault.exe;:\Windows\System32\conhost.exe + + + + cmd.exe + powershell.exe;powershell_ise.exe + Get-ItemProperty HKLM:\software\wow6432node\microsoft\windows\currentversion\uninstall\ + mysql server + select-object displayversion,displayname + + + cscript.exe;wscript.exe + powershell.exe;powershell_ise.exe + + + cscript.exe;wscript.exe + powershell.exe;powershell_ise.exe + + + powershell.exe;powershell_ise.exe + mshta.exe + + + wscript.exe;cscript.exe + IEX;Net.WebClient;ospp.vbs;powershell;slmgr.vbs;spiceworks_upload + + + wscript.exe + .jse + .js + .vba + .vbe + + + cscript.exe + .js + .jse + .vba + .vbe + + + mshta vbscript:CreateObject("Wscript.Shell");mshta vbscript:Execute("Execute;mshta vbscript:CreateObject("Wscript.Shell").Run("mshta.exe;javascript:a= + .jpg;.png;.lnk;.xls;.doc;.zip;.sct;.hta + + + C:\Windows\Temp\hpqhvind.exe;C:\ProgramData\DRM\;Test.exe + C:\ProgramData\DRM;wmplayer.exe;C:\ProgramData\DRM\CLR\CLR.EXE + + + regedit.exe + explorer.exe + + + + svchost.exe;taskhostw.exe;userinit.exe;smss.exe;csrss.exe;wininit.exe;winlogon.exe;lsass.exe;logonui.exe;services.exe + C:\windows\System32\;C:\windows\syswow64\ + wininit.exe;winlogon.exe;services.exe;dwm.exe;System;smss.exe;svchost.exe + + + \spoolsv.exe;\PrintIsolationHost.exe + C:\Windows\System32\spoolsv.exe;\GPLGS\gswin32c.exe;C:\Windows\System32\spool\drivers\;\bin\gswin64c.exe;C:\PROGRA~2\CUTEPD~1\;C:\Windows\EEFPrinter.exe + C:\Windows\system32\spool\DRIVERS + Brother Industries;Thomson Reuters + + COMSPEC + ScriptFile + AppData\Local\Temp\7z + AppData\Local\Temp\Temp1_ + \AppData\Local\Temp\Rar$ + + + powershell.exe;powershell_ise.exe + C:\users\ + Microsoft VS Code\Code.exe + \Deployment tool extract\setupodt.exe + + Shellcode + + ipy.exe + python.exe + + -agentpath: + -agentlib: + + + + + iexplore.exe;chrome.exe;firefox.exe;browser_broker.exe;vivaldi.exe;microsoftedge.exe;microsoftedgecp.exe;brave.exe;vivaldi.exe + tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe + apt-config + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe + tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe + .cmd;- + C:\Windows\system32\spool\DRIVERS\ + PhotoViewer.dll + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe + C:\Users\ + .exe + Zoom Video + Firefox + Microsoft Edge + Microsoft Teams + GrammarlyAddInSetupe + Teams.exe + Zoom.exe + browser_broker.exe + chrome.exe + edge.exe + firefox.exe + iexplore.exe + vivaldi.exe + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe + C:\ProgramData\ + Firefox + Microsoft Edge + Microsoft Teams + Zoom Video + + + acrobat.exe;acrord32.exe + tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe + + + apache;w3wp.exe;php-cgi.exe;nginx.exe;httpd.exe;tomcat;php.exe + arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe + + + cmd.exe + ping 127.0.0.1 + c:\windows\system32\inetsrv\ + + + sqlservr + arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;sh.exe;bash.exe + + + winword.exe;powerpnt.exe;excel.exe + control.exe + input.dll + + + msdt.exe + msdt.exe + BrowseForFile=;PCWDiagnostic + /af;-af + + + msdt.exe + pcwrun.exe + PCWDiagnostic + /af;-af + + + msdt.exe + /cab;-cab + .diagcab + + + powershell.exe;pwsh.exe;cmd.exe;mshta.exe;cscript.exe;wscript.exe;wsl.exe;rundll32.exe;regsvr32.exe + msdt.exe + + EQNEDT32.EXE + + winword.exe;excel.exe;powerpnt.exe + FLTLDR.EXE + + + /dde;-dde + + + + schtasks.exe + /create;-create;/change;-change + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ + + taskeng.exe + + schtasks.exe + /Run;-run + Sentinel\AutoRepair + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ + + + schtasks.exe + + at.exe + at.exe + + C:\Windows\System32\svchost.exe + netsvcs;-p;-s;Schedule + netsvcs;-p;-s;Schedule + + + + + + net.exe;net1.exe;net2.exe + stop + tvsu_tmp + + + net.exe;net1.exe;net2.exe + start + tvsu_tmp + + + wmiprvse.exe;mmc.exe;explorer.exe;services.exe + &1;cmd.exe;\\127.0.0.1\;/Q /c + + + wmiprvse.exe;mmc.exe;explorer.exe;services.exe + &1;cmd.exe;\\127.0.0.1\;-Q -c + + + schtasks;Create;ONLOGON;TN;Updater;TR;powershell + + + sc.exe + create + \NIC_Emulex_Firmware\;C:\Windows\Temp\ExchangeSetup\ + + + sc.exe + config;binpath + + + cmd.exe;powershell.exe + services.exe + + new-service + psexesvc.exe + + Execute processes remotely + psexe + PsExec Service + PsExec Launched + + + accepteula + + + Execute processes remotely + -s;/s + + psexec.exe + pskill.exe + pskill + + C:\WINDOWS\system32\svchost.exe;RPCSS + + + + && type + > + cmd.exe" /c cd + + + ntdsutil;/set {default} recoveryenabled no;telnet ;-dumpcr;putty;bash.exe;pssh;shareenum;sekurlsa;reg save;reg save;psscan;shellexec;vbscript:createobject;/output:clipboard;root\\default;root\\subscription;Wmiclass;WmiCl'+'as'+'s + + + ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy + ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy + + --disable-http2 --disable-quic + /Client/Login?id= + JABzA + + + 2f40abbb4f78e77745f0e657a19903fc953cc664;478dc5a5f934c62a9246f7d1fc275868f568bc07;37b4496e650b3994312c838435013560b3ca8571;37b4496e650b3994312c838435013560b3ca8571;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;807d86da63f0db1fc746d1f0b05bc357;849a2b0dc80aeca3d175c139efe5221c;86A4CAC227078B9C95C560C8F0370BF0;98908ce6f80ecc48628c8d2bf5b2a50c;a4b42c2c95d1f2ff12171a01c86cd64f;4abe604916c04fe3dd8b9cb3d501d3f;eac3e3ece94bc84e922ec077efb15edd;128CECC59C91C0D0574BC1075FE7CB40;88777aacd5f16599547926a4c9202862;0f49621b06f2cdaac8850c6e9581a594;17a36ac3e31f3a18936552aff2c80249;322cb39bc049aa69136925137906d855;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;3d129263f6a48647f103a04446fb0c2f;37cd353621b0f4fc6981b50071c94f01;1b60021baedc3f9201bcdb40e9b87f62;71345b139166482acaa568ac8816c7bc;5E022694C0DBD1FBBC263D608E577949;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc5733c013378fa418d13773f5bfe6f1;c579341f86f7e962719c7113943bb6e4;d326e629a90e78825645963b35e53a6a;5E022694C0DBD1FBBC263D608E577949;53841a0c6a3ff92976db08bfdf95e083;dc7e564809d6c2a2f3457c3c9b91f22b;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b;FE2CA1BE3BDA2A757036A89E54CC02DB;FE2CA1BE3BDA2A757036A89E54CC02DB + + 22d142f11cf2a30ea4953e1fffb0fa7e;2317d65da4639f4246de200650a70753;27612cb03c89158225ca201721ea1aad;412956675fbc3f8c51f438c1abc100eb;daf2da52475fd8981b19ec3c321a983c;490a140093b5870a47edc29f33542fd2;51a7068640af42c3a7c1b94f1c11ab9d;533340c54bd25256873b3dca34d7f74e;684eca6b62d69ce899a3ec3bb04d0a5b;69a19abf5ba56ee07cdd3425b07cf8bf;6cfd131fef548fcd60fbcdb59317df8e;72dc98449b45a7f1ccdef27d51e31e91;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;80c37e062aa4c94697f287352acf2e9d;815f1f8a7bc1e6f94cb5c416e381a110;a43d3b31575846fa4c3992b4143a06da;08e82dc7bae524884b7dc2134942aadb;7bcd736a2394fc49f3e27b3987cce640;57314359df11ffdf476f809671ec0275;b72737b464e50aa3664321e8e001ff32;ce8ce92fb6565181572dce00d69c24f8;5985087678414143d33ffc6e8863b887;84730a6e426fbd3cf6b821c59674c8a0;d5377dc1821c935302c065ad8432c0d2;d8f1356bebda9e77f480a6a60eab36bb;92f8e3f0f1f7cc49fad797a62a169acd;9003cfaac523e94d5479dc6a10575e60;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;c1e7850da5604e081b9647b58248d7e8;99828721ac1a0e32e4582c3f615d6e57;f559c87b4a14a4be1bd84df6553aaf56;b9c208ea8115232bfd9ec2c62f32d6b8;061089d8cb0ca58e660ce2e433a689b3;0e9afd3a870906ebf34a0b66d8b07435;9c115e9a81d25f9d88e7aaa4313d9a8f;520ee02668a1c7b7c262708e12b1ba6b;7bfba2c69bed6b160261bdbf2b826401;77a745b07d9c453650dd7f683b02b3ed;3a771efb7ba2cd0df247ab570e1408b2;0969b2b399a8d4cd2d751824d0d842b4;fc53f2cd780cd3a01a4299b8445f8511;4e39620afca6f60bb30e031ddc5a4330;bfe3f6a79cad5b9c642bb56f8037c43b;3dfebce4703f30eed713d795b90538b5;9793afcea43110610757bd3b800de517;36db24006e2b492cafb75f2663f241b2;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;649ef1dd4a5411d3afcf108d57ff87af;320b2f1d9551b5d1df4fb19bd9ab253a;3d75c72144d873b3c1c4977fbafe9184;b9cf4301b7b186a75e82a04e87b30fe4;b4e67706103c3b8ee148394ebee3f268;7bfbd72441e1f2ed48fbc0f33be00f24;cdb303f61a47720c7a8c5086e6b2a743;2a6f7ec77ab6bd4297e7b15ae06e2e61;8403a28e0bffa9cc085e7b662d0d5412;3ffd2915d285ad748202469d4a04e1f5;04078ef95a70a04e95bda06cc7bec3fa;235d427f94630575a4ea4bff180ecf5d;8035a8a143765551ca7db4bc5efb5dfd;cacaa3bf3b2801956318251db5e90f3c;1aadf739782afcae6d1c3e4d1f315cbd;c3e255888211d74cc6e3fb66b69bbffb;d9e9f22988d43d73d79db6ee178d70a4;16ab79fb2fd92db0b1f38bedb2f02ed8;8da15a97eaf69ff7ee184fc446f19cf1;ffc7305cb24c1955f9625e525d58aeee;c0e72eb4c9f897410c795c1b360090ef;9ad6fa6fdedb2df8055b3d30bd6f64f1;44619a88a6cff63523163c6a4cf375dd;a571660c9cf1696a2f4689b2007a12c7;81229c1e272218eeda14892fa8425883;0ac48cfa2ff8351365e99c1d26e082ad;afcdf79be1557326c854b6e20cb900a7 + a53a02b997935fd8eedcb5f7abab9b9f + e96a73c7bf33a464c510ede582318bf2 + serialfunc.exe + + e PAA;en PAA;enc PAA;enco PAA;encode PAA;encoded PAA;encodedco PAA;encodedcom PAA;encodedcomm PAA;encodedcomma PAA;encodedcomman PAA;encodedcommand PAA;e IAA;en IAA;enc IAA;enco IAA;encode IAA;encoded IAA;encodedco IAA;encodedcom IAA;encodedcomm IAA;encodedcomma IAA;encodedcomman IAA;encodedcommand IAA;e JAB;en JAB;enc JAB;enco JAB;encode JAB;encoded JAB;encodedco JAB;encodedcom JAB;encodedcomm JAB;encodedcomma JAB;encodedcomman JAB;encodedcommand JAB;e cwBFAFQA;en cwBFAFQA;enc cwBFAFQA;enco cwBFAFQA;encode cwBFAFQA;encoded cwBFAFQA;encodedco cwBFAFQA;encodedcom cwBFAFQA;encodedcomm cwBFAFQA;encodedcomma cwBFAFQA;encodedcomman cwBFAFQA;encodedcommand cwBFAFQA;e SQBFAF;en SQBFAF;enc SQBFAF;enco SQBFAF;encode SQBFAF;encoded SQBFAF;encodedco SQBFAF;encodedcom SQBFAF;encodedcomm SQBFAF;encodedcomma SQBFAF;encodedcomman SQBFAF;encodedcommand SQBFAF;e UwBFAFQA;en UwBFAFQA;enc UwBFAFQA;enco UwBFAFQA;encode UwBFAFQA;encoded UwBFAFQA;encodedco UwBFAFQA;encodedcom UwBFAFQA;encodedcomm UwBFAFQA;encodedcomma UwBFAFQA;encodedcomman UwBFAFQA;encodedcommand UwBFAFQA;e IABpAE4AdgBPAEsAZQAt;en IABpAE4AdgBPAEsAZQAt;enc IABpAE4AdgBPAEsAZQAt;enco IABpAE4AdgBPAEsAZQAt;encode IABpAE4AdgBPAEsAZQAt;encoded IABpAE4AdgBPAEsAZQAt;encodedco IABpAE4AdgBPAEsAZQAt;encodedcom IABpAE4AdgBPAEsAZQAt;encodedcomm IABpAE4AdgBPAEsAZQAt;encodedcomma IABpAE4AdgBPAEsAZQAt;encodedcomman IABpAE4AdgBPAEsAZQAt;encodedcommand IABpAE4AdgBPAEsAZQAt;e SQBmACgAJAB;en SQBmACgAJAB;enc SQBmACgAJAB;enco SQBmACgAJAB;encode SQBmACgAJAB;encoded SQBmACgAJAB;encodedco SQBmACgAJAB;encodedcom SQBmACgAJAB;encodedcomm SQBmACgAJAB;encodedcomma SQBmACgAJAB;encodedcomman SQBmACgAJAB;encodedcommand SQBmACgAJAB;e J;en J;enc J;enco J;encode J;encoded J;encodedco J;encodedcom J;encodedcomm J;encodedcomma J;encodedcomman J;encodedcommand J;e SUVY;en SUVY;enc SUVY;enco SUVY;encode SUVY;encoded SUVY;encodedco SUVY;encodedcom SUVY;encodedcomm SUVY;encodedcomma SUVY;encodedcomman SUVY;encodedcommand SUVY;e aWV4;en aWV4;enc aWV4;enco aWV4;encode aWV4;encoded aWV4;encodedco aWV4;encodedcom aWV4;encodedcomm aWV4;encodedcomma aWV4;encodedcomman aWV4;encodedcommand aWV4;e dmFy;en dmFy;enc dmFy;enco dmFy;encode dmFy;encoded dmFy;encodedco dmFy;encodedcom dmFy;encodedcomm dmFy;encodedcomma dmFy;encodedcomman dmFy;encodedcommand dmFy;e dgBhA;en dgBhA;enc dgBhA;enco dgBhA;encode dgBhA;encoded dgBhA;encodedco dgBhA;encodedcom dgBhA;encodedcomm dgBhA;encodedcomma dgBhA;encodedcomman dgBhA;encodedcommand dgBhA;e R2V0;en R2V0;enc R2V0;enco R2V0;encode R2V0;encoded R2V0;encodedco R2V0;encodedcom R2V0;encodedcomm R2V0;encodedcomma R2V0;encodedcomman R2V0;encodedcommand R2V0;e IAAgAH;en IAAgAH;enc IAAgAH;enco IAAgAH;encode IAAgAH;encoded IAAgAH;encodedco IAAgAH;encodedcom IAAgAH;encodedcomm IAAgAH;encodedcomma IAAgAH;encodedcomman IAAgAH;encodedcommand IAAgAH;e TVq;en TVq;enc TVq;enco TVq;encode TVq;encoded TVq;encodedco TVq;encodedcom TVq;encodedcomm TVq;encodedcomma TVq;encodedcomman TVq;encodedcommand TVq;e aQBIA;en aQBIA;enc aQBIA;enco aQBIA;encode aQBIA;encoded aQBIA;encodedco aQBIA;encodedcom aQBIA;encodedcomm aQBIA;encodedcomma aQBIA;encodedcomman aQBIA;encodedcommand aQBIA;e UEs;en UEs;enc UEs;enco UEs;encode UEs;encoded UEs;encodedco UEs;encodedcom UEs;encodedcomm UEs;encodedcomma UEs;encodedcomman UEs;encodedcommand UEs;e H4s;en H4s;enc H4s;enco H4s;encode H4s;encoded H4s;encodedco H4s;encodedcom H4s;encodedcomm H4s;encodedcomma H4s;encodedcomman H4s;encodedcommand H4s;e dXNpbm;en dXNpbm;enc dXNpbm;enco dXNpbm;encode dXNpbm;encoded dXNpbm;encodedco dXNpbm;encodedcom dXNpbm;encodedcomm dXNpbm;encodedcomma dXNpbm;encodedcomman dXNpbm;encodedcommand dXNpbm;e cwBhA;en cwBhA;enc cwBhA;enco cwBhA;encode cwBhA;encoded cwBhA;encodedco cwBhA;encodedcom cwBhA;encodedcomm cwBhA;encodedcomma cwBhA;encodedcomman cwBhA;encodedcommand cwBhA;JABzA + + + FromBase64String + JAB;SUVY;aWV4;dmFy;dgBhA;R2V0;SQBFAF;TVq;aQBIA;UEs;H4s;dXNpbm;cwBhA + + + /v Word experienced;/v Excel experienced;-v Word experienced;-v Excel experienced + + + JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ;QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA;kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA;IgAoACcAKgAnACkAOwAkA;IAKAAnACoAJwApADsAJA;iACgAJwAqACcAKQA7ACQA + + + e^;^en^;^nc + + + ^ + + + ..\;\.. + + + \cmd.exe /c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe /c del "C:\Users\*\Desktop\*.exe;\cmd.exe -c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe -c del "C:\Users\*\Desktop\*.exe + + ping.exe -n 6 127.0.0.1 &ping.exe /n 6 127.0.0.1 & type + System.Net.Networkinformation.ping + + mofcomp.exe + + + + + net.exe;net1.exe;net2.exe + user;group;localgroup + remove;delete;active;del + tvsu_tmp + + + + + + + + + net.exe;net1.exe;net2.exe + user + add + tvsu_tmp + + dsmod.exe + dsadd.exe + + + + WerFault.exe + -s;/s + + + + + + + + + + + + + + + cmd.exe + echo;\pipe\;> + + + cmd.exe + /c;copy;dll;\\;admin$ + + + rundll32.exe + ,;StartW + + + rundll32.exe + ,;update;appdata;temp;/i: + + + rundll32.exe + ,;update;appdata;temp;-i: + + + dllhost.exe + {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} + + + dllhost.exe + {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} + + + + winlogon.exe;services.exe;lsass.exe;csrss.exe;wininit.exe;spoolsv.exe;searchindexer.exe + powershell.exe;pwsh.exe;cmd.exe + AUTHORI;AUTORI + route ; ADD + + + + eventvwr.exe + c:\windows\system32\mmc.exe + + fodhelper.exe + InstallUtil.exe + Invoke-PsUaCme + BypassUAC + PowerUp + computerdefaults.exe + dism.exe + fodhelper.exe + + + NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC + NT AUTHORITY\SYSTEM;СИСТЕМА;NT-AUTORITÄT\SYSTEM;AUTORITE NT\SYSTEM + + c:\windows\system32\svchost.exe -k netsvcs -s Appinfo + runas.exe + + + + + + + + Cmd.Exe + winlogon.exe + utilman.exe + + + Cmd.Exe + winlogon.exe + sethc.exe + + + utilman.exe + C:\Windows\System32\ATBroker.exe;Magnify.exe;C:\Windows\System32\osk.exe + + sethc.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe + + sdbinst.exe + + + cmd.exe /c C:\Windows\Setup\Scripts\SetupComplete.cmd;cmd.exe /c C:\Windows\Setup\Scripts\PartnerSetupComplete.cmd + C:\Windows\Setup + C:\Windows\SysWOW64 + C:\Windows\System32 + C:\Windows\WinSxS + + + consent.exe + http + iexplore.exe + SYSTEM + + + dwm.exe + + + cmd.exe + 7zFM.exe + ;/c;-c + + + cmd.exe + elevation_service.exe + System + + + + + + + + unknown process + \LocalState\rootfs\ + \LocalState\rootfs\ + + + + + + + + + + + auditpol + /set;-set;/restore;-restore;/clear;-clear;/remove;-remove;/resourceSACL;-resourceSACL + + + + + + + +s;+h + attrib.exe + + + Hidden;Attributes + powershell.exe + + + + + Sysinternals Sysmon + /u;/c;-u;-c + C:\ProgramdData\sysmon\ + + + MpCmdRun.exe + Add-MpPreference;RemoveDefinitions;DisableIOAVProtection + + + + IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE + + + IMPHASH=19584675D94829987952432E018D5056 + + + IMPHASH=330768a4f172e10acb6287b87289d83b + + + PsKill.exe + + Set-MpPreference;Add-MpPreference;Remove-MpPreference;MpCmdRun.exe + RemoveDefinitions;RemoveDynamicSignature;DisableIOAVProtection;DisableRealTimeMonitoring;DisableBehaviorMonitoring;DisableBlockAtFirstSeen;DisableIOAVProtection;DisablePrivacyMode;DisableScriptScanning;DisableRealtimeMonitoring;DisableScanningNetworkFiles;DisableScanningMappedNetworkDrivesForFullScan;DisableRestorePoint;DisableRemovableDriveScanning;SignatureDisableUpdateOnStartupWithoutEngine;DisableIntrusionPreventionSystem;DisableScanOnRealtimeEnable;DisableArchiveScanning;DisableIntrusionPreventionSystem;DisableScriptScanning;DisableOnAccessProtection;ExclusionExtension;ExclusionPath;ExclusionProcess;ThreatDefaultAction;TamperProtection + + interface ipv6 set + interface ipv4 set + taskkill.exe + + firewall delete + firewall add + firewall set opmode disable + Core Networking - Router Solicitation + netsh advfirewall firewall + + + wevtutil.exe + cl + wevtutil im + wevtutil.exe im + ClickToRun + + + fltMC.exe + detach;unload + + + appcmd.exe + DontLog;True + iisetup.exe + + + set;NGenAssemblyUsageLog + New-ItemProperty;NGenAssemblyUsageLog + reg;add;dword;NGenAssemblyUsageLog + $env;NGenAssemblyUsageLog + + + set;COMPlus_ETWEnabled + New-ItemProperty;COMPlus_ETWEnabled + reg;add;dword;COMPlus_ETWEnabled + $env;COMPlus_ETWEnabled + + + + bash.exe;wsl.exe;ubuntu.exe;kali.exe + -e;/e;-u root;--exec bash;dev/tcp + + wsl.exe + wsl.exe + wslhost.exe + wslhost.exe + ubuntu.exe + ubuntu.exe + kali.exe + kali.exe + + pcalua.exe + pcalua.exe + bash.exe + bash.exe + forfiles.exe + forfiles.exe + .com + -appvscript + + + + C:\Users\NetworkService\;C:\Users\NetworkService\;HarddiskVolumeShadowCopy;C:\Users\Default\;C:\Users\Public;C:\Users\Guest\;\administrateur\;C:\Windows\Media\;C:\Windows\addins\;tsclient\;\htdocs\;\config\systemprofile\;C:\PerfLogs\;c:\windows\ServiceProfiles\;C:\Intel\Logs\;C:\Windows\repair\;C:\Windows\Help\;$Recycle;C:\Windows\Debug\;C:\Windows\Security\;C:\Windows\Fonts\;\wwwroot\;\Contacts;C:\Windows\vss\ + + + + + reg add hkcu\software\classes\ + reg.exe add hkcu\software\classes\ + C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry + + regedit.exe + : + + + reg.exe + delete + + + regedit.exe + /d;-d + + + HKCU:;HKLM + remove-item + + + HKCU:;HKLM + set-item;new-item + + + + + + chcp.exe + 936 + 1256 + 864 + 1258 + 855 + 866 + + + powershell.exe + -e ;-en;-enc;-enco;-encod;-encode;-encoded;-encodedc;-encodedco;-encodedcom;-encodedcomm;-encodedcomma;-encodedcomman;-encodedcommand;/e ;/en;/enc;/enco;/encod;/encode;/encoded;/encodedc;/encodedco;/encodedcom;/encodedcomm;/encodedcomma;/encodedcomman;/encodedcommand + + + powershell.exe + -w h;-wi h;-win h;-wind h;-windo h;-window h;-windows h;-windowst h;-windowsty h;-windowstyl h;-windowstyle h;/w h;/wi h;/win h;/wind h;/windo h;/window h;/windows h;/windowst h;/windowsty h;/windowstyl h;/windowstyle h + + + powershell.exe + -ex;/ex + bypass + + + powershell.exe + -noni;/noni + Import-Module FileServerResourceManager + C:\Program Files\LogicMonitor + + + powershell.exe + hextobin;iex;io.filestream;system.text;base64;system.io;io.file;IMAGE_SUBSYSTEM_WINDOWS_GUI;IMAGE_NT_OPTIONAL_HDR32;IMAGE_NT_OPTIONAL_HDR64;DllCharacteristicsType;GetDelegateForFunctionPointer;WriteProcessMemory;ReadProcessMemory;ImpersonateSelf;AdjustTokenPrivileges;NtCreateThreadEx;CreateRemoteThread;io.seek;iwr;-bxor;invoke-expression;remove.to.string;shellcode;System.Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;unicode;-useb;msxml2.serverxmlhttp;wscript.shell;-comobject;frombase64;io.compression;system.convert;io.streamreader;io.memorystream;compression.gzipstream;text.encoding;executioncontext;text.enc;convertto-securestring;runtime.interop;verbosepreference;[[string]]::join + + + powershell.exe + SUVYI;aWV4I;SQBFAFgA;aQBlA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC;UwB0AGE + + + C^om^S^pEc;^c^o^m^S^p^E^c^;Wscript.Shell;-ComObject;MsXml2.ServerXmlHttp;Remove.ToString;System.Convert;-UseB;[Byte[];^h^t^t^p;h"t"t"p + + IwAjACMAd;IyM=;SUVYI;aWV4I;SQBFAFgA;aQBlAHgA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC + WindowStyle Hidden function;WindowStyle Hidden;windowstyle h;windowstyl h;windowsty h;windowst h;windows h;window h;windo h;wind h;win h;wi h;-w h;/w h;win hi;win hid;win hidd;win hidde;win hidden + ^ + TYPE CON > + copy CON > + FromBase64String;action=create keyvalue=;VerbosePreference.ToString;SecureString;CSharpCodeProvider;runtime.interopservices.marshal;system.globalization.numberstyles;system.reflection.assembly;hextobin;VerbosePreference.ToString;system.text.encoding;io.filestream;io.filestream;io.seekorigin;text.encoding;unicode.getstring;FromBase64;[Convert]::;System.IO.File]::ReadAllText;|iex + + certutil + decode;encode + + + + ping.exe + 0x + + + + csc.exe + \AppData\;\Windows\Temp\ + + + csc.exe + wscript.exe + cscript.exe + mshta.exe + + + mofcomp.exe + .mof + C:\WINDOWS\Installer\MSI + MsMpEng.exe + aspnet_regiis.exe + msiexec.exe + + + csc.exe + out:;target:library + + Microsoft.Workflow.Compiler.exe + + + + + autochk.exe + \smss.exe;\fontdrvhost.exe;\dwm.exe + + + \consent.exe;\Runtimebroker.exe;\TiWorker.exe + \svchost.exe + - + + + \consent.exe;\Runtimebroker.exe;\TiWorker.exe + svchost.exe + - + + + SearchProtocolHost.exe + \SearchIndexer.exe;\dllhost.exe + - + + + dllhost.exe + \services.exe;\svchost.exe + - + + + smss.exe + \smss.exe + System + - + + + csrss.exe + - + \smss.exe;svchost.exe + + + wininit.exe + - + \smss.exe + + + winlogon.exe + \smss.exe + + + \lsass.exe;LsaIso.exe + \wininit.exe + + + LogonUI.exe + \wininit.exe;\winlogon.exe + + + services.exe + \wininit.exe + + + svchost.exe + - + \MsMpEng.exe;\services.exe + + + spoolsv.exe + \services.exe + + + taskhost.exe + \services.exe;\svchost.exe + + + userinit.exe + \dwm.exe;\winlogon.exe + + + \wmiprvse.exe;\wsmprovhost.exe;\winrshost.exe + - + \svchost.exe + + + \SearchProtocolHost.exe;\taskhost.exe;\csrss.exe + \werfault.exe;\wermgr.exe;\WerFaultSecure.exe + + + autochk.exe + \chkdsk.exe;\doskey.exe;\WerFault.exe + + + smss.exe + \autochk.exe;\smss.exe;\csrss.exe;\wininit.exe;\winlogon.exe;\setupcl.exe;\WerFault.exe + + + wermgr.exe + \WerFaultSecure.exe;\wermgr.exe;\WerFault.exe + + + conhost.exe + \mscorsvw.exe;\wermgr.exe;\WerFault.exe;\WerFaultSecure.exe + + System.Management.Automation + + + + + + + InstallUtil.exe + /logfile=;/LogToConsole=false;/U + + + InstallUtil.exe + -logfile=;-LogToConsole=false;-U + + + Mavinject.exe;mavinject64.exe + INJECTRUNNING + + + CMSTP.exe + /ni;/s + + + CMSTP.exe + /ns;/s + + + CMSTP.exe + -ni;-s + + + CMSTP.exe + -ns;-s + + + rundll32.exe;shell32.dll;_RunDLL + C:\Windows\ImmersiveControlPanel\SystemSettings.exe + + + odbcconf.exe + /S /A {REGSVR;-S -A {REGSVR + + script:http + Register-cimprovider + Scriptrunner.exe -appvscript + bginfo + cbd + runscripthelper.exe surfacecheck + xwizard RunWizard + PresentationHost + driver executeinf + control.exe /name;control.exe -name + Control_RunDLL + SyncAppvPublishingServer.exe + Scriptrunner.exe + ATBroker.exe + Appvlp.exe + InfDefaultInstall.EXE + PresentationHost.exe + RegisterCimProvider2.exe + RegisterCimProvider.exe + ScriptRunner.exe + csi.exe + extexport.exe + msconfig.EXE + rasdlui.exe + tttracer.exe + verclsid.exe + wab.exe + Register-cimprovider.exe + csi.exe + devtoolslauncher.exe LaunchForDeploy + bginfo + devtoolslauncher.exe + wab.exe + wsreset.exe + + cmstp.exe /ni /s;cmstp.exe -ni -s + cmstp /ni /s;cmstp -ni -s + + Mavinject.exe + INJECTRUNNING + + + rundll32.exe + DllRegisterServer + xapauthenticodesip.dll + + + regsvr32.exe + C:\Users;Appdata;Temp + + + regsvr32.exe + C:\Users;Public + + Microsoft(C) Register Server + SyncAppvPublishingServer.exe + control.exe + rasautou.exe + control.exe /name;control.exe -name + Control_RunDLL + + + msiexec.exe + /y;-y + C:\Windows\SysWOW64\DartSock.dll + C:\Windows\SysWOW64\ImageViewer2.OCX + C:\Windows\SysWOW64\SysTray.ocx + C:\Windows\SysWOW64\tdbg6.ocx + C:\Windows\SysWOW64\tdbg7.ocx + C:\Windows\SysWOW64\tdbg7.ocx + C:\Windows\SysWOW64\todg7.ocx + C:\Windows\SysWOW64\todgub7.dll + C:\Windows\SysWOW64\xarraydb.ocx + + + msiexec.exe + /i;-i + http + + + + RUNDLL32.EXE + ,;# + C:\Windows\resources\themes\Aero\AeroLite.msstyles + uxtheme.dll + ImageView_Fullscreen + EDGEHTML.dll + PhotoViewer.dll + \AppData\Local\WebEx\WebEx\ + + + RUNDLL32.EXE + -sta;/sta + + + RUNDLL32.EXE + shell32.dll;OpenAs_RunDLL + + + RUNDLL32.EXE + powershell + + + RUNDLL32.EXE + url.dll;OpenURL + + + RUNDLL32.EXE + url.dll;FileProtocolHandler + + + RUNDLL32.EXE + zipfldr.dll;RouteTheCall + + + RUNDLL32.EXE + Shell32.dll;Control_RunDLL + + + RUNDLL32.EXE + javascript: + + + RUNDLL32.EXE + RegisterXLL + + + rundll32.exe + C:\Users;Public + rdpinit.exe + rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe + + + rundll32.exe + C:\Users;Appdata;Temp + ImageView_ + rdpinit.exe + rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe + + advpack.dll;LaunchINFSection + ieadvpack.dll;LaunchINFSection + syssetup.dll;SetupInfObjectInstallAction + setupapi.dll;InstallHinfSection + InstallHinfSection + infDefaultInstall.exe + rundll32.exe "C:\Windows\twain_64.dll" + shdocvw.dll;OpenURL + advpack.dll;RegisterOCX + Zipfldr.dll;RouteTheCall + url.dll;FileProtocolHandler + url.dll;FileProtocolHandler + OpenURLA;file: + OpenURL;file: + + + mshta.exe + cmd.exe;powershell.exe;wscript.exe;cscript.exe;sh.exe;bash.exe;reg.exe;regsvr32.exe;bitsadmin + + + mshta.exe + + RunHTMLApplication + mshtml + vbscript:CreateObject + + odbcconf.exe + + + manage-bde.wsf + + + + + powershell.exe;powershell_ise.exe + msbuild.exe + + + msbuild.exe + regasm + + + msbuild.exe + userinit.exe + + + msbuild.exe + .xml + + + regasm.exe + \conhost.exe + + + msbuild.exe + .lnk + + .csproj + + + + + + + msxsl.exe + msxsl.exe + + + + + + + + + /stext + keylog + keyscan_ + Get-Keystrokes + /scomma + + + + + + sniff + C:\Program Files\Adobe\ + + + tcpdump.exe;tcpdump.c;tshark.exe;tshark.c;windump.exe;windump.c;wireshark.c;wireshark.exe + windump;tshark;tcpdump;windump;wireshark + netsh;trace;start;capture=yes + + + + vssadmin.exe + create;shadow + + + wmic.exe + shadowcopy;call;create + + + wmic.exe + call;create;esentutl;vss + + + win32_shadowcopy;create;clientaccessible + + + mklink;GLOBALROOT;Shadow + + + copy;NTDS\ntds.dit + + + ntdsutil.exe + + + copy;System32\config\SYSTEM + + + reg;save;HKLM + + + mimikatz;mimidrv;mimilove;mimilib;sekurlsa;lsadump;dumpcreds;privilege::;token::;logonpasswords;mimikittenz;mimiauth;::;kerberos::;misc::skeleton;privilege::debug;dpapi::cred;vault::cred;lsadump;misc::;Krbtgt;TOKEN::;invoke-mimi + + + cmdkey + + rpcping.exe + nltest.exe + + -ma lsass.exe;Do-Exfiltration;Powersploit;GPPPassword;gpprefdecrypt;gsecdump;hashdump;laZagne;ntds.dit;ppldump;pwdump;pwdumpx;secretsdump;/listcreds:;-listcreds: + + VaultCloseVault + VaultEnumerateItem + VaultFree + VaultGetItem + VaultOpenVault + Vaultcmd + vaultcli.dll + select * from moz_login + Invoke-WinEnum + System.Net.CredentialCache + create shadow + wlan;export;profile;key=clear + dcsync + HKCU /f password;HKCU -f password + HKLM /f password;HKLM -f password + nltest.exe + ProcDump.exe + ProcDump + + + asktgt;asktgs + createnetonly /program:;createnetonly -program: + dump /service:krbtgt;dump -service:krbtgt + harvest /interval:;harvest -interval: + renew /ticket:;renew -ticket: + asreproast + impersonateuser: + kerberoast + ptt /ticket: + klist.exe + hh.exe + + + + appcmd.exe + list;text;password + + + + quser.exe + + net.exe;net1.exe;net2.exe + group;localgroup; user + /domain + SUService + \users + tvsu_tmp + + + net.exe;net1.exe;net2.exe + group;localgroup; user + /domain + SUService + \users + tvsu_tmp + + + sharphound;bloodhound;azurehound;CollectionMethod;encryptzip;randomizefilenames;dumpcomputerstatus + sharphound;bloodhound + sharphound;bloodhound + sharphound;bloodhound + sharphound;bloodhound + sharphound;bloodhound + sharphound;bloodhound + + dscl . list /Groups;dscl . list -Groups + dscl . list /Users;dscl . list -Users + dsquery.exe + query.exe + + + + + + + + + + + tree.com + + + auditpol + /get;-get;/list;-list;/backup;-backup + + gpresult.exe + get-gpo;get-gpresult;get-gpreg + + + + + + + + tasklist.exe + qprocess.exe + + reg query + reg.exe query + driverquery.exe + + + tracert.exe + pathping.exe + + + + find;385201 + select-string;385201 + + + find;virus + select-string;virus + process;Description;virus + find;cb + select-string;cb + process;Description;cb + find;defender + select-string;defender + process;Description;defender + find;crowdstrike + select-string;crowdstrike + process;Description;crowdstrike + find;sentinel + select-string;sentinel + process;Description;sentinel + find;nessusd + select-string;nessusd + process;Description;nessusd + find;td-agent + select-string;td-agent + process;Description;td-agent + find;cbagentd + select-string;cbagentd + process;Description;cbagentd + find;sysmon + select-string;sysmon + process;Description;sysmon + find;winlogbeat + select-string;winlogbeat + process;Description;winlogbeat + find;winlogbeat + select-string;winlogbeat + process;Description;winlogbeat + find;csfalcon + select-string;csfalcon + process;Description;csfalcon + find;splunk + select-string;splunk + process;Description;splunk + find;sidecar + select-string;sidecar + process;Description;sidecar + + + fltMC.exe + misc::mflt + + AntiVirusProduct + root\SecurityCenter2 + + sysinfo.exe + systeminfo + + + + netsh.exe + get;list;show + + + netsh.exe + get;list;show + + ipconfig.exe + + netstat.exe + arp -a + arp.exe -a + arp -a + + + whoami.exe;whoami1.exe + + + wmic.exe + get;useraccount + + + netsh.exe + add;del;set + + + nbtstat + nessus + + + route.exe + print + + + route.exe + ADD;DEL;CHANGE;-f + + qwinsta.exe + rwinsta.exe + + + + + + + + Microsoft Office\root\Office + Microsoft Office\root\Office + automation;Embedding + + + admin$ + davclnt.dll + WebClientGroup + + + + + + + /shadow;-shadow + noConsentPrompt + + + tscon.exe + dest:rdp-tcp: + + + powershell.exe + WmiPrvSE.exe + + + WmiPrvSE.exe + \Users\ + + + NetworkDetective + WmiPrvSE.exe + + + sc.exe + tenable + WmiPrvSE.exe + + + cmd.exe + WmiPrvSE.exe + do_vbsUpload;Spiceworks + + + regsvr32.exe + WmiPrvSE.exe + + + cmd.exe + WmiPrvSE.exe + + + powershell.exe + WmiPrvSE.exe + + + dsa.msc + + + virtmgmt.msc + + + wmiprvse.exe + CompMgmtLauncher.exe + DismHost.exe + Microsoft.NET\Framework + NetEvtFwdr.exe + ServerManager.exe + WerFault.exe + chcp.com + g2mupdate.exe + slack.exe + + + wsmprovhost.exe + cmd.exe + sh.exe + bash.exe + wsl.exe + powershell.exe + powershell_ise.exe + schtasks.exe + at.exe + certutil.exe + mshta.exe + whoami.exe + ping.exe + ping.exe + bitsadmin.exe + + winrm.cmd + winrs.exe + winrshost.exe + waitfor.exe + wsmprovhost.exe + winrshost.exe + wsmprovhost.exe + + wmiprvse.exe + mshta.exe + + + ssh.exe;putty.exe;kitty.exe;kitty_portable.exe + + PuTTY suite + + sftp;psftp + + + rundll32.exe + + + rundll32.exe + ..\;, + + + rundll32.exe + ,StartW + + psshutdown + psservice + PsPasswd + mstsc.exe + telnet.exe + tftp.exe + powershellcustomhost + + + -Embedding + c:\windows\system32\mmc.exe + + --execm;atexec + {4991d34b-80a1-4291-83b6-3328366b9097} + {00020812-0000-0000-C000-000000000046} + {40AEEAB6-8FDA-41e3-9A5F-8350D4CFCA91} + {7e0423cd-1119-0928-900c-e6d4a52a0715} + {0006F04A-0000-0000-C000-000000000046} + {048EB43E-2059-422F-95E0-557DA96038AF} + {13709620-C279-11CE-A49E-444553540000} + {c08afd90-f2a1-11d1-8455-00a0c91f3880} + 9BA05972-F6A8-11CF-A442-00A0C90A8F39 + {00021A20-0000-0000-C000-000000000046} + {72C24DD5-D70A-438B-8A42-98424B88AFB8} + {00020906-0000-0000-C000-000000000046} + {cc5bbec3-db4a-4bed-828d-08d78ee3e1ed} + {1b7cd997-e5ff-4932-a7a6-2a9e636da385} + {16d51579-a30b-4c8b-a276-0ff4dc41e755} + rundll32.exe -sta;rundll32.exe /sta;rundll32 -sta;rundll32 /sta + shell32.dll;SHCreateLocalServerRunDll + -k DcomLaunch;/k DcomLaunch + + + + + + + + + + 7z.exe + a -mx9 -r0 -p;a -v500m -mx9 -r0 -p + + + WindowsAudioDevice-Powershell-Cmdlet + SoundRecorder.exe + + + + clip.exe + get-clipboard + + + + + + + + + + New-MailboxExportRequest + + + + screencapture + system.drawing.Imaging + system.drawing.bitmap + system.windows.forms.screen + + + + + + + odHRwczovL;aHR0cDovL;h0dHA6Ly;odHRwOi8v;aHR0cHM6Ly;h0dHBzOi8v + ie_to_edge_stub.exe;chrome.exe;firefox.exe;iexplore.exe;brave.exe;vivaldi.exe;msedge.exe;webex;teams.exe;goto opener.exe;lynx.exe;\Webex\webexAppLauncherLatest.exe;\WebEx\webexAppLauncher.exe;\WebEx\Applications\webexAppLauncher.exe;WebEx\webex.exe + wbx:;/SITE_TOKEN=;msteams:;PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSI + msedgeupdate.dll + + + VFZvQUFBQ;RWb0FBQU;UVm9BQUFB;VFZxQUFBR;RWcUFBQU;UVnFBQUFF;VFZwUUFBS;RWcFFBQU;UVnBRQUFJ;VFZxUUFBT;RWcVFBQU;UVnFRQUFN;VFZwVEFRR;RWcFRBUU;UVnBUQVFF + + + powershell.exe + AAAAYInlM;OiCAAAAYInlM;OiJAAAAYInlM;RwBlAHQAL;WwBOAGUAdAAuAFM;W05ldC5TZXJ2aWNl + + + Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք + + + + + + + + certutil.exe + urlcache;split;f + + + DownloadFile;DownloadString;Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;Invoke-Expression;Invoke-WebRequest + powershell.exe;cmd.exe + + + bitsadmin.exe + CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME + util;setieproxy;localsystem;AUTODETECT + + + BITS administration utility + CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME + + + \curl.exe;\wget.exe;\www.exe + + + \curl.exe;\wget.exe;\www.exe + + + certutil + split;f + + + certutil + verifyctl;URL + + start-bitstransfer + expand \\ + expand.exe \\ + ieexec http + ieexec.exe http + powercat + esentutl /y \\;esentutl -y \\ + esentutl.exe /y \\;esentutl.exe -y \\ + extrac32 \\ + extrac32.exe \\ + + + + + + portproxy + tor.exe + + TeamViewer_Desktop.exe + + psexec + + + + + + + winscp.exe;winscp.com;scp.exe;pscp + + + + bitch.exe;bitch.bat;bitch_lasagna.exe;Admin Cracker.exe;BulletsPassView.exe;ChromePass.exe;Dialupass.exe;LSASecretsView.exe;OpenedFilesView.exe;OperaPassView.exe;PasswordFox.exe;ProduKey.exe;RouterPassView.exe;USBDeview.exe;USBStealer.exe;VNCPassView.exe;WebBrowserPassView.exe;WirelessKeyView.exe;WirelessKeyView.exe;empv.exe;netpass.exe;pspv.exe;usbdll.exe;rdpv.exe;WirelessKeyView.exe;lasagna.exe;all -vvv >>;rsync -r + + + CredsLeaker;Windows.Security.Credentials.UI.CredentialPicker;function Leaker;function Await + + + .exe -url https://;dll,Run https://;Invoke-Merlin;-m SimpleHTTPServer;/m SimpleHTTPServer + + + + + -q=txt;/q=txt + nslookup.exe + + + rclone + Rsync for cloud storage + rclone + rclone + \rclone + + + s3browser + s3browser + s3browser + s3browser + + + add-ftp;.UploadFile( + ftp.exe + + + rundll32.exe + davclnt.dll;DavSetCookie + + + + + + + + + + + + bcdedit.exe + safeboot + + + bootcfg.exe + safeboot + + + -startvm;vrun.exe -vm + + + + + vssadmin.exe + delete;resize + + + wmic.exe + shadowcopy;delete + + + wbadmin.exe + SYSTEMSTATEBACKUP;delete + + + wmic.exe + wmic shadowstorage SET MaxSpace= + + + wmic.exe + cleareventlog;call disable;nteventlog where filename + + + diskpart.exe + format;clean;delete;remove + + + manage-bde.exe + changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw + + + manage-bde.wsf + changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw + + format + format + bootstatuspolicy ignoreallfailures + recoveryenabled No + Win32_Shadowcopy + sdelete + delete catalog + wbadmin delete catalog + erase + -nw -exec= + -p -nw + shred + diskshadow + + del ; /f + del ; -f + rmdir ; /s ; /q + rmdir ; -s ; -q + rd ; /s ; /q + rd ; -s ; -q + + + usn deletejournal + + + + + fsutil.exe + deletejournal + usn + + + + + + + + + + AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz + + + ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool + CPU miner;GPU miner;Lime Miner;XMRig CPU miner; miner + + + + b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 + + 87AECF008D87EC86EC8B00A2394B3E6C + FB3F0D0DE8B80EA8CFAB2A025EC6B833 + F4067FBF7FFF6945D0BB485B727B39AA + 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee + e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f + d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b + 53841a0c6a3ff92976db08bfdf95e083 + + + zoommtg + pwd= + + + zoommtg + zc=0 + + + zoommtg + zc=1 + + + msteams: + + + wbx: + + + C:\Users\ + \Downloads\ + + + C:\Users\ + \Desktop\ + + + \awk.exe;\sed.exe + + listena + -s -n -u -i:http: + /s /n /u /i:http: + assoc + del + expand + md + move + rd + ren + set + setx + bginfo.bgi /popup /nolicprompt;bginfo.bgi -popup -nolicprompt + find.exe + grabff + routerscan + pythonEngine.Execute + sesshijack + file:// + HTML Application host + Manager Profile Installer + Microsoft Application Virtualization Injector + Application Compatibility Database Installer + popd.exe + pushd.exe + subst.exe + doskey.exe + cls.exe + \ + C:\Windows\system32\svchost.exe -k iissvcs + \ + acrobat.exe + acrord32.exe + java.exe + javaw.exe + + + + + C:\Windows\system32\svchost.exe + + cacls + takeown + /x Macro + + \pipe\ + > + + /noprofile + /sc ONEVENT + \\VBOXSVR + | more + |more + \\tsclient + %PROCESSOR_ARCHITECTURE% + sysnative + AutoIt + Microsoft Filter Loader + more.com + :\Windows\Microsoft.NET\ + acrord32.exe + gpupdate.exe + :\Windows\Microsoft.NET\ + + + + + + + + C:\Windows\System32\WerFault.exe + C:\Windows\System32\wbem\WmiPrvSE.exe + + + + + + + C:\Users + C:\ProgramData + \Temp\ + \tmp\ + \drivers\ + \Download + + + + + C:\Windows\system32\backgroundTaskHost.exe + TrustedInstaller.exe + OneDrive.exe + vivaldi.exe + chrome.exe + C:\WINDOWS\system32\backgroundTaskHost.exe + setup + AppData\Local\Microsoft\Teams\current\Teams.exe + \AppData\Local\Microsoft\Edge SxS\Application\msedge.exe + + + + + + + + census + researchscan + scanhub + shadow + shodan + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + wscript.exe + + + + + + + + at.exe + schtasks.exe + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \temp\ + 127.0.0.1 + + + \wwwroot\ + + \Windows\addins\ + C:\Windows\repair\ + \htdocs\ + C:\Windows\system32\config\systemprofile\ + C:\Intel\Logs\ + C:\Windows\addins\ + C:\Windows\security\ + C:\Windows\Help\ + $RECYCLE.BIN + C:\Windows\Debug\ + C:\Windows\Fonts\ + C:\PerfLogs\ + :\$Recycle.bin\ + :\Users\Default\ + C:\Users\NetworkService\ + C:\Users\Public\ + C:\Windows\Media\ + \Windows\IME\ + C:\ProgramData + + + + + + + + CSC.exe + + + + + + + + + + infDefaultInstall.exe + SyncAppvPublishingServer.exe + + + InstallUtil.exe + + msiexec.exe + + + regasm.exe;regsvcs.exe + + + Mavinject.exe + + + + + + msbuild.exe + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + dsquery.exe + + + + + + + + + + + + + driverquery.exe + + + + nbtstat + + net.exe + net1.exe + + qwinsta.exe + rwinsta.exe + + + + + + + + + + + + true + 3389 + AutomationManager.ScriptRunner64.exe + C:\Program Files (x86)\VMware\VMware Remote Console\vmrc.exe + C:\Program Files\VMware\VMware Remote Console\vmrc.exe + C:\Program Files\WindowsApps\Microsoft.RemoteDesktop_ + CtxLicUsageRecorder.exe + FSAssessment.exe + FSDiscovery.exe + MobaRTE.exe + RDCMan.exe + RSSensor.exe + RTS2App.exe + RTSApp.exe + RemoteDesktopManager64.exe + RemoteDesktopManager.exe + RemoteDesktopManagerFree.exe + Terminals.exe + chrome.exe + mRemote.exe + mRemoteNG.exe + mstsc.exe + spiceworks-finder.exe + svchost.exe + thor64.exe + thor.exe + + + true + 3391 + AutomationManager.ScriptRunner64.exe + C:\Program Files (x86)\VMware\VMware Remote Console\vmrc.exe + C:\Program Files\VMware\VMware Remote Console\vmrc.exe + C:\Program Files\WindowsApps\Microsoft.RemoteDesktop_ + CtxLicUsageRecorder.exe + FSAssessment.exe + FSDiscovery.exe + MobaRTE.exe + RDCMan.exe + RSSensor.exe + RTS2App.exe + RTSApp.exe + RemoteDesktopManager64.exe + RemoteDesktopManager.exe + RemoteDesktopManagerFree.exe + Terminals.exe + chrome.exe + mRemote.exe + mRemoteNG.exe + mstsc.exe + spiceworks-finder.exe + svchost.exe + thor64.exe + thor.exe + + + true + 3389 + 127.0.0.1;0:0:0:0:0:0:0:1 + + + true + 3389 + fe80:0 + + + putty.exe;kitty.exe;kitty_portable.exe + + + wsmprovhost.exe + + + psftp.exe + + reg.exe + psshutdown + PsPasswd + psservice + ssh.exe + psexe + tftp.exe + telnet.exe + mstsc.exe + wmic.exe + sc.exe + pskill + dsquery.exe + plink.exe + vnc.exe + vncviewer.exe + vncservice.exe + omniinet.exe + hpsmhd.exe + + + + + + + + + + + + + + + + + + + + + + + + + + + 50050 + true + + + 25 + \Bin\EdgeTransport.exe;Bin\MSExchangeFrontendTransport.exe + true + + + + + + + + + + + powershell.exe + 0:0:0:0:0:0:0:;127.0.0.1 + + mshta.exe + cmd.exe + certutil.exe + certutil.exe + notepad.exe + regsvcs.exe + regsvr32.exe + rundll32.exe + + + + + + + tor.exe + hiddenservice.net;onion.city;onion.direct;onion.direct;onion.link;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org;onion.to + + + + + + + + + + dns.google;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;doh.opendns.com;.quad9.net;dns.cleanbrowsing.org;dns-family.adguard.com;dns.adguard.com;.233py.com;dnscrypt;dnscrypt-cert.oszx.co;dns.oszx.co;doh.dns.sb;doh.defaultroutes.de;doh.tiarap.org;doh.tiar.app;doh.captnemo.in;.aaflalo.me;doh.appliedprivacy.net;doh.dnswarden.com;commons.host;dns.twnic.tw;ibuki.cgnat.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;.seby.io;rdns.faelix.net;doh.li;.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk;adblock.mydns.network;ibksturm.synology.me;jcdns.fun + + + + + + + privatlab.com + mega.nz;mega.co.nz + .pcloud.com + + + + + + + + + + + + + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool + + + + + C:\Windows\system32\svchost.exe + 3389 + 22 + 21 + 5985 + false + + + C:\Windows\system32\svchost.exe + true + 135 + 445 + 5985 + + + System + svchost.exe + 445 + + + System + svchost.exe;lsass.exe + 389 + + + C:\Windows\System32\lsass.exe + 389 + 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 + EXCH + 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 + false + + + notepad.exe + 127.0.0.1 + + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + 80 + 443 + true + + github + githubusercontent.com + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + 80 + true + + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + 443 + true + + + apache.exe + + + java.exe + + + w3wp.exe + + + \php-cgi.exe;\php.exe + + + setup + + + tomcat + + + unins + + + unknown process + + + explorer.exe + + + inetinfo.exe + + + netcat.exe;nc.exe;nc64.exe;ncat.exe + procdump + psexe + vnc;vncs;vncv + + rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe;advanced_port_scanner.exe;rcpping.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe + + + 0 + 5985 + 5986 + 1293 + 1701 + 1194 + 3540 + 3389 + 22 + 1080 + 3128 + 8080 + 1723 + 23 + 4500 + 9001 + 9030 + 5900 + 5800 + + 0 + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + 443 + true + + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + 80 + true + + 80 + 443 + 636 + 5900 + 443 + + afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com + + + + + udp + + + System;svchost.exe;oracle.exe;apache.exe;java.exe;php-cgi.exe;w3wp.exe;httpd;ServerManager.exe;unknown process;sql;wscript;cscript;schtasks;at.exe;reg.exe;C:\Windows\System32\find.exe + 127.0.0.1;0:0:0:0:0:0:0:1 + 127.0.0.1;0:0:0:0:0:0:0:1 + + + + C:\Windows\System32\lsass.exe + 88 + + + epmap + llmnr + microsoft-ds + netbios-dgm + ntp + ssdp + epmap + llmnr + microsoft-ds + netbios-dgm + ntp + ssdp + + 53 + 67 + 68 + 1434 + 1812 + 3544 + 3702 + 5228 + 5353 + 5357 + 5989 + 6007 + 49154 + 49209 + 52176 + 59241 + 53 + 67 + 68 + 1812 + 3702 + 6007 + 49154 + 49209 + 50646 + 52176 + 59241 + + .bing.com + .cloudapp.net + .lync.com + .microsoft.com + .outlook.com + .search.msn.com + .wns.windows.com + aps.windows.com + arc.msn.com.nsatc.net + arc.msn.com + atson.telemetry.microsoft.com + au.download.windowsupdate.com + b.akamaiedge.net + bingforbusiness.com + client-office365-tas.msedge.net + config.edge.skype.com + csp.digicert.com + ctldl.windowsupdate.com + cy2.licensing.md.mp.microsoft.com.akadns.net + cy2.settings.data.microsoft.com.akadns.net + displaycatalog.mp.microsoft.com + download.windowsupdate.com + e-msedge.net + e3.delivery.dsp.mp.microsoft.com.nsatc.net + emdl.ws.microsoft.com + ettings-win.data.microsoft.com + fe2.update.microsoft.com + fe3.delivery.dsp.mp.microsoft.com.nsatc.net + fe3.delivery.mp.microsoft.com + g.akamaiedge.net + g.live.com + g.msn.com.nsatc.net + geo-prod.do.dsp.mp.microsoft.com + geo-prod.dodsp.mp.microsoft.com.nsatc.net + ile-service.weather.microsoft.com + ip5.afdorigin-prod-am02.afdogw.com + ipv4.login.msa.akadns6.net + licensing.mp.microsoft.com + m3p.wns.notify.windows.com.akadns.net + microsoft.com.akadns.net + microsoft.com.nsatc.net + microsoft.com + modern.watson.data.microsoft.com.akadns.net + msedge.net + msn.com.nsatc.net + msn.com + ocation-inference-westus.cloudapp.net + ocos-office365-s2s.msedge.net + ocsp.digicert.com + odern.watson.data.microsoft.com.akadns.net + oneclient.sfx.ms + pv4.login.msa.akadns6.net + query.prod.cms.rt.microsoft.com + ris.api.iris.microsoft.com.akadns.net + ris.api.iris.microsoft.com + s-msedge.net + settings.data.microsoft.com + sfe.trafficshaping.dsp.mp.microsoft.com + sls.update.microsoft.com + storecatalogrevocation.storequality.microsoft.com + storeedgefd.dsx.mp.microsoft.com + telecommand.telemetry.microsoft.com.akadns.net + tile-service.weather.microsoft.com + tlu.dl.delivery.mp.microsoft.com + tsfe.trafficshaping.dsp.mp.microsoft.com + vip5.afdorigin-prod-am02.afdogw.com + vip5.afdorigin-prod-ch02.afdogw.com + virtualearth.net + windows.net + windowsupdate.com + y2.displaycatalog.md.mp.microsoft.com.akadns.net + y2.licensing.md.mp.microsoft.com.akadns.net + y2.settings.data.microsoft.com.akadns.net + EdgeTransport.exe + MSExchangeDelivery.exe + MSExchangeFrontendTransport.exe + MSExchangeHMWorker.exe + MSExchangeSubmission.exe + \ + + + + + + + + + + + + + C:\Windows\ + \System32\;Syswow64;sysmon.exe;sysmon64.exe + + + C:\Windows\system32\ + config\systemprofile\ + + + C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe + + + A:\;B:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;N:\;O:\;P:\;Q:\;R:\;S:\;T:\;U:\;V:\;W:\;X:\;Y:\;Z:\;AA:\;BB:\;CC:\;DD:\;EE:\;FF:\;GG:\;HH:\;II:\;JJ:\;KK:\;LL:\;MM:\;NN:\;OO:\;PP:\;QQ:\;RR:\;SS:\;TT:\;UU:\;VV:\;WW:\;XX:\;YY;ZZ:\ + :\PROGRA~ + :\Program Files + :\Program Files + :\Program Files + :\ProgramData\ + :\Users\ + :\Windows\ + :\inetpub\ + :\$SysReset + :\$WinREAgent + :\inetpub\ + + + \ + + + C:\Users\ + + + C:\ProgramData\ + C:\ProgramData\sysmon\sysmon64.exe;C:\ProgramData\sysmon\sysmon.exe + + + C:\Program Files;C:\PROGRA~ + + + C:\inetpub\ + + + $RECYCLE.BIN + packetbeat.exe;metricbeat.exe;filebeat.exe;winlogbeat.exe;o365beat.exe;graylog-sidecar.exe;graylog-collector-sidecar.exe;splunkd.exe;splunk.exe;syslogng.exe;syslog-ng.exe;nxlog-processor.exe;snarecore.exe;fluentd;td-agent + C:\Windows\system32\config\systemprofile\ + C:\Windows\sysWOW64\config\systemprofile\ + \Temp\ + C:\Users\ + + + + + Microsoft\Teams\current\Teams.exe + \git.exe + Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe + C:\ProgramData\Lenovo\ImController\ + + + + + + + 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e + + + 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5;c948ae14761095e4d76b55d9de86412258be7afd;c996d7971c49252c582171d9380360f2;ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1;10b30bdee43b3a2ec4aa63375577ade650269d25;d2fd132ab7bbc6bbb87a84f026fa0244 + + DumpExt.dll + mimidrv + lsremora + wceaux.dll + npcap + \Temp + :\Users + ChongKim Chan + ? + Revoked + Unavailable + Valid + false + + + + + + + + + + + + + + msdt.exe + sdiageng.dll + + + WINWORD.exe;EXCEL.EXE + VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wshom.ocx + wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll + + + ntkrnlmp.exe + + + \spool\drivers\x64\3\;\spool\drivers\W32X86\3\;\spool\drivers\IA64\3\ + spoolsv.exe;printisolationhost.exe + Valid + Brother Industries;Canon;Sharp;Microsoft Corporation;DYMO;Euro Plus d.o.o;HP Inc;Hewlett-Packard + + + C:\Windows\ + \Users\Public\;\Desktop\;\Downloads\;\AppData\Local\Temp\;\PerfLogs\;$Recycle;\Fonts\ + \Program Files + + + EQNEDT32.EXE + EQNEDT32.EXE + + + ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll + C:\Users;\Temp\;\ProgramData\ + + + ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll + wscript.exe;cscript.exe;powershell.exe;rundll32.exe;msbuild.exe;msiexec.exe;csc.exe + + + WINWORD.exe;EXCEL.EXE + VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wshom.ocx + wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll;fastprox.dll + + + WINWORD.exe;EXCEL.EXE + VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll + + + WINWORD.exe;EXCEL.EXE + VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll + + + WINWORD.exe;EXCEL.EXE + taskschd.dll + + + wscript.exe;cscript.exe + taskschd.dll + + + wmiprvse.exe + taskschd.dll + + + powershell.exe + msi.dll + + + powershell + amsi.dll + + + powershell + amsi.dll + + + WINWORD.exe;EXCEL.EXE + clr.dll + + + clr.dll;System.Management.ni.dll;Microsoft.Build.Utilities + + + wscript.exe;cscript.exe + msxml;wshom.ocx + + + wscript.exe;cscript.exe + winhttp.dll;mswsock.dll;IPHLPAPI.DLL + + + installutil.exe + CustomMarshalers.dll;CustomMarshalers.ni.dll;System.Management.ni.dll;WMINet_Utils.dll;mswsock.dll + + + System.Management.Automation.ni.dll + C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ + + + System.Management.Automation.dll + C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ + Lenovo.Vantage.AddinHost;\Microsoft.Sara.exe;C:\Program Files\CONEXANT + + + C:\Windows\System32\vaultcli.dll + \svchost.exe;\GameBar.exe;C:\Program Files\WindowsApps;\Microsoft\Teams\current\Teams.exe + + + \\ + + + \Microsoft\Word\Startup\ + .wll + + + \Microsoft\Excel\Startup\ + .xll + + + \Microsoft\Addins\ + .xla + + + tor-lib.dll + + + C:\Windows\System32\WinSCard.dll;C:\Windows\System32\cryptdll.dll;C:\Windows\System32\hid.dll;C:\Windows\System32\samlib.dll;C:\Windows\System32\vaultcli.dll + + + rundll32.exe + vaultcli.dll;wlanapi.dll + combase.dll + cryptdll.dll + imm32.dll + logoncli.dll + netapi32.dll + ntasn1.dll + ntdsapi.dll + samlib.dll + shcore.dll + srvcli.dll + + + odbc32.dll;winhttp.dll;netapi32.dll;SHLWAPI.dll + + + C:\Windows\Explorer.EXE + C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe + + + C:\ProgramData\ + C:\ProgramData\ + .exe + Adobe + C:\ProgramData\Lenovo\ + C:\ProgramData\Microsoft\Windows Defender\ + C:\ProgramData\sysmon\sysmon64.exe + + + C:\Users\Default\;C:\Users\Public\ + .exe + + + 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e + + + C:\Windows\System32\svchost.exe + false + + + Revoked + + + Expired + + + jscript9.dll + mshta.exe + + scrobj.dll + crypt0.dll + + C:\Windows\System32\wlanapi.dll + C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe + C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe + C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience + C:\Windows\ImmersiveControlPanel\SystemSettings.exe + C:\Windows\ImmersiveControlPanel\SystemSettings.exe + C:\Windows\System32\AppHostRegistrationVerifier.exe + C:\Windows\System32\CompatTelRunner.exe + C:\Windows\System32\DeviceCensus.exe + C:\Windows\System32\DriverStore\FileRepository\ + C:\Windows\System32\LogonUI.exe + C:\Windows\System32\MoNotificationUx.exe + C:\Windows\System32\SystemSettingsBroker.exe + C:\Windows\System32\dxgiadaptercache.exe + C:\Windows\System32\netsh.exe + C:\Windows\System32\wlanext.exe + C:\Windows\UUS\amd64\MoUsoCoreWorker.exe + C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_ + C:\Windows\explorer.exe + + C:\Windows\Microsoft.NET\assembly\GAC_MSIL + + + + + + \Microsoft Office\ + \mscorlib.ni.dll + + + \Microsoft Office\ + \sppc.dll + + + C:\Windows\System32\svchost.exe + true + + + Fortinet + Lenovo + Sophos + mscorsvw.exe + C:\Program Files (x86)\Microsoft Office\root\Office15\officebackgroundtaskhandler.exe + C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe + C:\Program Files\Microsoft Office\root\Office15\officebackgroundtaskhandler.exe + C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe + C:\Windows\SysWOW64\SearchProtocolHost.exe + C:\Windows\System32\InstallAgentUserBroker.exe + C:\Windows\System32\RuntimeBroker.exe + C:\Windows\System32\SearchIndexer.exe + C:\Windows\System32\SettingSyncHost.exe + C:\Windows\System32\backgroundTaskHost.exe + C:\Windows\System32\sppsvc.exe + C:\Windows\System32\taskhost.exe + C:\Windows\System32\taskhostw.exe + C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe + C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe + HxTsr.exe + SearchUI.exe + C:\Program Files (x86)\Common Files\BIExcelFunctions1.1\32bit\Sage. + C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Pfx. + C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Adist64.dll + C:\Program Files (x86)\Microsoft Office\Office15\Library\Analysis\ANALYS32.XLL + C:\Program Files (x86)\Microsoft Office\Office16\Library\Analysis\ANALYS32.XLL + C:\Program Files\Microsoft Office\Office15\Library\Analysis\ANALYS32.XLL + C:\Program Files\Microsoft Office\Office16\Library\Analysis\ANALYS32.XLL + C:\Windows\SysWOW64\sppc.dll + Microsoft.Office.Interop.VisOcx.dll + Microsoft.Office.Interop.Word.dll + Microsoft.Vbe.Interop.dll + OFFICE.DLL + + + + + + + + 0x001A0000 + c:\windows\system32\lsass.exe + + + msiexec.exe + + + chrome.exe;firefox.exe;edge.exe;browser_broker.exe;iexplore.exe + + + 0x001A0000 + c:\windows\system32\lsass.exe + + + c:\windows\system32\lsass.exe + c:\windows\system32\rundll32.exe + + + DbgUiRemoteBreakin + nacl64.exe + + + QueryProcessDebugInformationRemote + nacl64.exe + + + isdebuggerpresent + nacl64.exe + + + DebugActiveProcess + nacl64.exe + + + LoadLibrary + C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe + C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe + C:\Windows\ImmersiveControlPanel\SystemSettings.exe + C:\Windows\System32\DriverStore\FileRepository\ + C:\Windows\System32\igfxEM.exe + C:\Windows\System32\igfxHK.exe + Enterprise\Common7\IDE\devenv.exe + C:\Program Files (x86)\ASUS\ROG Live Service\FileOperator.exe + C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe + + + CreateFileMapping;MapViewOfFile + + + LdrLoadDll + + + CryptAcquireContextA;CryptDecodeObjectEx;CryptImportPublicKeyInfo;CryptEncrypt;CryptGenKey;CryptDecrypt;CryptStringToBinary;CryptBinaryToString;CryptImportKey + + + c:\windows\system32\csrss.exe + CrtlRoutine + + 0B80 + 0C7C + 0C88 + c:\windows\system32\mstsc.exe + + C:\WINDOWS\SYSTEM32\ntdll.dll + EtwEventWrite + + + + + + + C:\Windows\SysWOW64\wbem\WmiPrvSE.exe + C:\Windows\system32\audiodg.exe + C:\Windows\system32\services.exe + C:\Windows\system32\svchost.exe + C:\Windows\system32\wbem\WmiPrvSE.exe + C:\Windows\system32\wininit.exe + C:\Windows\system32\winlogon.exe + + + + + + + + + + + + + C:\Windows\System32\SHELL32.dll+9b5bd + \LocalBridge.exe + + + C:\Windows\System32\wshom.ocx+c8a0;C:\Windows\System32\wshom.ocx+c39d + + + C:\Windows\SYSTEM32\framedynos.dll+2cb3e + C:\Windows\system32\SgrmBroker.exe;C:\Windows\system32\SecurityHealthService.exe;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Windows\system32\services.exe;C:\Windows\system32\wininit.exe;C:\Windows\system32\sppsvc.exe;C:\Windows\System32\smss.exe;C:\Windows\system32\csrss.exe;C:\Windows\System32\svchost.exe + + + C:\Windows\SYSTEM32\framedynos.dll+2b496 + + + C:\Windows\SYSTEM32\dbgcore.DLL+6cfb + + + C:\Windows\System32\KernelBase.dll+de67e + + + ntdll.dll+a0044 + + + clr.dll+6c23;clr.dll+6b38 + + + C:\Windows\\SYSTEM32\ntdll.dll+;|C:\Windows\System32\KERNELBASE.dll+;|UNKNOWN( + ) + + + "UNKNOWN(;)|UNKNOWN( + ) + + + "UNKNOWN + 0x1F0FFF;0x1F1FFF;0x143A;0x1410;0x1010;0x1F2FFF;0x1F3FFF;0x1FFFFF + + + C:\Program Files;\Microsoft Office\Root\Office + \Microsoft Shared\VBA + C:\Program Files (x86)\Intuit\ + + + C:\Windows\system32\lsass.exe + 0x1FFFFF + UNKNOWN + WmiPerfClass.dll + C:\Windows\sysWOW64\wbem\wmiprvse.exe;C:\Windows\system32\wbem\wmiprvse.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe;WmiPerfClass.dll;C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files (x86)\Common Files\Adobe + + + C:\Windows\system32\lsass.exe + C:\Windows\system32\wsmprovhost.exe + + + C:\Windows\system32\lsass.exe + 0x1FFFFF + python27.dll;_ctypes.pyd;KERNELBASE.dll;ntdll.dll + + + C:\Windows\system32\lsass.exe + C:\Windows\SYSTEM32\ntdll.dll+4595c|C:\Windows\system32\KERNELBASE.dll+8185 + + + C:\Windows\system32\lsass.exe + C:\WINDOWS\SYSTEM32\ntdll.dll+ + ) + |C:\WINDOWS\System32\KERNELBASE.dll+;|UNKNOWN( + wow64.dll;)|C;Exchange.Diagnostics;Microsoft.Exchange + C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe;c:\windows\system32\inetsrv\w3wp.exe;MSExchangeHMHost.exe;C:\Windows\sysWOW64\wbem\wmiprvse.exe + + + C:\Windows\system32\winlogon.exe + 0x1F3FFF + C:\Windows\Microsoft.NET;UNKNOWN + + + .exe + C:\Windows\sysmon64.exe;C:\Windows\sysmon64.exe + 0x1C00 + + + C:\Windows\system32\lsass.exe + 0x1F1FFF + UNKNOWN + + + C:\Windows\system32\lsass.exe + 0x1010 + UNKNOWN + + + C:\Windows\system32\lsass.exe + 0x143A + UNKNOWN + + + C:\Windows\system32\lsass.exe + 0x1fffff + dbghelp.dll;dbgcore.dll + + + dbghelp.dll;dbgcore.dll + C:\Windows\system32\lsass.exe + C:\wfx32\ + + + powershell.exe + C:\Programdata\sysmon\sysmon64.exe;C:\Programdata\sysmon\sysmon.exe;C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe;\dismhost.exe + + + getasynckeystate + + + cmlua.dll + + + System.Management.Automation + C:\ProgramData\Microsoft\Windows Defender\platform\ + ctiuser.dll + C:\Program Files\Citrix\ConfigSync\ConfigSyncRun.exe + C:\Program Files\Microsoft\Exchange Server\V14\bin\ExSetupUI.exe + C:\Program Files\Microsoft\Exchange Server\V15\bin\ExSetupUI.exe + C:\Program Files\Microsoft\Exchange Server\V16\bin\ExSetupUI.exe + C:\Windows\SysWOW64\sdiagnhost.exe + C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe + C:\Windows\Temp\ExchangeSetup\ExSetupUI.exe + C:\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe + C:\Program Files\Microsoft Azure Active Directory Connect\AzureADConnect.exe + C:\Windows\system32\HOSTNAME.EXE + C:\Windows\system32\ROUTE.exe + C:\Windows\system32\query.exe + MsMpEng.exe + + + C:\Windows\system32\lsass.exe + comsvcs.dll + + + VBE7.dll;VBEUI.DLL;VBE7INTL.DLL + + + VBE6.dll;VBEUI.DLL;VBE6INTL.DLL + + + Office + verclsid.exe + VBE7.dll;VBEUI.DLL;VBE7INTL.DLL + |UNKNOWN( + 0x1FFFFF + + + C:\Program Files\Microsoft Office\Root\Office + C:\Windows\System32\KERNELBASE.dll+76516 + + + C:\Windows\System32\SHELL32.dll+ae3b9 + C:\WINDOWS\system32\sihost.exe + C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub + + UNKNOWN + + |UNKNOWN( + C:\WINDOWS\SYSTEM32\ntdll.dll+ + |C:\WINDOWS\System32\KERNELBASE.dll+ + ) + 0x1028;0x1fffff + C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git\ + + + winword.exe;excel.exe;powerpnt.exe + :\Windows\Microsoft.NET\Framework64\v2.;UNKNOWN + + + UNKNOWN + 0x147a + + + C:\Windows\Sysmon64.exe;C:\Windows\Sysmon.exe + C:\WINDOWS\system32\wbem\wmiprvse.exe + C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe + C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe;C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe;C:\Program Files (x86)\Google\Update\GoogleUpdate.exe + 0x1400 + + + 0x0800 + + 0x0810 + + 0x0820 + + 0x810 + + 0x820 + cscript.exe + wscript.exe + jjs.exe + dump + mimikatz + CorperfmontExt.dll + + + + + + wmiprvse.exe + lsass.exe + + + lsass.exe + winlogon.exe + + + + lsass.exe + C:\Windows\system32\w32tm.exe;C:\Windows\System32\ping.exe;C:\Windows\System32\net.exe;C:\Windows\System32\net1.exe;C:\Windows\SYSTEM32\HOSTNAME.EXE;C:\Programdata\sysmon\sysmon.exe;C:\Programdata\sysmon\sysmon64.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\Program Files (x86)\BeAnywhere Support Express\;C:\Program Files (x86)\CheckPoint\;C:\Program Files (x86)\Common Files\Intuit\QuickBooks\;C:\Program Files (x86)\Fortinet\;C:\Program Files (x86)\Trend Micro\;C:\Program Files\Adobe\Adobe Creative Cloud Experience\;C:\Program Files\CheckPoint\;C:\Program Files\Fortinet\;C:\Program Files\Realtek;C:\Program Files\Trend Micro\;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Program Files (x86)\Lenovo\;snmpd.exe;taskmgr;:\Windows\System32\smss.exe;:\Windows\system32\wininit.exe;\Bin\FMS.exe; \EMET_GUI.exe;\EMET_Service.exe;\Google\Update\GoogleUpdate.exe;\RAAGTAPP.EXE;\controls\cef\ConnectWise.exe;C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe;C:\Program Files\Hewlett-Packard\AMS\service\hpqams.exe;C:\Program Files\Intel\SUR\WILLAMETTE\ESRV\esrv_svc.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\WINDOWS\system32\WerFault.exe;C:\WINDOWS\system32\taskkill.exe;C:\Windows\SysWOW64\WerFault.exe;C:\Windows\System32\snmp.exe;C:\Windows\system32\msiexec.exe;C:\Windows\system32\spoolsv.exe;C:\Windows\system32\svchost.exe + + + :\Windows\system32\sppsvc.exe + :\Windows\system32\sdiagnhost.exe + + UNKNOWN(00007F + + C:\Windows\SYSTEM32\ntdll.dll + C:\Windows\SYSTEM32\win32u.dll + C:\Windows\SYSTEM32\wow64win.dll + + + + + + + + + + \TEMP\nessus_ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + solarwinds.businesslayerhost + .exe;.dll;.ps1;.mz;.jpg;.png + + + C:\WINDOWS\SysWOW64\netsetupsvc.dll + + + C:\Windows\SoftwareDistribution + C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_;.exe + .exe + + + proj + .targets + .build + .props + .tasks + .sln + .cs + + + + + + + .bat + .btm + .cmd + .com + .cmdline + .bas + .bin + C:\Windows\SysWOW64\Wbem + C:\Windows\System32\Wbem + .ws + .wsc + .wsf + .wsh + .pif + + .hta + + IronPython + .py + .pyc + .pyd + + + .cdxml + .ps1 + .ps1xml + .psc1 + .psd1 + .psm1 + .pssc + + + powershell.exe;powershell_ise.exe + + C:\Windows\SysWOW64\WindowsPowerShell + C:\Windows\System32\WindowsPowerShell + c:\Windows\System32\WindowsPowerShell\v1.0\profile + c:\Windows\Syswow64\WindowsPowerShell\v1.0\profile + \UsageLogs\powershell.exe.log + PSReadLine\ConsoleHost_history.txt + + .vbs + .oracle_jre_usage\ + .js + .jse + .vb + .vbe + .vbsript + + + + + Report.wer.tmp + \WER\ + C:\Windows\system32\wermgr.exe + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe + .exe + C:\Users + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe + .dll + C:\Users + + + + + + + + + + + !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;==READ==THIS==PLEASE==;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy + + crackmapexec + \Crypto.Cipher._AES.pyd + \Crypto.Cipher._DES.pyd + \Crypto.Hash._SHA256.pyd + \Crypto.Random.OSRNG.winrandom.pyd + \Crypto.Util.strxor.pyd + \crackmapexec.exe.manifest + \greenlet.pyd + BootStrapDLL.dll + C:\windows\temp\wininit.exe + lazycat;powerkatz;mimikatz;mimidrv;mimilove;mimilib;mimikittenz;mimiauth;invoke-mimi + rdpwrap.dll + winspool.drv + + C:\Windows\System32\Wbem + C:\Windows\SysWOW64\Wbem + C:\WINDOWS\system32\wbem\scrcons.exe + + + + + \Programs\Startup\ + \Startup\ + + + + + + + + + + + + \Word\STARTUP\ + \Microsoft\Templates\ + \Excel\XLSTART\ + .dotm + .XLSB + + + C:\Windows\Tasks\ + + + w3wp.exe + .aspx + \wwwroot\aspnet_client\ + + + w3wp.exe + .php + + + w3wp.exe + .aaa + + + \wwwroot\aspnet_client\ + .aspx;.php + + + \wwwroot\ + \wwwroot\aspnet_client\;jpg + + + .asp + \wwwroot\ + + + .aspx + \wwwroot\ + + \ecp\auth\ + \oab\auth\ + ClientAccess\Owa\ + \owa\auth\ + httpproxy\rpc\ + ClientAccess\ecp\ + \htdocs\ + + + + + + + + + + + + + + + .SPL + spoolsv.exe;printfilterpipelinesvc.exe;printisolationhost.exe;splwow64.exe;msiexec.exe;poqexec.exe + + + spoolsv.exe + .exe + C\:\Windows\System32\spool\;C\:\Windows\Temp\;C\:\Users\ + + + msiexec.exe + \Microsoft\Edge\Application + elevation_service.exe + + + + + + + + + + + + + + + + + + + + + + + + + \LocalState\rootfs\ + + + + C:\PerfLogs\ + C:\Temp\ + C:\Users\Default\ + C:\Users\Public\ + C:\Windows\Temp\ + \AppData\Temp\ + C:\WINDOWS\system32\dxgiadaptercache.exe + + $Recycle.Bin + $Recycle.Bin + + C:\Windows\ + \config\systemprofile\ + + + C:\Windows\ + \config\systemprofile\ + + + + + + + + + + + + + + + + + .chm + + + + + + + proj + .sln + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + UMWorkerProcess.exe;UMService.exe + . + .log;.cfg;.txt;cleanup;.HealthCheck;\wp.active;.db + + + + + + + + + + + + + + .7z + .7zip + .arj + .s7z + .a + .ace + .ar + .arc + .bin + .cab + .pak + .gz + .img + .iso + .lzm + .lzma + Temp\Rar$ + .rar + RarSFX + .sfx + .sz + .tar + .tar.gz + .xz + .zip + + + + + + + + + + + + + .ost + .eml + .msg + .pst + + + + + + + + + + Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք + + + + + + + Teamviewer.exe + rundll32.exe + mstsc.exe + cmd.exe + ipy.exe + WScript.exe + cscript.exe + mshta.exe + python.exe + wmic.exe + + + + + + + HiddenService + torrc + \tor.exe + tor-gencert + + + + + + + + + + + + + + + + rclone + s3browser + grabff.exe + grabff.exe + + + + + + RESTORE_;_FILES.txt + + + DECRYPT_;_FILES.txt + + + \run.dat;\task.dat;\storage.dat + AppData + Symantec + BlueJeans + + + VBoxRT.dll;VboxC.dll + + + + + + + + + + + + + + Content.IE5;INetCache + .exe;.zip;.ps1;.bat;.rar;.dll + + + MSForms.exd + + + .exe + C:\windows\system32\ + + + .exe + C:\windows\ + \system32\ + + + .dll;.exe + C:\windows\ + C:\Users\ + + + .dll;.exe + C:\Users\ + + + \Microsoft\Word\Startup\ + .wll + + + C:\windows\system32\CodeIntegrity\ + + + \Microsoft\Excel\Startup\ + .xll + + + \Microsoft\Outlook\VbaProject.OTM + + + \Microsoft\Addins\ + .xla + + + .vsto + + + .bat + C:\Windows\ + C:\ProgramData\Lenovo\SystemUpdate\sessionSE\ + + + .dll + C:\Windows\ + + + .sys + C:\Windows\ + + + .exe + C:\Windows\ + C:\Windows\System32\;C:\windows\syswow64\ + + + .exe + C:\Windows\System32\ + + + .exe + C:\Windows\SysWow64\ + + + .theme + + + \Packages\oice_ + + + VirtualboxVM.exe + + notepad++.exe + .lnk:Zone.Identifier + \UsageLogs\cscript.exe.log + \UsageLogs\mshta.exe.log + \UsageLogs\msiexec.exe.log + \UsageLogs\regsvr32.exe.log + \UsageLogs\rundll32.exe.log + \UsageLogs\svchost.exe.log + \UsageLogs\wmic.exe.log + \UsageLogs\wscript.exe.log + \regsvr32.exe.log + \UsageLogs\wsmprovhost.exe.log + .lnk + .url + + .sys + .inf + C:\Windows\SysWOW64\Drivers + C:\Windows\System32\Drivers + \Drivers\ + .drv + + .xlam + .xlsm + .xla + .xll + .xls + .xlsb + .xlsx + .xlt + .xltm + .xlw + \Microsoft\Templates\ + .eml + .msg + .pptm + .potm + .pptm + .pptm + .sldm + \Microsoft\Office\Recent + oleObject + \Downloads\ + \Content.Outlook\ + .docb + .wbk + .ped + .dot + .dotx + .doc + .docm + .docx + + .accdb + .accde + .accdr + .accdt + .mdb + .mde + .msc + .mst + .potx + .ppam + .ppsm + .ppsx + .ppt + .pptm + .pptx + .pub + .sldm + .sldx + .xls + .xps + + + + .pem + .crt + .ca-bundle + .cer + .csr + .der + .p7b + .p7r + .p7s + .pfx + .sto + .p12 + .crl + .sst + .key + + + + .hlp + ACLUI.DLL.UI + ACLUI.DLL + AFLogVw.exe + AShld.exe + AShldRes.DLL.asr + AShldRes.DLL + AhnI2.dll + CamMute.exe + CommFunc.dll + CommFunc.jax + DESqmWrapper.dll + DESqmWrapper.wrapper + FSPMAPI.dll.fsp + FSPMAPI.dll + Gadget.exe + LoLTWLauncher.exe + Mc.exe + McUtil.dll.ping + McUtil.dll.url + McUtil.dll + MpSvc.dll + MsMpEng.exe + NtUserEx.dat + NtUserEx.dat + NtUserEx.dll + NtUserEx.dll + NvSmart.exe + NvSmartMax.dll + NvSmartMax.dll + NvSmartMaxapp.dll + OInfo11.ISO + OInfo11.ocx + OInfoP11.exe + OleView.exe + OleView.exe + POETWLauncher.exe + RasTls.dll.config + RasTls.dll.msc + RasTls.dll + RasTls.exe + RunHelp.exe + Sidebar.dll.doc + Sidebar.dll + Ushata.dll + Ushata.exe + Ushata.fox + VeetlePlayer.exe + boot.ldr + chrome_frame_helper.dll.rom + chrome_frame_helper.dll + chrome_frame_helper.exe + dvcemumanager.exe + fsguidll.exe + fslapi.dll.gui + fslapi.dll + fsstm.exe + hccutils.dll.res + hccutils.dll + hha.dll.bak + hha.dll + hhc.exe + hkcmd.exe + iviewers.dll + jli.dll + libvlc.dll + mPclient.dll + mcf.ep + mcf.exe + mcupdui.exe + mcut.exe + mcutil.dll.bbc + mcvsmap.exe + msi.dll.dat + msi.dll + msseces.asm + msseces.exe + mtcReport.ktc + rc.dll + rc.exe + rc.hlp + sep_NE.exe + sep_NE.slf + tplcdclr.exe + winmm.dll + wts.chm + credwiz.exe + + ssMUIDLL.dll + aepic.dll + ftllib.dll + userenv.dll + \Terminal Server Client\Cache\ + C:\Windows\Prefetch + \\tsclient + C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ + \Temp\debug.bin + Temp\7z + C:\Windows\AppPatch\Custom + .chm + .cpl + .mht + \Chrome\User Data\Default\Extensions\ + .crx + .appref-ms + .gadget + .JSE + .exe + .scf + Exchange Server\ClientAccess\Owa\ + \Device\HarddiskVolumeShadowCopy + .zip\ + .FON + .FOT + C:\Windows\System32\GroupPolicy\Machine\Scripts + C:\Windows\System32\GroupPolicy\User\Scripts + .iqy + .ico + .isp + .msc + .manifest + MEMORY.dmp + .msi + .cs + .customDestinations-ms + C:\Windows\Minidump + .PAF + .bmc + .rdp + .rtf + .reg + .SHS + .slk + .SCR + .set + .SettingContent-ms + .SHD + .SPL + .scr + HammerDrillStatus.dll + Microsoft\Windows\WER\ + .ICL + .sdb + .SCT + .SHB + Temp\Temp1_ + + \Microsoft\;CLR_v;\UsageLogs\ + .ade + .adp + .application + .appref-ms + .asc + .bmf + .cer + .dmp + .gpg + .htm + .html + .json + .jsp + .key + .mof + .ocx + .p7b + .p12 + .pem + .pfx + .pgp + .php + .ppk + .war + .xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \Software\Microsoft\Terminal Server Client + DefaultPrinter + + + MountedDevices + Mountpoints2 + Active Setup\Installed Components + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} + + + + + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\ + LoggedOnUser + + LastLoggedOnUser + LastLoggedOnProvider + + + + + + + HKCR\ms-msdt\ + + + HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck +
DWORD (0x00000001)
+ + + + + + + + + SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost + \print\ + \AzureAttestService\CoInitializeSecurityParam + C:\$WINDOWS.~BT\ + + + + \AccessVBOM + C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe + + + Security\VBAWarnings + C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe + + + Security\VBAWarnings + C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe + + + EXCEL.exe;WINWORD.exe + {8BD21D32-EC42-11CE-9E0D-00AA006002F3};{5B9D8FC8-4A71-101B-97A6-00000B65C08B} + + + + HKCU\di + + + HKCU\� + + + HKLM\SOFTWARE\Microsoft\AMSI\Providers\ + hklm\software\microsoft\windows script\settings\amsienable + hkcu\software\microsoft\windows script\settings\amsienable + + + + + + Google\Chrome\Extensions + update_url + SetValue + + + + ForcePasswordReset + + + HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC\CurrVal + + + HKLM\SAM\SAM\DOMAINS\Account\Users\ + Last Password Change + + + HKLM\SAM\SAM\DOMAINS\Account\Users\ + Account Expiration + + + HKLM\SAM\SAM\DOMAINS\Account\Users\ + Last Failed Logon + + + HKLM\SAM\SAM\Domains\Builtin\Aliases\00000220\ + + + HKLM\SAM\SAM\Domains\Builtin\Aliases\0000022B\ + + + + SOFTWARE\Microsoft\Wow64\x86\ + + SetValue + \CurrentVersion\Run\ + Add_exclusions_here + + \Microsoft\System\Scripts + \Windows\System\Scripts + HKLM\SYSTEM\Setup\CmdLine + + \Start +
DWORD (0x00000000)
+ + + \Start +
DWORD (0x00000001)
+ + + \Start +
DWORD (0x00000002)
+ + + \Start +
DWORD (0x00000003)
+ + + \Start +
DWORD (0x00000004)
+ + \ImagePath + \ServiceDll + \ServiceManifest + hkcu\software\microsoft\windows nt\currentversion\windows\run\ + hkcu\software\microsoft\windows\currentversion\explorer\shell folders\common startup + hkcu\software\microsoft\windows\currentversion\explorer\shell folders\startup + hklm\software\microsoft\command processor\autorun + hkcu\software\microsoft\windows nt\currentversion\accessibility\ATs\\*(1)\StartExe + Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup + + \Print\Monitors + + + + + + + HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ + $ + CreateKey + + + HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ + $ + CreateKey + + + + HKLM\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} + C:\WINDOWS\sysmon64.exe + C:\WINDOWS\sysmon.exe + C:\Programdata\sysmon\sysmon64.exe + + + + HKCR\ + (Default) + \shell\open\command\(Default) +
URL:
+ + + HKCU\Software\Classes\ + (Default) + \shell\open\command\(Default) +
URL:
+ + + HKCR\ + \shell\open\command\(Default) +
%1
+ + + HKCU\Software\Classes\ + \shell\open\command\(Default) +
%1
+ + + \shell\open\command\DelegateExecute + + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe + + + + Session Manager\KnownDlls + + + + + Outlook\Addins + + + Word\Addins + + + Excel\Addins + + + Powerpoint\Addins + + + Software\Microsoft\VSTO\Security\Inclusion\ + + + Software\Microsoft\VSTO\SolutionMetadata\ + + + + + + + + + + + cmmgr32.exe + + + + HKLU\Software\Microsoft\Command Processor\AutoRun + HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute + HKLM\System\CurrentControlSet\Control\Session Manager\Execute + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug + HKLM\Software\Microsoft\Command Processor\AutoRun + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup + UserInitMprLogonScript + HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath + + HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages + + + + + + + + \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default) +
C:\Users\Public\;$Recyclebin;\temp\;\Desktop\;\Downloads\;\Content.Outlook\;\Microsoft\Office\
+
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
+ + + \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default) +
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
+ + + \ProgID\(Default);\TreatAs\(Default) + + + + \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ + Debugger;ReportingMode;MonitorProcess + + + \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ + GlobalFlag +
DWORD (0x00000200)
+ + + \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ + MonitorProcess + + + \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ + ReportingMode +
DWORD (0x00000001)
+ + + \Microsoft\Windows NT\CurrentVersion\SilentProcessExit + CreateKey + + + \Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules\ + C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{;}\EDGEMITMP_;.tmp\setup.exe + + + + + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree + SD + Microsoft\Windows\UpdateOrchestrator + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree + ID + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks + Author + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks + Path + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks + Date + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot + + + + + + SetValue + \Environment\ + + + + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA +
DWORD (0x00000000)
+ + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin +
DWORD (0x00000000)
+ + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop +
DWORD (0x00000000)
+ + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe + exefile\shell\runas\command\isolatedCommand + + + + + + + + + + + + + \Hidden + + SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\ + $ +
DWORD (0x00000000)
+ + + + + HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Parameters + C:\WINDOWS\sysmon64.exe + C:\WINDOWS\sysmon.exe + C:\Programdata\sysmon\sysmon64.exe + + + + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel + MitigationOptions;MitigationAuditOptions + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options + MitigationOptions;MitigationAuditOptions + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmcompute.exe\0\MitigationOptions + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmwp.exe\0\MitigationOptions + msiexec.exe + TiWorker.exe + + + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options + MitigationOptions;MitigationAuditOptions + C:\Program Files\Microsoft Office 15\root\integration\integrator.exe + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acro + + + + DisableTaskMgr + C:\WINDOWS\system32\svchost.exe + C:\windows\SysWOW64\svchost.exe + + + HKLM\SYSTEM\CurrentControlSet\ + \Instances\;Altitude + HKLM\System\CurrentControlSet\Services\CldFlt\Instances\CldFlt\Altitude + SetValue + + + + \Security\Level +
DWORD (0x00000001)
+ + + \Security\Level +
DWORD (0x00000002)
+ + + \Security\Level +
DWORD (0x00000003)
+ + + \Security\Level +
DWORD (0x00000004)
+ + + \Outlook\Security + + \Security\Level + + \Word\Security + \Excel\Security + \Security\Level1Remove + + \HideSCAHealth + HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring + HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride + HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ + \Enabled +
DWORD (0x00000000)
+ + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ + \Enabled +
DWORD (0x00000001)
+ + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ + \Enabled + + + HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging + \EnableScriptBlockLogging +
DWORD (0x00000000)
+ + + HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging + \EnableScriptBlockLogging + DeleteKey;DeleteValue + + + hklm\software\microsoft\windows\currentversion\policies\system\audit + \ProcessCreationIncludeCmdLine_Enabled +
DWORD (0x00000000)
+ + + hklm\software\microsoft\windows\currentversion\policies\system\audit + \ProcessCreationIncludeCmdLine_Enabled + DeleteKey;DeleteValue + + + HKLM\System\CurrentControlSet\Services\Eventlog + \CustomSD + + + HKLM\System\CurrentControlSet\Services\Eventlog + \MaxSize + + + + globallyopenports + + EnableFirewall + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + + + + \Microsoft\.NETFramework\ETWEnabled +
DWORD (0x00000000)
+ + + \Microsoft\.NETFramework\NGenAssemblyUsageLog + + + SetValue + \Environment\NGenAssemblyUsageLog + + + SetValue + \Environment\COMPlus_ETWEnabled + + + + + + + + \LastKey + + + SymbolicLinkValue + + + \Software\Microsoft\Windows\CurrentVersion\Explorer + \AppData\;\ProgramData\;\Temp\;C:\users + + + ‮ + + HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg + + + + \Software\Policies\Microsoft\SystemCertificates\;\SOFTWARE\Microsoft\EnterpriseCertificates\;HKLM\SOFTWARE\Microsoft\SystemCertificates\;HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ + CreateKey + C:\WINDOWS\Sysmon64.exe + C:\WINDOWS\Sysmon.exe + C:\WINDOWS\system32\certsrv.exe + C:\WINDOWS\system32\CompatTelRunner.exe + C:\WINDOWS\system32\svchost.exe + C:\Windows\SysWOW64\SearchProtocolHost.exe + C:\Windows\system32\SearchProtocolHost.exe + C:\Windows\system32\taskhost.exe + C:\windows\SysWOW64\svchost.exe + C:\WINDOWS\System32\DriverStore\FileRepository\asus + C:\ProgramData\Microsoft\Windows Defender\Platform\ + C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe + C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe + + fDenyTSConnections + Terminal Server\WinStations\RDP-Tcp + RDP-tcp\PortNumber + Control\Terminal Server\fSingleSessionPerUser + + + + � + + + Й;ќ;Л;я;К + + + + + + + + HKLM\HARDWARE\ACPI\DSDT + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Account Name + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Display Name + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Email + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP User + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP User + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\MAPI Provider + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 User + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP User + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP Password + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName + SecurityPasswordAES + OptionsPasswordAES + SecurityPasswordExported + PermanentPassword + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + HKLM\SOFTWARE\GitForWindows + + + + + + + + + + + + + + + + + + + + + + + + + HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ + DeleteKey + + + + + + + + + + + \Services\VSS\Diag\(Default) + + + + + + + + HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters + + + HKLM\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters + + + \LastKey + + + \WinStationsDisabled + + + \TSServerDrainMode + + + \TypedURLs + + + HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\disabledcomponents + + + HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage\Bind +
Binary Data
+ + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards + + + services\http\parameters\urlaclinf + + + cRecentFiles\c1\ + tDIText + + + \File MRU\Item 1 + + + HKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHash + + + HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + HKLM\Software\Microsoft\Windows\CurrentVersion\RunService + HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + CurrentVersion\Windows\Load + CurrentVersion\Windows\Run + CurrentVersion\Winlogon\Shell + CurrentVersion\Winlogon\System + \Software\Microsoft\Windows NT\CurrentVersion\Windows\load + \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + SOFTWARE\Microsoft\.NETFramework\ETWEnabled + \Group Policy\Scripts + Terminal Server\Wds\rdpwd\StartupPrograms + Winlogon\AlternateShells\AvailableShells + Policies\System\Shell + Windows CE Services\AutoStartOnConnect + Windows CE Services\AutoStartOnDisconnect + PreferenceMACs\Default\extensions.settings + CurrentVersion\URL + \CurrentVersion\Font Drivers + HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown + CurrentVersion\Windows\IconServiceLib + Active Setup\Installed Components + NullSessionShares + NullSessionPipes + PasswordExpiryNotification + SafeBoot\AlternateShell + Desktop\Scrnsave.exe + \DisplayVersion + \ModifyPath + \Microsoft\Windows\CurrentVersion\Uninstall\ + \UninstallString + Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman + + \Explorer\FileExts\ + \shell\install\command\ + \ProfileImagePath + + \Classes\AllFilesystemObjects\ + \Classes\*\ + \Software\Microsoft\Ctf\LangBarAddin + \ContextMenuHandlers\ + \CurrentVersion\Shell + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers + \Classes\Directory\ + \Classes\Drive\ + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + \Classes\Folder\ + \Hidden + \HideFileExt + \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components + \SOFTWARE\Classes\Protocols\Filter + \SOFTWARE\Classes\Protocols\Handler + \SharedTaskScheduler + \ShowSuperHidden + \ColumnHandlers + \CopyHookHandlers + \ExtShellFolderViews + \PropertySheetHandlers + \ShellServiceObjectDelayLoad + \ShellServiceObjects + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ + HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand + + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + + \3\1809 + \3\2500 + \3\1206 + \DisableSecuritySettingsCheck + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries + HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ + \ProxyServer + SavedLegacySettings + Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy + EnableConsoleTracing + EnableFileTracing + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ + HKLM\SOFTWARE\Microsoft\Netsh + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ + + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + + + Office Test\ + + + \Internet Explorer\Toolbar\ + \Internet Explorer\Extensions\ + + \Browser Helper Objects\ + {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ + + \UrlUpdateInfo + \InstallSource + + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ + TamperProtection + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff + \Software\Policies\Microsoft\Windows\System\Scripts\Logoff + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon + \Software\Policies\Microsoft\Windows\System\Scripts\Logon + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup + + Domain + DHCPDefaultGateway + DhcpIPAddress + DhcpNameserver + Dhcpserver + DhcpSubnetMask + Nameserver + \DefaultGateway + PersistentRoutes + }\Category + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + SubnetMask + \Trusted Documents\TrustRecords + Software\Microsoft\VBA\7.1\Common + Software\Microsoft\VBA\7.1\Trusted + \Security\DontTrustInstalledFiles + \Security\Trusted Locations + Security\ProtectedView\DisableInternetFilesInPV + Security\ProtectedView\DisableAttachmentsInPV + Security\ProtectedView\DisableUnsafeLocationsInPV + Software\WinRAR\ArcHistory + WinZip\mru\ + Recent File List + Outlook\WebView\Inbox + Outlook\Today\UserDefinedUrl + Outlook\WebView\Calendar + \Place MRU + \LinkDate + \DriverVerVersion + \DriverVersion + \LowerCaseLongPath + \Publisher + Compatibility Assistant\Store\ + \BinProductVersion + Root\InventoryApplicationShortcut\ + Root\InventoryDriverBinary\ + Root\InventoryDeviceContainer\ + + Root\InventoryApplication\ + ProgramID;Name;Version;Publisher;Language;InstallDate;Source;RootDirPath;HiddenArp;UninstallString;RegistryKeyPath;UserSID;sha256 + + + Root\InventoryApplicationFile\ + ProgramId;FileId;LowerCaseLongPath;Name;OriginalFileName;Publisher;Version;binfileversion;LinkDate;Size;Language;USN;IsPeFile;IsOsComponent;sha256;AppxPackageFullName + + + Root\InventoryApplicationAppV\ + + + Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations + + \Explorer\MountPoints2 + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices + + HKLM\System\CurrentControlSet\services\ + \DeleteFlag +
DWORD (0x00000001)
+ + + \ConsentStore\bluetooth + \ConsentStore\contacts + \ConsentStore\hunmanInterfaceDevice + \ConsentStore\location + \ConsentStore\microphone + \ConsentStore\usb\ + \ConsentStore\webcam + \ConsentStore\humanInterfaceDevice + LastVisitedMRU + SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit + \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU + HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR + HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ + HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\Microsoft\Cryptography\OID + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID + HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll + Classes\exefile\shell\runas\command\isolatedCommand + \FriendlyName + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + HKLM\SOFTWARE\Microsoft\Tracing\ + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318} +
ndis;rndis
+ + HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 + + \Software\AppDataLow\Software\Microsoft\ +
.exe;.dll;powershell;wmic
+ + Software\Microsoft\Office test\Special\Perf + \CurrentControlSet\Services\NTDS\LsaDbExtPt + \Services\NTDS\DirectoryServiceExtPt + GoToMyPc\FileTransfer\history + GoToMyPc\GuestInvite + Filesharing + DesktopSharing + LogIncomingConnections + LogOutgoingConnections + PermanentPasswordDate + Security_Adminrights + vncviewer\MRU + Autostart_GUI + Meeting_UserName + BuddyLoginName + BuddyLoginTokenID + Always_Online + HKLM\SOFTWARE\Microsoft\CurrentVersion\Policies\System\EnableLinkedConnections + Software\recfg + \Keyboard Layout\Preload\ + \Keyboard Layout\Substitutes\ + HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ + \Client\Enabled + \Server\Enabled + Kitty\Sessions + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel + PuTTY\Sessions + Terminal Server Client\Servers + WinSCP 2\Sessions + WinSCP 2\Sessions + + + + + + + + Content.IE5;INetCache + .exe;.zip;.ps1;.bat;.rar;.vbs;.hta + + + :Zone.Identifier + blob:;about:internet + + + 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e + + + Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf + + + IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE + + + IMPHASH=19584675D94829987952432E018D5056 + + + IMPHASH=330768a4f172e10acb6287b87289d83b + + + + + + IMPHASH=00000000000000000000000000000000 + AppData\Local\Microsoft\Windows\AppCache\ + \Microsoft\Windows\INetCache\ + \Microsoft\Windows\Temporary Internet Files\Content.IE5 + \Mozilla\Firefox\Profiles\ + .default\prefs-1.js + Microsoft\Windows\Start Menu\Programs\Startup + + + + + + + + + + + + + + + + msagent_;\MSSE-;postex;\status_ + + + \atctl;\userpipe;\iehelper;\sdlrpc;\comnap + + + \PSEXESVC + -stdin + -stdout + + + \svcctl + + + \ntsvcs + + \9f81f59bc58452127884ce513865ed20 + \46a676ab7f179e511e30dd2dc41bd388 + tssmp_endpoint + \NamePipe_MoreWindows + \WCEServicePipe + \ahexec + \cachedumppipe + \csexec + \e710f28d59aa529d6792ca6ff0ca1b34 + \isapi_dg + \isapi_http + \isapi_http + \lsadump + \lsassw + \paexec + \pcheap_reuse + \gruntsvc + \remcom + \rpchlp_3 + \sdlrpc + \winsession + msf-pipe + \atsvc + \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc + \atctl;\userpipe;\iehelper;\sdlrpc;\comnap + \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester + + \pipe\ + CtxSharefilepipe0 + + + \winreg + Anonymous Pipe + + + + + + + ConnectPipe + + + + + lsass + \SQLLocal\RTCLOCAL + \spoolss + C:\Windows\system32\wbem\wmiprvse.exe + C:\Windows\System32\LxRun.exe + C:\Windows\System32\SearchIndexer.exe + C:\Windows\System32\smss.exe + C:\Windows\System32\spoolsv.exe + C:\Windows\System32\wininit.exe + C:\Windows\system32\DFSRs.exe + C:\Windows\SystemApps\Microsoft.Windows + + C:\Windows\Microsoft.NET\Framework + \ngen.exe + + + C:\Windows\SystemApps\ShellExperienceHost_ + \ShellExperienceHost.exe + + C:\Windows\system32\SearchProtocolHost.exe + \System + ProtectedPrefix\LocalService\FTHPIPE + + Exchange Server + + C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\BIN\OWSTIMER.EXE + C:\Windows\syswow64\snmp.exe + c:\windows\system32\inetsrv\w3wp.exe + \M.E.C.Core.WinRMDataCommunicator.NamedPipe. + + C:\Windows\system32\dns.exe + + \sql\query + C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe + \TDLN- + vmware- + \InitShutdown + \MsFteWds + \W32TIME_ALT + \WiFiNetworkManagerTask + \Winsock2CatelogChangeListener + \browser + \epmapper + \eventlog + \scerpc + \wkssvc + \ntapvsrq + Anonymous Pipe + + + + + + + + + + Created + + + + + + + type: 16;type: 16 + powershell.exe + + + github + powershell.exe + + + powershell;cscript.exe;wscript.exe;mshta.exe;bitsadmin.exe;\cmd.exe + . + + + dropboxapi.com + \Dropbox\Client\Dropbox.exe;\Dropbox\bin\Dropbox.exe;\Oracle\Java\ + + + 1drv + \AppData\Local\Microsoft\OneDrive\OneDrive.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe;\Internet Explorer\iexplore.exe;C:\Windows\System32\AppHostRegistrationVerifier.exe;C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe;C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe;C:\Program Files\Mozilla Firefox\firefox.exe + + + .box.com;upload + + + mega.nz;mega.co.nz + + + privatlab.com + + + thedoccloud.com;deftsecurity.com;websitetheme.com;highdatabase.com;incomeupdate.com;zupertech.com;panhardware.com;databasegalore.com;avsvmcloud.com;freescanonline.com + + + tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat + + + efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet + + + .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com + + + + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.nimpool.io;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool;analytics.blue;estream.to + + graph.microsoft.com + dl.dropboxusercontent.com + api.onedrive.com + zoom.us + teamviewer + Screenconnect + + + census + researchscan + scanhub + shadow + shodan + + .download + .kp + .su + .ss + .xn + .sy + .ve + .xxx + .cn + .click + .club + .ir + .ru + .host + .icu + .pw + .website + .ninja + .rocks + .top + .ua + .xyz + + + kuternull.com;rimrun.com;0ffice36o;asushotfix;infestexe;rahasn.webhop.org;rahasn.akamake.net;rahasn.homewealth.biz;winodwsupdates;israirairlines + + githubusercontent.com;github.com + + api.ipify.org;whatismyipaddress.com;edns.ip-api.com;checkip.dyndns.org;icanhazip.com;ifconfig.me;ifconfig.co;ipaddress.com;ipecho.net;ident.me;api.ip.sb;www.myexternalip.com;ip.anysrc.net;wtfismyip.com;myexternalip.com;ipecho.net;checkip.amazonaws.com;goo.gl;git.io;bit.ly;ow.ly;ip-api.com + + tiny-share.com;paste.ee;pastebin.com + + afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com + darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org + adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk + gc._msdcs. + _kerberos._tcp.dc._msdcs. + _kerberos._udp.dc._msdcs. + _ldap._tcp.pdc._msdcs. + wpad + + _ldap. + C:\Windows\ + unknown process + C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe + + + System;svchost.exe;services.exe;unknown process;\;; + + + + + + C:\Program Files (x86)\Admin Arsenal\ + C:\Program Files (x86)\CheckPoint\ + C:\Program Files (x86)\Fortinet\ + C:\Program Files (x86)\OpenDNS\OpenDNS Connector + C:\Program Files (x86)\Razer\Razer Services\ + C:\Program Files (x86)\Trend Micro\ + C:\Program Files (x86)\VMware + C:\Program Files (x86)\Veeam\ + C:\Program Files\CheckPoint\ + C:\Program Files\Trend Micro\ + Slack.exe + \controls\cef\ConnectWise.exe + git-remote-https.exe + C:\Program Files (x86)\Enpass\Enpass.exe + C:\Program Files (x86)\Fiserv\Vision\VisionGUI.NET.exe + C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe + C:\Program Files (x86)\Lenovo\System Update\Tvsukernel.exe + C:\Program Files\VMware\vCenter Server\jre\bin\java.exe + C:\Program Files\VMware\vCenter Server\python\python.exe + C:\Windows\SysWOW64\SearchProtocolHost.exe + C:\Windows\System32\dsregcmd.exe + C:\Windows\sysmon64.exe + C:\Windows\sysmon.exe + brave-sync.s3.dualstack. + .salesforceliveagent.com + ads-serve.brave.com + + .msftncsi.com + ..localmachine + + -pushp.svc.ms + .b-msedge.net + .bing.com + .hotmail.com + .live.com + .live.net + .microsoft.com + .microsoftonline.com + .microsoftstore.com + .ms-acdc.office.com + .msedge.net + .msn.com + .msocdn.com + .s-microsoft.com + .skype.com + .skype.net + .windows.com + .windows.net.nsatc.net + .windowsupdate.com + .xboxlive.com + login.windows.net + + .activedirectory.windowsazure.com + .msauth.net + .msftauth.net + .opinsights.azure.com + management.azure.com + outlook.office365.com + portal.azure.com + + .mozaws.net + .mozilla.com + .mozilla.net + .mozilla.org + .spotify.com + .spotify.map.fastly.net + googleapis.com + clients1.google.com + clients2.google.com + clients3.google.com + clients4.google.com + clients5.google.com + clients6.google.com + cloudsearch.googleapis.com + id.google.com + safebrowsing.googleapis.com + www.googleapis.com + + .akadns.net + .netflix.com + .typekit.net + aspnetcdn.com + ajax.googleapis.com + cdnjs.cloudflare.com + cdnjs.cloudflare.com + fonts.googleapis.com + + .steamcontent.com + + .disqus.com + .fontawesome.com + disqus.com + + .1rx.io + .2mdn.net + .adadvisor.net + .adap.tv + .addthis.com + .adform.net + .adnxs.com + .adroll.com + .adrta.com + .adsafeprotected.com + .adsrvr.org + .advertising.com + .amazon-adsystem.com + .amazon-adsystem.com + .analytics.yahoo.com + .aol.com + .betrad.com + .bidswitch.net + .casalemedia.com + .chartbeat.net + .cnn.com + .convertro.com + .criteo.com + .criteo.net + .crwdcntrl.net + .demdex.net + .domdex.com + .dotomi.com + .doubleclick.net + .doubleverify.com + .emxdgt.com + .exelator.com + .google-analytics.com + .googleadservices.com + .googlesyndication.com + .googletagmanager.com + .googlevideo.com + .gstatic.com + .gvt1.com + .gvt2.com + .ib-ibi.com + .jivox.com + .mathtag.com + .moatads.com + .moatpixel.com + .mookie1.com + .myvisualiq.net + .netmng.com + .nexac.com + .nexac.com + .openx.net + .optimizely.com + .outbrain.com + .pardot.com + .phx.gbl + .pinterest.com + .pubmatic.com + .quantcount.com + .quantserve.com + .revsci.net + .rfihub.net + .rlcdn.com + .rubiconproject.com + .scdn.co + .scorecardresearch.com + .serving-sys.com + .sharethrough.com + .simpli.fi + .sitescout.com + .smartadserver.com + .snapads.com + .spotxchange.com + .taboola.com + .taboola.map.fastly.net + .tapad.com + .tidaltv.com + .trafficmanager.net + .tremorhub.com + .tribalfusion.com + .turn.com + .twimg.com + .tynt.com + .w55c.net + .ytimg.com + .zorosrv.com + ads.yahoo.com + 1rx.io + adservice.google.com + ampcid.google.com + clientservices.googleapis.com + d29x207vrinatv.cloudfront.net + googleadapis.l.google.com + imasdk.googleapis.com + l.google.com + ml314.com + mtalk.google.com + update.googleapis.com + www.googletagservices.com + + .pscp.tv + + adsniper.ru + cdnvideo.ru + chat.minergate.com + cwsa.minergate.com + forum.minergate.com + leadlab.click + mc.yandex.ru + pool.ntp.org + vmg.host + yandex.ru + .adobe.com + .autodesk.com + .avast.com + .avcdn.net + .cdn.bitdefender.net + .digicert.com + .eset.com + .globalsign.com + .globalsign.net + .intuit.com + .java.com + .macromedia.com + .oracle.com + .quickbooks.com + .usertrust.com + amazontrust.com + ocsp.identrust.com + pki.goog + ads.playground.xyz + citrixupdates.cloud.com + forticlient.fortinet.net + mft10.onbaseonline.com + msocsp.com + ocsp.comodoca.com + ocsp.cybertrust.ne.jp + ocsp.entrust.net + ocsp.entrust.net + ocsp.godaddy.com + ocsp.int-x3.letsencrypt.org + ocsp.intel.com + ocsp.msocsp.com + ocsp.quovadisglobal.com + ocsp.quovadisoffshore.com + ocsp.sectigo.com + ocsp.starfieldtech.com + ocsp.thawte.com + ocsp.trustwave.com + ocsp.verisign.com + pki-goog.l.google.com + pki.intel.com + scrootca1.ocsp.secomtrust.net + scrootca2.ocsp.secomtrust.net + stats.anchor.host + status.rapidssl.com + status.thawte.com + ts-ocsp.ws.symantec.com + upgrade.bitdefender.com + + + + + + + + + + + + + + + + + .;>;unknown;anonymous + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + C:\Program Files (x86)\Symantec\ + C:\Program Files\Google\Chrome\Application\chrome.exe + C:\Program Files\Symantec\ + + + + + + + \BHO\ie_to_edge_stub.exe;\Microsoft\Teams\;\Vivaldi\Application\;Google\Chrome\;Google\Update;BraveSoftware\Brave-Browser\;Edge\Application\;EdgeUpdate\Install\;Program Files\SmartGit\ + + + + + + + + + + + \appdata\local\google\chrome\user data\swreporter\;software_reporter_tool.exe + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + NETWORK SERVICE; LOCAL SERVICE + + + + + + + OUTLOOK.exe;WINWORD.exe;EXCEL.EXE;powerpnt.exe;msaccess.exe;mspub.exe;eqnedt32.exe;visio.exe;wordpad.exe;wordview.exe;msohtmed.exe;lync.exe;teams.exe + :\Program Files\Microsoft Office\;:\Program Files (x86)\Microsoft Office\ + + + w3wp.exe;tomcat;apache;nginx;httpd + whitelist_me_here + + + powershell.exel;powershell_ise.exe + whitelist_me_here + + + .exe + .pdf;.doc;.xls;.doc;.ppt;.txt;.rtf;.htm;.iso;.zip;.rar;.7z + + + psexesvc + psexec + + + wmiprvse.exe + + + C:\Users\Public\ + amdsfhdcd.bin + intuit + + + AcroRd32.exe;notepad.exe;mshta.exe;hh.exe;certutil.exe;certoc.exe;certreq.exe;desktopimgdownldr.exe;esentutl.exe;finger.exe;presentationhost.exe;cscript.exe;wscript.exe;mspaint.exe;RdrCEF.exe + + + IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 + IMPHASH=3A19059BD7688CB88E70005F18EFC439 + IMPHASH=bf6223a49e45d99094406777eb6004ba + IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 + IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 + IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF + IMPHASH=4C1B52A19748428E51B14C278D0F58E3 + IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F + IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A + IMPHASH=672B13F4A0B6F27D29065123FE882DFC + IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F + IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D + IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 + IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 + IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 + IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 + IMPHASH=D21BBC50DCC169D7B4D0F01962793154 + IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 + IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 + IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC + IMPHASH=6118619783FC175BC7EBECFF0769B46E + IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA + IMPHASH=563233BFA169ACC7892451F71AD5850A + IMPHASH=87575CB7A0E0700EB37F2E3668671A08 + IMPHASH=13F08707F759AF6003837A150A371BA1 + IMPHASH=1781F06048A7E58B323F0B9259BE798B + IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 + IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D + IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 + IMPHASH=713C29B396B907ED71A72482759ED757 + IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F + IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E + IMPHASH=8B114550386E31895DFAB371E741123D + IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 + IMPHASH=9D68781980370E00E0BD939EE5E6C141 + IMPHASH=B18A1401FF8F444056D29450FBC0A6CE + IMPHASH=CB567F9498452721D77A451374955F5F + IMPHASH=730073214094CD328547BF1F72289752 + IMPHASH=17B461A082950FC6332228572138B80C + IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 + IMPHASH=819B19D53CA6736448F9325A85736792 + IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E + IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 + IMPHASH=0588081AB0E63BA785938467E1B10CCA + IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C + IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 + IMPHASH=4DA924CF622D039D58BCE71CDF05D242 + IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 + IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF + IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE + IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 + IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 + IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E + IMPHASH=E6F9D5152DA699934B30DAAB206471F6 + IMPHASH=3AD59991CCF1D67339B319B15A41B35D + IMPHASH=FFDD59E0318B85A3E480874D9796D872 + IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 + IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 + IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 + IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 + IMPHASH=0E2216679CA6E1094D63322E3412D650 + IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB + IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 + IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 + IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 + IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F + IMPHASH=767637C23BB42CD5D7397CF58B0BE688 + IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 + IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC + IMPHASH=7D010C6BB6A3726F327F7E239166D127 + IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 + IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F + IMPHASH=5834ED4291BDEB928270428EBBAF7604 + IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 + IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 + IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 + IMPHASH=3DE09703C8E79ED2CA3F01074719906B + IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F + IMPHASH=E96A73C7BF33A464C510EDE582318BF2 + IMPHASH=32089B8851BBF8BC2D014E9F37288C83 + IMPHASH=09D278F9DE118EF09163C6140255C690 + IMPHASH=03866661686829D806989E2FC5A72606 + IMPHASH=E57401FBDADCD4571FF385AB82BD5D6D + IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE + IMPHASH=19584675D94829987952432E018D5056 + IMPHASH=330768A4F172E10ACB6287B87289D83B + + + \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll + + + certutil.exe + certoc.exe + CertReq.exe + + Desktopimgdownldr.exe + esentutl.exe + + finger.exe + presentationhost.exe + + + bitsadmin.exe + C:\Windows;$WINDOWS.;\SoftwareDistribution\ + System + TrustedInstaller;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC + + + \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll + + + + + \ No newline at end of file From 234fe3d2900cda29a6f14bdefcb17aabfcbce314 Mon Sep 17 00:00:00 2001 From: cyberkryption Date: Fri, 23 Sep 2022 15:19:05 +0100 Subject: [PATCH 361/471] Update sysmonconfig-cyberkryption.xml --- sysmonconfig-cyberkryption.xml | 64 +++++++++++++++++----------------- 1 file changed, 32 insertions(+), 32 deletions(-) diff --git a/sysmonconfig-cyberkryption.xml b/sysmonconfig-cyberkryption.xml index 540c518d..0e7633fa 100644 --- a/sysmonconfig-cyberkryption.xml +++ b/sysmonconfig-cyberkryption.xml @@ -312,7 +312,7 @@ Shellcode - ipy.exe + ipy.exe python.exe -agentpath: @@ -904,7 +904,7 @@ 0x - + csc.exe \AppData\;\Windows\Temp\ @@ -1679,7 +1679,7 @@ PsPasswd mstsc.exe telnet.exe - tftp.exe + tftp.exe powershellcustomhost @@ -1960,7 +1960,7 @@ AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz - + ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool CPU miner;GPU miner;Lime Miner;XMRig CPU miner; miner @@ -1968,9 +1968,9 @@ b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 - 87AECF008D87EC86EC8B00A2394B3E6C - FB3F0D0DE8B80EA8CFAB2A025EC6B833 - F4067FBF7FFF6945D0BB485B727B39AA + 87AECF008D87EC86EC8B00A2394B3E6C + FB3F0D0DE8B80EA8CFAB2A025EC6B833 + F4067FBF7FFF6945D0BB485B727B39AA 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b @@ -2052,22 +2052,22 @@ cacls takeown - /x Macro - + /x Macro + \pipe\ > - /noprofile - /sc ONEVENT - \\VBOXSVR - | more - |more + /noprofile + /sc ONEVENT + \\VBOXSVR + | more + |more \\tsclient %PROCESSOR_ARCHITECTURE% sysnative AutoIt Microsoft Filter Loader - more.com + more.com :\Windows\Microsoft.NET\ acrord32.exe gpupdate.exe @@ -2230,7 +2230,7 @@ \wwwroot\ - \Windows\addins\ + \Windows\addins\ C:\Windows\repair\ \htdocs\ C:\Windows\system32\config\systemprofile\ @@ -2543,7 +2543,7 @@ - 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool @@ -2580,7 +2580,7 @@ 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 false - + notepad.exe 127.0.0.1 @@ -3092,7 +3092,7 @@ Expired - + jscript9.dll mshta.exe @@ -3426,8 +3426,8 @@ C:\WINDOWS\system32\sihost.exe C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub - UNKNOWN - + UNKNOWN + |UNKNOWN( C:\WINDOWS\SYSTEM32\ntdll.dll+ |C:\WINDOWS\System32\KERNELBASE.dll+ @@ -3435,11 +3435,11 @@ 0x1028;0x1fffff C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git\ - + winword.exe;excel.exe;powerpnt.exe :\Windows\Microsoft.NET\Framework64\v2.;UNKNOWN - + UNKNOWN 0x147a @@ -3773,8 +3773,8 @@ \AppData\Temp\ C:\WINDOWS\system32\dxgiadaptercache.exe - $Recycle.Bin - $Recycle.Bin + $Recycle.Bin + $Recycle.Bin C:\Windows\ \config\systemprofile\ @@ -4102,8 +4102,8 @@ \UsageLogs\wscript.exe.log \regsvr32.exe.log \UsageLogs\wsmprovhost.exe.log - .lnk - .url + .lnk + .url .sys .inf @@ -4563,7 +4563,7 @@ CreateKey - + HKLM\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} C:\WINDOWS\sysmon64.exe C:\WINDOWS\sysmon.exe @@ -5470,7 +5470,7 @@ Content.IE5;INetCache .exe;.zip;.ps1;.bat;.rar;.vbs;.hta - + :Zone.Identifier blob:;about:internet @@ -5684,7 +5684,7 @@ .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com - + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.nimpool.io;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool;analytics.blue;estream.to graph.microsoft.com @@ -5741,7 +5741,7 @@ _kerberos._udp.dc._msdcs. _ldap._tcp.pdc._msdcs. wpad - + _ldap. C:\Windows\ unknown process @@ -5757,7 +5757,7 @@ type: 99 type: 33 --> - System;svchost.exe;services.exe;unknown process;\;; + System;svchost.exe;services.exe;unknown process;\;; From 7ec3de1a7741dcd6e077ae02d1a14b69aed347f1 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 23 Sep 2022 10:49:55 -0400 Subject: [PATCH 362/471] merge in changes from cyberkryption --- sysmonconfig-export.xml | 1252 +++++++++++++++++++-------------------- 1 file changed, 626 insertions(+), 626 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 4bbab408..0e7633fa 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -299,7 +299,7 @@ Brother Industries;Thomson Reuters COMSPEC - ScriptFile + ScriptFile AppData\Local\Temp\7z AppData\Local\Temp\Temp1_ \AppData\Local\Temp\Rar$ @@ -312,8 +312,8 @@ Shellcode - ipy.exe - python.exe + ipy.exe + python.exe -agentpath: -agentlib: @@ -637,7 +637,7 @@ NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC NT AUTHORITY\SYSTEM;СИСТЕМА;NT-AUTORITÄT\SYSTEM;AUTORITE NT\SYSTEM - c:\windows\system32\svchost.exe -k netsvcs -s Appinfo + c:\windows\system32\svchost.exe -k netsvcs -s Appinfo runas.exe @@ -701,8 +701,8 @@ unknown process - \LocalState\rootfs\ - \LocalState\rootfs\ + \LocalState\rootfs\ + \LocalState\rootfs\ @@ -825,7 +825,7 @@ reg add hkcu\software\classes\ reg.exe add hkcu\software\classes\ - C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry + C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry regedit.exe : @@ -904,7 +904,7 @@ 0x - + csc.exe \AppData\;\Windows\Temp\ @@ -926,7 +926,7 @@ csc.exe out:;target:library - Microsoft.Workflow.Compiler.exe + Microsoft.Workflow.Compiler.exe @@ -1034,11 +1034,11 @@ - + InstallUtil.exe /logfile=;/LogToConsole=false;/U - + InstallUtil.exe -logfile=;-LogToConsole=false;-U @@ -1214,7 +1214,7 @@ syssetup.dll;SetupInfObjectInstallAction setupapi.dll;InstallHinfSection InstallHinfSection - infDefaultInstall.exe + infDefaultInstall.exe rundll32.exe "C:\Windows\twain_64.dll" shdocvw.dll;OpenURL advpack.dll;RegisterOCX @@ -1266,7 +1266,7 @@ msbuild.exe .lnk - .csproj + .csproj @@ -1442,7 +1442,7 @@ reg query reg.exe query - driverquery.exe + driverquery.exe tracert.exe @@ -1547,14 +1547,14 @@ ADD;DEL;CHANGE;-f qwinsta.exe - rwinsta.exe + rwinsta.exe - + Microsoft Office\root\Office Microsoft Office\root\Office automation;Embedding @@ -1677,9 +1677,9 @@ psshutdown psservice PsPasswd - mstsc.exe + mstsc.exe telnet.exe - tftp.exe + tftp.exe powershellcustomhost @@ -1928,8 +1928,8 @@ delete catalog wbadmin delete catalog erase - -nw -exec= - -p -nw + -nw -exec= + -p -nw shred diskshadow @@ -1960,7 +1960,7 @@ AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz - + ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool CPU miner;GPU miner;Lime Miner;XMRig CPU miner; miner @@ -1968,9 +1968,9 @@ b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 - 87AECF008D87EC86EC8B00A2394B3E6C - FB3F0D0DE8B80EA8CFAB2A025EC6B833 - F4067FBF7FFF6945D0BB485B727B39AA + 87AECF008D87EC86EC8B00A2394B3E6C + FB3F0D0DE8B80EA8CFAB2A025EC6B833 + F4067FBF7FFF6945D0BB485B727B39AA 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b @@ -2024,54 +2024,54 @@ pythonEngine.Execute sesshijack file:// - HTML Application host - Manager Profile Installer - Microsoft Application Virtualization Injector - Application Compatibility Database Installer + HTML Application host + Manager Profile Installer + Microsoft Application Virtualization Injector + Application Compatibility Database Installer popd.exe pushd.exe subst.exe doskey.exe cls.exe \ - C:\Windows\system32\svchost.exe -k iissvcs + C:\Windows\system32\svchost.exe -k iissvcs \ acrobat.exe acrord32.exe - java.exe - javaw.exe + java.exe + javaw.exe - + C:\Windows\system32\svchost.exe cacls takeown - /x Macro - + /x Macro + \pipe\ > - /noprofile - /sc ONEVENT - \\VBOXSVR - | more - |more - \\tsclient - %PROCESSOR_ARCHITECTURE% - sysnative - AutoIt - Microsoft Filter Loader - more.com - :\Windows\Microsoft.NET\ - acrord32.exe - gpupdate.exe - :\Windows\Microsoft.NET\ + /noprofile + /sc ONEVENT + \\VBOXSVR + | more + |more + \\tsclient + %PROCESSOR_ARCHITECTURE% + sysnative + AutoIt + Microsoft Filter Loader + more.com + :\Windows\Microsoft.NET\ + acrord32.exe + gpupdate.exe + :\Windows\Microsoft.NET\ @@ -2230,7 +2230,7 @@ \wwwroot\ - \Windows\addins\ + \Windows\addins\ C:\Windows\repair\ \htdocs\ C:\Windows\system32\config\systemprofile\ @@ -2247,8 +2247,8 @@ C:\Users\NetworkService\ C:\Users\Public\ C:\Windows\Media\ - \Windows\IME\ - C:\ProgramData + \Windows\IME\ + C:\ProgramData @@ -2475,11 +2475,11 @@ - + 50050 true - + 25 \Bin\EdgeTransport.exe;Bin\MSExchangeFrontendTransport.exe true @@ -2543,11 +2543,11 @@ - 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool - + C:\Windows\system32\svchost.exe 3389 22 @@ -2555,24 +2555,24 @@ 5985 false - + C:\Windows\system32\svchost.exe true 135 445 5985 - + System svchost.exe 445 - + System svchost.exe;lsass.exe 389 - + C:\Windows\System32\lsass.exe 389 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 @@ -2580,103 +2580,103 @@ 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 false - + notepad.exe 127.0.0.1 - + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 80 443 true - github - githubusercontent.com - + github + githubusercontent.com + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 80 true - + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 443 true - + apache.exe - + java.exe - + w3wp.exe - + \php-cgi.exe;\php.exe - + setup - + tomcat - + unins - + unknown process - + explorer.exe - + inetinfo.exe - netcat.exe;nc.exe;nc64.exe;ncat.exe - procdump - psexe - vnc;vncs;vncv + netcat.exe;nc.exe;nc64.exe;ncat.exe + procdump + psexe + vnc;vncs;vncv rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe;advanced_port_scanner.exe;rcpping.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe - 0 + 0 5985 5986 - 1293 - 1701 - 1194 - 3540 - 3389 - 22 - 1080 - 3128 - 8080 - 1723 - 23 - 4500 - 9001 - 9030 - 5900 - 5800 + 1293 + 1701 + 1194 + 3540 + 3389 + 22 + 1080 + 3128 + 8080 + 1723 + 23 + 4500 + 9001 + 9030 + 5900 + 5800 - 0 - + 0 + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 443 true - + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 80 true - 80 - 443 - 636 - 5900 - 443 + 80 + 443 + 636 + 5900 + 443 afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com @@ -2815,7 +2815,7 @@ MSExchangeFrontendTransport.exe MSExchangeHMWorker.exe MSExchangeSubmission.exe - \ + \ @@ -2827,18 +2827,18 @@ - + C:\Windows\ \System32\;Syswow64;sysmon.exe;sysmon64.exe - + C:\Windows\system32\ config\systemprofile\ - + C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe - + A:\;B:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;N:\;O:\;P:\;Q:\;R:\;S:\;T:\;U:\;V:\;W:\;X:\;Y:\;Z:\;AA:\;BB:\;CC:\;DD:\;EE:\;FF:\;GG:\;HH:\;II:\;JJ:\;KK:\;LL:\;MM:\;NN:\;OO:\;PP:\;QQ:\;RR:\;SS:\;TT:\;UU:\;VV:\;WW:\;XX:\;YY;ZZ:\ :\PROGRA~ :\Program Files @@ -2852,29 +2852,29 @@ :\$WinREAgent :\inetpub\ - + \ - + C:\Users\ - + C:\ProgramData\ C:\ProgramData\sysmon\sysmon64.exe;C:\ProgramData\sysmon\sysmon.exe - + C:\Program Files;C:\PROGRA~ - + C:\inetpub\ $RECYCLE.BIN packetbeat.exe;metricbeat.exe;filebeat.exe;winlogbeat.exe;o365beat.exe;graylog-sidecar.exe;graylog-collector-sidecar.exe;splunkd.exe;splunk.exe;syslogng.exe;syslog-ng.exe;nxlog-processor.exe;snarecore.exe;fluentd;td-agent - C:\Windows\system32\config\systemprofile\ - C:\Windows\sysWOW64\config\systemprofile\ + C:\Windows\system32\config\systemprofile\ + C:\Windows\sysWOW64\config\systemprofile\ \Temp\ - C:\Users\ + C:\Users\ @@ -2899,14 +2899,14 @@ lsremora wceaux.dll npcap - \Temp - :\Users + \Temp + :\Users ChongKim Chan ? Revoked Unavailable Valid - false + false @@ -2924,12 +2924,12 @@ msdt.exe sdiageng.dll - + WINWORD.exe;EXCEL.EXE VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wshom.ocx wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - + ntkrnlmp.exe @@ -2943,7 +2943,7 @@ \Users\Public\;\Desktop\;\Downloads\;\AppData\Local\Temp\;\PerfLogs\;$Recycle;\Fonts\ \Program Files - + EQNEDT32.EXE EQNEDT32.EXE @@ -2955,87 +2955,87 @@ ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll wscript.exe;cscript.exe;powershell.exe;rundll32.exe;msbuild.exe;msiexec.exe;csc.exe - + WINWORD.exe;EXCEL.EXE VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wshom.ocx wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll;fastprox.dll - + WINWORD.exe;EXCEL.EXE VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - + WINWORD.exe;EXCEL.EXE VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - + WINWORD.exe;EXCEL.EXE taskschd.dll - + wscript.exe;cscript.exe taskschd.dll - + wmiprvse.exe taskschd.dll - + powershell.exe msi.dll - + powershell amsi.dll - + powershell amsi.dll - + WINWORD.exe;EXCEL.EXE clr.dll - + clr.dll;System.Management.ni.dll;Microsoft.Build.Utilities - + wscript.exe;cscript.exe msxml;wshom.ocx - + wscript.exe;cscript.exe winhttp.dll;mswsock.dll;IPHLPAPI.DLL - + installutil.exe CustomMarshalers.dll;CustomMarshalers.ni.dll;System.Management.ni.dll;WMINet_Utils.dll;mswsock.dll - + System.Management.Automation.ni.dll C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ - + System.Management.Automation.dll C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ Lenovo.Vantage.AddinHost;\Microsoft.Sara.exe;C:\Program Files\CONEXANT - + C:\Windows\System32\vaultcli.dll \svchost.exe;\GameBar.exe;C:\Program Files\WindowsApps;\Microsoft\Teams\current\Teams.exe - + \\ - + \Microsoft\Word\Startup\ .wll - + \Microsoft\Excel\Startup\ .xll - + \Microsoft\Addins\ .xla @@ -3059,14 +3059,14 @@ shcore.dll srvcli.dll - + odbc32.dll;winhttp.dll;netapi32.dll;SHLWAPI.dll - + C:\Windows\Explorer.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - + C:\ProgramData\ C:\ProgramData\ .exe @@ -3075,24 +3075,24 @@ C:\ProgramData\Microsoft\Windows Defender\ C:\ProgramData\sysmon\sysmon64.exe - + C:\Users\Default\;C:\Users\Public\ .exe 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - + C:\Windows\System32\svchost.exe false - + Revoked - + Expired - + jscript9.dll mshta.exe @@ -3119,20 +3119,20 @@ C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_ C:\Windows\explorer.exe - C:\Windows\Microsoft.NET\assembly\GAC_MSIL + C:\Windows\Microsoft.NET\assembly\GAC_MSIL - + \Microsoft Office\ \mscorlib.ni.dll - + \Microsoft Office\ \sppc.dll - + C:\Windows\System32\svchost.exe true @@ -3286,10 +3286,10 @@ C:\Windows\System32\KernelBase.dll+de67e - + ntdll.dll+a0044 - + clr.dll+6c23;clr.dll+6b38 @@ -3342,7 +3342,7 @@ 0x1F3FFF C:\Windows\Microsoft.NET;UNKNOWN - + .exe C:\Windows\sysmon64.exe;C:\Windows\sysmon64.exe 0x1C00 @@ -3372,11 +3372,11 @@ C:\Windows\system32\lsass.exe C:\wfx32\ - + powershell.exe C:\Programdata\sysmon\sysmon64.exe;C:\Programdata\sysmon\sysmon.exe;C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe;\dismhost.exe - + getasynckeystate @@ -3426,8 +3426,8 @@ C:\WINDOWS\system32\sihost.exe C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub - UNKNOWN - + UNKNOWN + |UNKNOWN( C:\WINDOWS\SYSTEM32\ntdll.dll+ |C:\WINDOWS\System32\KERNELBASE.dll+ @@ -3435,11 +3435,11 @@ 0x1028;0x1fffff C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git\ - + winword.exe;excel.exe;powerpnt.exe :\Windows\Microsoft.NET\Framework64\v2.;UNKNOWN - + UNKNOWN 0x147a @@ -3460,12 +3460,12 @@ 0x810 0x820 - cscript.exe - wscript.exe + cscript.exe + wscript.exe jjs.exe dump mimikatz - CorperfmontExt.dll + CorperfmontExt.dll @@ -3488,7 +3488,7 @@ :\Windows\system32\sdiagnhost.exe UNKNOWN(00007F - + C:\Windows\SYSTEM32\ntdll.dll C:\Windows\SYSTEM32\win32u.dll C:\Windows\SYSTEM32\wow64win.dll @@ -3673,7 +3673,7 @@ .XLSB - C:\Windows\Tasks\ + C:\Windows\Tasks\ w3wp.exe @@ -3704,13 +3704,13 @@ .aspx \wwwroot\ - \ecp\auth\ - \oab\auth\ - ClientAccess\Owa\ - \owa\auth\ - httpproxy\rpc\ - ClientAccess\ecp\ - \htdocs\ + \ecp\auth\ + \oab\auth\ + ClientAccess\Owa\ + \owa\auth\ + httpproxy\rpc\ + ClientAccess\ecp\ + \htdocs\ @@ -3761,7 +3761,7 @@ - \LocalState\rootfs\ + \LocalState\rootfs\ @@ -3773,8 +3773,8 @@ \AppData\Temp\ C:\WINDOWS\system32\dxgiadaptercache.exe - $Recycle.Bin - $Recycle.Bin + $Recycle.Bin + $Recycle.Bin C:\Windows\ \config\systemprofile\ @@ -3899,9 +3899,9 @@ .iso .lzm .lzma - Temp\Rar$ + Temp\Rar$ .rar - RarSFX + RarSFX .sfx .sz .tar @@ -3941,11 +3941,11 @@ Teamviewer.exe - rundll32.exe + rundll32.exe mstsc.exe - cmd.exe - ipy.exe - WScript.exe + cmd.exe + ipy.exe + WScript.exe cscript.exe mshta.exe python.exe @@ -4009,88 +4009,88 @@ - + Content.IE5;INetCache .exe;.zip;.ps1;.bat;.rar;.dll - + MSForms.exd - + .exe C:\windows\system32\ - + .exe C:\windows\ \system32\ - + .dll;.exe C:\windows\ C:\Users\ - + .dll;.exe C:\Users\ - + \Microsoft\Word\Startup\ .wll - + C:\windows\system32\CodeIntegrity\ - + \Microsoft\Excel\Startup\ .xll - + \Microsoft\Outlook\VbaProject.OTM - + \Microsoft\Addins\ .xla - + .vsto - + .bat C:\Windows\ C:\ProgramData\Lenovo\SystemUpdate\sessionSE\ - + .dll C:\Windows\ - + .sys C:\Windows\ - + .exe C:\Windows\ C:\Windows\System32\;C:\windows\syswow64\ - + .exe C:\Windows\System32\ - + .exe C:\Windows\SysWow64\ - + .theme - + \Packages\oice_ - + VirtualboxVM.exe - notepad++.exe + notepad++.exe .lnk:Zone.Identifier \UsageLogs\cscript.exe.log \UsageLogs\mshta.exe.log @@ -4102,47 +4102,47 @@ \UsageLogs\wscript.exe.log \regsvr32.exe.log \UsageLogs\wsmprovhost.exe.log - .lnk - .url + .lnk + .url - .sys - .inf - C:\Windows\SysWOW64\Drivers - C:\Windows\System32\Drivers - \Drivers\ + .sys + .inf + C:\Windows\SysWOW64\Drivers + C:\Windows\System32\Drivers + \Drivers\ .drv - .xlam - .xlsm - .xla - .xll - .xls - .xlsb - .xlsx - .xlt - .xltm - .xlw - \Microsoft\Templates\ - .eml - .msg - .pptm - .potm - .pptm - .pptm - .sldm - \Microsoft\Office\Recent + .xlam + .xlsm + .xla + .xll + .xls + .xlsb + .xlsx + .xlt + .xltm + .xlw + \Microsoft\Templates\ + .eml + .msg + .pptm + .potm + .pptm + .pptm + .sldm + \Microsoft\Office\Recent oleObject - \Downloads\ - \Content.Outlook\ - .docb - .wbk - .ped - .dot - .dotx - .doc - .docm - .docx - + \Downloads\ + \Content.Outlook\ + .docb + .wbk + .ped + .dot + .dotx + .doc + .docm + .docx + .accdb .accde .accdr @@ -4165,7 +4165,7 @@ .xps - + .pem .crt .ca-bundle @@ -4183,7 +4183,7 @@ .key - + .hlp ACLUI.DLL.UI ACLUI.DLL @@ -4272,64 +4272,64 @@ wts.chm credwiz.exe - ssMUIDLL.dll + ssMUIDLL.dll aepic.dll ftllib.dll userenv.dll \Terminal Server Client\Cache\ C:\Windows\Prefetch - \\tsclient - C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ + \\tsclient + C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ \Temp\debug.bin - Temp\7z - C:\Windows\AppPatch\Custom - .chm - .cpl - .mht - \Chrome\User Data\Default\Extensions\ - .crx - .appref-ms - .gadget - .JSE - .exe - .scf - Exchange Server\ClientAccess\Owa\ - \Device\HarddiskVolumeShadowCopy - .zip\ - .FON - .FOT - C:\Windows\System32\GroupPolicy\Machine\Scripts - C:\Windows\System32\GroupPolicy\User\Scripts - .iqy - .ico - .isp - .msc - .manifest - MEMORY.dmp - .msi - .cs - .customDestinations-ms - C:\Windows\Minidump - .PAF + Temp\7z + C:\Windows\AppPatch\Custom + .chm + .cpl + .mht + \Chrome\User Data\Default\Extensions\ + .crx + .appref-ms + .gadget + .JSE + .exe + .scf + Exchange Server\ClientAccess\Owa\ + \Device\HarddiskVolumeShadowCopy + .zip\ + .FON + .FOT + C:\Windows\System32\GroupPolicy\Machine\Scripts + C:\Windows\System32\GroupPolicy\User\Scripts + .iqy + .ico + .isp + .msc + .manifest + MEMORY.dmp + .msi + .cs + .customDestinations-ms + C:\Windows\Minidump + .PAF .bmc .rdp - .rtf - .reg - .SHS - .slk - .SCR - .set - .SettingContent-ms - .SHD - .SPL - .scr - HammerDrillStatus.dll - Microsoft\Windows\WER\ - .ICL - .sdb - .SCT - .SHB - Temp\Temp1_ + .rtf + .reg + .SHS + .slk + .SCR + .set + .SettingContent-ms + .SHD + .SPL + .scr + HammerDrillStatus.dll + Microsoft\Windows\WER\ + .ICL + .sdb + .SCT + .SHB + Temp\Temp1_ \Microsoft\;CLR_v;\UsageLogs\ .ade @@ -4392,28 +4392,28 @@ DefaultPrinter - MountedDevices - Mountpoints2 - Active Setup\Installed Components - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} + MountedDevices + Mountpoints2 + Active Setup\Installed Components + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\ LoggedOnUser - LastLoggedOnUser - LastLoggedOnProvider + LastLoggedOnUser + LastLoggedOnProvider @@ -4459,10 +4459,10 @@ HKCU\di - + HKCU\� - + HKLM\SOFTWARE\Microsoft\AMSI\Providers\ hklm\software\microsoft\windows script\settings\amsienable hkcu\software\microsoft\windows script\settings\amsienable @@ -4470,34 +4470,34 @@ - + Google\Chrome\Extensions update_url SetValue - + ForcePasswordReset - + HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC\CurrVal - + HKLM\SAM\SAM\DOMAINS\Account\Users\ Last Password Change - + HKLM\SAM\SAM\DOMAINS\Account\Users\ Account Expiration - + HKLM\SAM\SAM\DOMAINS\Account\Users\ Last Failed Logon - + HKLM\SAM\SAM\Domains\Builtin\Aliases\00000220\ - + HKLM\SAM\SAM\Domains\Builtin\Aliases\0000022B\ @@ -4542,12 +4542,12 @@ Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup \Print\Monitors - + @@ -4563,7 +4563,7 @@ CreateKey - + HKLM\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} C:\WINDOWS\sysmon64.exe C:\WINDOWS\sysmon.exe @@ -4604,7 +4604,7 @@ - Session Manager\KnownDlls + Session Manager\KnownDlls @@ -4657,12 +4657,12 @@ UserInitMprLogonScript HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath - HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages + HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages @@ -4717,26 +4717,26 @@ SD Microsoft\Windows\UpdateOrchestrator - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree ID - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks Author - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks Path - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks Date - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot @@ -4760,7 +4760,7 @@ HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop
DWORD (0x00000000)
 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe exefile\shell\runas\command\isolatedCommand @@ -4775,7 +4775,7 @@ - \Hidden + \Hidden SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\ $ @@ -4809,7 +4809,7 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acro - + DisableTaskMgr C:\WINDOWS\system32\svchost.exe C:\windows\SysWOW64\svchost.exe @@ -4837,45 +4837,45 @@ \Security\Level
DWORD (0x00000004)
 - + \Outlook\Security \Security\Level - \Word\Security - \Excel\Security - \Security\Level1Remove + \Word\Security + \Excel\Security + \Security\Level1Remove - \HideSCAHealth - HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring - HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride - HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled + \HideSCAHealth + HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring + HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride + HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled
DWORD (0x00000000)
 - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled
DWORD (0x00000001)
 - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled @@ -4908,11 +4908,11 @@ \MaxSize - + globallyopenports EnableFirewall - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List @@ -4938,20 +4938,20 @@ \LastKey - + SymbolicLinkValue - + \Software\Microsoft\Windows\CurrentVersion\Explorer \AppData\;\ProgramData\;\Temp\;C:\users - + ‮ - HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg + HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg - + \Software\Policies\Microsoft\SystemCertificates\;\SOFTWARE\Microsoft\EnterpriseCertificates\;HKLM\SOFTWARE\Microsoft\SystemCertificates\;HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ CreateKey C:\WINDOWS\Sysmon64.exe @@ -4968,16 +4968,16 @@ C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe - fDenyTSConnections - Terminal Server\WinStations\RDP-Tcp - RDP-tcp\PortNumber - Control\Terminal Server\fSingleSessionPerUser + fDenyTSConnections + Terminal Server\WinStations\RDP-Tcp + RDP-tcp\PortNumber + Control\Terminal Server\fSingleSessionPerUser - + � - + Й;ќ;Л;я;К @@ -5111,7 +5111,7 @@ - + HKLM\SOFTWARE\GitForWindows @@ -5156,35 +5156,35 @@ - + HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters - + HKLM\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters \LastKey - + \WinStationsDisabled - + \TSServerDrainMode \TypedURLs - + HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\disabledcomponents - + HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage\Bind
Binary Data
 - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards - + services\http\parameters\urlaclinf @@ -5194,7 +5194,7 @@ \File MRU\Item 1 - + HKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHash @@ -5212,140 +5212,140 @@ SOFTWARE\Microsoft\.NETFramework\ETWEnabled \Group Policy\Scripts Terminal Server\Wds\rdpwd\StartupPrograms - Winlogon\AlternateShells\AvailableShells - Policies\System\Shell - Windows CE Services\AutoStartOnConnect - Windows CE Services\AutoStartOnDisconnect - PreferenceMACs\Default\extensions.settings - CurrentVersion\URL - \CurrentVersion\Font Drivers - HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown - CurrentVersion\Windows\IconServiceLib - Active Setup\Installed Components - NullSessionShares - NullSessionPipes - PasswordExpiryNotification - SafeBoot\AlternateShell - Desktop\Scrnsave.exe - \DisplayVersion - \ModifyPath - \Microsoft\Windows\CurrentVersion\Uninstall\ - \UninstallString - Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman + Winlogon\AlternateShells\AvailableShells + Policies\System\Shell + Windows CE Services\AutoStartOnConnect + Windows CE Services\AutoStartOnDisconnect + PreferenceMACs\Default\extensions.settings + CurrentVersion\URL + \CurrentVersion\Font Drivers + HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown + CurrentVersion\Windows\IconServiceLib + Active Setup\Installed Components + NullSessionShares + NullSessionPipes + PasswordExpiryNotification + SafeBoot\AlternateShell + Desktop\Scrnsave.exe + \DisplayVersion + \ModifyPath + \Microsoft\Windows\CurrentVersion\Uninstall\ + \UninstallString + Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman - \Explorer\FileExts\ - \shell\install\command\ + \Explorer\FileExts\ + \shell\install\command\ \ProfileImagePath - \Classes\AllFilesystemObjects\ - \Classes\*\ - \Software\Microsoft\Ctf\LangBarAddin - \ContextMenuHandlers\ - \CurrentVersion\Shell - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers - \Classes\Directory\ - \Classes\Drive\ - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - \Classes\Folder\ - \Hidden - \HideFileExt - \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components - \SOFTWARE\Classes\Protocols\Filter - \SOFTWARE\Classes\Protocols\Handler - \SharedTaskScheduler - \ShowSuperHidden - \ColumnHandlers - \CopyHookHandlers - \ExtShellFolderViews - \PropertySheetHandlers - \ShellServiceObjectDelayLoad - \ShellServiceObjects + \Classes\AllFilesystemObjects\ + \Classes\*\ + \Software\Microsoft\Ctf\LangBarAddin + \ContextMenuHandlers\ + \CurrentVersion\Shell + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers + \Classes\Directory\ + \Classes\Drive\ + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + \Classes\Folder\ + \Hidden + \HideFileExt + \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components + \SOFTWARE\Classes\Protocols\Filter + \SOFTWARE\Classes\Protocols\Handler + \SharedTaskScheduler + \ShowSuperHidden + \ColumnHandlers + \CopyHookHandlers + \ExtShellFolderViews + \PropertySheetHandlers + \ShellServiceObjectDelayLoad + \ShellServiceObjects - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ - HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ + HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand - HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ - \3\1809 - \3\2500 - \3\1206 - \DisableSecuritySettingsCheck - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries - HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ - \ProxyServer - SavedLegacySettings - Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy - EnableConsoleTracing - EnableFileTracing + \3\1809 + \3\2500 + \3\1206 + \DisableSecuritySettingsCheck + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries + HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ + \ProxyServer + SavedLegacySettings + Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy + EnableConsoleTracing + EnableFileTracing HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ - HKLM\SOFTWARE\Microsoft\Netsh - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ + HKLM\SOFTWARE\Microsoft\Netsh + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ - HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - Office Test\ + Office Test\ - \Internet Explorer\Toolbar\ - \Internet Explorer\Extensions\ + \Internet Explorer\Toolbar\ + \Internet Explorer\Extensions\ - \Browser Helper Objects\ - {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ + \Browser Helper Objects\ + {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ - \UrlUpdateInfo - \InstallSource + \UrlUpdateInfo + \InstallSource - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ - TamperProtection - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ + TamperProtection + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff - \Software\Policies\Microsoft\Windows\System\Scripts\Logoff - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon - \Software\Policies\Microsoft\Windows\System\Scripts\Logon - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff + \Software\Policies\Microsoft\Windows\System\Scripts\Logoff + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon + \Software\Policies\Microsoft\Windows\System\Scripts\Logon + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup - Domain - DHCPDefaultGateway - DhcpIPAddress - DhcpNameserver - Dhcpserver - DhcpSubnetMask - Nameserver - \DefaultGateway - PersistentRoutes - }\Category - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - SubnetMask - \Trusted Documents\TrustRecords - Software\Microsoft\VBA\7.1\Common - Software\Microsoft\VBA\7.1\Trusted - \Security\DontTrustInstalledFiles - \Security\Trusted Locations - Security\ProtectedView\DisableInternetFilesInPV - Security\ProtectedView\DisableAttachmentsInPV - Security\ProtectedView\DisableUnsafeLocationsInPV + Domain + DHCPDefaultGateway + DhcpIPAddress + DhcpNameserver + Dhcpserver + DhcpSubnetMask + Nameserver + \DefaultGateway + PersistentRoutes + }\Category + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + SubnetMask + \Trusted Documents\TrustRecords + Software\Microsoft\VBA\7.1\Common + Software\Microsoft\VBA\7.1\Trusted + \Security\DontTrustInstalledFiles + \Security\Trusted Locations + Security\ProtectedView\DisableInternetFilesInPV + Security\ProtectedView\DisableAttachmentsInPV + Security\ProtectedView\DisableUnsafeLocationsInPV Software\WinRAR\ArcHistory WinZip\mru\ Recent File List @@ -5353,66 +5353,66 @@ Outlook\Today\UserDefinedUrl Outlook\WebView\Calendar \Place MRU - \LinkDate - \DriverVerVersion - \DriverVersion - \LowerCaseLongPath - \Publisher - Compatibility Assistant\Store\ - \BinProductVersion - Root\InventoryApplicationShortcut\ - Root\InventoryDriverBinary\ - Root\InventoryDeviceContainer\ - + \LinkDate + \DriverVerVersion + \DriverVersion + \LowerCaseLongPath + \Publisher + Compatibility Assistant\Store\ + \BinProductVersion + Root\InventoryApplicationShortcut\ + Root\InventoryDriverBinary\ + Root\InventoryDeviceContainer\ + Root\InventoryApplication\ ProgramID;Name;Version;Publisher;Language;InstallDate;Source;RootDirPath;HiddenArp;UninstallString;RegistryKeyPath;UserSID;sha256 - + Root\InventoryApplicationFile\ ProgramId;FileId;LowerCaseLongPath;Name;OriginalFileName;Publisher;Version;binfileversion;LinkDate;Size;Language;USN;IsPeFile;IsOsComponent;sha256;AppxPackageFullName - + Root\InventoryApplicationAppV\ - + Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations - \Explorer\MountPoints2 - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices + \Explorer\MountPoints2 + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices HKLM\System\CurrentControlSet\services\ \DeleteFlag
DWORD (0x00000001)
 - \ConsentStore\bluetooth - \ConsentStore\contacts - \ConsentStore\hunmanInterfaceDevice - \ConsentStore\location - \ConsentStore\microphone - \ConsentStore\usb\ - \ConsentStore\webcam - \ConsentStore\humanInterfaceDevice - LastVisitedMRU - SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit + \ConsentStore\bluetooth + \ConsentStore\contacts + \ConsentStore\hunmanInterfaceDevice + \ConsentStore\location + \ConsentStore\microphone + \ConsentStore\usb\ + \ConsentStore\webcam + \ConsentStore\humanInterfaceDevice + LastVisitedMRU + SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU - HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR + HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ - HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\Microsoft\Cryptography\OID - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID - HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll - Classes\exefile\shell\runas\command\isolatedCommand - \FriendlyName - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ - \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\Microsoft\Cryptography\OID + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID + HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll + Classes\exefile\shell\runas\command\isolatedCommand + \FriendlyName + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB - HKLM\SOFTWARE\Microsoft\Tracing\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + HKLM\SOFTWARE\Microsoft\Tracing\ HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318} @@ -5444,33 +5444,33 @@ Software\recfg \Keyboard Layout\Preload\ \Keyboard Layout\Substitutes\ - HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ - \Client\Enabled - \Server\Enabled + HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ + \Client\Enabled + \Server\Enabled Kitty\Sessions - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel PuTTY\Sessions - Terminal Server Client\Servers - WinSCP 2\Sessions - WinSCP 2\Sessions + Terminal Server Client\Servers + WinSCP 2\Sessions + WinSCP 2\Sessions - + Content.IE5;INetCache .exe;.zip;.ps1;.bat;.rar;.vbs;.hta - + :Zone.Identifier blob:;about:internet @@ -5553,7 +5553,7 @@ \sdlrpc \winsession msf-pipe - \atsvc + \atsvc \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc \atctl;\userpipe;\iehelper;\sdlrpc;\comnap \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester @@ -5562,13 +5562,13 @@ CtxSharefilepipe0 - \winreg - Anonymous Pipe + \winreg + Anonymous Pipe @@ -5650,7 +5650,7 @@ github powershell.exe - + powershell;cscript.exe;wscript.exe;mshta.exe;bitsadmin.exe;\cmd.exe . @@ -5674,25 +5674,25 @@ thedoccloud.com;deftsecurity.com;websitetheme.com;highdatabase.com;incomeupdate.com;zupertech.com;panhardware.com;databasegalore.com;avsvmcloud.com;freescanonline.com - + tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat - + efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet - + .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com - + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.nimpool.io;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool;analytics.blue;estream.to - graph.microsoft.com - dl.dropboxusercontent.com - api.onedrive.com - zoom.us - teamviewer - Screenconnect + graph.microsoft.com + dl.dropboxusercontent.com + api.onedrive.com + zoom.us + teamviewer + Screenconnect census @@ -5701,33 +5701,33 @@ shadow shodan - .download - .kp - .su - .ss - .xn - .sy - .ve - .xxx - .cn - .click - .club - .ir - .ru - .host - .icu - .pw - .website - .ninja - .rocks - .top - .ua - .xyz + .download + .kp + .su + .ss + .xn + .sy + .ve + .xxx + .cn + .click + .club + .ir + .ru + .host + .icu + .pw + .website + .ninja + .rocks + .top + .ua + .xyz - + kuternull.com;rimrun.com;0ffice36o;asushotfix;infestexe;rahasn.webhop.org;rahasn.akamake.net;rahasn.homewealth.biz;winodwsupdates;israirairlines - githubusercontent.com;github.com + githubusercontent.com;github.com api.ipify.org;whatismyipaddress.com;edns.ip-api.com;checkip.dyndns.org;icanhazip.com;ifconfig.me;ifconfig.co;ipaddress.com;ipecho.net;ident.me;api.ip.sb;www.myexternalip.com;ip.anysrc.net;wtfismyip.com;myexternalip.com;ipecho.net;checkip.amazonaws.com;goo.gl;git.io;bit.ly;ow.ly;ip-api.com @@ -5736,28 +5736,28 @@ afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk - gc._msdcs. - _kerberos._tcp.dc._msdcs. - _kerberos._udp.dc._msdcs. - _ldap._tcp.pdc._msdcs. - wpad - + gc._msdcs. + _kerberos._tcp.dc._msdcs. + _kerberos._udp.dc._msdcs. + _ldap._tcp.pdc._msdcs. + wpad + _ldap. C:\Windows\ unknown process C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe - System;svchost.exe;services.exe;unknown process;\;; + System;svchost.exe;services.exe;unknown process;\;; @@ -6029,7 +6029,7 @@ - + .;>;unknown;anonymous C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Symantec\ @@ -6040,7 +6040,7 @@ - + \BHO\ie_to_edge_stub.exe;\Microsoft\Teams\;\Vivaldi\Application\;Google\Chrome\;Google\Update;BraveSoftware\Brave-Browser\;Edge\Application\;EdgeUpdate\Install\;Program Files\SmartGit\ @@ -6060,35 +6060,35 @@ - + OUTLOOK.exe;WINWORD.exe;EXCEL.EXE;powerpnt.exe;msaccess.exe;mspub.exe;eqnedt32.exe;visio.exe;wordpad.exe;wordview.exe;msohtmed.exe;lync.exe;teams.exe :\Program Files\Microsoft Office\;:\Program Files (x86)\Microsoft Office\ - + w3wp.exe;tomcat;apache;nginx;httpd whitelist_me_here - + powershell.exel;powershell_ise.exe whitelist_me_here - + .exe .pdf;.doc;.xls;.doc;.ppt;.txt;.rtf;.htm;.iso;.zip;.rar;.7z - + psexesvc psexec - + wmiprvse.exe - + C:\Users\Public\ amdsfhdcd.bin intuit - + AcroRd32.exe;notepad.exe;mshta.exe;hh.exe;certutil.exe;certoc.exe;certreq.exe;desktopimgdownldr.exe;esentutl.exe;finger.exe;presentationhost.exe;cscript.exe;wscript.exe;mspaint.exe;RdrCEF.exe From 2c4d896122cb0193e7e6731759e18b6d8de0a08b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 23 Sep 2022 11:10:27 -0400 Subject: [PATCH 363/471] Fix dupe ='s --- sysmonconfig-export.xml | 62 ++++++++++++++++++++--------------------- 1 file changed, 31 insertions(+), 31 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 0e7633fa..9fa80068 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -312,7 +312,7 @@ Shellcode - ipy.exe + ipy.exe python.exe -agentpath: @@ -904,7 +904,7 @@ 0x - + csc.exe \AppData\;\Windows\Temp\ @@ -1679,7 +1679,7 @@ PsPasswd mstsc.exe telnet.exe - tftp.exe + tftp.exe powershellcustomhost @@ -1960,7 +1960,7 @@ AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz - + ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool CPU miner;GPU miner;Lime Miner;XMRig CPU miner; miner @@ -1968,9 +1968,9 @@ b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 - 87AECF008D87EC86EC8B00A2394B3E6C - FB3F0D0DE8B80EA8CFAB2A025EC6B833 - F4067FBF7FFF6945D0BB485B727B39AA + 87AECF008D87EC86EC8B00A2394B3E6C + FB3F0D0DE8B80EA8CFAB2A025EC6B833 + F4067FBF7FFF6945D0BB485B727B39AA 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b @@ -2052,22 +2052,22 @@ cacls takeown - /x Macro + /x Macro \pipe\ > - /noprofile - /sc ONEVENT - \\VBOXSVR - | more - |more + /noprofile + /sc ONEVENT + \\VBOXSVR + | more + |more \\tsclient %PROCESSOR_ARCHITECTURE% sysnative AutoIt Microsoft Filter Loader - more.com + more.com :\Windows\Microsoft.NET\ acrord32.exe gpupdate.exe @@ -2230,7 +2230,7 @@ \wwwroot\ - \Windows\addins\ + \Windows\addins\ C:\Windows\repair\ \htdocs\ C:\Windows\system32\config\systemprofile\ @@ -2543,7 +2543,7 @@ - 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool @@ -2580,7 +2580,7 @@ 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 false - + notepad.exe 127.0.0.1 @@ -3092,7 +3092,7 @@ Expired - + jscript9.dll mshta.exe @@ -3426,8 +3426,8 @@ C:\WINDOWS\system32\sihost.exe C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub - UNKNOWN - + UNKNOWN + |UNKNOWN( C:\WINDOWS\SYSTEM32\ntdll.dll+ |C:\WINDOWS\System32\KERNELBASE.dll+ @@ -3435,11 +3435,11 @@ 0x1028;0x1fffff C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git\ - + winword.exe;excel.exe;powerpnt.exe :\Windows\Microsoft.NET\Framework64\v2.;UNKNOWN - + UNKNOWN 0x147a @@ -3630,7 +3630,7 @@ - !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;==READ==THIS==PLEASE==;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy + !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;=READ=THIS=PLEASE=;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy crackmapexec \Crypto.Cipher._AES.pyd @@ -3773,8 +3773,8 @@ \AppData\Temp\ C:\WINDOWS\system32\dxgiadaptercache.exe - $Recycle.Bin - $Recycle.Bin + $Recycle.Bin + $Recycle.Bin C:\Windows\ \config\systemprofile\ @@ -4102,8 +4102,8 @@ \UsageLogs\wscript.exe.log \regsvr32.exe.log \UsageLogs\wsmprovhost.exe.log - .lnk - .url + .lnk + .url .sys .inf @@ -4563,7 +4563,7 @@ CreateKey - + HKLM\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} C:\WINDOWS\sysmon64.exe C:\WINDOWS\sysmon.exe @@ -5470,7 +5470,7 @@ Content.IE5;INetCache .exe;.zip;.ps1;.bat;.rar;.vbs;.hta - + :Zone.Identifier blob:;about:internet @@ -5684,7 +5684,7 @@ .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com - + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.nimpool.io;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool;analytics.blue;estream.to graph.microsoft.com @@ -5741,7 +5741,7 @@ _kerberos._udp.dc._msdcs. _ldap._tcp.pdc._msdcs. wpad - + _ldap. C:\Windows\ unknown process From 9f7e99a7e99380a9fba10c15b6a09befc35a2b63 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 23 Sep 2022 13:12:24 -0400 Subject: [PATCH 364/471] Revert "merge in changes from cyberkryption" This reverts commit 7ec3de1a7741dcd6e077ae02d1a14b69aed347f1. --- sysmonconfig-export.xml | 1252 +++++++++++++++++++-------------------- 1 file changed, 626 insertions(+), 626 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 9fa80068..50017341 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -299,7 +299,7 @@ Brother Industries;Thomson Reuters COMSPEC - ScriptFile + ScriptFile AppData\Local\Temp\7z AppData\Local\Temp\Temp1_ \AppData\Local\Temp\Rar$ @@ -312,8 +312,8 @@ Shellcode - ipy.exe - python.exe + ipy.exe + python.exe -agentpath: -agentlib: @@ -637,7 +637,7 @@ NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC NT AUTHORITY\SYSTEM;СИСТЕМА;NT-AUTORITÄT\SYSTEM;AUTORITE NT\SYSTEM - c:\windows\system32\svchost.exe -k netsvcs -s Appinfo + c:\windows\system32\svchost.exe -k netsvcs -s Appinfo runas.exe @@ -701,8 +701,8 @@ unknown process - \LocalState\rootfs\ - \LocalState\rootfs\ + \LocalState\rootfs\ + \LocalState\rootfs\ @@ -825,7 +825,7 @@ reg add hkcu\software\classes\ reg.exe add hkcu\software\classes\ - C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry + C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry regedit.exe : @@ -904,7 +904,7 @@ 0x - + csc.exe \AppData\;\Windows\Temp\ @@ -926,7 +926,7 @@ csc.exe out:;target:library - Microsoft.Workflow.Compiler.exe + Microsoft.Workflow.Compiler.exe @@ -1034,11 +1034,11 @@ - + InstallUtil.exe /logfile=;/LogToConsole=false;/U - + InstallUtil.exe -logfile=;-LogToConsole=false;-U @@ -1214,7 +1214,7 @@ syssetup.dll;SetupInfObjectInstallAction setupapi.dll;InstallHinfSection InstallHinfSection - infDefaultInstall.exe + infDefaultInstall.exe rundll32.exe "C:\Windows\twain_64.dll" shdocvw.dll;OpenURL advpack.dll;RegisterOCX @@ -1266,7 +1266,7 @@ msbuild.exe .lnk - .csproj + .csproj @@ -1442,7 +1442,7 @@ reg query reg.exe query - driverquery.exe + driverquery.exe tracert.exe @@ -1547,14 +1547,14 @@ ADD;DEL;CHANGE;-f qwinsta.exe - rwinsta.exe + rwinsta.exe - + Microsoft Office\root\Office Microsoft Office\root\Office automation;Embedding @@ -1677,9 +1677,9 @@ psshutdown psservice PsPasswd - mstsc.exe + mstsc.exe telnet.exe - tftp.exe + tftp.exe powershellcustomhost @@ -1928,8 +1928,8 @@ delete catalog wbadmin delete catalog erase - -nw -exec= - -p -nw + -nw -exec= + -p -nw shred diskshadow @@ -1960,7 +1960,7 @@ AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz - + ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool CPU miner;GPU miner;Lime Miner;XMRig CPU miner; miner @@ -1968,9 +1968,9 @@ b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 - 87AECF008D87EC86EC8B00A2394B3E6C - FB3F0D0DE8B80EA8CFAB2A025EC6B833 - F4067FBF7FFF6945D0BB485B727B39AA + 87AECF008D87EC86EC8B00A2394B3E6C + FB3F0D0DE8B80EA8CFAB2A025EC6B833 + F4067FBF7FFF6945D0BB485B727B39AA 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b @@ -2024,54 +2024,54 @@ pythonEngine.Execute sesshijack file:// - HTML Application host - Manager Profile Installer - Microsoft Application Virtualization Injector - Application Compatibility Database Installer + HTML Application host + Manager Profile Installer + Microsoft Application Virtualization Injector + Application Compatibility Database Installer popd.exe pushd.exe subst.exe doskey.exe cls.exe \ - C:\Windows\system32\svchost.exe -k iissvcs + C:\Windows\system32\svchost.exe -k iissvcs \ acrobat.exe acrord32.exe - java.exe - javaw.exe + java.exe + javaw.exe - + C:\Windows\system32\svchost.exe cacls takeown - /x Macro - + /x Macro + \pipe\ > - /noprofile - /sc ONEVENT - \\VBOXSVR - | more - |more - \\tsclient - %PROCESSOR_ARCHITECTURE% - sysnative - AutoIt - Microsoft Filter Loader - more.com - :\Windows\Microsoft.NET\ - acrord32.exe - gpupdate.exe - :\Windows\Microsoft.NET\ + /noprofile + /sc ONEVENT + \\VBOXSVR + | more + |more + \\tsclient + %PROCESSOR_ARCHITECTURE% + sysnative + AutoIt + Microsoft Filter Loader + more.com + :\Windows\Microsoft.NET\ + acrord32.exe + gpupdate.exe + :\Windows\Microsoft.NET\ @@ -2230,7 +2230,7 @@ \wwwroot\ - \Windows\addins\ + \Windows\addins\ C:\Windows\repair\ \htdocs\ C:\Windows\system32\config\systemprofile\ @@ -2247,8 +2247,8 @@ C:\Users\NetworkService\ C:\Users\Public\ C:\Windows\Media\ - \Windows\IME\ - C:\ProgramData + \Windows\IME\ + C:\ProgramData @@ -2475,11 +2475,11 @@ - + 50050 true - + 25 \Bin\EdgeTransport.exe;Bin\MSExchangeFrontendTransport.exe true @@ -2543,11 +2543,11 @@ - 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool - + C:\Windows\system32\svchost.exe 3389 22 @@ -2555,24 +2555,24 @@ 5985 false - + C:\Windows\system32\svchost.exe true 135 445 5985 - + System svchost.exe 445 - + System svchost.exe;lsass.exe 389 - + C:\Windows\System32\lsass.exe 389 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 @@ -2580,103 +2580,103 @@ 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 false - + notepad.exe 127.0.0.1 - + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 80 443 true - github - githubusercontent.com - + github + githubusercontent.com + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 80 true - + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 443 true - + apache.exe - + java.exe - + w3wp.exe - + \php-cgi.exe;\php.exe - + setup - + tomcat - + unins - + unknown process - + explorer.exe - + inetinfo.exe - netcat.exe;nc.exe;nc64.exe;ncat.exe - procdump - psexe - vnc;vncs;vncv + netcat.exe;nc.exe;nc64.exe;ncat.exe + procdump + psexe + vnc;vncs;vncv rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe;advanced_port_scanner.exe;rcpping.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe - 0 + 0 5985 5986 - 1293 - 1701 - 1194 - 3540 - 3389 - 22 - 1080 - 3128 - 8080 - 1723 - 23 - 4500 - 9001 - 9030 - 5900 - 5800 + 1293 + 1701 + 1194 + 3540 + 3389 + 22 + 1080 + 3128 + 8080 + 1723 + 23 + 4500 + 9001 + 9030 + 5900 + 5800 - 0 - + 0 + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 443 true - + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 80 true - 80 - 443 - 636 - 5900 - 443 + 80 + 443 + 636 + 5900 + 443 afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com @@ -2815,7 +2815,7 @@ MSExchangeFrontendTransport.exe MSExchangeHMWorker.exe MSExchangeSubmission.exe - \ + \ @@ -2827,18 +2827,18 @@ - + C:\Windows\ \System32\;Syswow64;sysmon.exe;sysmon64.exe - + C:\Windows\system32\ config\systemprofile\ - + C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe - + A:\;B:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;N:\;O:\;P:\;Q:\;R:\;S:\;T:\;U:\;V:\;W:\;X:\;Y:\;Z:\;AA:\;BB:\;CC:\;DD:\;EE:\;FF:\;GG:\;HH:\;II:\;JJ:\;KK:\;LL:\;MM:\;NN:\;OO:\;PP:\;QQ:\;RR:\;SS:\;TT:\;UU:\;VV:\;WW:\;XX:\;YY;ZZ:\ :\PROGRA~ :\Program Files @@ -2852,29 +2852,29 @@ :\$WinREAgent :\inetpub\ - + \ - + C:\Users\ - + C:\ProgramData\ C:\ProgramData\sysmon\sysmon64.exe;C:\ProgramData\sysmon\sysmon.exe - + C:\Program Files;C:\PROGRA~ - + C:\inetpub\ $RECYCLE.BIN packetbeat.exe;metricbeat.exe;filebeat.exe;winlogbeat.exe;o365beat.exe;graylog-sidecar.exe;graylog-collector-sidecar.exe;splunkd.exe;splunk.exe;syslogng.exe;syslog-ng.exe;nxlog-processor.exe;snarecore.exe;fluentd;td-agent - C:\Windows\system32\config\systemprofile\ - C:\Windows\sysWOW64\config\systemprofile\ + C:\Windows\system32\config\systemprofile\ + C:\Windows\sysWOW64\config\systemprofile\ \Temp\ - C:\Users\ + C:\Users\ @@ -2899,14 +2899,14 @@ lsremora wceaux.dll npcap - \Temp - :\Users + \Temp + :\Users ChongKim Chan ? Revoked Unavailable Valid - false + false @@ -2924,12 +2924,12 @@ msdt.exe sdiageng.dll - + WINWORD.exe;EXCEL.EXE VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wshom.ocx wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - + ntkrnlmp.exe @@ -2943,7 +2943,7 @@ \Users\Public\;\Desktop\;\Downloads\;\AppData\Local\Temp\;\PerfLogs\;$Recycle;\Fonts\ \Program Files - + EQNEDT32.EXE EQNEDT32.EXE @@ -2955,87 +2955,87 @@ ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll wscript.exe;cscript.exe;powershell.exe;rundll32.exe;msbuild.exe;msiexec.exe;csc.exe - + WINWORD.exe;EXCEL.EXE VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wshom.ocx wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll;fastprox.dll - + WINWORD.exe;EXCEL.EXE VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - + WINWORD.exe;EXCEL.EXE VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - + WINWORD.exe;EXCEL.EXE taskschd.dll - + wscript.exe;cscript.exe taskschd.dll - + wmiprvse.exe taskschd.dll - + powershell.exe msi.dll - + powershell amsi.dll - + powershell amsi.dll - + WINWORD.exe;EXCEL.EXE clr.dll - + clr.dll;System.Management.ni.dll;Microsoft.Build.Utilities - + wscript.exe;cscript.exe msxml;wshom.ocx - + wscript.exe;cscript.exe winhttp.dll;mswsock.dll;IPHLPAPI.DLL - + installutil.exe CustomMarshalers.dll;CustomMarshalers.ni.dll;System.Management.ni.dll;WMINet_Utils.dll;mswsock.dll - + System.Management.Automation.ni.dll C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ - + System.Management.Automation.dll C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ Lenovo.Vantage.AddinHost;\Microsoft.Sara.exe;C:\Program Files\CONEXANT - + C:\Windows\System32\vaultcli.dll \svchost.exe;\GameBar.exe;C:\Program Files\WindowsApps;\Microsoft\Teams\current\Teams.exe - + \\ - + \Microsoft\Word\Startup\ .wll - + \Microsoft\Excel\Startup\ .xll - + \Microsoft\Addins\ .xla @@ -3059,14 +3059,14 @@ shcore.dll srvcli.dll - + odbc32.dll;winhttp.dll;netapi32.dll;SHLWAPI.dll - + C:\Windows\Explorer.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - + C:\ProgramData\ C:\ProgramData\ .exe @@ -3075,24 +3075,24 @@ C:\ProgramData\Microsoft\Windows Defender\ C:\ProgramData\sysmon\sysmon64.exe - + C:\Users\Default\;C:\Users\Public\ .exe 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - + C:\Windows\System32\svchost.exe false - + Revoked - + Expired - + jscript9.dll mshta.exe @@ -3119,20 +3119,20 @@ C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_ C:\Windows\explorer.exe - C:\Windows\Microsoft.NET\assembly\GAC_MSIL + C:\Windows\Microsoft.NET\assembly\GAC_MSIL - + \Microsoft Office\ \mscorlib.ni.dll - + \Microsoft Office\ \sppc.dll - + C:\Windows\System32\svchost.exe true @@ -3286,10 +3286,10 @@ C:\Windows\System32\KernelBase.dll+de67e - + ntdll.dll+a0044 - + clr.dll+6c23;clr.dll+6b38 @@ -3342,7 +3342,7 @@ 0x1F3FFF C:\Windows\Microsoft.NET;UNKNOWN - + .exe C:\Windows\sysmon64.exe;C:\Windows\sysmon64.exe 0x1C00 @@ -3372,11 +3372,11 @@ C:\Windows\system32\lsass.exe C:\wfx32\ - + powershell.exe C:\Programdata\sysmon\sysmon64.exe;C:\Programdata\sysmon\sysmon.exe;C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe;\dismhost.exe - + getasynckeystate @@ -3426,8 +3426,8 @@ C:\WINDOWS\system32\sihost.exe C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub - UNKNOWN - + UNKNOWN + |UNKNOWN( C:\WINDOWS\SYSTEM32\ntdll.dll+ |C:\WINDOWS\System32\KERNELBASE.dll+ @@ -3435,11 +3435,11 @@ 0x1028;0x1fffff C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git\ - + winword.exe;excel.exe;powerpnt.exe :\Windows\Microsoft.NET\Framework64\v2.;UNKNOWN - + UNKNOWN 0x147a @@ -3460,12 +3460,12 @@ 0x810 0x820 - cscript.exe - wscript.exe + cscript.exe + wscript.exe jjs.exe dump mimikatz - CorperfmontExt.dll + CorperfmontExt.dll @@ -3488,7 +3488,7 @@ :\Windows\system32\sdiagnhost.exe UNKNOWN(00007F - + C:\Windows\SYSTEM32\ntdll.dll C:\Windows\SYSTEM32\win32u.dll C:\Windows\SYSTEM32\wow64win.dll @@ -3673,7 +3673,7 @@ .XLSB - C:\Windows\Tasks\ + C:\Windows\Tasks\ w3wp.exe @@ -3704,13 +3704,13 @@ .aspx \wwwroot\ - \ecp\auth\ - \oab\auth\ - ClientAccess\Owa\ - \owa\auth\ - httpproxy\rpc\ - ClientAccess\ecp\ - \htdocs\ + \ecp\auth\ + \oab\auth\ + ClientAccess\Owa\ + \owa\auth\ + httpproxy\rpc\ + ClientAccess\ecp\ + \htdocs\ @@ -3761,7 +3761,7 @@ - \LocalState\rootfs\ + \LocalState\rootfs\ @@ -3773,8 +3773,8 @@ \AppData\Temp\ C:\WINDOWS\system32\dxgiadaptercache.exe - $Recycle.Bin - $Recycle.Bin + $Recycle.Bin + $Recycle.Bin C:\Windows\ \config\systemprofile\ @@ -3899,9 +3899,9 @@ .iso .lzm .lzma - Temp\Rar$ + Temp\Rar$ .rar - RarSFX + RarSFX .sfx .sz .tar @@ -3941,11 +3941,11 @@ Teamviewer.exe - rundll32.exe + rundll32.exe mstsc.exe - cmd.exe - ipy.exe - WScript.exe + cmd.exe + ipy.exe + WScript.exe cscript.exe mshta.exe python.exe @@ -4009,88 +4009,88 @@ - + Content.IE5;INetCache .exe;.zip;.ps1;.bat;.rar;.dll - + MSForms.exd - + .exe C:\windows\system32\ - + .exe C:\windows\ \system32\ - + .dll;.exe C:\windows\ C:\Users\ - + .dll;.exe C:\Users\ - + \Microsoft\Word\Startup\ .wll - + C:\windows\system32\CodeIntegrity\ - + \Microsoft\Excel\Startup\ .xll - + \Microsoft\Outlook\VbaProject.OTM - + \Microsoft\Addins\ .xla - + .vsto - + .bat C:\Windows\ C:\ProgramData\Lenovo\SystemUpdate\sessionSE\ - + .dll C:\Windows\ - + .sys C:\Windows\ - + .exe C:\Windows\ C:\Windows\System32\;C:\windows\syswow64\ - + .exe C:\Windows\System32\ - + .exe C:\Windows\SysWow64\ - + .theme - + \Packages\oice_ - + VirtualboxVM.exe - notepad++.exe + notepad++.exe .lnk:Zone.Identifier \UsageLogs\cscript.exe.log \UsageLogs\mshta.exe.log @@ -4102,47 +4102,47 @@ \UsageLogs\wscript.exe.log \regsvr32.exe.log \UsageLogs\wsmprovhost.exe.log - .lnk - .url + .lnk + .url - .sys - .inf - C:\Windows\SysWOW64\Drivers - C:\Windows\System32\Drivers - \Drivers\ + .sys + .inf + C:\Windows\SysWOW64\Drivers + C:\Windows\System32\Drivers + \Drivers\ .drv - .xlam - .xlsm - .xla - .xll - .xls - .xlsb - .xlsx - .xlt - .xltm - .xlw - \Microsoft\Templates\ - .eml - .msg - .pptm - .potm - .pptm - .pptm - .sldm - \Microsoft\Office\Recent + .xlam + .xlsm + .xla + .xll + .xls + .xlsb + .xlsx + .xlt + .xltm + .xlw + \Microsoft\Templates\ + .eml + .msg + .pptm + .potm + .pptm + .pptm + .sldm + \Microsoft\Office\Recent oleObject - \Downloads\ - \Content.Outlook\ - .docb - .wbk - .ped - .dot - .dotx - .doc - .docm - .docx - + \Downloads\ + \Content.Outlook\ + .docb + .wbk + .ped + .dot + .dotx + .doc + .docm + .docx + .accdb .accde .accdr @@ -4165,7 +4165,7 @@ .xps - + .pem .crt .ca-bundle @@ -4183,7 +4183,7 @@ .key - + .hlp ACLUI.DLL.UI ACLUI.DLL @@ -4272,64 +4272,64 @@ wts.chm credwiz.exe - ssMUIDLL.dll + ssMUIDLL.dll aepic.dll ftllib.dll userenv.dll \Terminal Server Client\Cache\ C:\Windows\Prefetch - \\tsclient - C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ + \\tsclient + C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ \Temp\debug.bin - Temp\7z - C:\Windows\AppPatch\Custom - .chm - .cpl - .mht - \Chrome\User Data\Default\Extensions\ - .crx - .appref-ms - .gadget - .JSE - .exe - .scf - Exchange Server\ClientAccess\Owa\ - \Device\HarddiskVolumeShadowCopy - .zip\ - .FON - .FOT - C:\Windows\System32\GroupPolicy\Machine\Scripts - C:\Windows\System32\GroupPolicy\User\Scripts - .iqy - .ico - .isp - .msc - .manifest - MEMORY.dmp - .msi - .cs - .customDestinations-ms - C:\Windows\Minidump - .PAF + Temp\7z + C:\Windows\AppPatch\Custom + .chm + .cpl + .mht + \Chrome\User Data\Default\Extensions\ + .crx + .appref-ms + .gadget + .JSE + .exe + .scf + Exchange Server\ClientAccess\Owa\ + \Device\HarddiskVolumeShadowCopy + .zip\ + .FON + .FOT + C:\Windows\System32\GroupPolicy\Machine\Scripts + C:\Windows\System32\GroupPolicy\User\Scripts + .iqy + .ico + .isp + .msc + .manifest + MEMORY.dmp + .msi + .cs + .customDestinations-ms + C:\Windows\Minidump + .PAF .bmc .rdp - .rtf - .reg - .SHS - .slk - .SCR - .set - .SettingContent-ms - .SHD - .SPL - .scr - HammerDrillStatus.dll - Microsoft\Windows\WER\ - .ICL - .sdb - .SCT - .SHB - Temp\Temp1_ + .rtf + .reg + .SHS + .slk + .SCR + .set + .SettingContent-ms + .SHD + .SPL + .scr + HammerDrillStatus.dll + Microsoft\Windows\WER\ + .ICL + .sdb + .SCT + .SHB + Temp\Temp1_ \Microsoft\;CLR_v;\UsageLogs\ .ade @@ -4392,28 +4392,28 @@ DefaultPrinter - MountedDevices - Mountpoints2 - Active Setup\Installed Components - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} + MountedDevices + Mountpoints2 + Active Setup\Installed Components + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\ LoggedOnUser - LastLoggedOnUser - LastLoggedOnProvider + LastLoggedOnUser + LastLoggedOnProvider @@ -4459,10 +4459,10 @@ HKCU\di - + HKCU\� - + HKLM\SOFTWARE\Microsoft\AMSI\Providers\ hklm\software\microsoft\windows script\settings\amsienable hkcu\software\microsoft\windows script\settings\amsienable @@ -4470,34 +4470,34 @@ - + Google\Chrome\Extensions update_url SetValue - + ForcePasswordReset - + HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC\CurrVal - + HKLM\SAM\SAM\DOMAINS\Account\Users\ Last Password Change - + HKLM\SAM\SAM\DOMAINS\Account\Users\ Account Expiration - + HKLM\SAM\SAM\DOMAINS\Account\Users\ Last Failed Logon - + HKLM\SAM\SAM\Domains\Builtin\Aliases\00000220\ - + HKLM\SAM\SAM\Domains\Builtin\Aliases\0000022B\ @@ -4542,12 +4542,12 @@ Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup \Print\Monitors - + @@ -4563,7 +4563,7 @@ CreateKey - + HKLM\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} C:\WINDOWS\sysmon64.exe C:\WINDOWS\sysmon.exe @@ -4604,7 +4604,7 @@ - Session Manager\KnownDlls + Session Manager\KnownDlls @@ -4657,12 +4657,12 @@ UserInitMprLogonScript HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath - HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages + HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages @@ -4717,26 +4717,26 @@ SD Microsoft\Windows\UpdateOrchestrator - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree ID - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks Author - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks Path - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks Date - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot @@ -4760,7 +4760,7 @@ HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop
DWORD (0x00000000)
 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe exefile\shell\runas\command\isolatedCommand @@ -4775,7 +4775,7 @@ - \Hidden + \Hidden SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\ $ @@ -4809,7 +4809,7 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acro - + DisableTaskMgr C:\WINDOWS\system32\svchost.exe C:\windows\SysWOW64\svchost.exe @@ -4837,45 +4837,45 @@ \Security\Level
DWORD (0x00000004)
 - + \Outlook\Security \Security\Level - \Word\Security - \Excel\Security - \Security\Level1Remove + \Word\Security + \Excel\Security + \Security\Level1Remove - \HideSCAHealth - HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring - HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride - HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled + \HideSCAHealth + HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring + HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride + HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled
DWORD (0x00000000)
 - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled
DWORD (0x00000001)
 - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled @@ -4908,11 +4908,11 @@ \MaxSize - + globallyopenports EnableFirewall - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List @@ -4938,20 +4938,20 @@ \LastKey - + SymbolicLinkValue - + \Software\Microsoft\Windows\CurrentVersion\Explorer \AppData\;\ProgramData\;\Temp\;C:\users - + ‮ - HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg + HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg - + \Software\Policies\Microsoft\SystemCertificates\;\SOFTWARE\Microsoft\EnterpriseCertificates\;HKLM\SOFTWARE\Microsoft\SystemCertificates\;HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ CreateKey C:\WINDOWS\Sysmon64.exe @@ -4968,16 +4968,16 @@ C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe - fDenyTSConnections - Terminal Server\WinStations\RDP-Tcp - RDP-tcp\PortNumber - Control\Terminal Server\fSingleSessionPerUser + fDenyTSConnections + Terminal Server\WinStations\RDP-Tcp + RDP-tcp\PortNumber + Control\Terminal Server\fSingleSessionPerUser - + � - + Й;ќ;Л;я;К @@ -5111,7 +5111,7 @@ - + HKLM\SOFTWARE\GitForWindows @@ -5156,35 +5156,35 @@ - + HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters - + HKLM\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters \LastKey - + \WinStationsDisabled - + \TSServerDrainMode \TypedURLs - + HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\disabledcomponents - + HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage\Bind
Binary Data
 - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards - + services\http\parameters\urlaclinf @@ -5194,7 +5194,7 @@ \File MRU\Item 1 - + HKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHash @@ -5212,140 +5212,140 @@ SOFTWARE\Microsoft\.NETFramework\ETWEnabled \Group Policy\Scripts Terminal Server\Wds\rdpwd\StartupPrograms - Winlogon\AlternateShells\AvailableShells - Policies\System\Shell - Windows CE Services\AutoStartOnConnect - Windows CE Services\AutoStartOnDisconnect - PreferenceMACs\Default\extensions.settings - CurrentVersion\URL - \CurrentVersion\Font Drivers - HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown - CurrentVersion\Windows\IconServiceLib - Active Setup\Installed Components - NullSessionShares - NullSessionPipes - PasswordExpiryNotification - SafeBoot\AlternateShell - Desktop\Scrnsave.exe - \DisplayVersion - \ModifyPath - \Microsoft\Windows\CurrentVersion\Uninstall\ - \UninstallString - Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman + Winlogon\AlternateShells\AvailableShells + Policies\System\Shell + Windows CE Services\AutoStartOnConnect + Windows CE Services\AutoStartOnDisconnect + PreferenceMACs\Default\extensions.settings + CurrentVersion\URL + \CurrentVersion\Font Drivers + HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown + CurrentVersion\Windows\IconServiceLib + Active Setup\Installed Components + NullSessionShares + NullSessionPipes + PasswordExpiryNotification + SafeBoot\AlternateShell + Desktop\Scrnsave.exe + \DisplayVersion + \ModifyPath + \Microsoft\Windows\CurrentVersion\Uninstall\ + \UninstallString + Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman - \Explorer\FileExts\ - \shell\install\command\ + \Explorer\FileExts\ + \shell\install\command\ \ProfileImagePath - \Classes\AllFilesystemObjects\ - \Classes\*\ - \Software\Microsoft\Ctf\LangBarAddin - \ContextMenuHandlers\ - \CurrentVersion\Shell - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers - \Classes\Directory\ - \Classes\Drive\ - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - \Classes\Folder\ - \Hidden - \HideFileExt - \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components - \SOFTWARE\Classes\Protocols\Filter - \SOFTWARE\Classes\Protocols\Handler - \SharedTaskScheduler - \ShowSuperHidden - \ColumnHandlers - \CopyHookHandlers - \ExtShellFolderViews - \PropertySheetHandlers - \ShellServiceObjectDelayLoad - \ShellServiceObjects + \Classes\AllFilesystemObjects\ + \Classes\*\ + \Software\Microsoft\Ctf\LangBarAddin + \ContextMenuHandlers\ + \CurrentVersion\Shell + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers + \Classes\Directory\ + \Classes\Drive\ + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + \Classes\Folder\ + \Hidden + \HideFileExt + \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components + \SOFTWARE\Classes\Protocols\Filter + \SOFTWARE\Classes\Protocols\Handler + \SharedTaskScheduler + \ShowSuperHidden + \ColumnHandlers + \CopyHookHandlers + \ExtShellFolderViews + \PropertySheetHandlers + \ShellServiceObjectDelayLoad + \ShellServiceObjects - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ - HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ + HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand - HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ - \3\1809 - \3\2500 - \3\1206 - \DisableSecuritySettingsCheck - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries - HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ - \ProxyServer - SavedLegacySettings - Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy - EnableConsoleTracing - EnableFileTracing + \3\1809 + \3\2500 + \3\1206 + \DisableSecuritySettingsCheck + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries + HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ + \ProxyServer + SavedLegacySettings + Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy + EnableConsoleTracing + EnableFileTracing HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ - HKLM\SOFTWARE\Microsoft\Netsh - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ + HKLM\SOFTWARE\Microsoft\Netsh + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ - HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - Office Test\ + Office Test\ - \Internet Explorer\Toolbar\ - \Internet Explorer\Extensions\ + \Internet Explorer\Toolbar\ + \Internet Explorer\Extensions\ - \Browser Helper Objects\ - {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ + \Browser Helper Objects\ + {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ - \UrlUpdateInfo - \InstallSource + \UrlUpdateInfo + \InstallSource - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ - TamperProtection - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ + TamperProtection + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff - \Software\Policies\Microsoft\Windows\System\Scripts\Logoff - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon - \Software\Policies\Microsoft\Windows\System\Scripts\Logon - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff + \Software\Policies\Microsoft\Windows\System\Scripts\Logoff + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon + \Software\Policies\Microsoft\Windows\System\Scripts\Logon + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup - Domain - DHCPDefaultGateway - DhcpIPAddress - DhcpNameserver - Dhcpserver - DhcpSubnetMask - Nameserver - \DefaultGateway - PersistentRoutes - }\Category - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - SubnetMask - \Trusted Documents\TrustRecords - Software\Microsoft\VBA\7.1\Common - Software\Microsoft\VBA\7.1\Trusted - \Security\DontTrustInstalledFiles - \Security\Trusted Locations - Security\ProtectedView\DisableInternetFilesInPV - Security\ProtectedView\DisableAttachmentsInPV - Security\ProtectedView\DisableUnsafeLocationsInPV + Domain + DHCPDefaultGateway + DhcpIPAddress + DhcpNameserver + Dhcpserver + DhcpSubnetMask + Nameserver + \DefaultGateway + PersistentRoutes + }\Category + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + SubnetMask + \Trusted Documents\TrustRecords + Software\Microsoft\VBA\7.1\Common + Software\Microsoft\VBA\7.1\Trusted + \Security\DontTrustInstalledFiles + \Security\Trusted Locations + Security\ProtectedView\DisableInternetFilesInPV + Security\ProtectedView\DisableAttachmentsInPV + Security\ProtectedView\DisableUnsafeLocationsInPV Software\WinRAR\ArcHistory WinZip\mru\ Recent File List @@ -5353,66 +5353,66 @@ Outlook\Today\UserDefinedUrl Outlook\WebView\Calendar \Place MRU - \LinkDate - \DriverVerVersion - \DriverVersion - \LowerCaseLongPath - \Publisher - Compatibility Assistant\Store\ - \BinProductVersion - Root\InventoryApplicationShortcut\ - Root\InventoryDriverBinary\ - Root\InventoryDeviceContainer\ - + \LinkDate + \DriverVerVersion + \DriverVersion + \LowerCaseLongPath + \Publisher + Compatibility Assistant\Store\ + \BinProductVersion + Root\InventoryApplicationShortcut\ + Root\InventoryDriverBinary\ + Root\InventoryDeviceContainer\ + Root\InventoryApplication\ ProgramID;Name;Version;Publisher;Language;InstallDate;Source;RootDirPath;HiddenArp;UninstallString;RegistryKeyPath;UserSID;sha256 - + Root\InventoryApplicationFile\ ProgramId;FileId;LowerCaseLongPath;Name;OriginalFileName;Publisher;Version;binfileversion;LinkDate;Size;Language;USN;IsPeFile;IsOsComponent;sha256;AppxPackageFullName - + Root\InventoryApplicationAppV\ - + Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations - \Explorer\MountPoints2 - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices + \Explorer\MountPoints2 + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices HKLM\System\CurrentControlSet\services\ \DeleteFlag
DWORD (0x00000001)
 - \ConsentStore\bluetooth - \ConsentStore\contacts - \ConsentStore\hunmanInterfaceDevice - \ConsentStore\location - \ConsentStore\microphone - \ConsentStore\usb\ - \ConsentStore\webcam - \ConsentStore\humanInterfaceDevice - LastVisitedMRU - SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit + \ConsentStore\bluetooth + \ConsentStore\contacts + \ConsentStore\hunmanInterfaceDevice + \ConsentStore\location + \ConsentStore\microphone + \ConsentStore\usb\ + \ConsentStore\webcam + \ConsentStore\humanInterfaceDevice + LastVisitedMRU + SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU - HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR + HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ - HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\Microsoft\Cryptography\OID - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID - HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll - Classes\exefile\shell\runas\command\isolatedCommand - \FriendlyName - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ - \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\Microsoft\Cryptography\OID + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID + HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll + Classes\exefile\shell\runas\command\isolatedCommand + \FriendlyName + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB - HKLM\SOFTWARE\Microsoft\Tracing\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + HKLM\SOFTWARE\Microsoft\Tracing\ HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318} @@ -5444,33 +5444,33 @@ Software\recfg \Keyboard Layout\Preload\ \Keyboard Layout\Substitutes\ - HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ - \Client\Enabled - \Server\Enabled + HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ + \Client\Enabled + \Server\Enabled Kitty\Sessions - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel PuTTY\Sessions - Terminal Server Client\Servers - WinSCP 2\Sessions - WinSCP 2\Sessions + Terminal Server Client\Servers + WinSCP 2\Sessions + WinSCP 2\Sessions - + Content.IE5;INetCache .exe;.zip;.ps1;.bat;.rar;.vbs;.hta - + :Zone.Identifier blob:;about:internet @@ -5553,7 +5553,7 @@ \sdlrpc \winsession msf-pipe - \atsvc + \atsvc \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc \atctl;\userpipe;\iehelper;\sdlrpc;\comnap \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester @@ -5562,13 +5562,13 @@ CtxSharefilepipe0 - \winreg - Anonymous Pipe + \winreg + Anonymous Pipe @@ -5650,7 +5650,7 @@ github powershell.exe - + powershell;cscript.exe;wscript.exe;mshta.exe;bitsadmin.exe;\cmd.exe . @@ -5674,25 +5674,25 @@ thedoccloud.com;deftsecurity.com;websitetheme.com;highdatabase.com;incomeupdate.com;zupertech.com;panhardware.com;databasegalore.com;avsvmcloud.com;freescanonline.com - + tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat - + efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet - + .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com - + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.nimpool.io;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool;analytics.blue;estream.to - graph.microsoft.com - dl.dropboxusercontent.com - api.onedrive.com - zoom.us - teamviewer - Screenconnect + graph.microsoft.com + dl.dropboxusercontent.com + api.onedrive.com + zoom.us + teamviewer + Screenconnect census @@ -5701,33 +5701,33 @@ shadow shodan - .download - .kp - .su - .ss - .xn - .sy - .ve - .xxx - .cn - .click - .club - .ir - .ru - .host - .icu - .pw - .website - .ninja - .rocks - .top - .ua - .xyz + .download + .kp + .su + .ss + .xn + .sy + .ve + .xxx + .cn + .click + .club + .ir + .ru + .host + .icu + .pw + .website + .ninja + .rocks + .top + .ua + .xyz - + kuternull.com;rimrun.com;0ffice36o;asushotfix;infestexe;rahasn.webhop.org;rahasn.akamake.net;rahasn.homewealth.biz;winodwsupdates;israirairlines - githubusercontent.com;github.com + githubusercontent.com;github.com api.ipify.org;whatismyipaddress.com;edns.ip-api.com;checkip.dyndns.org;icanhazip.com;ifconfig.me;ifconfig.co;ipaddress.com;ipecho.net;ident.me;api.ip.sb;www.myexternalip.com;ip.anysrc.net;wtfismyip.com;myexternalip.com;ipecho.net;checkip.amazonaws.com;goo.gl;git.io;bit.ly;ow.ly;ip-api.com @@ -5736,28 +5736,28 @@ afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk - gc._msdcs. - _kerberos._tcp.dc._msdcs. - _kerberos._udp.dc._msdcs. - _ldap._tcp.pdc._msdcs. - wpad - + gc._msdcs. + _kerberos._tcp.dc._msdcs. + _kerberos._udp.dc._msdcs. + _ldap._tcp.pdc._msdcs. + wpad + _ldap. C:\Windows\ unknown process C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe - System;svchost.exe;services.exe;unknown process;\;; + System;svchost.exe;services.exe;unknown process;\;; @@ -6029,7 +6029,7 @@ - + .;>;unknown;anonymous C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Symantec\ @@ -6040,7 +6040,7 @@ - + \BHO\ie_to_edge_stub.exe;\Microsoft\Teams\;\Vivaldi\Application\;Google\Chrome\;Google\Update;BraveSoftware\Brave-Browser\;Edge\Application\;EdgeUpdate\Install\;Program Files\SmartGit\ @@ -6060,35 +6060,35 @@ - + OUTLOOK.exe;WINWORD.exe;EXCEL.EXE;powerpnt.exe;msaccess.exe;mspub.exe;eqnedt32.exe;visio.exe;wordpad.exe;wordview.exe;msohtmed.exe;lync.exe;teams.exe :\Program Files\Microsoft Office\;:\Program Files (x86)\Microsoft Office\ - + w3wp.exe;tomcat;apache;nginx;httpd whitelist_me_here - + powershell.exel;powershell_ise.exe whitelist_me_here - + .exe .pdf;.doc;.xls;.doc;.ppt;.txt;.rtf;.htm;.iso;.zip;.rar;.7z - + psexesvc psexec - + wmiprvse.exe - + C:\Users\Public\ amdsfhdcd.bin intuit - + AcroRd32.exe;notepad.exe;mshta.exe;hh.exe;certutil.exe;certoc.exe;certreq.exe;desktopimgdownldr.exe;esentutl.exe;finger.exe;presentationhost.exe;cscript.exe;wscript.exe;mspaint.exe;RdrCEF.exe From ca5c12e1f5a0ea3b23dd6c77b004894a93e03dbf Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 23 Sep 2022 13:14:00 -0400 Subject: [PATCH 365/471] Renove --- sysmonconfig-cyberkryption.xml | 6208 -------------------------------- 1 file changed, 6208 deletions(-) delete mode 100644 sysmonconfig-cyberkryption.xml diff --git a/sysmonconfig-cyberkryption.xml b/sysmonconfig-cyberkryption.xml deleted file mode 100644 index 0e7633fa..00000000 --- a/sysmonconfig-cyberkryption.xml +++ /dev/null @@ -1,6208 +0,0 @@ - - - md5,sha256,imphash - - - - - - - - - TEMP\nessus_;nessus_task_list - TEMP\nessus_;nessus_task_list - - - rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe - advanced_port_scanner.exe;rcpping.exe;nc.exe;nc64.exe;netcat.exe;ncat.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe - Network Scanner;Advanced IP Scanner - - - adfind - adfind - -gcb -sc;/gcb /sc;-f (objectcategory=;/f (objectcategory=;trustdmp - - - - - - - - - - - - - - PurpleSharp;xyz123456 - PurpleSharp - - - - - /serverlevelplugindll - - - add;sslcert;http - - http del sslcert - - - - - - - C:\Users\ - Content.Outlook - - - .SettingContent-ms - immersivecontrolpanel - - - .doc.exe - .docx.exe - .docx.exe - .xls.exe - .xlsx.exe - .ppt.exe - .pptx.exe - .rtf.exe - .pdf.exe - .txt.exe - .exe - ______.exe - - - Hwp.exe - gbb.exe - - - - - svchost.exe;termsvcs - rdpclip.exe;csrss.exe;wininit.exe - - - dns.exe - werfault.exe;conhost.exe;dnscmd.exe;dns.exe - - - UMWorkerProcess.exe;UMService.exe - perfenabled - - - UMWorkerProcess.exe;UMService.exe - perfenabled - wemgr.exe;werfault.exe - - - \wwwroot\ - - - \Atlassian\Confluence\jre\bin\java.exe - cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin - - - \jre\bin\java.exe - cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe - - \Atlassian\Confluence\jre\bin\java.exe - - - keytool.exe - cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe - - - bash.exe;cmd.exe;powershell.exe;pwsh.exe - id -Gn `;id /Gn `;id -Gn ';id /Gn ' - - - - e=Access&;y=Guest&;&p=;&c=;&k= - - - - - - - - - - - wmic.exe - process;call;create - - - wmic.exe - call set priority;call terminate;product get name;bios, get serialNumber;BIOS GET SERIALNUMBER;onboarddevice get;useraccount where name;useraccount get;path win32_networkadapter where index=;process list;useraccount get /ALL;useraccount list;qfe get description,installedOn /format:csv;process get caption,executablepath,commandline;service get name,displayname,pathname,startmode;share list;win32_share - - - - C:\Users\;$Recycle;\Temp\;\Downloads\ - \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 - conhost.exe - - - svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe - conhost.exe - - - conhost.exe - :\Windows\splwow64.exe;:\Windows\System32\WerFault.exe;:\Windows\System32\conhost.exe - - - - cmd.exe - powershell.exe;powershell_ise.exe - Get-ItemProperty HKLM:\software\wow6432node\microsoft\windows\currentversion\uninstall\ - mysql server - select-object displayversion,displayname - - - cscript.exe;wscript.exe - powershell.exe;powershell_ise.exe - - - cscript.exe;wscript.exe - powershell.exe;powershell_ise.exe - - - powershell.exe;powershell_ise.exe - mshta.exe - - - wscript.exe;cscript.exe - IEX;Net.WebClient;ospp.vbs;powershell;slmgr.vbs;spiceworks_upload - - - wscript.exe - .jse - .js - .vba - .vbe - - - cscript.exe - .js - .jse - .vba - .vbe - - - mshta vbscript:CreateObject("Wscript.Shell");mshta vbscript:Execute("Execute;mshta vbscript:CreateObject("Wscript.Shell").Run("mshta.exe;javascript:a= - .jpg;.png;.lnk;.xls;.doc;.zip;.sct;.hta - - - C:\Windows\Temp\hpqhvind.exe;C:\ProgramData\DRM\;Test.exe - C:\ProgramData\DRM;wmplayer.exe;C:\ProgramData\DRM\CLR\CLR.EXE - - - regedit.exe - explorer.exe - - - - svchost.exe;taskhostw.exe;userinit.exe;smss.exe;csrss.exe;wininit.exe;winlogon.exe;lsass.exe;logonui.exe;services.exe - C:\windows\System32\;C:\windows\syswow64\ - wininit.exe;winlogon.exe;services.exe;dwm.exe;System;smss.exe;svchost.exe - - - \spoolsv.exe;\PrintIsolationHost.exe - C:\Windows\System32\spoolsv.exe;\GPLGS\gswin32c.exe;C:\Windows\System32\spool\drivers\;\bin\gswin64c.exe;C:\PROGRA~2\CUTEPD~1\;C:\Windows\EEFPrinter.exe - C:\Windows\system32\spool\DRIVERS - Brother Industries;Thomson Reuters - - COMSPEC - ScriptFile - AppData\Local\Temp\7z - AppData\Local\Temp\Temp1_ - \AppData\Local\Temp\Rar$ - - - powershell.exe;powershell_ise.exe - C:\users\ - Microsoft VS Code\Code.exe - \Deployment tool extract\setupodt.exe - - Shellcode - - ipy.exe - python.exe - - -agentpath: - -agentlib: - - - - - iexplore.exe;chrome.exe;firefox.exe;browser_broker.exe;vivaldi.exe;microsoftedge.exe;microsoftedgecp.exe;brave.exe;vivaldi.exe - tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe - apt-config - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe - tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe - .cmd;- - C:\Windows\system32\spool\DRIVERS\ - PhotoViewer.dll - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe - C:\Users\ - .exe - Zoom Video - Firefox - Microsoft Edge - Microsoft Teams - GrammarlyAddInSetupe - Teams.exe - Zoom.exe - browser_broker.exe - chrome.exe - edge.exe - firefox.exe - iexplore.exe - vivaldi.exe - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe - C:\ProgramData\ - Firefox - Microsoft Edge - Microsoft Teams - Zoom Video - - - acrobat.exe;acrord32.exe - tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe - - - apache;w3wp.exe;php-cgi.exe;nginx.exe;httpd.exe;tomcat;php.exe - arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe - - - cmd.exe - ping 127.0.0.1 - c:\windows\system32\inetsrv\ - - - sqlservr - arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;sh.exe;bash.exe - - - winword.exe;powerpnt.exe;excel.exe - control.exe - input.dll - - - msdt.exe - msdt.exe - BrowseForFile=;PCWDiagnostic - /af;-af - - - msdt.exe - pcwrun.exe - PCWDiagnostic - /af;-af - - - msdt.exe - /cab;-cab - .diagcab - - - powershell.exe;pwsh.exe;cmd.exe;mshta.exe;cscript.exe;wscript.exe;wsl.exe;rundll32.exe;regsvr32.exe - msdt.exe - - EQNEDT32.EXE - - winword.exe;excel.exe;powerpnt.exe - FLTLDR.EXE - - - /dde;-dde - - - - schtasks.exe - /create;-create;/change;-change - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - - taskeng.exe - - schtasks.exe - /Run;-run - Sentinel\AutoRepair - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - - - schtasks.exe - - at.exe - at.exe - - C:\Windows\System32\svchost.exe - netsvcs;-p;-s;Schedule - netsvcs;-p;-s;Schedule - - - - - - net.exe;net1.exe;net2.exe - stop - tvsu_tmp - - - net.exe;net1.exe;net2.exe - start - tvsu_tmp - - - wmiprvse.exe;mmc.exe;explorer.exe;services.exe - &1;cmd.exe;\\127.0.0.1\;/Q /c - - - wmiprvse.exe;mmc.exe;explorer.exe;services.exe - &1;cmd.exe;\\127.0.0.1\;-Q -c - - - schtasks;Create;ONLOGON;TN;Updater;TR;powershell - - - sc.exe - create - \NIC_Emulex_Firmware\;C:\Windows\Temp\ExchangeSetup\ - - - sc.exe - config;binpath - - - cmd.exe;powershell.exe - services.exe - - new-service - psexesvc.exe - - Execute processes remotely - psexe - PsExec Service - PsExec Launched - - - accepteula - - - Execute processes remotely - -s;/s - - psexec.exe - pskill.exe - pskill - - C:\WINDOWS\system32\svchost.exe;RPCSS - - - - && type - > - cmd.exe" /c cd - - - ntdsutil;/set {default} recoveryenabled no;telnet ;-dumpcr;putty;bash.exe;pssh;shareenum;sekurlsa;reg save;reg save;psscan;shellexec;vbscript:createobject;/output:clipboard;root\\default;root\\subscription;Wmiclass;WmiCl'+'as'+'s - - - ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy - ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy - - --disable-http2 --disable-quic - /Client/Login?id= - JABzA - - - 2f40abbb4f78e77745f0e657a19903fc953cc664;478dc5a5f934c62a9246f7d1fc275868f568bc07;37b4496e650b3994312c838435013560b3ca8571;37b4496e650b3994312c838435013560b3ca8571;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;807d86da63f0db1fc746d1f0b05bc357;849a2b0dc80aeca3d175c139efe5221c;86A4CAC227078B9C95C560C8F0370BF0;98908ce6f80ecc48628c8d2bf5b2a50c;a4b42c2c95d1f2ff12171a01c86cd64f;4abe604916c04fe3dd8b9cb3d501d3f;eac3e3ece94bc84e922ec077efb15edd;128CECC59C91C0D0574BC1075FE7CB40;88777aacd5f16599547926a4c9202862;0f49621b06f2cdaac8850c6e9581a594;17a36ac3e31f3a18936552aff2c80249;322cb39bc049aa69136925137906d855;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;3d129263f6a48647f103a04446fb0c2f;37cd353621b0f4fc6981b50071c94f01;1b60021baedc3f9201bcdb40e9b87f62;71345b139166482acaa568ac8816c7bc;5E022694C0DBD1FBBC263D608E577949;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc5733c013378fa418d13773f5bfe6f1;c579341f86f7e962719c7113943bb6e4;d326e629a90e78825645963b35e53a6a;5E022694C0DBD1FBBC263D608E577949;53841a0c6a3ff92976db08bfdf95e083;dc7e564809d6c2a2f3457c3c9b91f22b;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b;FE2CA1BE3BDA2A757036A89E54CC02DB;FE2CA1BE3BDA2A757036A89E54CC02DB - - 22d142f11cf2a30ea4953e1fffb0fa7e;2317d65da4639f4246de200650a70753;27612cb03c89158225ca201721ea1aad;412956675fbc3f8c51f438c1abc100eb;daf2da52475fd8981b19ec3c321a983c;490a140093b5870a47edc29f33542fd2;51a7068640af42c3a7c1b94f1c11ab9d;533340c54bd25256873b3dca34d7f74e;684eca6b62d69ce899a3ec3bb04d0a5b;69a19abf5ba56ee07cdd3425b07cf8bf;6cfd131fef548fcd60fbcdb59317df8e;72dc98449b45a7f1ccdef27d51e31e91;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;80c37e062aa4c94697f287352acf2e9d;815f1f8a7bc1e6f94cb5c416e381a110;a43d3b31575846fa4c3992b4143a06da;08e82dc7bae524884b7dc2134942aadb;7bcd736a2394fc49f3e27b3987cce640;57314359df11ffdf476f809671ec0275;b72737b464e50aa3664321e8e001ff32;ce8ce92fb6565181572dce00d69c24f8;5985087678414143d33ffc6e8863b887;84730a6e426fbd3cf6b821c59674c8a0;d5377dc1821c935302c065ad8432c0d2;d8f1356bebda9e77f480a6a60eab36bb;92f8e3f0f1f7cc49fad797a62a169acd;9003cfaac523e94d5479dc6a10575e60;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;c1e7850da5604e081b9647b58248d7e8;99828721ac1a0e32e4582c3f615d6e57;f559c87b4a14a4be1bd84df6553aaf56;b9c208ea8115232bfd9ec2c62f32d6b8;061089d8cb0ca58e660ce2e433a689b3;0e9afd3a870906ebf34a0b66d8b07435;9c115e9a81d25f9d88e7aaa4313d9a8f;520ee02668a1c7b7c262708e12b1ba6b;7bfba2c69bed6b160261bdbf2b826401;77a745b07d9c453650dd7f683b02b3ed;3a771efb7ba2cd0df247ab570e1408b2;0969b2b399a8d4cd2d751824d0d842b4;fc53f2cd780cd3a01a4299b8445f8511;4e39620afca6f60bb30e031ddc5a4330;bfe3f6a79cad5b9c642bb56f8037c43b;3dfebce4703f30eed713d795b90538b5;9793afcea43110610757bd3b800de517;36db24006e2b492cafb75f2663f241b2;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;649ef1dd4a5411d3afcf108d57ff87af;320b2f1d9551b5d1df4fb19bd9ab253a;3d75c72144d873b3c1c4977fbafe9184;b9cf4301b7b186a75e82a04e87b30fe4;b4e67706103c3b8ee148394ebee3f268;7bfbd72441e1f2ed48fbc0f33be00f24;cdb303f61a47720c7a8c5086e6b2a743;2a6f7ec77ab6bd4297e7b15ae06e2e61;8403a28e0bffa9cc085e7b662d0d5412;3ffd2915d285ad748202469d4a04e1f5;04078ef95a70a04e95bda06cc7bec3fa;235d427f94630575a4ea4bff180ecf5d;8035a8a143765551ca7db4bc5efb5dfd;cacaa3bf3b2801956318251db5e90f3c;1aadf739782afcae6d1c3e4d1f315cbd;c3e255888211d74cc6e3fb66b69bbffb;d9e9f22988d43d73d79db6ee178d70a4;16ab79fb2fd92db0b1f38bedb2f02ed8;8da15a97eaf69ff7ee184fc446f19cf1;ffc7305cb24c1955f9625e525d58aeee;c0e72eb4c9f897410c795c1b360090ef;9ad6fa6fdedb2df8055b3d30bd6f64f1;44619a88a6cff63523163c6a4cf375dd;a571660c9cf1696a2f4689b2007a12c7;81229c1e272218eeda14892fa8425883;0ac48cfa2ff8351365e99c1d26e082ad;afcdf79be1557326c854b6e20cb900a7 - a53a02b997935fd8eedcb5f7abab9b9f - e96a73c7bf33a464c510ede582318bf2 - serialfunc.exe - - e PAA;en PAA;enc PAA;enco PAA;encode PAA;encoded PAA;encodedco PAA;encodedcom PAA;encodedcomm PAA;encodedcomma PAA;encodedcomman PAA;encodedcommand PAA;e IAA;en IAA;enc IAA;enco IAA;encode IAA;encoded IAA;encodedco IAA;encodedcom IAA;encodedcomm IAA;encodedcomma IAA;encodedcomman IAA;encodedcommand IAA;e JAB;en JAB;enc JAB;enco JAB;encode JAB;encoded JAB;encodedco JAB;encodedcom JAB;encodedcomm JAB;encodedcomma JAB;encodedcomman JAB;encodedcommand JAB;e cwBFAFQA;en cwBFAFQA;enc cwBFAFQA;enco cwBFAFQA;encode cwBFAFQA;encoded cwBFAFQA;encodedco cwBFAFQA;encodedcom cwBFAFQA;encodedcomm cwBFAFQA;encodedcomma cwBFAFQA;encodedcomman cwBFAFQA;encodedcommand cwBFAFQA;e SQBFAF;en SQBFAF;enc SQBFAF;enco SQBFAF;encode SQBFAF;encoded SQBFAF;encodedco SQBFAF;encodedcom SQBFAF;encodedcomm SQBFAF;encodedcomma SQBFAF;encodedcomman SQBFAF;encodedcommand SQBFAF;e UwBFAFQA;en UwBFAFQA;enc UwBFAFQA;enco UwBFAFQA;encode UwBFAFQA;encoded UwBFAFQA;encodedco UwBFAFQA;encodedcom UwBFAFQA;encodedcomm UwBFAFQA;encodedcomma UwBFAFQA;encodedcomman UwBFAFQA;encodedcommand UwBFAFQA;e IABpAE4AdgBPAEsAZQAt;en IABpAE4AdgBPAEsAZQAt;enc IABpAE4AdgBPAEsAZQAt;enco IABpAE4AdgBPAEsAZQAt;encode IABpAE4AdgBPAEsAZQAt;encoded IABpAE4AdgBPAEsAZQAt;encodedco IABpAE4AdgBPAEsAZQAt;encodedcom IABpAE4AdgBPAEsAZQAt;encodedcomm IABpAE4AdgBPAEsAZQAt;encodedcomma IABpAE4AdgBPAEsAZQAt;encodedcomman IABpAE4AdgBPAEsAZQAt;encodedcommand IABpAE4AdgBPAEsAZQAt;e SQBmACgAJAB;en SQBmACgAJAB;enc SQBmACgAJAB;enco SQBmACgAJAB;encode SQBmACgAJAB;encoded SQBmACgAJAB;encodedco SQBmACgAJAB;encodedcom SQBmACgAJAB;encodedcomm SQBmACgAJAB;encodedcomma SQBmACgAJAB;encodedcomman SQBmACgAJAB;encodedcommand SQBmACgAJAB;e J;en J;enc J;enco J;encode J;encoded J;encodedco J;encodedcom J;encodedcomm J;encodedcomma J;encodedcomman J;encodedcommand J;e SUVY;en SUVY;enc SUVY;enco SUVY;encode SUVY;encoded SUVY;encodedco SUVY;encodedcom SUVY;encodedcomm SUVY;encodedcomma SUVY;encodedcomman SUVY;encodedcommand SUVY;e aWV4;en aWV4;enc aWV4;enco aWV4;encode aWV4;encoded aWV4;encodedco aWV4;encodedcom aWV4;encodedcomm aWV4;encodedcomma aWV4;encodedcomman aWV4;encodedcommand aWV4;e dmFy;en dmFy;enc dmFy;enco dmFy;encode dmFy;encoded dmFy;encodedco dmFy;encodedcom dmFy;encodedcomm dmFy;encodedcomma dmFy;encodedcomman dmFy;encodedcommand dmFy;e dgBhA;en dgBhA;enc dgBhA;enco dgBhA;encode dgBhA;encoded dgBhA;encodedco dgBhA;encodedcom dgBhA;encodedcomm dgBhA;encodedcomma dgBhA;encodedcomman dgBhA;encodedcommand dgBhA;e R2V0;en R2V0;enc R2V0;enco R2V0;encode R2V0;encoded R2V0;encodedco R2V0;encodedcom R2V0;encodedcomm R2V0;encodedcomma R2V0;encodedcomman R2V0;encodedcommand R2V0;e IAAgAH;en IAAgAH;enc IAAgAH;enco IAAgAH;encode IAAgAH;encoded IAAgAH;encodedco IAAgAH;encodedcom IAAgAH;encodedcomm IAAgAH;encodedcomma IAAgAH;encodedcomman IAAgAH;encodedcommand IAAgAH;e TVq;en TVq;enc TVq;enco TVq;encode TVq;encoded TVq;encodedco TVq;encodedcom TVq;encodedcomm TVq;encodedcomma TVq;encodedcomman TVq;encodedcommand TVq;e aQBIA;en aQBIA;enc aQBIA;enco aQBIA;encode aQBIA;encoded aQBIA;encodedco aQBIA;encodedcom aQBIA;encodedcomm aQBIA;encodedcomma aQBIA;encodedcomman aQBIA;encodedcommand aQBIA;e UEs;en UEs;enc UEs;enco UEs;encode UEs;encoded UEs;encodedco UEs;encodedcom UEs;encodedcomm UEs;encodedcomma UEs;encodedcomman UEs;encodedcommand UEs;e H4s;en H4s;enc H4s;enco H4s;encode H4s;encoded H4s;encodedco H4s;encodedcom H4s;encodedcomm H4s;encodedcomma H4s;encodedcomman H4s;encodedcommand H4s;e dXNpbm;en dXNpbm;enc dXNpbm;enco dXNpbm;encode dXNpbm;encoded dXNpbm;encodedco dXNpbm;encodedcom dXNpbm;encodedcomm dXNpbm;encodedcomma dXNpbm;encodedcomman dXNpbm;encodedcommand dXNpbm;e cwBhA;en cwBhA;enc cwBhA;enco cwBhA;encode cwBhA;encoded cwBhA;encodedco cwBhA;encodedcom cwBhA;encodedcomm cwBhA;encodedcomma cwBhA;encodedcomman cwBhA;encodedcommand cwBhA;JABzA - - - FromBase64String - JAB;SUVY;aWV4;dmFy;dgBhA;R2V0;SQBFAF;TVq;aQBIA;UEs;H4s;dXNpbm;cwBhA - - - /v Word experienced;/v Excel experienced;-v Word experienced;-v Excel experienced - - - JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ;QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA;kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA;IgAoACcAKgAnACkAOwAkA;IAKAAnACoAJwApADsAJA;iACgAJwAqACcAKQA7ACQA - - - e^;^en^;^nc - - - ^ - - - ..\;\.. - - - \cmd.exe /c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe /c del "C:\Users\*\Desktop\*.exe;\cmd.exe -c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe -c del "C:\Users\*\Desktop\*.exe - - ping.exe -n 6 127.0.0.1 &ping.exe /n 6 127.0.0.1 & type - System.Net.Networkinformation.ping - - mofcomp.exe - - - - - net.exe;net1.exe;net2.exe - user;group;localgroup - remove;delete;active;del - tvsu_tmp - - - - - - - - - net.exe;net1.exe;net2.exe - user - add - tvsu_tmp - - dsmod.exe - dsadd.exe - - - - WerFault.exe - -s;/s - - - - - - - - - - - - - - - cmd.exe - echo;\pipe\;> - - - cmd.exe - /c;copy;dll;\\;admin$ - - - rundll32.exe - ,;StartW - - - rundll32.exe - ,;update;appdata;temp;/i: - - - rundll32.exe - ,;update;appdata;temp;-i: - - - dllhost.exe - {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} - - - dllhost.exe - {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} - - - - winlogon.exe;services.exe;lsass.exe;csrss.exe;wininit.exe;spoolsv.exe;searchindexer.exe - powershell.exe;pwsh.exe;cmd.exe - AUTHORI;AUTORI - route ; ADD - - - - eventvwr.exe - c:\windows\system32\mmc.exe - - fodhelper.exe - InstallUtil.exe - Invoke-PsUaCme - BypassUAC - PowerUp - computerdefaults.exe - dism.exe - fodhelper.exe - - - NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC - NT AUTHORITY\SYSTEM;СИСТЕМА;NT-AUTORITÄT\SYSTEM;AUTORITE NT\SYSTEM - - c:\windows\system32\svchost.exe -k netsvcs -s Appinfo - runas.exe - - - - - - - - Cmd.Exe - winlogon.exe - utilman.exe - - - Cmd.Exe - winlogon.exe - sethc.exe - - - utilman.exe - C:\Windows\System32\ATBroker.exe;Magnify.exe;C:\Windows\System32\osk.exe - - sethc.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe - - sdbinst.exe - - - cmd.exe /c C:\Windows\Setup\Scripts\SetupComplete.cmd;cmd.exe /c C:\Windows\Setup\Scripts\PartnerSetupComplete.cmd - C:\Windows\Setup - C:\Windows\SysWOW64 - C:\Windows\System32 - C:\Windows\WinSxS - - - consent.exe - http - iexplore.exe - SYSTEM - - - dwm.exe - - - cmd.exe - 7zFM.exe - ;/c;-c - - - cmd.exe - elevation_service.exe - System - - - - - - - - unknown process - \LocalState\rootfs\ - \LocalState\rootfs\ - - - - - - - - - - - auditpol - /set;-set;/restore;-restore;/clear;-clear;/remove;-remove;/resourceSACL;-resourceSACL - - - - - - - +s;+h - attrib.exe - - - Hidden;Attributes - powershell.exe - - - - - Sysinternals Sysmon - /u;/c;-u;-c - C:\ProgramdData\sysmon\ - - - MpCmdRun.exe - Add-MpPreference;RemoveDefinitions;DisableIOAVProtection - - - - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE - - - IMPHASH=19584675D94829987952432E018D5056 - - - IMPHASH=330768a4f172e10acb6287b87289d83b - - - PsKill.exe - - Set-MpPreference;Add-MpPreference;Remove-MpPreference;MpCmdRun.exe - RemoveDefinitions;RemoveDynamicSignature;DisableIOAVProtection;DisableRealTimeMonitoring;DisableBehaviorMonitoring;DisableBlockAtFirstSeen;DisableIOAVProtection;DisablePrivacyMode;DisableScriptScanning;DisableRealtimeMonitoring;DisableScanningNetworkFiles;DisableScanningMappedNetworkDrivesForFullScan;DisableRestorePoint;DisableRemovableDriveScanning;SignatureDisableUpdateOnStartupWithoutEngine;DisableIntrusionPreventionSystem;DisableScanOnRealtimeEnable;DisableArchiveScanning;DisableIntrusionPreventionSystem;DisableScriptScanning;DisableOnAccessProtection;ExclusionExtension;ExclusionPath;ExclusionProcess;ThreatDefaultAction;TamperProtection - - interface ipv6 set - interface ipv4 set - taskkill.exe - - firewall delete - firewall add - firewall set opmode disable - Core Networking - Router Solicitation - netsh advfirewall firewall - - - wevtutil.exe - cl - wevtutil im - wevtutil.exe im - ClickToRun - - - fltMC.exe - detach;unload - - - appcmd.exe - DontLog;True - iisetup.exe - - - set;NGenAssemblyUsageLog - New-ItemProperty;NGenAssemblyUsageLog - reg;add;dword;NGenAssemblyUsageLog - $env;NGenAssemblyUsageLog - - - set;COMPlus_ETWEnabled - New-ItemProperty;COMPlus_ETWEnabled - reg;add;dword;COMPlus_ETWEnabled - $env;COMPlus_ETWEnabled - - - - bash.exe;wsl.exe;ubuntu.exe;kali.exe - -e;/e;-u root;--exec bash;dev/tcp - - wsl.exe - wsl.exe - wslhost.exe - wslhost.exe - ubuntu.exe - ubuntu.exe - kali.exe - kali.exe - - pcalua.exe - pcalua.exe - bash.exe - bash.exe - forfiles.exe - forfiles.exe - .com - -appvscript - - - - C:\Users\NetworkService\;C:\Users\NetworkService\;HarddiskVolumeShadowCopy;C:\Users\Default\;C:\Users\Public;C:\Users\Guest\;\administrateur\;C:\Windows\Media\;C:\Windows\addins\;tsclient\;\htdocs\;\config\systemprofile\;C:\PerfLogs\;c:\windows\ServiceProfiles\;C:\Intel\Logs\;C:\Windows\repair\;C:\Windows\Help\;$Recycle;C:\Windows\Debug\;C:\Windows\Security\;C:\Windows\Fonts\;\wwwroot\;\Contacts;C:\Windows\vss\ - - - - - reg add hkcu\software\classes\ - reg.exe add hkcu\software\classes\ - C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry - - regedit.exe - : - - - reg.exe - delete - - - regedit.exe - /d;-d - - - HKCU:;HKLM - remove-item - - - HKCU:;HKLM - set-item;new-item - - - - - - chcp.exe - 936 - 1256 - 864 - 1258 - 855 - 866 - - - powershell.exe - -e ;-en;-enc;-enco;-encod;-encode;-encoded;-encodedc;-encodedco;-encodedcom;-encodedcomm;-encodedcomma;-encodedcomman;-encodedcommand;/e ;/en;/enc;/enco;/encod;/encode;/encoded;/encodedc;/encodedco;/encodedcom;/encodedcomm;/encodedcomma;/encodedcomman;/encodedcommand - - - powershell.exe - -w h;-wi h;-win h;-wind h;-windo h;-window h;-windows h;-windowst h;-windowsty h;-windowstyl h;-windowstyle h;/w h;/wi h;/win h;/wind h;/windo h;/window h;/windows h;/windowst h;/windowsty h;/windowstyl h;/windowstyle h - - - powershell.exe - -ex;/ex - bypass - - - powershell.exe - -noni;/noni - Import-Module FileServerResourceManager - C:\Program Files\LogicMonitor - - - powershell.exe - hextobin;iex;io.filestream;system.text;base64;system.io;io.file;IMAGE_SUBSYSTEM_WINDOWS_GUI;IMAGE_NT_OPTIONAL_HDR32;IMAGE_NT_OPTIONAL_HDR64;DllCharacteristicsType;GetDelegateForFunctionPointer;WriteProcessMemory;ReadProcessMemory;ImpersonateSelf;AdjustTokenPrivileges;NtCreateThreadEx;CreateRemoteThread;io.seek;iwr;-bxor;invoke-expression;remove.to.string;shellcode;System.Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;unicode;-useb;msxml2.serverxmlhttp;wscript.shell;-comobject;frombase64;io.compression;system.convert;io.streamreader;io.memorystream;compression.gzipstream;text.encoding;executioncontext;text.enc;convertto-securestring;runtime.interop;verbosepreference;[[string]]::join - - - powershell.exe - SUVYI;aWV4I;SQBFAFgA;aQBlA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC;UwB0AGE - - - C^om^S^pEc;^c^o^m^S^p^E^c^;Wscript.Shell;-ComObject;MsXml2.ServerXmlHttp;Remove.ToString;System.Convert;-UseB;[Byte[];^h^t^t^p;h"t"t"p - - IwAjACMAd;IyM=;SUVYI;aWV4I;SQBFAFgA;aQBlAHgA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC - WindowStyle Hidden function;WindowStyle Hidden;windowstyle h;windowstyl h;windowsty h;windowst h;windows h;window h;windo h;wind h;win h;wi h;-w h;/w h;win hi;win hid;win hidd;win hidde;win hidden - ^ - TYPE CON > - copy CON > - FromBase64String;action=create keyvalue=;VerbosePreference.ToString;SecureString;CSharpCodeProvider;runtime.interopservices.marshal;system.globalization.numberstyles;system.reflection.assembly;hextobin;VerbosePreference.ToString;system.text.encoding;io.filestream;io.filestream;io.seekorigin;text.encoding;unicode.getstring;FromBase64;[Convert]::;System.IO.File]::ReadAllText;|iex - - certutil - decode;encode - - - - ping.exe - 0x - - - - csc.exe - \AppData\;\Windows\Temp\ - - - csc.exe - wscript.exe - cscript.exe - mshta.exe - - - mofcomp.exe - .mof - C:\WINDOWS\Installer\MSI - MsMpEng.exe - aspnet_regiis.exe - msiexec.exe - - - csc.exe - out:;target:library - - Microsoft.Workflow.Compiler.exe - - - - - autochk.exe - \smss.exe;\fontdrvhost.exe;\dwm.exe - - - \consent.exe;\Runtimebroker.exe;\TiWorker.exe - \svchost.exe - - - - - \consent.exe;\Runtimebroker.exe;\TiWorker.exe - svchost.exe - - - - - SearchProtocolHost.exe - \SearchIndexer.exe;\dllhost.exe - - - - - dllhost.exe - \services.exe;\svchost.exe - - - - - smss.exe - \smss.exe - System - - - - - csrss.exe - - - \smss.exe;svchost.exe - - - wininit.exe - - - \smss.exe - - - winlogon.exe - \smss.exe - - - \lsass.exe;LsaIso.exe - \wininit.exe - - - LogonUI.exe - \wininit.exe;\winlogon.exe - - - services.exe - \wininit.exe - - - svchost.exe - - - \MsMpEng.exe;\services.exe - - - spoolsv.exe - \services.exe - - - taskhost.exe - \services.exe;\svchost.exe - - - userinit.exe - \dwm.exe;\winlogon.exe - - - \wmiprvse.exe;\wsmprovhost.exe;\winrshost.exe - - - \svchost.exe - - - \SearchProtocolHost.exe;\taskhost.exe;\csrss.exe - \werfault.exe;\wermgr.exe;\WerFaultSecure.exe - - - autochk.exe - \chkdsk.exe;\doskey.exe;\WerFault.exe - - - smss.exe - \autochk.exe;\smss.exe;\csrss.exe;\wininit.exe;\winlogon.exe;\setupcl.exe;\WerFault.exe - - - wermgr.exe - \WerFaultSecure.exe;\wermgr.exe;\WerFault.exe - - - conhost.exe - \mscorsvw.exe;\wermgr.exe;\WerFault.exe;\WerFaultSecure.exe - - System.Management.Automation - - - - - - - InstallUtil.exe - /logfile=;/LogToConsole=false;/U - - - InstallUtil.exe - -logfile=;-LogToConsole=false;-U - - - Mavinject.exe;mavinject64.exe - INJECTRUNNING - - - CMSTP.exe - /ni;/s - - - CMSTP.exe - /ns;/s - - - CMSTP.exe - -ni;-s - - - CMSTP.exe - -ns;-s - - - rundll32.exe;shell32.dll;_RunDLL - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - - - odbcconf.exe - /S /A {REGSVR;-S -A {REGSVR - - script:http - Register-cimprovider - Scriptrunner.exe -appvscript - bginfo - cbd - runscripthelper.exe surfacecheck - xwizard RunWizard - PresentationHost - driver executeinf - control.exe /name;control.exe -name - Control_RunDLL - SyncAppvPublishingServer.exe - Scriptrunner.exe - ATBroker.exe - Appvlp.exe - InfDefaultInstall.EXE - PresentationHost.exe - RegisterCimProvider2.exe - RegisterCimProvider.exe - ScriptRunner.exe - csi.exe - extexport.exe - msconfig.EXE - rasdlui.exe - tttracer.exe - verclsid.exe - wab.exe - Register-cimprovider.exe - csi.exe - devtoolslauncher.exe LaunchForDeploy - bginfo - devtoolslauncher.exe - wab.exe - wsreset.exe - - cmstp.exe /ni /s;cmstp.exe -ni -s - cmstp /ni /s;cmstp -ni -s - - Mavinject.exe - INJECTRUNNING - - - rundll32.exe - DllRegisterServer - xapauthenticodesip.dll - - - regsvr32.exe - C:\Users;Appdata;Temp - - - regsvr32.exe - C:\Users;Public - - Microsoft(C) Register Server - SyncAppvPublishingServer.exe - control.exe - rasautou.exe - control.exe /name;control.exe -name - Control_RunDLL - - - msiexec.exe - /y;-y - C:\Windows\SysWOW64\DartSock.dll - C:\Windows\SysWOW64\ImageViewer2.OCX - C:\Windows\SysWOW64\SysTray.ocx - C:\Windows\SysWOW64\tdbg6.ocx - C:\Windows\SysWOW64\tdbg7.ocx - C:\Windows\SysWOW64\tdbg7.ocx - C:\Windows\SysWOW64\todg7.ocx - C:\Windows\SysWOW64\todgub7.dll - C:\Windows\SysWOW64\xarraydb.ocx - - - msiexec.exe - /i;-i - http - - - - RUNDLL32.EXE - ,;# - C:\Windows\resources\themes\Aero\AeroLite.msstyles - uxtheme.dll - ImageView_Fullscreen - EDGEHTML.dll - PhotoViewer.dll - \AppData\Local\WebEx\WebEx\ - - - RUNDLL32.EXE - -sta;/sta - - - RUNDLL32.EXE - shell32.dll;OpenAs_RunDLL - - - RUNDLL32.EXE - powershell - - - RUNDLL32.EXE - url.dll;OpenURL - - - RUNDLL32.EXE - url.dll;FileProtocolHandler - - - RUNDLL32.EXE - zipfldr.dll;RouteTheCall - - - RUNDLL32.EXE - Shell32.dll;Control_RunDLL - - - RUNDLL32.EXE - javascript: - - - RUNDLL32.EXE - RegisterXLL - - - rundll32.exe - C:\Users;Public - rdpinit.exe - rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe - - - rundll32.exe - C:\Users;Appdata;Temp - ImageView_ - rdpinit.exe - rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe - - advpack.dll;LaunchINFSection - ieadvpack.dll;LaunchINFSection - syssetup.dll;SetupInfObjectInstallAction - setupapi.dll;InstallHinfSection - InstallHinfSection - infDefaultInstall.exe - rundll32.exe "C:\Windows\twain_64.dll" - shdocvw.dll;OpenURL - advpack.dll;RegisterOCX - Zipfldr.dll;RouteTheCall - url.dll;FileProtocolHandler - url.dll;FileProtocolHandler - OpenURLA;file: - OpenURL;file: - - - mshta.exe - cmd.exe;powershell.exe;wscript.exe;cscript.exe;sh.exe;bash.exe;reg.exe;regsvr32.exe;bitsadmin - - - mshta.exe - - RunHTMLApplication - mshtml - vbscript:CreateObject - - odbcconf.exe - - - manage-bde.wsf - - - - - powershell.exe;powershell_ise.exe - msbuild.exe - - - msbuild.exe - regasm - - - msbuild.exe - userinit.exe - - - msbuild.exe - .xml - - - regasm.exe - \conhost.exe - - - msbuild.exe - .lnk - - .csproj - - - - - - - msxsl.exe - msxsl.exe - - - - - - - - - /stext - keylog - keyscan_ - Get-Keystrokes - /scomma - - - - - - sniff - C:\Program Files\Adobe\ - - - tcpdump.exe;tcpdump.c;tshark.exe;tshark.c;windump.exe;windump.c;wireshark.c;wireshark.exe - windump;tshark;tcpdump;windump;wireshark - netsh;trace;start;capture=yes - - - - vssadmin.exe - create;shadow - - - wmic.exe - shadowcopy;call;create - - - wmic.exe - call;create;esentutl;vss - - - win32_shadowcopy;create;clientaccessible - - - mklink;GLOBALROOT;Shadow - - - copy;NTDS\ntds.dit - - - ntdsutil.exe - - - copy;System32\config\SYSTEM - - - reg;save;HKLM - - - mimikatz;mimidrv;mimilove;mimilib;sekurlsa;lsadump;dumpcreds;privilege::;token::;logonpasswords;mimikittenz;mimiauth;::;kerberos::;misc::skeleton;privilege::debug;dpapi::cred;vault::cred;lsadump;misc::;Krbtgt;TOKEN::;invoke-mimi - - - cmdkey - - rpcping.exe - nltest.exe - - -ma lsass.exe;Do-Exfiltration;Powersploit;GPPPassword;gpprefdecrypt;gsecdump;hashdump;laZagne;ntds.dit;ppldump;pwdump;pwdumpx;secretsdump;/listcreds:;-listcreds: - - VaultCloseVault - VaultEnumerateItem - VaultFree - VaultGetItem - VaultOpenVault - Vaultcmd - vaultcli.dll - select * from moz_login - Invoke-WinEnum - System.Net.CredentialCache - create shadow - wlan;export;profile;key=clear - dcsync - HKCU /f password;HKCU -f password - HKLM /f password;HKLM -f password - nltest.exe - ProcDump.exe - ProcDump - - - asktgt;asktgs - createnetonly /program:;createnetonly -program: - dump /service:krbtgt;dump -service:krbtgt - harvest /interval:;harvest -interval: - renew /ticket:;renew -ticket: - asreproast - impersonateuser: - kerberoast - ptt /ticket: - klist.exe - hh.exe - - - - appcmd.exe - list;text;password - - - - quser.exe - - net.exe;net1.exe;net2.exe - group;localgroup; user - /domain - SUService - \users - tvsu_tmp - - - net.exe;net1.exe;net2.exe - group;localgroup; user - /domain - SUService - \users - tvsu_tmp - - - sharphound;bloodhound;azurehound;CollectionMethod;encryptzip;randomizefilenames;dumpcomputerstatus - sharphound;bloodhound - sharphound;bloodhound - sharphound;bloodhound - sharphound;bloodhound - sharphound;bloodhound - sharphound;bloodhound - - dscl . list /Groups;dscl . list -Groups - dscl . list /Users;dscl . list -Users - dsquery.exe - query.exe - - - - - - - - - - - tree.com - - - auditpol - /get;-get;/list;-list;/backup;-backup - - gpresult.exe - get-gpo;get-gpresult;get-gpreg - - - - - - - - tasklist.exe - qprocess.exe - - reg query - reg.exe query - driverquery.exe - - - tracert.exe - pathping.exe - - - - find;385201 - select-string;385201 - - - find;virus - select-string;virus - process;Description;virus - find;cb - select-string;cb - process;Description;cb - find;defender - select-string;defender - process;Description;defender - find;crowdstrike - select-string;crowdstrike - process;Description;crowdstrike - find;sentinel - select-string;sentinel - process;Description;sentinel - find;nessusd - select-string;nessusd - process;Description;nessusd - find;td-agent - select-string;td-agent - process;Description;td-agent - find;cbagentd - select-string;cbagentd - process;Description;cbagentd - find;sysmon - select-string;sysmon - process;Description;sysmon - find;winlogbeat - select-string;winlogbeat - process;Description;winlogbeat - find;winlogbeat - select-string;winlogbeat - process;Description;winlogbeat - find;csfalcon - select-string;csfalcon - process;Description;csfalcon - find;splunk - select-string;splunk - process;Description;splunk - find;sidecar - select-string;sidecar - process;Description;sidecar - - - fltMC.exe - misc::mflt - - AntiVirusProduct - root\SecurityCenter2 - - sysinfo.exe - systeminfo - - - - netsh.exe - get;list;show - - - netsh.exe - get;list;show - - ipconfig.exe - - netstat.exe - arp -a - arp.exe -a - arp -a - - - whoami.exe;whoami1.exe - - - wmic.exe - get;useraccount - - - netsh.exe - add;del;set - - - nbtstat - nessus - - - route.exe - print - - - route.exe - ADD;DEL;CHANGE;-f - - qwinsta.exe - rwinsta.exe - - - - - - - - Microsoft Office\root\Office - Microsoft Office\root\Office - automation;Embedding - - - admin$ - davclnt.dll - WebClientGroup - - - - - - - /shadow;-shadow - noConsentPrompt - - - tscon.exe - dest:rdp-tcp: - - - powershell.exe - WmiPrvSE.exe - - - WmiPrvSE.exe - \Users\ - - - NetworkDetective - WmiPrvSE.exe - - - sc.exe - tenable - WmiPrvSE.exe - - - cmd.exe - WmiPrvSE.exe - do_vbsUpload;Spiceworks - - - regsvr32.exe - WmiPrvSE.exe - - - cmd.exe - WmiPrvSE.exe - - - powershell.exe - WmiPrvSE.exe - - - dsa.msc - - - virtmgmt.msc - - - wmiprvse.exe - CompMgmtLauncher.exe - DismHost.exe - Microsoft.NET\Framework - NetEvtFwdr.exe - ServerManager.exe - WerFault.exe - chcp.com - g2mupdate.exe - slack.exe - - - wsmprovhost.exe - cmd.exe - sh.exe - bash.exe - wsl.exe - powershell.exe - powershell_ise.exe - schtasks.exe - at.exe - certutil.exe - mshta.exe - whoami.exe - ping.exe - ping.exe - bitsadmin.exe - - winrm.cmd - winrs.exe - winrshost.exe - waitfor.exe - wsmprovhost.exe - winrshost.exe - wsmprovhost.exe - - wmiprvse.exe - mshta.exe - - - ssh.exe;putty.exe;kitty.exe;kitty_portable.exe - - PuTTY suite - - sftp;psftp - - - rundll32.exe - - - rundll32.exe - ..\;, - - - rundll32.exe - ,StartW - - psshutdown - psservice - PsPasswd - mstsc.exe - telnet.exe - tftp.exe - powershellcustomhost - - - -Embedding - c:\windows\system32\mmc.exe - - --execm;atexec - {4991d34b-80a1-4291-83b6-3328366b9097} - {00020812-0000-0000-C000-000000000046} - {40AEEAB6-8FDA-41e3-9A5F-8350D4CFCA91} - {7e0423cd-1119-0928-900c-e6d4a52a0715} - {0006F04A-0000-0000-C000-000000000046} - {048EB43E-2059-422F-95E0-557DA96038AF} - {13709620-C279-11CE-A49E-444553540000} - {c08afd90-f2a1-11d1-8455-00a0c91f3880} - 9BA05972-F6A8-11CF-A442-00A0C90A8F39 - {00021A20-0000-0000-C000-000000000046} - {72C24DD5-D70A-438B-8A42-98424B88AFB8} - {00020906-0000-0000-C000-000000000046} - {cc5bbec3-db4a-4bed-828d-08d78ee3e1ed} - {1b7cd997-e5ff-4932-a7a6-2a9e636da385} - {16d51579-a30b-4c8b-a276-0ff4dc41e755} - rundll32.exe -sta;rundll32.exe /sta;rundll32 -sta;rundll32 /sta - shell32.dll;SHCreateLocalServerRunDll - -k DcomLaunch;/k DcomLaunch - - - - - - - - - - 7z.exe - a -mx9 -r0 -p;a -v500m -mx9 -r0 -p - - - WindowsAudioDevice-Powershell-Cmdlet - SoundRecorder.exe - - - - clip.exe - get-clipboard - - - - - - - - - - New-MailboxExportRequest - - - - screencapture - system.drawing.Imaging - system.drawing.bitmap - system.windows.forms.screen - - - - - - - odHRwczovL;aHR0cDovL;h0dHA6Ly;odHRwOi8v;aHR0cHM6Ly;h0dHBzOi8v - ie_to_edge_stub.exe;chrome.exe;firefox.exe;iexplore.exe;brave.exe;vivaldi.exe;msedge.exe;webex;teams.exe;goto opener.exe;lynx.exe;\Webex\webexAppLauncherLatest.exe;\WebEx\webexAppLauncher.exe;\WebEx\Applications\webexAppLauncher.exe;WebEx\webex.exe - wbx:;/SITE_TOKEN=;msteams:;PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSI - msedgeupdate.dll - - - VFZvQUFBQ;RWb0FBQU;UVm9BQUFB;VFZxQUFBR;RWcUFBQU;UVnFBQUFF;VFZwUUFBS;RWcFFBQU;UVnBRQUFJ;VFZxUUFBT;RWcVFBQU;UVnFRQUFN;VFZwVEFRR;RWcFRBUU;UVnBUQVFF - - - powershell.exe - AAAAYInlM;OiCAAAAYInlM;OiJAAAAYInlM;RwBlAHQAL;WwBOAGUAdAAuAFM;W05ldC5TZXJ2aWNl - - - Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք - - - - - - - - certutil.exe - urlcache;split;f - - - DownloadFile;DownloadString;Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;Invoke-Expression;Invoke-WebRequest - powershell.exe;cmd.exe - - - bitsadmin.exe - CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME - util;setieproxy;localsystem;AUTODETECT - - - BITS administration utility - CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME - - - \curl.exe;\wget.exe;\www.exe - - - \curl.exe;\wget.exe;\www.exe - - - certutil - split;f - - - certutil - verifyctl;URL - - start-bitstransfer - expand \\ - expand.exe \\ - ieexec http - ieexec.exe http - powercat - esentutl /y \\;esentutl -y \\ - esentutl.exe /y \\;esentutl.exe -y \\ - extrac32 \\ - extrac32.exe \\ - - - - - - portproxy - tor.exe - - TeamViewer_Desktop.exe - - psexec - - - - - - - winscp.exe;winscp.com;scp.exe;pscp - - - - bitch.exe;bitch.bat;bitch_lasagna.exe;Admin Cracker.exe;BulletsPassView.exe;ChromePass.exe;Dialupass.exe;LSASecretsView.exe;OpenedFilesView.exe;OperaPassView.exe;PasswordFox.exe;ProduKey.exe;RouterPassView.exe;USBDeview.exe;USBStealer.exe;VNCPassView.exe;WebBrowserPassView.exe;WirelessKeyView.exe;WirelessKeyView.exe;empv.exe;netpass.exe;pspv.exe;usbdll.exe;rdpv.exe;WirelessKeyView.exe;lasagna.exe;all -vvv >>;rsync -r - - - CredsLeaker;Windows.Security.Credentials.UI.CredentialPicker;function Leaker;function Await - - - .exe -url https://;dll,Run https://;Invoke-Merlin;-m SimpleHTTPServer;/m SimpleHTTPServer - - - - - -q=txt;/q=txt - nslookup.exe - - - rclone - Rsync for cloud storage - rclone - rclone - \rclone - - - s3browser - s3browser - s3browser - s3browser - - - add-ftp;.UploadFile( - ftp.exe - - - rundll32.exe - davclnt.dll;DavSetCookie - - - - - - - - - - - - bcdedit.exe - safeboot - - - bootcfg.exe - safeboot - - - -startvm;vrun.exe -vm - - - - - vssadmin.exe - delete;resize - - - wmic.exe - shadowcopy;delete - - - wbadmin.exe - SYSTEMSTATEBACKUP;delete - - - wmic.exe - wmic shadowstorage SET MaxSpace= - - - wmic.exe - cleareventlog;call disable;nteventlog where filename - - - diskpart.exe - format;clean;delete;remove - - - manage-bde.exe - changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw - - - manage-bde.wsf - changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw - - format - format - bootstatuspolicy ignoreallfailures - recoveryenabled No - Win32_Shadowcopy - sdelete - delete catalog - wbadmin delete catalog - erase - -nw -exec= - -p -nw - shred - diskshadow - - del ; /f - del ; -f - rmdir ; /s ; /q - rmdir ; -s ; -q - rd ; /s ; /q - rd ; -s ; -q - - - usn deletejournal - - - - - fsutil.exe - deletejournal - usn - - - - - - - - - - AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz - - - ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool - CPU miner;GPU miner;Lime Miner;XMRig CPU miner; miner - - - - b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 - - 87AECF008D87EC86EC8B00A2394B3E6C - FB3F0D0DE8B80EA8CFAB2A025EC6B833 - F4067FBF7FFF6945D0BB485B727B39AA - 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee - e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f - d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b - 53841a0c6a3ff92976db08bfdf95e083 - - - zoommtg - pwd= - - - zoommtg - zc=0 - - - zoommtg - zc=1 - - - msteams: - - - wbx: - - - C:\Users\ - \Downloads\ - - - C:\Users\ - \Desktop\ - - - \awk.exe;\sed.exe - - listena - -s -n -u -i:http: - /s /n /u /i:http: - assoc - del - expand - md - move - rd - ren - set - setx - bginfo.bgi /popup /nolicprompt;bginfo.bgi -popup -nolicprompt - find.exe - grabff - routerscan - pythonEngine.Execute - sesshijack - file:// - HTML Application host - Manager Profile Installer - Microsoft Application Virtualization Injector - Application Compatibility Database Installer - popd.exe - pushd.exe - subst.exe - doskey.exe - cls.exe - \ - C:\Windows\system32\svchost.exe -k iissvcs - \ - acrobat.exe - acrord32.exe - java.exe - javaw.exe - - - - - C:\Windows\system32\svchost.exe - - cacls - takeown - /x Macro - - \pipe\ - > - - /noprofile - /sc ONEVENT - \\VBOXSVR - | more - |more - \\tsclient - %PROCESSOR_ARCHITECTURE% - sysnative - AutoIt - Microsoft Filter Loader - more.com - :\Windows\Microsoft.NET\ - acrord32.exe - gpupdate.exe - :\Windows\Microsoft.NET\ - - - - - - - - C:\Windows\System32\WerFault.exe - C:\Windows\System32\wbem\WmiPrvSE.exe - - - - - - - C:\Users - C:\ProgramData - \Temp\ - \tmp\ - \drivers\ - \Download - - - - - C:\Windows\system32\backgroundTaskHost.exe - TrustedInstaller.exe - OneDrive.exe - vivaldi.exe - chrome.exe - C:\WINDOWS\system32\backgroundTaskHost.exe - setup - AppData\Local\Microsoft\Teams\current\Teams.exe - \AppData\Local\Microsoft\Edge SxS\Application\msedge.exe - - - - - - - - census - researchscan - scanhub - shadow - shodan - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - wscript.exe - - - - - - - - at.exe - schtasks.exe - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \temp\ - 127.0.0.1 - - - \wwwroot\ - - \Windows\addins\ - C:\Windows\repair\ - \htdocs\ - C:\Windows\system32\config\systemprofile\ - C:\Intel\Logs\ - C:\Windows\addins\ - C:\Windows\security\ - C:\Windows\Help\ - $RECYCLE.BIN - C:\Windows\Debug\ - C:\Windows\Fonts\ - C:\PerfLogs\ - :\$Recycle.bin\ - :\Users\Default\ - C:\Users\NetworkService\ - C:\Users\Public\ - C:\Windows\Media\ - \Windows\IME\ - C:\ProgramData - - - - - - - - CSC.exe - - - - - - - - - - infDefaultInstall.exe - SyncAppvPublishingServer.exe - - - InstallUtil.exe - - msiexec.exe - - - regasm.exe;regsvcs.exe - - - Mavinject.exe - - - - - - msbuild.exe - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - dsquery.exe - - - - - - - - - - - - - driverquery.exe - - - - nbtstat - - net.exe - net1.exe - - qwinsta.exe - rwinsta.exe - - - - - - - - - - - - true - 3389 - AutomationManager.ScriptRunner64.exe - C:\Program Files (x86)\VMware\VMware Remote Console\vmrc.exe - C:\Program Files\VMware\VMware Remote Console\vmrc.exe - C:\Program Files\WindowsApps\Microsoft.RemoteDesktop_ - CtxLicUsageRecorder.exe - FSAssessment.exe - FSDiscovery.exe - MobaRTE.exe - RDCMan.exe - RSSensor.exe - RTS2App.exe - RTSApp.exe - RemoteDesktopManager64.exe - RemoteDesktopManager.exe - RemoteDesktopManagerFree.exe - Terminals.exe - chrome.exe - mRemote.exe - mRemoteNG.exe - mstsc.exe - spiceworks-finder.exe - svchost.exe - thor64.exe - thor.exe - - - true - 3391 - AutomationManager.ScriptRunner64.exe - C:\Program Files (x86)\VMware\VMware Remote Console\vmrc.exe - C:\Program Files\VMware\VMware Remote Console\vmrc.exe - C:\Program Files\WindowsApps\Microsoft.RemoteDesktop_ - CtxLicUsageRecorder.exe - FSAssessment.exe - FSDiscovery.exe - MobaRTE.exe - RDCMan.exe - RSSensor.exe - RTS2App.exe - RTSApp.exe - RemoteDesktopManager64.exe - RemoteDesktopManager.exe - RemoteDesktopManagerFree.exe - Terminals.exe - chrome.exe - mRemote.exe - mRemoteNG.exe - mstsc.exe - spiceworks-finder.exe - svchost.exe - thor64.exe - thor.exe - - - true - 3389 - 127.0.0.1;0:0:0:0:0:0:0:1 - - - true - 3389 - fe80:0 - - - putty.exe;kitty.exe;kitty_portable.exe - - - wsmprovhost.exe - - - psftp.exe - - reg.exe - psshutdown - PsPasswd - psservice - ssh.exe - psexe - tftp.exe - telnet.exe - mstsc.exe - wmic.exe - sc.exe - pskill - dsquery.exe - plink.exe - vnc.exe - vncviewer.exe - vncservice.exe - omniinet.exe - hpsmhd.exe - - - - - - - - - - - - - - - - - - - - - - - - - - - 50050 - true - - - 25 - \Bin\EdgeTransport.exe;Bin\MSExchangeFrontendTransport.exe - true - - - - - - - - - - - powershell.exe - 0:0:0:0:0:0:0:;127.0.0.1 - - mshta.exe - cmd.exe - certutil.exe - certutil.exe - notepad.exe - regsvcs.exe - regsvr32.exe - rundll32.exe - - - - - - - tor.exe - hiddenservice.net;onion.city;onion.direct;onion.direct;onion.link;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org;onion.to - - - - - - - - - - dns.google;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;doh.opendns.com;.quad9.net;dns.cleanbrowsing.org;dns-family.adguard.com;dns.adguard.com;.233py.com;dnscrypt;dnscrypt-cert.oszx.co;dns.oszx.co;doh.dns.sb;doh.defaultroutes.de;doh.tiarap.org;doh.tiar.app;doh.captnemo.in;.aaflalo.me;doh.appliedprivacy.net;doh.dnswarden.com;commons.host;dns.twnic.tw;ibuki.cgnat.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;.seby.io;rdns.faelix.net;doh.li;.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk;adblock.mydns.network;ibksturm.synology.me;jcdns.fun - - - - - - - privatlab.com - mega.nz;mega.co.nz - .pcloud.com - - - - - - - - - - - - - 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool - - - - - C:\Windows\system32\svchost.exe - 3389 - 22 - 21 - 5985 - false - - - C:\Windows\system32\svchost.exe - true - 135 - 445 - 5985 - - - System - svchost.exe - 445 - - - System - svchost.exe;lsass.exe - 389 - - - C:\Windows\System32\lsass.exe - 389 - 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 - EXCH - 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 - false - - - notepad.exe - 127.0.0.1 - - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - 80 - 443 - true - - github - githubusercontent.com - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - 80 - true - - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - 443 - true - - - apache.exe - - - java.exe - - - w3wp.exe - - - \php-cgi.exe;\php.exe - - - setup - - - tomcat - - - unins - - - unknown process - - - explorer.exe - - - inetinfo.exe - - - netcat.exe;nc.exe;nc64.exe;ncat.exe - procdump - psexe - vnc;vncs;vncv - - rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe;advanced_port_scanner.exe;rcpping.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe - - - 0 - 5985 - 5986 - 1293 - 1701 - 1194 - 3540 - 3389 - 22 - 1080 - 3128 - 8080 - 1723 - 23 - 4500 - 9001 - 9030 - 5900 - 5800 - - 0 - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - 443 - true - - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - 80 - true - - 80 - 443 - 636 - 5900 - 443 - - afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com - - - - - udp - - - System;svchost.exe;oracle.exe;apache.exe;java.exe;php-cgi.exe;w3wp.exe;httpd;ServerManager.exe;unknown process;sql;wscript;cscript;schtasks;at.exe;reg.exe;C:\Windows\System32\find.exe - 127.0.0.1;0:0:0:0:0:0:0:1 - 127.0.0.1;0:0:0:0:0:0:0:1 - - - - C:\Windows\System32\lsass.exe - 88 - - - epmap - llmnr - microsoft-ds - netbios-dgm - ntp - ssdp - epmap - llmnr - microsoft-ds - netbios-dgm - ntp - ssdp - - 53 - 67 - 68 - 1434 - 1812 - 3544 - 3702 - 5228 - 5353 - 5357 - 5989 - 6007 - 49154 - 49209 - 52176 - 59241 - 53 - 67 - 68 - 1812 - 3702 - 6007 - 49154 - 49209 - 50646 - 52176 - 59241 - - .bing.com - .cloudapp.net - .lync.com - .microsoft.com - .outlook.com - .search.msn.com - .wns.windows.com - aps.windows.com - arc.msn.com.nsatc.net - arc.msn.com - atson.telemetry.microsoft.com - au.download.windowsupdate.com - b.akamaiedge.net - bingforbusiness.com - client-office365-tas.msedge.net - config.edge.skype.com - csp.digicert.com - ctldl.windowsupdate.com - cy2.licensing.md.mp.microsoft.com.akadns.net - cy2.settings.data.microsoft.com.akadns.net - displaycatalog.mp.microsoft.com - download.windowsupdate.com - e-msedge.net - e3.delivery.dsp.mp.microsoft.com.nsatc.net - emdl.ws.microsoft.com - ettings-win.data.microsoft.com - fe2.update.microsoft.com - fe3.delivery.dsp.mp.microsoft.com.nsatc.net - fe3.delivery.mp.microsoft.com - g.akamaiedge.net - g.live.com - g.msn.com.nsatc.net - geo-prod.do.dsp.mp.microsoft.com - geo-prod.dodsp.mp.microsoft.com.nsatc.net - ile-service.weather.microsoft.com - ip5.afdorigin-prod-am02.afdogw.com - ipv4.login.msa.akadns6.net - licensing.mp.microsoft.com - m3p.wns.notify.windows.com.akadns.net - microsoft.com.akadns.net - microsoft.com.nsatc.net - microsoft.com - modern.watson.data.microsoft.com.akadns.net - msedge.net - msn.com.nsatc.net - msn.com - ocation-inference-westus.cloudapp.net - ocos-office365-s2s.msedge.net - ocsp.digicert.com - odern.watson.data.microsoft.com.akadns.net - oneclient.sfx.ms - pv4.login.msa.akadns6.net - query.prod.cms.rt.microsoft.com - ris.api.iris.microsoft.com.akadns.net - ris.api.iris.microsoft.com - s-msedge.net - settings.data.microsoft.com - sfe.trafficshaping.dsp.mp.microsoft.com - sls.update.microsoft.com - storecatalogrevocation.storequality.microsoft.com - storeedgefd.dsx.mp.microsoft.com - telecommand.telemetry.microsoft.com.akadns.net - tile-service.weather.microsoft.com - tlu.dl.delivery.mp.microsoft.com - tsfe.trafficshaping.dsp.mp.microsoft.com - vip5.afdorigin-prod-am02.afdogw.com - vip5.afdorigin-prod-ch02.afdogw.com - virtualearth.net - windows.net - windowsupdate.com - y2.displaycatalog.md.mp.microsoft.com.akadns.net - y2.licensing.md.mp.microsoft.com.akadns.net - y2.settings.data.microsoft.com.akadns.net - EdgeTransport.exe - MSExchangeDelivery.exe - MSExchangeFrontendTransport.exe - MSExchangeHMWorker.exe - MSExchangeSubmission.exe - \ - - - - - - - - - - - - - C:\Windows\ - \System32\;Syswow64;sysmon.exe;sysmon64.exe - - - C:\Windows\system32\ - config\systemprofile\ - - - C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe - - - A:\;B:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;N:\;O:\;P:\;Q:\;R:\;S:\;T:\;U:\;V:\;W:\;X:\;Y:\;Z:\;AA:\;BB:\;CC:\;DD:\;EE:\;FF:\;GG:\;HH:\;II:\;JJ:\;KK:\;LL:\;MM:\;NN:\;OO:\;PP:\;QQ:\;RR:\;SS:\;TT:\;UU:\;VV:\;WW:\;XX:\;YY;ZZ:\ - :\PROGRA~ - :\Program Files - :\Program Files - :\Program Files - :\ProgramData\ - :\Users\ - :\Windows\ - :\inetpub\ - :\$SysReset - :\$WinREAgent - :\inetpub\ - - - \ - - - C:\Users\ - - - C:\ProgramData\ - C:\ProgramData\sysmon\sysmon64.exe;C:\ProgramData\sysmon\sysmon.exe - - - C:\Program Files;C:\PROGRA~ - - - C:\inetpub\ - - - $RECYCLE.BIN - packetbeat.exe;metricbeat.exe;filebeat.exe;winlogbeat.exe;o365beat.exe;graylog-sidecar.exe;graylog-collector-sidecar.exe;splunkd.exe;splunk.exe;syslogng.exe;syslog-ng.exe;nxlog-processor.exe;snarecore.exe;fluentd;td-agent - C:\Windows\system32\config\systemprofile\ - C:\Windows\sysWOW64\config\systemprofile\ - \Temp\ - C:\Users\ - - - - - Microsoft\Teams\current\Teams.exe - \git.exe - Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe - C:\ProgramData\Lenovo\ImController\ - - - - - - - 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - - - 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5;c948ae14761095e4d76b55d9de86412258be7afd;c996d7971c49252c582171d9380360f2;ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1;10b30bdee43b3a2ec4aa63375577ade650269d25;d2fd132ab7bbc6bbb87a84f026fa0244 - - DumpExt.dll - mimidrv - lsremora - wceaux.dll - npcap - \Temp - :\Users - ChongKim Chan - ? - Revoked - Unavailable - Valid - false - - - - - - - - - - - - - - msdt.exe - sdiageng.dll - - - WINWORD.exe;EXCEL.EXE - VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wshom.ocx - wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - - - ntkrnlmp.exe - - - \spool\drivers\x64\3\;\spool\drivers\W32X86\3\;\spool\drivers\IA64\3\ - spoolsv.exe;printisolationhost.exe - Valid - Brother Industries;Canon;Sharp;Microsoft Corporation;DYMO;Euro Plus d.o.o;HP Inc;Hewlett-Packard - - - C:\Windows\ - \Users\Public\;\Desktop\;\Downloads\;\AppData\Local\Temp\;\PerfLogs\;$Recycle;\Fonts\ - \Program Files - - - EQNEDT32.EXE - EQNEDT32.EXE - - - ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll - C:\Users;\Temp\;\ProgramData\ - - - ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll - wscript.exe;cscript.exe;powershell.exe;rundll32.exe;msbuild.exe;msiexec.exe;csc.exe - - - WINWORD.exe;EXCEL.EXE - VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wshom.ocx - wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll;fastprox.dll - - - WINWORD.exe;EXCEL.EXE - VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - - - WINWORD.exe;EXCEL.EXE - VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - - - WINWORD.exe;EXCEL.EXE - taskschd.dll - - - wscript.exe;cscript.exe - taskschd.dll - - - wmiprvse.exe - taskschd.dll - - - powershell.exe - msi.dll - - - powershell - amsi.dll - - - powershell - amsi.dll - - - WINWORD.exe;EXCEL.EXE - clr.dll - - - clr.dll;System.Management.ni.dll;Microsoft.Build.Utilities - - - wscript.exe;cscript.exe - msxml;wshom.ocx - - - wscript.exe;cscript.exe - winhttp.dll;mswsock.dll;IPHLPAPI.DLL - - - installutil.exe - CustomMarshalers.dll;CustomMarshalers.ni.dll;System.Management.ni.dll;WMINet_Utils.dll;mswsock.dll - - - System.Management.Automation.ni.dll - C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ - - - System.Management.Automation.dll - C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ - Lenovo.Vantage.AddinHost;\Microsoft.Sara.exe;C:\Program Files\CONEXANT - - - C:\Windows\System32\vaultcli.dll - \svchost.exe;\GameBar.exe;C:\Program Files\WindowsApps;\Microsoft\Teams\current\Teams.exe - - - \\ - - - \Microsoft\Word\Startup\ - .wll - - - \Microsoft\Excel\Startup\ - .xll - - - \Microsoft\Addins\ - .xla - - - tor-lib.dll - - - C:\Windows\System32\WinSCard.dll;C:\Windows\System32\cryptdll.dll;C:\Windows\System32\hid.dll;C:\Windows\System32\samlib.dll;C:\Windows\System32\vaultcli.dll - - - rundll32.exe - vaultcli.dll;wlanapi.dll - combase.dll - cryptdll.dll - imm32.dll - logoncli.dll - netapi32.dll - ntasn1.dll - ntdsapi.dll - samlib.dll - shcore.dll - srvcli.dll - - - odbc32.dll;winhttp.dll;netapi32.dll;SHLWAPI.dll - - - C:\Windows\Explorer.EXE - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - - - C:\ProgramData\ - C:\ProgramData\ - .exe - Adobe - C:\ProgramData\Lenovo\ - C:\ProgramData\Microsoft\Windows Defender\ - C:\ProgramData\sysmon\sysmon64.exe - - - C:\Users\Default\;C:\Users\Public\ - .exe - - - 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - - - C:\Windows\System32\svchost.exe - false - - - Revoked - - - Expired - - - jscript9.dll - mshta.exe - - scrobj.dll - crypt0.dll - - C:\Windows\System32\wlanapi.dll - C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe - C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe - C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\System32\AppHostRegistrationVerifier.exe - C:\Windows\System32\CompatTelRunner.exe - C:\Windows\System32\DeviceCensus.exe - C:\Windows\System32\DriverStore\FileRepository\ - C:\Windows\System32\LogonUI.exe - C:\Windows\System32\MoNotificationUx.exe - C:\Windows\System32\SystemSettingsBroker.exe - C:\Windows\System32\dxgiadaptercache.exe - C:\Windows\System32\netsh.exe - C:\Windows\System32\wlanext.exe - C:\Windows\UUS\amd64\MoUsoCoreWorker.exe - C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_ - C:\Windows\explorer.exe - - C:\Windows\Microsoft.NET\assembly\GAC_MSIL - - - - - - \Microsoft Office\ - \mscorlib.ni.dll - - - \Microsoft Office\ - \sppc.dll - - - C:\Windows\System32\svchost.exe - true - - - Fortinet - Lenovo - Sophos - mscorsvw.exe - C:\Program Files (x86)\Microsoft Office\root\Office15\officebackgroundtaskhandler.exe - C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe - C:\Program Files\Microsoft Office\root\Office15\officebackgroundtaskhandler.exe - C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe - C:\Windows\SysWOW64\SearchProtocolHost.exe - C:\Windows\System32\InstallAgentUserBroker.exe - C:\Windows\System32\RuntimeBroker.exe - C:\Windows\System32\SearchIndexer.exe - C:\Windows\System32\SettingSyncHost.exe - C:\Windows\System32\backgroundTaskHost.exe - C:\Windows\System32\sppsvc.exe - C:\Windows\System32\taskhost.exe - C:\Windows\System32\taskhostw.exe - C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe - C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe - HxTsr.exe - SearchUI.exe - C:\Program Files (x86)\Common Files\BIExcelFunctions1.1\32bit\Sage. - C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Pfx. - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Adist64.dll - C:\Program Files (x86)\Microsoft Office\Office15\Library\Analysis\ANALYS32.XLL - C:\Program Files (x86)\Microsoft Office\Office16\Library\Analysis\ANALYS32.XLL - C:\Program Files\Microsoft Office\Office15\Library\Analysis\ANALYS32.XLL - C:\Program Files\Microsoft Office\Office16\Library\Analysis\ANALYS32.XLL - C:\Windows\SysWOW64\sppc.dll - Microsoft.Office.Interop.VisOcx.dll - Microsoft.Office.Interop.Word.dll - Microsoft.Vbe.Interop.dll - OFFICE.DLL - - - - - - - - 0x001A0000 - c:\windows\system32\lsass.exe - - - msiexec.exe - - - chrome.exe;firefox.exe;edge.exe;browser_broker.exe;iexplore.exe - - - 0x001A0000 - c:\windows\system32\lsass.exe - - - c:\windows\system32\lsass.exe - c:\windows\system32\rundll32.exe - - - DbgUiRemoteBreakin - nacl64.exe - - - QueryProcessDebugInformationRemote - nacl64.exe - - - isdebuggerpresent - nacl64.exe - - - DebugActiveProcess - nacl64.exe - - - LoadLibrary - C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\System32\DriverStore\FileRepository\ - C:\Windows\System32\igfxEM.exe - C:\Windows\System32\igfxHK.exe - Enterprise\Common7\IDE\devenv.exe - C:\Program Files (x86)\ASUS\ROG Live Service\FileOperator.exe - C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe - - - CreateFileMapping;MapViewOfFile - - - LdrLoadDll - - - CryptAcquireContextA;CryptDecodeObjectEx;CryptImportPublicKeyInfo;CryptEncrypt;CryptGenKey;CryptDecrypt;CryptStringToBinary;CryptBinaryToString;CryptImportKey - - - c:\windows\system32\csrss.exe - CrtlRoutine - - 0B80 - 0C7C - 0C88 - c:\windows\system32\mstsc.exe - - C:\WINDOWS\SYSTEM32\ntdll.dll - EtwEventWrite - - - - - - - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe - C:\Windows\system32\audiodg.exe - C:\Windows\system32\services.exe - C:\Windows\system32\svchost.exe - C:\Windows\system32\wbem\WmiPrvSE.exe - C:\Windows\system32\wininit.exe - C:\Windows\system32\winlogon.exe - - - - - - - - - - - - - C:\Windows\System32\SHELL32.dll+9b5bd - \LocalBridge.exe - - - C:\Windows\System32\wshom.ocx+c8a0;C:\Windows\System32\wshom.ocx+c39d - - - C:\Windows\SYSTEM32\framedynos.dll+2cb3e - C:\Windows\system32\SgrmBroker.exe;C:\Windows\system32\SecurityHealthService.exe;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Windows\system32\services.exe;C:\Windows\system32\wininit.exe;C:\Windows\system32\sppsvc.exe;C:\Windows\System32\smss.exe;C:\Windows\system32\csrss.exe;C:\Windows\System32\svchost.exe - - - C:\Windows\SYSTEM32\framedynos.dll+2b496 - - - C:\Windows\SYSTEM32\dbgcore.DLL+6cfb - - - C:\Windows\System32\KernelBase.dll+de67e - - - ntdll.dll+a0044 - - - clr.dll+6c23;clr.dll+6b38 - - - C:\Windows\\SYSTEM32\ntdll.dll+;|C:\Windows\System32\KERNELBASE.dll+;|UNKNOWN( - ) - - - "UNKNOWN(;)|UNKNOWN( - ) - - - "UNKNOWN - 0x1F0FFF;0x1F1FFF;0x143A;0x1410;0x1010;0x1F2FFF;0x1F3FFF;0x1FFFFF - - - C:\Program Files;\Microsoft Office\Root\Office - \Microsoft Shared\VBA - C:\Program Files (x86)\Intuit\ - - - C:\Windows\system32\lsass.exe - 0x1FFFFF - UNKNOWN - WmiPerfClass.dll - C:\Windows\sysWOW64\wbem\wmiprvse.exe;C:\Windows\system32\wbem\wmiprvse.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe;WmiPerfClass.dll;C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files (x86)\Common Files\Adobe - - - C:\Windows\system32\lsass.exe - C:\Windows\system32\wsmprovhost.exe - - - C:\Windows\system32\lsass.exe - 0x1FFFFF - python27.dll;_ctypes.pyd;KERNELBASE.dll;ntdll.dll - - - C:\Windows\system32\lsass.exe - C:\Windows\SYSTEM32\ntdll.dll+4595c|C:\Windows\system32\KERNELBASE.dll+8185 - - - C:\Windows\system32\lsass.exe - C:\WINDOWS\SYSTEM32\ntdll.dll+ - ) - |C:\WINDOWS\System32\KERNELBASE.dll+;|UNKNOWN( - wow64.dll;)|C;Exchange.Diagnostics;Microsoft.Exchange - C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe;c:\windows\system32\inetsrv\w3wp.exe;MSExchangeHMHost.exe;C:\Windows\sysWOW64\wbem\wmiprvse.exe - - - C:\Windows\system32\winlogon.exe - 0x1F3FFF - C:\Windows\Microsoft.NET;UNKNOWN - - - .exe - C:\Windows\sysmon64.exe;C:\Windows\sysmon64.exe - 0x1C00 - - - C:\Windows\system32\lsass.exe - 0x1F1FFF - UNKNOWN - - - C:\Windows\system32\lsass.exe - 0x1010 - UNKNOWN - - - C:\Windows\system32\lsass.exe - 0x143A - UNKNOWN - - - C:\Windows\system32\lsass.exe - 0x1fffff - dbghelp.dll;dbgcore.dll - - - dbghelp.dll;dbgcore.dll - C:\Windows\system32\lsass.exe - C:\wfx32\ - - - powershell.exe - C:\Programdata\sysmon\sysmon64.exe;C:\Programdata\sysmon\sysmon.exe;C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe;\dismhost.exe - - - getasynckeystate - - - cmlua.dll - - - System.Management.Automation - C:\ProgramData\Microsoft\Windows Defender\platform\ - ctiuser.dll - C:\Program Files\Citrix\ConfigSync\ConfigSyncRun.exe - C:\Program Files\Microsoft\Exchange Server\V14\bin\ExSetupUI.exe - C:\Program Files\Microsoft\Exchange Server\V15\bin\ExSetupUI.exe - C:\Program Files\Microsoft\Exchange Server\V16\bin\ExSetupUI.exe - C:\Windows\SysWOW64\sdiagnhost.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\Temp\ExchangeSetup\ExSetupUI.exe - C:\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe - C:\Program Files\Microsoft Azure Active Directory Connect\AzureADConnect.exe - C:\Windows\system32\HOSTNAME.EXE - C:\Windows\system32\ROUTE.exe - C:\Windows\system32\query.exe - MsMpEng.exe - - - C:\Windows\system32\lsass.exe - comsvcs.dll - - - VBE7.dll;VBEUI.DLL;VBE7INTL.DLL - - - VBE6.dll;VBEUI.DLL;VBE6INTL.DLL - - - Office - verclsid.exe - VBE7.dll;VBEUI.DLL;VBE7INTL.DLL - |UNKNOWN( - 0x1FFFFF - - - C:\Program Files\Microsoft Office\Root\Office - C:\Windows\System32\KERNELBASE.dll+76516 - - - C:\Windows\System32\SHELL32.dll+ae3b9 - C:\WINDOWS\system32\sihost.exe - C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub - - UNKNOWN - - |UNKNOWN( - C:\WINDOWS\SYSTEM32\ntdll.dll+ - |C:\WINDOWS\System32\KERNELBASE.dll+ - ) - 0x1028;0x1fffff - C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git\ - - - winword.exe;excel.exe;powerpnt.exe - :\Windows\Microsoft.NET\Framework64\v2.;UNKNOWN - - - UNKNOWN - 0x147a - - - C:\Windows\Sysmon64.exe;C:\Windows\Sysmon.exe - C:\WINDOWS\system32\wbem\wmiprvse.exe - C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe - C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe;C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe;C:\Program Files (x86)\Google\Update\GoogleUpdate.exe - 0x1400 - - - 0x0800 - - 0x0810 - - 0x0820 - - 0x810 - - 0x820 - cscript.exe - wscript.exe - jjs.exe - dump - mimikatz - CorperfmontExt.dll - - - - - - wmiprvse.exe - lsass.exe - - - lsass.exe - winlogon.exe - - - - lsass.exe - C:\Windows\system32\w32tm.exe;C:\Windows\System32\ping.exe;C:\Windows\System32\net.exe;C:\Windows\System32\net1.exe;C:\Windows\SYSTEM32\HOSTNAME.EXE;C:\Programdata\sysmon\sysmon.exe;C:\Programdata\sysmon\sysmon64.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\Program Files (x86)\BeAnywhere Support Express\;C:\Program Files (x86)\CheckPoint\;C:\Program Files (x86)\Common Files\Intuit\QuickBooks\;C:\Program Files (x86)\Fortinet\;C:\Program Files (x86)\Trend Micro\;C:\Program Files\Adobe\Adobe Creative Cloud Experience\;C:\Program Files\CheckPoint\;C:\Program Files\Fortinet\;C:\Program Files\Realtek;C:\Program Files\Trend Micro\;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Program Files (x86)\Lenovo\;snmpd.exe;taskmgr;:\Windows\System32\smss.exe;:\Windows\system32\wininit.exe;\Bin\FMS.exe; \EMET_GUI.exe;\EMET_Service.exe;\Google\Update\GoogleUpdate.exe;\RAAGTAPP.EXE;\controls\cef\ConnectWise.exe;C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe;C:\Program Files\Hewlett-Packard\AMS\service\hpqams.exe;C:\Program Files\Intel\SUR\WILLAMETTE\ESRV\esrv_svc.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\WINDOWS\system32\WerFault.exe;C:\WINDOWS\system32\taskkill.exe;C:\Windows\SysWOW64\WerFault.exe;C:\Windows\System32\snmp.exe;C:\Windows\system32\msiexec.exe;C:\Windows\system32\spoolsv.exe;C:\Windows\system32\svchost.exe - - - :\Windows\system32\sppsvc.exe - :\Windows\system32\sdiagnhost.exe - - UNKNOWN(00007F - - C:\Windows\SYSTEM32\ntdll.dll - C:\Windows\SYSTEM32\win32u.dll - C:\Windows\SYSTEM32\wow64win.dll - - - - - - - - - - \TEMP\nessus_ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - solarwinds.businesslayerhost - .exe;.dll;.ps1;.mz;.jpg;.png - - - C:\WINDOWS\SysWOW64\netsetupsvc.dll - - - C:\Windows\SoftwareDistribution - C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_;.exe - .exe - - - proj - .targets - .build - .props - .tasks - .sln - .cs - - - - - - - .bat - .btm - .cmd - .com - .cmdline - .bas - .bin - C:\Windows\SysWOW64\Wbem - C:\Windows\System32\Wbem - .ws - .wsc - .wsf - .wsh - .pif - - .hta - - IronPython - .py - .pyc - .pyd - - - .cdxml - .ps1 - .ps1xml - .psc1 - .psd1 - .psm1 - .pssc - - - powershell.exe;powershell_ise.exe - - C:\Windows\SysWOW64\WindowsPowerShell - C:\Windows\System32\WindowsPowerShell - c:\Windows\System32\WindowsPowerShell\v1.0\profile - c:\Windows\Syswow64\WindowsPowerShell\v1.0\profile - \UsageLogs\powershell.exe.log - PSReadLine\ConsoleHost_history.txt - - .vbs - .oracle_jre_usage\ - .js - .jse - .vb - .vbe - .vbsript - - - - - Report.wer.tmp - \WER\ - C:\Windows\system32\wermgr.exe - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe - .exe - C:\Users - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe - .dll - C:\Users - - - - - - - - - - - !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;==READ==THIS==PLEASE==;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy - - crackmapexec - \Crypto.Cipher._AES.pyd - \Crypto.Cipher._DES.pyd - \Crypto.Hash._SHA256.pyd - \Crypto.Random.OSRNG.winrandom.pyd - \Crypto.Util.strxor.pyd - \crackmapexec.exe.manifest - \greenlet.pyd - BootStrapDLL.dll - C:\windows\temp\wininit.exe - lazycat;powerkatz;mimikatz;mimidrv;mimilove;mimilib;mimikittenz;mimiauth;invoke-mimi - rdpwrap.dll - winspool.drv - - C:\Windows\System32\Wbem - C:\Windows\SysWOW64\Wbem - C:\WINDOWS\system32\wbem\scrcons.exe - - - - - \Programs\Startup\ - \Startup\ - - - - - - - - - - - - \Word\STARTUP\ - \Microsoft\Templates\ - \Excel\XLSTART\ - .dotm - .XLSB - - - C:\Windows\Tasks\ - - - w3wp.exe - .aspx - \wwwroot\aspnet_client\ - - - w3wp.exe - .php - - - w3wp.exe - .aaa - - - \wwwroot\aspnet_client\ - .aspx;.php - - - \wwwroot\ - \wwwroot\aspnet_client\;jpg - - - .asp - \wwwroot\ - - - .aspx - \wwwroot\ - - \ecp\auth\ - \oab\auth\ - ClientAccess\Owa\ - \owa\auth\ - httpproxy\rpc\ - ClientAccess\ecp\ - \htdocs\ - - - - - - - - - - - - - - - .SPL - spoolsv.exe;printfilterpipelinesvc.exe;printisolationhost.exe;splwow64.exe;msiexec.exe;poqexec.exe - - - spoolsv.exe - .exe - C\:\Windows\System32\spool\;C\:\Windows\Temp\;C\:\Users\ - - - msiexec.exe - \Microsoft\Edge\Application - elevation_service.exe - - - - - - - - - - - - - - - - - - - - - - - - - \LocalState\rootfs\ - - - - C:\PerfLogs\ - C:\Temp\ - C:\Users\Default\ - C:\Users\Public\ - C:\Windows\Temp\ - \AppData\Temp\ - C:\WINDOWS\system32\dxgiadaptercache.exe - - $Recycle.Bin - $Recycle.Bin - - C:\Windows\ - \config\systemprofile\ - - - C:\Windows\ - \config\systemprofile\ - - - - - - - - - - - - - - - - - .chm - - - - - - - proj - .sln - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - UMWorkerProcess.exe;UMService.exe - . - .log;.cfg;.txt;cleanup;.HealthCheck;\wp.active;.db - - - - - - - - - - - - - - .7z - .7zip - .arj - .s7z - .a - .ace - .ar - .arc - .bin - .cab - .pak - .gz - .img - .iso - .lzm - .lzma - Temp\Rar$ - .rar - RarSFX - .sfx - .sz - .tar - .tar.gz - .xz - .zip - - - - - - - - - - - - - .ost - .eml - .msg - .pst - - - - - - - - - - Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք - - - - - - - Teamviewer.exe - rundll32.exe - mstsc.exe - cmd.exe - ipy.exe - WScript.exe - cscript.exe - mshta.exe - python.exe - wmic.exe - - - - - - - HiddenService - torrc - \tor.exe - tor-gencert - - - - - - - - - - - - - - - - rclone - s3browser - grabff.exe - grabff.exe - - - - - - RESTORE_;_FILES.txt - - - DECRYPT_;_FILES.txt - - - \run.dat;\task.dat;\storage.dat - AppData - Symantec - BlueJeans - - - VBoxRT.dll;VboxC.dll - - - - - - - - - - - - - - Content.IE5;INetCache - .exe;.zip;.ps1;.bat;.rar;.dll - - - MSForms.exd - - - .exe - C:\windows\system32\ - - - .exe - C:\windows\ - \system32\ - - - .dll;.exe - C:\windows\ - C:\Users\ - - - .dll;.exe - C:\Users\ - - - \Microsoft\Word\Startup\ - .wll - - - C:\windows\system32\CodeIntegrity\ - - - \Microsoft\Excel\Startup\ - .xll - - - \Microsoft\Outlook\VbaProject.OTM - - - \Microsoft\Addins\ - .xla - - - .vsto - - - .bat - C:\Windows\ - C:\ProgramData\Lenovo\SystemUpdate\sessionSE\ - - - .dll - C:\Windows\ - - - .sys - C:\Windows\ - - - .exe - C:\Windows\ - C:\Windows\System32\;C:\windows\syswow64\ - - - .exe - C:\Windows\System32\ - - - .exe - C:\Windows\SysWow64\ - - - .theme - - - \Packages\oice_ - - - VirtualboxVM.exe - - notepad++.exe - .lnk:Zone.Identifier - \UsageLogs\cscript.exe.log - \UsageLogs\mshta.exe.log - \UsageLogs\msiexec.exe.log - \UsageLogs\regsvr32.exe.log - \UsageLogs\rundll32.exe.log - \UsageLogs\svchost.exe.log - \UsageLogs\wmic.exe.log - \UsageLogs\wscript.exe.log - \regsvr32.exe.log - \UsageLogs\wsmprovhost.exe.log - .lnk - .url - - .sys - .inf - C:\Windows\SysWOW64\Drivers - C:\Windows\System32\Drivers - \Drivers\ - .drv - - .xlam - .xlsm - .xla - .xll - .xls - .xlsb - .xlsx - .xlt - .xltm - .xlw - \Microsoft\Templates\ - .eml - .msg - .pptm - .potm - .pptm - .pptm - .sldm - \Microsoft\Office\Recent - oleObject - \Downloads\ - \Content.Outlook\ - .docb - .wbk - .ped - .dot - .dotx - .doc - .docm - .docx - - .accdb - .accde - .accdr - .accdt - .mdb - .mde - .msc - .mst - .potx - .ppam - .ppsm - .ppsx - .ppt - .pptm - .pptx - .pub - .sldm - .sldx - .xls - .xps - - - - .pem - .crt - .ca-bundle - .cer - .csr - .der - .p7b - .p7r - .p7s - .pfx - .sto - .p12 - .crl - .sst - .key - - - - .hlp - ACLUI.DLL.UI - ACLUI.DLL - AFLogVw.exe - AShld.exe - AShldRes.DLL.asr - AShldRes.DLL - AhnI2.dll - CamMute.exe - CommFunc.dll - CommFunc.jax - DESqmWrapper.dll - DESqmWrapper.wrapper - FSPMAPI.dll.fsp - FSPMAPI.dll - Gadget.exe - LoLTWLauncher.exe - Mc.exe - McUtil.dll.ping - McUtil.dll.url - McUtil.dll - MpSvc.dll - MsMpEng.exe - NtUserEx.dat - NtUserEx.dat - NtUserEx.dll - NtUserEx.dll - NvSmart.exe - NvSmartMax.dll - NvSmartMax.dll - NvSmartMaxapp.dll - OInfo11.ISO - OInfo11.ocx - OInfoP11.exe - OleView.exe - OleView.exe - POETWLauncher.exe - RasTls.dll.config - RasTls.dll.msc - RasTls.dll - RasTls.exe - RunHelp.exe - Sidebar.dll.doc - Sidebar.dll - Ushata.dll - Ushata.exe - Ushata.fox - VeetlePlayer.exe - boot.ldr - chrome_frame_helper.dll.rom - chrome_frame_helper.dll - chrome_frame_helper.exe - dvcemumanager.exe - fsguidll.exe - fslapi.dll.gui - fslapi.dll - fsstm.exe - hccutils.dll.res - hccutils.dll - hha.dll.bak - hha.dll - hhc.exe - hkcmd.exe - iviewers.dll - jli.dll - libvlc.dll - mPclient.dll - mcf.ep - mcf.exe - mcupdui.exe - mcut.exe - mcutil.dll.bbc - mcvsmap.exe - msi.dll.dat - msi.dll - msseces.asm - msseces.exe - mtcReport.ktc - rc.dll - rc.exe - rc.hlp - sep_NE.exe - sep_NE.slf - tplcdclr.exe - winmm.dll - wts.chm - credwiz.exe - - ssMUIDLL.dll - aepic.dll - ftllib.dll - userenv.dll - \Terminal Server Client\Cache\ - C:\Windows\Prefetch - \\tsclient - C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ - \Temp\debug.bin - Temp\7z - C:\Windows\AppPatch\Custom - .chm - .cpl - .mht - \Chrome\User Data\Default\Extensions\ - .crx - .appref-ms - .gadget - .JSE - .exe - .scf - Exchange Server\ClientAccess\Owa\ - \Device\HarddiskVolumeShadowCopy - .zip\ - .FON - .FOT - C:\Windows\System32\GroupPolicy\Machine\Scripts - C:\Windows\System32\GroupPolicy\User\Scripts - .iqy - .ico - .isp - .msc - .manifest - MEMORY.dmp - .msi - .cs - .customDestinations-ms - C:\Windows\Minidump - .PAF - .bmc - .rdp - .rtf - .reg - .SHS - .slk - .SCR - .set - .SettingContent-ms - .SHD - .SPL - .scr - HammerDrillStatus.dll - Microsoft\Windows\WER\ - .ICL - .sdb - .SCT - .SHB - Temp\Temp1_ - - \Microsoft\;CLR_v;\UsageLogs\ - .ade - .adp - .application - .appref-ms - .asc - .bmf - .cer - .dmp - .gpg - .htm - .html - .json - .jsp - .key - .mof - .ocx - .p7b - .p12 - .pem - .pfx - .pgp - .php - .ppk - .war - .xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \Software\Microsoft\Terminal Server Client - DefaultPrinter - - - MountedDevices - Mountpoints2 - Active Setup\Installed Components - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} - - - - - - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\ - LoggedOnUser - - LastLoggedOnUser - LastLoggedOnProvider - - - - - - - HKCR\ms-msdt\ - - - HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck -
DWORD (0x00000001)
- - - - - - - - - SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - \print\ - \AzureAttestService\CoInitializeSecurityParam - C:\$WINDOWS.~BT\ - - - - \AccessVBOM - C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe - - - Security\VBAWarnings - C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe - - - Security\VBAWarnings - C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe - - - EXCEL.exe;WINWORD.exe - {8BD21D32-EC42-11CE-9E0D-00AA006002F3};{5B9D8FC8-4A71-101B-97A6-00000B65C08B} - - - - HKCU\di - - - HKCU\� - - - HKLM\SOFTWARE\Microsoft\AMSI\Providers\ - hklm\software\microsoft\windows script\settings\amsienable - hkcu\software\microsoft\windows script\settings\amsienable - - - - - - Google\Chrome\Extensions - update_url - SetValue - - - - ForcePasswordReset - - - HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC\CurrVal - - - HKLM\SAM\SAM\DOMAINS\Account\Users\ - Last Password Change - - - HKLM\SAM\SAM\DOMAINS\Account\Users\ - Account Expiration - - - HKLM\SAM\SAM\DOMAINS\Account\Users\ - Last Failed Logon - - - HKLM\SAM\SAM\Domains\Builtin\Aliases\00000220\ - - - HKLM\SAM\SAM\Domains\Builtin\Aliases\0000022B\ - - - - SOFTWARE\Microsoft\Wow64\x86\ - - SetValue - \CurrentVersion\Run\ - Add_exclusions_here - - \Microsoft\System\Scripts - \Windows\System\Scripts - HKLM\SYSTEM\Setup\CmdLine - - \Start -
DWORD (0x00000000)
- - - \Start -
DWORD (0x00000001)
- - - \Start -
DWORD (0x00000002)
- - - \Start -
DWORD (0x00000003)
- - - \Start -
DWORD (0x00000004)
- - \ImagePath - \ServiceDll - \ServiceManifest - hkcu\software\microsoft\windows nt\currentversion\windows\run\ - hkcu\software\microsoft\windows\currentversion\explorer\shell folders\common startup - hkcu\software\microsoft\windows\currentversion\explorer\shell folders\startup - hklm\software\microsoft\command processor\autorun - hkcu\software\microsoft\windows nt\currentversion\accessibility\ATs\\*(1)\StartExe - Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup - - \Print\Monitors - - - - - - - HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ - $ - CreateKey - - - HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ - $ - CreateKey - - - - HKLM\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} - C:\WINDOWS\sysmon64.exe - C:\WINDOWS\sysmon.exe - C:\Programdata\sysmon\sysmon64.exe - - - - HKCR\ - (Default) - \shell\open\command\(Default) -
URL:
- - - HKCU\Software\Classes\ - (Default) - \shell\open\command\(Default) -
URL:
- - - HKCR\ - \shell\open\command\(Default) -
%1
- - - HKCU\Software\Classes\ - \shell\open\command\(Default) -
%1
- - - \shell\open\command\DelegateExecute - - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe - - - - Session Manager\KnownDlls - - - - - Outlook\Addins - - - Word\Addins - - - Excel\Addins - - - Powerpoint\Addins - - - Software\Microsoft\VSTO\Security\Inclusion\ - - - Software\Microsoft\VSTO\SolutionMetadata\ - - - - - - - - - - - cmmgr32.exe - - - - HKLU\Software\Microsoft\Command Processor\AutoRun - HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute - HKLM\System\CurrentControlSet\Control\Session Manager\Execute - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell - HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug - HKLM\Software\Microsoft\Command Processor\AutoRun - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup - UserInitMprLogonScript - HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath - - HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages - - - - - - - - \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default) -
C:\Users\Public\;$Recyclebin;\temp\;\Desktop\;\Downloads\;\Content.Outlook\;\Microsoft\Office\
-
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
- - - \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default) -
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
- - - \ProgID\(Default);\TreatAs\(Default) - - - - \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ - Debugger;ReportingMode;MonitorProcess - - - \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ - GlobalFlag -
DWORD (0x00000200)
- - - \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ - MonitorProcess - - - \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ - ReportingMode -
DWORD (0x00000001)
- - - \Microsoft\Windows NT\CurrentVersion\SilentProcessExit - CreateKey - - - \Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules\ - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{;}\EDGEMITMP_;.tmp\setup.exe - - - - - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree - SD - Microsoft\Windows\UpdateOrchestrator - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree - ID - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks - Author - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks - Path - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks - Date - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot - - - - - - SetValue - \Environment\ - - - - - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA -
DWORD (0x00000000)
- - - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin -
DWORD (0x00000000)
- - - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop -
DWORD (0x00000000)
- - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy - \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe - exefile\shell\runas\command\isolatedCommand - - - - - - - - - - - - - \Hidden - - SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\ - $ -
DWORD (0x00000000)
- - - - - HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Parameters - C:\WINDOWS\sysmon64.exe - C:\WINDOWS\sysmon.exe - C:\Programdata\sysmon\sysmon64.exe - - - - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel - MitigationOptions;MitigationAuditOptions - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options - MitigationOptions;MitigationAuditOptions - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmcompute.exe\0\MitigationOptions - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmwp.exe\0\MitigationOptions - msiexec.exe - TiWorker.exe - - - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options - MitigationOptions;MitigationAuditOptions - C:\Program Files\Microsoft Office 15\root\integration\integrator.exe - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acro - - - - DisableTaskMgr - C:\WINDOWS\system32\svchost.exe - C:\windows\SysWOW64\svchost.exe - - - HKLM\SYSTEM\CurrentControlSet\ - \Instances\;Altitude - HKLM\System\CurrentControlSet\Services\CldFlt\Instances\CldFlt\Altitude - SetValue - - - - \Security\Level -
DWORD (0x00000001)
- - - \Security\Level -
DWORD (0x00000002)
- - - \Security\Level -
DWORD (0x00000003)
- - - \Security\Level -
DWORD (0x00000004)
- - - \Outlook\Security - - \Security\Level - - \Word\Security - \Excel\Security - \Security\Level1Remove - - \HideSCAHealth - HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring - HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride - HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting - - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ - \Enabled -
DWORD (0x00000000)
- - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ - \Enabled -
DWORD (0x00000001)
- - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ - \Enabled - - - HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging - \EnableScriptBlockLogging -
DWORD (0x00000000)
- - - HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging - \EnableScriptBlockLogging - DeleteKey;DeleteValue - - - hklm\software\microsoft\windows\currentversion\policies\system\audit - \ProcessCreationIncludeCmdLine_Enabled -
DWORD (0x00000000)
- - - hklm\software\microsoft\windows\currentversion\policies\system\audit - \ProcessCreationIncludeCmdLine_Enabled - DeleteKey;DeleteValue - - - HKLM\System\CurrentControlSet\Services\Eventlog - \CustomSD - - - HKLM\System\CurrentControlSet\Services\Eventlog - \MaxSize - - - - globallyopenports - - EnableFirewall - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List - - - - \Microsoft\.NETFramework\ETWEnabled -
DWORD (0x00000000)
- - - \Microsoft\.NETFramework\NGenAssemblyUsageLog - - - SetValue - \Environment\NGenAssemblyUsageLog - - - SetValue - \Environment\COMPlus_ETWEnabled - - - - - - - - \LastKey - - - SymbolicLinkValue - - - \Software\Microsoft\Windows\CurrentVersion\Explorer - \AppData\;\ProgramData\;\Temp\;C:\users - - - ‮ - - HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg - - - - \Software\Policies\Microsoft\SystemCertificates\;\SOFTWARE\Microsoft\EnterpriseCertificates\;HKLM\SOFTWARE\Microsoft\SystemCertificates\;HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ - CreateKey - C:\WINDOWS\Sysmon64.exe - C:\WINDOWS\Sysmon.exe - C:\WINDOWS\system32\certsrv.exe - C:\WINDOWS\system32\CompatTelRunner.exe - C:\WINDOWS\system32\svchost.exe - C:\Windows\SysWOW64\SearchProtocolHost.exe - C:\Windows\system32\SearchProtocolHost.exe - C:\Windows\system32\taskhost.exe - C:\windows\SysWOW64\svchost.exe - C:\WINDOWS\System32\DriverStore\FileRepository\asus - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe - C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe - - fDenyTSConnections - Terminal Server\WinStations\RDP-Tcp - RDP-tcp\PortNumber - Control\Terminal Server\fSingleSessionPerUser - - - - � - - - Й;ќ;Л;я;К - - - - - - - - HKLM\HARDWARE\ACPI\DSDT - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Account Name - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Display Name - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Email - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP User - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP User - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\MAPI Provider - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 User - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP User - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP Password - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName - SecurityPasswordAES - OptionsPasswordAES - SecurityPasswordExported - PermanentPassword - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - HKLM\SOFTWARE\GitForWindows - - - - - - - - - - - - - - - - - - - - - - - - - HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ - DeleteKey - - - - - - - - - - - \Services\VSS\Diag\(Default) - - - - - - - - HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters - - - HKLM\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters - - - \LastKey - - - \WinStationsDisabled - - - \TSServerDrainMode - - - \TypedURLs - - - HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\disabledcomponents - - - HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage\Bind -
Binary Data
- - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards - - - services\http\parameters\urlaclinf - - - cRecentFiles\c1\ - tDIText - - - \File MRU\Item 1 - - - HKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHash - - - HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - HKLM\Software\Microsoft\Windows\CurrentVersion\RunService - HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - CurrentVersion\Windows\Load - CurrentVersion\Windows\Run - CurrentVersion\Winlogon\Shell - CurrentVersion\Winlogon\System - \Software\Microsoft\Windows NT\CurrentVersion\Windows\load - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - SOFTWARE\Microsoft\.NETFramework\ETWEnabled - \Group Policy\Scripts - Terminal Server\Wds\rdpwd\StartupPrograms - Winlogon\AlternateShells\AvailableShells - Policies\System\Shell - Windows CE Services\AutoStartOnConnect - Windows CE Services\AutoStartOnDisconnect - PreferenceMACs\Default\extensions.settings - CurrentVersion\URL - \CurrentVersion\Font Drivers - HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown - CurrentVersion\Windows\IconServiceLib - Active Setup\Installed Components - NullSessionShares - NullSessionPipes - PasswordExpiryNotification - SafeBoot\AlternateShell - Desktop\Scrnsave.exe - \DisplayVersion - \ModifyPath - \Microsoft\Windows\CurrentVersion\Uninstall\ - \UninstallString - Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman - - \Explorer\FileExts\ - \shell\install\command\ - \ProfileImagePath - - \Classes\AllFilesystemObjects\ - \Classes\*\ - \Software\Microsoft\Ctf\LangBarAddin - \ContextMenuHandlers\ - \CurrentVersion\Shell - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers - \Classes\Directory\ - \Classes\Drive\ - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - \Classes\Folder\ - \Hidden - \HideFileExt - \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components - \SOFTWARE\Classes\Protocols\Filter - \SOFTWARE\Classes\Protocols\Handler - \SharedTaskScheduler - \ShowSuperHidden - \ColumnHandlers - \CopyHookHandlers - \ExtShellFolderViews - \PropertySheetHandlers - \ShellServiceObjectDelayLoad - \ShellServiceObjects - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ - HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand - - HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ - - \3\1809 - \3\2500 - \3\1206 - \DisableSecuritySettingsCheck - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries - HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ - \ProxyServer - SavedLegacySettings - Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy - EnableConsoleTracing - EnableFileTracing - - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ - HKLM\SOFTWARE\Microsoft\Netsh - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ - - HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - - - Office Test\ - - - \Internet Explorer\Toolbar\ - \Internet Explorer\Extensions\ - - \Browser Helper Objects\ - {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ - - \UrlUpdateInfo - \InstallSource - - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ - TamperProtection - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff - \Software\Policies\Microsoft\Windows\System\Scripts\Logoff - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon - \Software\Policies\Microsoft\Windows\System\Scripts\Logon - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup - - Domain - DHCPDefaultGateway - DhcpIPAddress - DhcpNameserver - Dhcpserver - DhcpSubnetMask - Nameserver - \DefaultGateway - PersistentRoutes - }\Category - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - SubnetMask - \Trusted Documents\TrustRecords - Software\Microsoft\VBA\7.1\Common - Software\Microsoft\VBA\7.1\Trusted - \Security\DontTrustInstalledFiles - \Security\Trusted Locations - Security\ProtectedView\DisableInternetFilesInPV - Security\ProtectedView\DisableAttachmentsInPV - Security\ProtectedView\DisableUnsafeLocationsInPV - Software\WinRAR\ArcHistory - WinZip\mru\ - Recent File List - Outlook\WebView\Inbox - Outlook\Today\UserDefinedUrl - Outlook\WebView\Calendar - \Place MRU - \LinkDate - \DriverVerVersion - \DriverVersion - \LowerCaseLongPath - \Publisher - Compatibility Assistant\Store\ - \BinProductVersion - Root\InventoryApplicationShortcut\ - Root\InventoryDriverBinary\ - Root\InventoryDeviceContainer\ - - Root\InventoryApplication\ - ProgramID;Name;Version;Publisher;Language;InstallDate;Source;RootDirPath;HiddenArp;UninstallString;RegistryKeyPath;UserSID;sha256 - - - Root\InventoryApplicationFile\ - ProgramId;FileId;LowerCaseLongPath;Name;OriginalFileName;Publisher;Version;binfileversion;LinkDate;Size;Language;USN;IsPeFile;IsOsComponent;sha256;AppxPackageFullName - - - Root\InventoryApplicationAppV\ - - - Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations - - \Explorer\MountPoints2 - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices - - HKLM\System\CurrentControlSet\services\ - \DeleteFlag -
DWORD (0x00000001)
- - - \ConsentStore\bluetooth - \ConsentStore\contacts - \ConsentStore\hunmanInterfaceDevice - \ConsentStore\location - \ConsentStore\microphone - \ConsentStore\usb\ - \ConsentStore\webcam - \ConsentStore\humanInterfaceDevice - LastVisitedMRU - SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit - \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU - HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR - HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ - HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\Microsoft\Cryptography\OID - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID - HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll - Classes\exefile\shell\runas\command\isolatedCommand - \FriendlyName - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ - \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB - HKLM\SOFTWARE\Microsoft\Tracing\ - - - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318} -
ndis;rndis
- - HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 - - \Software\AppDataLow\Software\Microsoft\ -
.exe;.dll;powershell;wmic
- - Software\Microsoft\Office test\Special\Perf - \CurrentControlSet\Services\NTDS\LsaDbExtPt - \Services\NTDS\DirectoryServiceExtPt - GoToMyPc\FileTransfer\history - GoToMyPc\GuestInvite - Filesharing - DesktopSharing - LogIncomingConnections - LogOutgoingConnections - PermanentPasswordDate - Security_Adminrights - vncviewer\MRU - Autostart_GUI - Meeting_UserName - BuddyLoginName - BuddyLoginTokenID - Always_Online - HKLM\SOFTWARE\Microsoft\CurrentVersion\Policies\System\EnableLinkedConnections - Software\recfg - \Keyboard Layout\Preload\ - \Keyboard Layout\Substitutes\ - HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ - \Client\Enabled - \Server\Enabled - Kitty\Sessions - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel - PuTTY\Sessions - Terminal Server Client\Servers - WinSCP 2\Sessions - WinSCP 2\Sessions - - - - - - - - Content.IE5;INetCache - .exe;.zip;.ps1;.bat;.rar;.vbs;.hta - - - :Zone.Identifier - blob:;about:internet - - - 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - - - Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf - - - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE - - - IMPHASH=19584675D94829987952432E018D5056 - - - IMPHASH=330768a4f172e10acb6287b87289d83b - - - - - - IMPHASH=00000000000000000000000000000000 - AppData\Local\Microsoft\Windows\AppCache\ - \Microsoft\Windows\INetCache\ - \Microsoft\Windows\Temporary Internet Files\Content.IE5 - \Mozilla\Firefox\Profiles\ - .default\prefs-1.js - Microsoft\Windows\Start Menu\Programs\Startup - - - - - - - - - - - - - - - - msagent_;\MSSE-;postex;\status_ - - - \atctl;\userpipe;\iehelper;\sdlrpc;\comnap - - - \PSEXESVC - -stdin - -stdout - - - \svcctl - - - \ntsvcs - - \9f81f59bc58452127884ce513865ed20 - \46a676ab7f179e511e30dd2dc41bd388 - tssmp_endpoint - \NamePipe_MoreWindows - \WCEServicePipe - \ahexec - \cachedumppipe - \csexec - \e710f28d59aa529d6792ca6ff0ca1b34 - \isapi_dg - \isapi_http - \isapi_http - \lsadump - \lsassw - \paexec - \pcheap_reuse - \gruntsvc - \remcom - \rpchlp_3 - \sdlrpc - \winsession - msf-pipe - \atsvc - \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc - \atctl;\userpipe;\iehelper;\sdlrpc;\comnap - \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester - - \pipe\ - CtxSharefilepipe0 - - - \winreg - Anonymous Pipe - - - - - - - ConnectPipe - - - - - lsass - \SQLLocal\RTCLOCAL - \spoolss - C:\Windows\system32\wbem\wmiprvse.exe - C:\Windows\System32\LxRun.exe - C:\Windows\System32\SearchIndexer.exe - C:\Windows\System32\smss.exe - C:\Windows\System32\spoolsv.exe - C:\Windows\System32\wininit.exe - C:\Windows\system32\DFSRs.exe - C:\Windows\SystemApps\Microsoft.Windows - - C:\Windows\Microsoft.NET\Framework - \ngen.exe - - - C:\Windows\SystemApps\ShellExperienceHost_ - \ShellExperienceHost.exe - - C:\Windows\system32\SearchProtocolHost.exe - \System - ProtectedPrefix\LocalService\FTHPIPE - - Exchange Server - - C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\BIN\OWSTIMER.EXE - C:\Windows\syswow64\snmp.exe - c:\windows\system32\inetsrv\w3wp.exe - \M.E.C.Core.WinRMDataCommunicator.NamedPipe. - - C:\Windows\system32\dns.exe - - \sql\query - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe - \TDLN- - vmware- - \InitShutdown - \MsFteWds - \W32TIME_ALT - \WiFiNetworkManagerTask - \Winsock2CatelogChangeListener - \browser - \epmapper - \eventlog - \scerpc - \wkssvc - \ntapvsrq - Anonymous Pipe - - - - - - - - - - Created - - - - - - - type: 16;type: 16 - powershell.exe - - - github - powershell.exe - - - powershell;cscript.exe;wscript.exe;mshta.exe;bitsadmin.exe;\cmd.exe - . - - - dropboxapi.com - \Dropbox\Client\Dropbox.exe;\Dropbox\bin\Dropbox.exe;\Oracle\Java\ - - - 1drv - \AppData\Local\Microsoft\OneDrive\OneDrive.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe;\Internet Explorer\iexplore.exe;C:\Windows\System32\AppHostRegistrationVerifier.exe;C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe;C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe;C:\Program Files\Mozilla Firefox\firefox.exe - - - .box.com;upload - - - mega.nz;mega.co.nz - - - privatlab.com - - - thedoccloud.com;deftsecurity.com;websitetheme.com;highdatabase.com;incomeupdate.com;zupertech.com;panhardware.com;databasegalore.com;avsvmcloud.com;freescanonline.com - - - tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat - - - efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet - - - .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com - - - - 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.nimpool.io;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool;analytics.blue;estream.to - - graph.microsoft.com - dl.dropboxusercontent.com - api.onedrive.com - zoom.us - teamviewer - Screenconnect - - - census - researchscan - scanhub - shadow - shodan - - .download - .kp - .su - .ss - .xn - .sy - .ve - .xxx - .cn - .click - .club - .ir - .ru - .host - .icu - .pw - .website - .ninja - .rocks - .top - .ua - .xyz - - - kuternull.com;rimrun.com;0ffice36o;asushotfix;infestexe;rahasn.webhop.org;rahasn.akamake.net;rahasn.homewealth.biz;winodwsupdates;israirairlines - - githubusercontent.com;github.com - - api.ipify.org;whatismyipaddress.com;edns.ip-api.com;checkip.dyndns.org;icanhazip.com;ifconfig.me;ifconfig.co;ipaddress.com;ipecho.net;ident.me;api.ip.sb;www.myexternalip.com;ip.anysrc.net;wtfismyip.com;myexternalip.com;ipecho.net;checkip.amazonaws.com;goo.gl;git.io;bit.ly;ow.ly;ip-api.com - - tiny-share.com;paste.ee;pastebin.com - - afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com - darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org - adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk - gc._msdcs. - _kerberos._tcp.dc._msdcs. - _kerberos._udp.dc._msdcs. - _ldap._tcp.pdc._msdcs. - wpad - - _ldap. - C:\Windows\ - unknown process - C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe - - - System;svchost.exe;services.exe;unknown process;\;; - - - - - - C:\Program Files (x86)\Admin Arsenal\ - C:\Program Files (x86)\CheckPoint\ - C:\Program Files (x86)\Fortinet\ - C:\Program Files (x86)\OpenDNS\OpenDNS Connector - C:\Program Files (x86)\Razer\Razer Services\ - C:\Program Files (x86)\Trend Micro\ - C:\Program Files (x86)\VMware - C:\Program Files (x86)\Veeam\ - C:\Program Files\CheckPoint\ - C:\Program Files\Trend Micro\ - Slack.exe - \controls\cef\ConnectWise.exe - git-remote-https.exe - C:\Program Files (x86)\Enpass\Enpass.exe - C:\Program Files (x86)\Fiserv\Vision\VisionGUI.NET.exe - C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe - C:\Program Files (x86)\Lenovo\System Update\Tvsukernel.exe - C:\Program Files\VMware\vCenter Server\jre\bin\java.exe - C:\Program Files\VMware\vCenter Server\python\python.exe - C:\Windows\SysWOW64\SearchProtocolHost.exe - C:\Windows\System32\dsregcmd.exe - C:\Windows\sysmon64.exe - C:\Windows\sysmon.exe - brave-sync.s3.dualstack. - .salesforceliveagent.com - ads-serve.brave.com - - .msftncsi.com - ..localmachine - - -pushp.svc.ms - .b-msedge.net - .bing.com - .hotmail.com - .live.com - .live.net - .microsoft.com - .microsoftonline.com - .microsoftstore.com - .ms-acdc.office.com - .msedge.net - .msn.com - .msocdn.com - .s-microsoft.com - .skype.com - .skype.net - .windows.com - .windows.net.nsatc.net - .windowsupdate.com - .xboxlive.com - login.windows.net - - .activedirectory.windowsazure.com - .msauth.net - .msftauth.net - .opinsights.azure.com - management.azure.com - outlook.office365.com - portal.azure.com - - .mozaws.net - .mozilla.com - .mozilla.net - .mozilla.org - .spotify.com - .spotify.map.fastly.net - googleapis.com - clients1.google.com - clients2.google.com - clients3.google.com - clients4.google.com - clients5.google.com - clients6.google.com - cloudsearch.googleapis.com - id.google.com - safebrowsing.googleapis.com - www.googleapis.com - - .akadns.net - .netflix.com - .typekit.net - aspnetcdn.com - ajax.googleapis.com - cdnjs.cloudflare.com - cdnjs.cloudflare.com - fonts.googleapis.com - - .steamcontent.com - - .disqus.com - .fontawesome.com - disqus.com - - .1rx.io - .2mdn.net - .adadvisor.net - .adap.tv - .addthis.com - .adform.net - .adnxs.com - .adroll.com - .adrta.com - .adsafeprotected.com - .adsrvr.org - .advertising.com - .amazon-adsystem.com - .amazon-adsystem.com - .analytics.yahoo.com - .aol.com - .betrad.com - .bidswitch.net - .casalemedia.com - .chartbeat.net - .cnn.com - .convertro.com - .criteo.com - .criteo.net - .crwdcntrl.net - .demdex.net - .domdex.com - .dotomi.com - .doubleclick.net - .doubleverify.com - .emxdgt.com - .exelator.com - .google-analytics.com - .googleadservices.com - .googlesyndication.com - .googletagmanager.com - .googlevideo.com - .gstatic.com - .gvt1.com - .gvt2.com - .ib-ibi.com - .jivox.com - .mathtag.com - .moatads.com - .moatpixel.com - .mookie1.com - .myvisualiq.net - .netmng.com - .nexac.com - .nexac.com - .openx.net - .optimizely.com - .outbrain.com - .pardot.com - .phx.gbl - .pinterest.com - .pubmatic.com - .quantcount.com - .quantserve.com - .revsci.net - .rfihub.net - .rlcdn.com - .rubiconproject.com - .scdn.co - .scorecardresearch.com - .serving-sys.com - .sharethrough.com - .simpli.fi - .sitescout.com - .smartadserver.com - .snapads.com - .spotxchange.com - .taboola.com - .taboola.map.fastly.net - .tapad.com - .tidaltv.com - .trafficmanager.net - .tremorhub.com - .tribalfusion.com - .turn.com - .twimg.com - .tynt.com - .w55c.net - .ytimg.com - .zorosrv.com - ads.yahoo.com - 1rx.io - adservice.google.com - ampcid.google.com - clientservices.googleapis.com - d29x207vrinatv.cloudfront.net - googleadapis.l.google.com - imasdk.googleapis.com - l.google.com - ml314.com - mtalk.google.com - update.googleapis.com - www.googletagservices.com - - .pscp.tv - - adsniper.ru - cdnvideo.ru - chat.minergate.com - cwsa.minergate.com - forum.minergate.com - leadlab.click - mc.yandex.ru - pool.ntp.org - vmg.host - yandex.ru - .adobe.com - .autodesk.com - .avast.com - .avcdn.net - .cdn.bitdefender.net - .digicert.com - .eset.com - .globalsign.com - .globalsign.net - .intuit.com - .java.com - .macromedia.com - .oracle.com - .quickbooks.com - .usertrust.com - amazontrust.com - ocsp.identrust.com - pki.goog - ads.playground.xyz - citrixupdates.cloud.com - forticlient.fortinet.net - mft10.onbaseonline.com - msocsp.com - ocsp.comodoca.com - ocsp.cybertrust.ne.jp - ocsp.entrust.net - ocsp.entrust.net - ocsp.godaddy.com - ocsp.int-x3.letsencrypt.org - ocsp.intel.com - ocsp.msocsp.com - ocsp.quovadisglobal.com - ocsp.quovadisoffshore.com - ocsp.sectigo.com - ocsp.starfieldtech.com - ocsp.thawte.com - ocsp.trustwave.com - ocsp.verisign.com - pki-goog.l.google.com - pki.intel.com - scrootca1.ocsp.secomtrust.net - scrootca2.ocsp.secomtrust.net - stats.anchor.host - status.rapidssl.com - status.thawte.com - ts-ocsp.ws.symantec.com - upgrade.bitdefender.com - - - - - - - - - - - - - - - - - .;>;unknown;anonymous - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Symantec\ - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files\Symantec\ - - - - - - - \BHO\ie_to_edge_stub.exe;\Microsoft\Teams\;\Vivaldi\Application\;Google\Chrome\;Google\Update;BraveSoftware\Brave-Browser\;Edge\Application\;EdgeUpdate\Install\;Program Files\SmartGit\ - - - - - - - - - - - \appdata\local\google\chrome\user data\swreporter\;software_reporter_tool.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - NETWORK SERVICE; LOCAL SERVICE - - - - - - - OUTLOOK.exe;WINWORD.exe;EXCEL.EXE;powerpnt.exe;msaccess.exe;mspub.exe;eqnedt32.exe;visio.exe;wordpad.exe;wordview.exe;msohtmed.exe;lync.exe;teams.exe - :\Program Files\Microsoft Office\;:\Program Files (x86)\Microsoft Office\ - - - w3wp.exe;tomcat;apache;nginx;httpd - whitelist_me_here - - - powershell.exel;powershell_ise.exe - whitelist_me_here - - - .exe - .pdf;.doc;.xls;.doc;.ppt;.txt;.rtf;.htm;.iso;.zip;.rar;.7z - - - psexesvc - psexec - - - wmiprvse.exe - - - C:\Users\Public\ - amdsfhdcd.bin - intuit - - - AcroRd32.exe;notepad.exe;mshta.exe;hh.exe;certutil.exe;certoc.exe;certreq.exe;desktopimgdownldr.exe;esentutl.exe;finger.exe;presentationhost.exe;cscript.exe;wscript.exe;mspaint.exe;RdrCEF.exe - - - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 - IMPHASH=3A19059BD7688CB88E70005F18EFC439 - IMPHASH=bf6223a49e45d99094406777eb6004ba - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF - IMPHASH=4C1B52A19748428E51B14C278D0F58E3 - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A - IMPHASH=672B13F4A0B6F27D29065123FE882DFC - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 - IMPHASH=D21BBC50DCC169D7B4D0F01962793154 - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC - IMPHASH=6118619783FC175BC7EBECFF0769B46E - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA - IMPHASH=563233BFA169ACC7892451F71AD5850A - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 - IMPHASH=13F08707F759AF6003837A150A371BA1 - IMPHASH=1781F06048A7E58B323F0B9259BE798B - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 - IMPHASH=713C29B396B907ED71A72482759ED757 - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E - IMPHASH=8B114550386E31895DFAB371E741123D - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 - IMPHASH=9D68781980370E00E0BD939EE5E6C141 - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE - IMPHASH=CB567F9498452721D77A451374955F5F - IMPHASH=730073214094CD328547BF1F72289752 - IMPHASH=17B461A082950FC6332228572138B80C - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 - IMPHASH=819B19D53CA6736448F9325A85736792 - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 - IMPHASH=0588081AB0E63BA785938467E1B10CCA - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 - IMPHASH=4DA924CF622D039D58BCE71CDF05D242 - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E - IMPHASH=E6F9D5152DA699934B30DAAB206471F6 - IMPHASH=3AD59991CCF1D67339B319B15A41B35D - IMPHASH=FFDD59E0318B85A3E480874D9796D872 - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 - IMPHASH=0E2216679CA6E1094D63322E3412D650 - IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB - IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 - IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 - IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 - IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F - IMPHASH=767637C23BB42CD5D7397CF58B0BE688 - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC - IMPHASH=7D010C6BB6A3726F327F7E239166D127 - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F - IMPHASH=5834ED4291BDEB928270428EBBAF7604 - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 - IMPHASH=3DE09703C8E79ED2CA3F01074719906B - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F - IMPHASH=E96A73C7BF33A464C510EDE582318BF2 - IMPHASH=32089B8851BBF8BC2D014E9F37288C83 - IMPHASH=09D278F9DE118EF09163C6140255C690 - IMPHASH=03866661686829D806989E2FC5A72606 - IMPHASH=E57401FBDADCD4571FF385AB82BD5D6D - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE - IMPHASH=19584675D94829987952432E018D5056 - IMPHASH=330768A4F172E10ACB6287B87289D83B - - - \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll - - - certutil.exe - certoc.exe - CertReq.exe - - Desktopimgdownldr.exe - esentutl.exe - - finger.exe - presentationhost.exe - - - bitsadmin.exe - C:\Windows;$WINDOWS.;\SoftwareDistribution\ - System - TrustedInstaller;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC - - - \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll - - - - - \ No newline at end of file From 42fcf2af39cbe82b374a87b9e76422634b30c2f0 Mon Sep 17 00:00:00 2001 From: cyberkryption Date: Sun, 25 Sep 2022 15:37:26 +0100 Subject: [PATCH 366/471] Delete sysmonconfig-cyberkryption.xml --- sysmonconfig-cyberkryption.xml | 6208 -------------------------------- 1 file changed, 6208 deletions(-) delete mode 100644 sysmonconfig-cyberkryption.xml diff --git a/sysmonconfig-cyberkryption.xml b/sysmonconfig-cyberkryption.xml deleted file mode 100644 index 0e7633fa..00000000 --- a/sysmonconfig-cyberkryption.xml +++ /dev/null @@ -1,6208 +0,0 @@ - - - md5,sha256,imphash - - - - - - - - - TEMP\nessus_;nessus_task_list - TEMP\nessus_;nessus_task_list - - - rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe - advanced_port_scanner.exe;rcpping.exe;nc.exe;nc64.exe;netcat.exe;ncat.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe - Network Scanner;Advanced IP Scanner - - - adfind - adfind - -gcb -sc;/gcb /sc;-f (objectcategory=;/f (objectcategory=;trustdmp - - - - - - - - - - - - - - PurpleSharp;xyz123456 - PurpleSharp - - - - - /serverlevelplugindll - - - add;sslcert;http - - http del sslcert - - - - - - - C:\Users\ - Content.Outlook - - - .SettingContent-ms - immersivecontrolpanel - - - .doc.exe - .docx.exe - .docx.exe - .xls.exe - .xlsx.exe - .ppt.exe - .pptx.exe - .rtf.exe - .pdf.exe - .txt.exe - .exe - ______.exe - - - Hwp.exe - gbb.exe - - - - - svchost.exe;termsvcs - rdpclip.exe;csrss.exe;wininit.exe - - - dns.exe - werfault.exe;conhost.exe;dnscmd.exe;dns.exe - - - UMWorkerProcess.exe;UMService.exe - perfenabled - - - UMWorkerProcess.exe;UMService.exe - perfenabled - wemgr.exe;werfault.exe - - - \wwwroot\ - - - \Atlassian\Confluence\jre\bin\java.exe - cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin - - - \jre\bin\java.exe - cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe - - \Atlassian\Confluence\jre\bin\java.exe - - - keytool.exe - cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe - - - bash.exe;cmd.exe;powershell.exe;pwsh.exe - id -Gn `;id /Gn `;id -Gn ';id /Gn ' - - - - e=Access&;y=Guest&;&p=;&c=;&k= - - - - - - - - - - - wmic.exe - process;call;create - - - wmic.exe - call set priority;call terminate;product get name;bios, get serialNumber;BIOS GET SERIALNUMBER;onboarddevice get;useraccount where name;useraccount get;path win32_networkadapter where index=;process list;useraccount get /ALL;useraccount list;qfe get description,installedOn /format:csv;process get caption,executablepath,commandline;service get name,displayname,pathname,startmode;share list;win32_share - - - - C:\Users\;$Recycle;\Temp\;\Downloads\ - \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 - conhost.exe - - - svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe - conhost.exe - - - conhost.exe - :\Windows\splwow64.exe;:\Windows\System32\WerFault.exe;:\Windows\System32\conhost.exe - - - - cmd.exe - powershell.exe;powershell_ise.exe - Get-ItemProperty HKLM:\software\wow6432node\microsoft\windows\currentversion\uninstall\ - mysql server - select-object displayversion,displayname - - - cscript.exe;wscript.exe - powershell.exe;powershell_ise.exe - - - cscript.exe;wscript.exe - powershell.exe;powershell_ise.exe - - - powershell.exe;powershell_ise.exe - mshta.exe - - - wscript.exe;cscript.exe - IEX;Net.WebClient;ospp.vbs;powershell;slmgr.vbs;spiceworks_upload - - - wscript.exe - .jse - .js - .vba - .vbe - - - cscript.exe - .js - .jse - .vba - .vbe - - - mshta vbscript:CreateObject("Wscript.Shell");mshta vbscript:Execute("Execute;mshta vbscript:CreateObject("Wscript.Shell").Run("mshta.exe;javascript:a= - .jpg;.png;.lnk;.xls;.doc;.zip;.sct;.hta - - - C:\Windows\Temp\hpqhvind.exe;C:\ProgramData\DRM\;Test.exe - C:\ProgramData\DRM;wmplayer.exe;C:\ProgramData\DRM\CLR\CLR.EXE - - - regedit.exe - explorer.exe - - - - svchost.exe;taskhostw.exe;userinit.exe;smss.exe;csrss.exe;wininit.exe;winlogon.exe;lsass.exe;logonui.exe;services.exe - C:\windows\System32\;C:\windows\syswow64\ - wininit.exe;winlogon.exe;services.exe;dwm.exe;System;smss.exe;svchost.exe - - - \spoolsv.exe;\PrintIsolationHost.exe - C:\Windows\System32\spoolsv.exe;\GPLGS\gswin32c.exe;C:\Windows\System32\spool\drivers\;\bin\gswin64c.exe;C:\PROGRA~2\CUTEPD~1\;C:\Windows\EEFPrinter.exe - C:\Windows\system32\spool\DRIVERS - Brother Industries;Thomson Reuters - - COMSPEC - ScriptFile - AppData\Local\Temp\7z - AppData\Local\Temp\Temp1_ - \AppData\Local\Temp\Rar$ - - - powershell.exe;powershell_ise.exe - C:\users\ - Microsoft VS Code\Code.exe - \Deployment tool extract\setupodt.exe - - Shellcode - - ipy.exe - python.exe - - -agentpath: - -agentlib: - - - - - iexplore.exe;chrome.exe;firefox.exe;browser_broker.exe;vivaldi.exe;microsoftedge.exe;microsoftedgecp.exe;brave.exe;vivaldi.exe - tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe - apt-config - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe - tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe - .cmd;- - C:\Windows\system32\spool\DRIVERS\ - PhotoViewer.dll - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe - C:\Users\ - .exe - Zoom Video - Firefox - Microsoft Edge - Microsoft Teams - GrammarlyAddInSetupe - Teams.exe - Zoom.exe - browser_broker.exe - chrome.exe - edge.exe - firefox.exe - iexplore.exe - vivaldi.exe - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe - C:\ProgramData\ - Firefox - Microsoft Edge - Microsoft Teams - Zoom Video - - - acrobat.exe;acrord32.exe - tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe - - - apache;w3wp.exe;php-cgi.exe;nginx.exe;httpd.exe;tomcat;php.exe - arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe - - - cmd.exe - ping 127.0.0.1 - c:\windows\system32\inetsrv\ - - - sqlservr - arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;sh.exe;bash.exe - - - winword.exe;powerpnt.exe;excel.exe - control.exe - input.dll - - - msdt.exe - msdt.exe - BrowseForFile=;PCWDiagnostic - /af;-af - - - msdt.exe - pcwrun.exe - PCWDiagnostic - /af;-af - - - msdt.exe - /cab;-cab - .diagcab - - - powershell.exe;pwsh.exe;cmd.exe;mshta.exe;cscript.exe;wscript.exe;wsl.exe;rundll32.exe;regsvr32.exe - msdt.exe - - EQNEDT32.EXE - - winword.exe;excel.exe;powerpnt.exe - FLTLDR.EXE - - - /dde;-dde - - - - schtasks.exe - /create;-create;/change;-change - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - - taskeng.exe - - schtasks.exe - /Run;-run - Sentinel\AutoRepair - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - - - schtasks.exe - - at.exe - at.exe - - C:\Windows\System32\svchost.exe - netsvcs;-p;-s;Schedule - netsvcs;-p;-s;Schedule - - - - - - net.exe;net1.exe;net2.exe - stop - tvsu_tmp - - - net.exe;net1.exe;net2.exe - start - tvsu_tmp - - - wmiprvse.exe;mmc.exe;explorer.exe;services.exe - &1;cmd.exe;\\127.0.0.1\;/Q /c - - - wmiprvse.exe;mmc.exe;explorer.exe;services.exe - &1;cmd.exe;\\127.0.0.1\;-Q -c - - - schtasks;Create;ONLOGON;TN;Updater;TR;powershell - - - sc.exe - create - \NIC_Emulex_Firmware\;C:\Windows\Temp\ExchangeSetup\ - - - sc.exe - config;binpath - - - cmd.exe;powershell.exe - services.exe - - new-service - psexesvc.exe - - Execute processes remotely - psexe - PsExec Service - PsExec Launched - - - accepteula - - - Execute processes remotely - -s;/s - - psexec.exe - pskill.exe - pskill - - C:\WINDOWS\system32\svchost.exe;RPCSS - - - - && type - > - cmd.exe" /c cd - - - ntdsutil;/set {default} recoveryenabled no;telnet ;-dumpcr;putty;bash.exe;pssh;shareenum;sekurlsa;reg save;reg save;psscan;shellexec;vbscript:createobject;/output:clipboard;root\\default;root\\subscription;Wmiclass;WmiCl'+'as'+'s - - - ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy - ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy - - --disable-http2 --disable-quic - /Client/Login?id= - JABzA - - - 2f40abbb4f78e77745f0e657a19903fc953cc664;478dc5a5f934c62a9246f7d1fc275868f568bc07;37b4496e650b3994312c838435013560b3ca8571;37b4496e650b3994312c838435013560b3ca8571;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;807d86da63f0db1fc746d1f0b05bc357;849a2b0dc80aeca3d175c139efe5221c;86A4CAC227078B9C95C560C8F0370BF0;98908ce6f80ecc48628c8d2bf5b2a50c;a4b42c2c95d1f2ff12171a01c86cd64f;4abe604916c04fe3dd8b9cb3d501d3f;eac3e3ece94bc84e922ec077efb15edd;128CECC59C91C0D0574BC1075FE7CB40;88777aacd5f16599547926a4c9202862;0f49621b06f2cdaac8850c6e9581a594;17a36ac3e31f3a18936552aff2c80249;322cb39bc049aa69136925137906d855;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;3d129263f6a48647f103a04446fb0c2f;37cd353621b0f4fc6981b50071c94f01;1b60021baedc3f9201bcdb40e9b87f62;71345b139166482acaa568ac8816c7bc;5E022694C0DBD1FBBC263D608E577949;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc5733c013378fa418d13773f5bfe6f1;c579341f86f7e962719c7113943bb6e4;d326e629a90e78825645963b35e53a6a;5E022694C0DBD1FBBC263D608E577949;53841a0c6a3ff92976db08bfdf95e083;dc7e564809d6c2a2f3457c3c9b91f22b;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b;FE2CA1BE3BDA2A757036A89E54CC02DB;FE2CA1BE3BDA2A757036A89E54CC02DB - - 22d142f11cf2a30ea4953e1fffb0fa7e;2317d65da4639f4246de200650a70753;27612cb03c89158225ca201721ea1aad;412956675fbc3f8c51f438c1abc100eb;daf2da52475fd8981b19ec3c321a983c;490a140093b5870a47edc29f33542fd2;51a7068640af42c3a7c1b94f1c11ab9d;533340c54bd25256873b3dca34d7f74e;684eca6b62d69ce899a3ec3bb04d0a5b;69a19abf5ba56ee07cdd3425b07cf8bf;6cfd131fef548fcd60fbcdb59317df8e;72dc98449b45a7f1ccdef27d51e31e91;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;80c37e062aa4c94697f287352acf2e9d;815f1f8a7bc1e6f94cb5c416e381a110;a43d3b31575846fa4c3992b4143a06da;08e82dc7bae524884b7dc2134942aadb;7bcd736a2394fc49f3e27b3987cce640;57314359df11ffdf476f809671ec0275;b72737b464e50aa3664321e8e001ff32;ce8ce92fb6565181572dce00d69c24f8;5985087678414143d33ffc6e8863b887;84730a6e426fbd3cf6b821c59674c8a0;d5377dc1821c935302c065ad8432c0d2;d8f1356bebda9e77f480a6a60eab36bb;92f8e3f0f1f7cc49fad797a62a169acd;9003cfaac523e94d5479dc6a10575e60;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;c1e7850da5604e081b9647b58248d7e8;99828721ac1a0e32e4582c3f615d6e57;f559c87b4a14a4be1bd84df6553aaf56;b9c208ea8115232bfd9ec2c62f32d6b8;061089d8cb0ca58e660ce2e433a689b3;0e9afd3a870906ebf34a0b66d8b07435;9c115e9a81d25f9d88e7aaa4313d9a8f;520ee02668a1c7b7c262708e12b1ba6b;7bfba2c69bed6b160261bdbf2b826401;77a745b07d9c453650dd7f683b02b3ed;3a771efb7ba2cd0df247ab570e1408b2;0969b2b399a8d4cd2d751824d0d842b4;fc53f2cd780cd3a01a4299b8445f8511;4e39620afca6f60bb30e031ddc5a4330;bfe3f6a79cad5b9c642bb56f8037c43b;3dfebce4703f30eed713d795b90538b5;9793afcea43110610757bd3b800de517;36db24006e2b492cafb75f2663f241b2;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;649ef1dd4a5411d3afcf108d57ff87af;320b2f1d9551b5d1df4fb19bd9ab253a;3d75c72144d873b3c1c4977fbafe9184;b9cf4301b7b186a75e82a04e87b30fe4;b4e67706103c3b8ee148394ebee3f268;7bfbd72441e1f2ed48fbc0f33be00f24;cdb303f61a47720c7a8c5086e6b2a743;2a6f7ec77ab6bd4297e7b15ae06e2e61;8403a28e0bffa9cc085e7b662d0d5412;3ffd2915d285ad748202469d4a04e1f5;04078ef95a70a04e95bda06cc7bec3fa;235d427f94630575a4ea4bff180ecf5d;8035a8a143765551ca7db4bc5efb5dfd;cacaa3bf3b2801956318251db5e90f3c;1aadf739782afcae6d1c3e4d1f315cbd;c3e255888211d74cc6e3fb66b69bbffb;d9e9f22988d43d73d79db6ee178d70a4;16ab79fb2fd92db0b1f38bedb2f02ed8;8da15a97eaf69ff7ee184fc446f19cf1;ffc7305cb24c1955f9625e525d58aeee;c0e72eb4c9f897410c795c1b360090ef;9ad6fa6fdedb2df8055b3d30bd6f64f1;44619a88a6cff63523163c6a4cf375dd;a571660c9cf1696a2f4689b2007a12c7;81229c1e272218eeda14892fa8425883;0ac48cfa2ff8351365e99c1d26e082ad;afcdf79be1557326c854b6e20cb900a7 - a53a02b997935fd8eedcb5f7abab9b9f - e96a73c7bf33a464c510ede582318bf2 - serialfunc.exe - - e PAA;en PAA;enc PAA;enco PAA;encode PAA;encoded PAA;encodedco PAA;encodedcom PAA;encodedcomm PAA;encodedcomma PAA;encodedcomman PAA;encodedcommand PAA;e IAA;en IAA;enc IAA;enco IAA;encode IAA;encoded IAA;encodedco IAA;encodedcom IAA;encodedcomm IAA;encodedcomma IAA;encodedcomman IAA;encodedcommand IAA;e JAB;en JAB;enc JAB;enco JAB;encode JAB;encoded JAB;encodedco JAB;encodedcom JAB;encodedcomm JAB;encodedcomma JAB;encodedcomman JAB;encodedcommand JAB;e cwBFAFQA;en cwBFAFQA;enc cwBFAFQA;enco cwBFAFQA;encode cwBFAFQA;encoded cwBFAFQA;encodedco cwBFAFQA;encodedcom cwBFAFQA;encodedcomm cwBFAFQA;encodedcomma cwBFAFQA;encodedcomman cwBFAFQA;encodedcommand cwBFAFQA;e SQBFAF;en SQBFAF;enc SQBFAF;enco SQBFAF;encode SQBFAF;encoded SQBFAF;encodedco SQBFAF;encodedcom SQBFAF;encodedcomm SQBFAF;encodedcomma SQBFAF;encodedcomman SQBFAF;encodedcommand SQBFAF;e UwBFAFQA;en UwBFAFQA;enc UwBFAFQA;enco UwBFAFQA;encode UwBFAFQA;encoded UwBFAFQA;encodedco UwBFAFQA;encodedcom UwBFAFQA;encodedcomm UwBFAFQA;encodedcomma UwBFAFQA;encodedcomman UwBFAFQA;encodedcommand UwBFAFQA;e IABpAE4AdgBPAEsAZQAt;en IABpAE4AdgBPAEsAZQAt;enc IABpAE4AdgBPAEsAZQAt;enco IABpAE4AdgBPAEsAZQAt;encode IABpAE4AdgBPAEsAZQAt;encoded IABpAE4AdgBPAEsAZQAt;encodedco IABpAE4AdgBPAEsAZQAt;encodedcom IABpAE4AdgBPAEsAZQAt;encodedcomm IABpAE4AdgBPAEsAZQAt;encodedcomma IABpAE4AdgBPAEsAZQAt;encodedcomman IABpAE4AdgBPAEsAZQAt;encodedcommand IABpAE4AdgBPAEsAZQAt;e SQBmACgAJAB;en SQBmACgAJAB;enc SQBmACgAJAB;enco SQBmACgAJAB;encode SQBmACgAJAB;encoded SQBmACgAJAB;encodedco SQBmACgAJAB;encodedcom SQBmACgAJAB;encodedcomm SQBmACgAJAB;encodedcomma SQBmACgAJAB;encodedcomman SQBmACgAJAB;encodedcommand SQBmACgAJAB;e J;en J;enc J;enco J;encode J;encoded J;encodedco J;encodedcom J;encodedcomm J;encodedcomma J;encodedcomman J;encodedcommand J;e SUVY;en SUVY;enc SUVY;enco SUVY;encode SUVY;encoded SUVY;encodedco SUVY;encodedcom SUVY;encodedcomm SUVY;encodedcomma SUVY;encodedcomman SUVY;encodedcommand SUVY;e aWV4;en aWV4;enc aWV4;enco aWV4;encode aWV4;encoded aWV4;encodedco aWV4;encodedcom aWV4;encodedcomm aWV4;encodedcomma aWV4;encodedcomman aWV4;encodedcommand aWV4;e dmFy;en dmFy;enc dmFy;enco dmFy;encode dmFy;encoded dmFy;encodedco dmFy;encodedcom dmFy;encodedcomm dmFy;encodedcomma dmFy;encodedcomman dmFy;encodedcommand dmFy;e dgBhA;en dgBhA;enc dgBhA;enco dgBhA;encode dgBhA;encoded dgBhA;encodedco dgBhA;encodedcom dgBhA;encodedcomm dgBhA;encodedcomma dgBhA;encodedcomman dgBhA;encodedcommand dgBhA;e R2V0;en R2V0;enc R2V0;enco R2V0;encode R2V0;encoded R2V0;encodedco R2V0;encodedcom R2V0;encodedcomm R2V0;encodedcomma R2V0;encodedcomman R2V0;encodedcommand R2V0;e IAAgAH;en IAAgAH;enc IAAgAH;enco IAAgAH;encode IAAgAH;encoded IAAgAH;encodedco IAAgAH;encodedcom IAAgAH;encodedcomm IAAgAH;encodedcomma IAAgAH;encodedcomman IAAgAH;encodedcommand IAAgAH;e TVq;en TVq;enc TVq;enco TVq;encode TVq;encoded TVq;encodedco TVq;encodedcom TVq;encodedcomm TVq;encodedcomma TVq;encodedcomman TVq;encodedcommand TVq;e aQBIA;en aQBIA;enc aQBIA;enco aQBIA;encode aQBIA;encoded aQBIA;encodedco aQBIA;encodedcom aQBIA;encodedcomm aQBIA;encodedcomma aQBIA;encodedcomman aQBIA;encodedcommand aQBIA;e UEs;en UEs;enc UEs;enco UEs;encode UEs;encoded UEs;encodedco UEs;encodedcom UEs;encodedcomm UEs;encodedcomma UEs;encodedcomman UEs;encodedcommand UEs;e H4s;en H4s;enc H4s;enco H4s;encode H4s;encoded H4s;encodedco H4s;encodedcom H4s;encodedcomm H4s;encodedcomma H4s;encodedcomman H4s;encodedcommand H4s;e dXNpbm;en dXNpbm;enc dXNpbm;enco dXNpbm;encode dXNpbm;encoded dXNpbm;encodedco dXNpbm;encodedcom dXNpbm;encodedcomm dXNpbm;encodedcomma dXNpbm;encodedcomman dXNpbm;encodedcommand dXNpbm;e cwBhA;en cwBhA;enc cwBhA;enco cwBhA;encode cwBhA;encoded cwBhA;encodedco cwBhA;encodedcom cwBhA;encodedcomm cwBhA;encodedcomma cwBhA;encodedcomman cwBhA;encodedcommand cwBhA;JABzA - - - FromBase64String - JAB;SUVY;aWV4;dmFy;dgBhA;R2V0;SQBFAF;TVq;aQBIA;UEs;H4s;dXNpbm;cwBhA - - - /v Word experienced;/v Excel experienced;-v Word experienced;-v Excel experienced - - - JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ;QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA;kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA;IgAoACcAKgAnACkAOwAkA;IAKAAnACoAJwApADsAJA;iACgAJwAqACcAKQA7ACQA - - - e^;^en^;^nc - - - ^ - - - ..\;\.. - - - \cmd.exe /c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe /c del "C:\Users\*\Desktop\*.exe;\cmd.exe -c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe -c del "C:\Users\*\Desktop\*.exe - - ping.exe -n 6 127.0.0.1 &ping.exe /n 6 127.0.0.1 & type - System.Net.Networkinformation.ping - - mofcomp.exe - - - - - net.exe;net1.exe;net2.exe - user;group;localgroup - remove;delete;active;del - tvsu_tmp - - - - - - - - - net.exe;net1.exe;net2.exe - user - add - tvsu_tmp - - dsmod.exe - dsadd.exe - - - - WerFault.exe - -s;/s - - - - - - - - - - - - - - - cmd.exe - echo;\pipe\;> - - - cmd.exe - /c;copy;dll;\\;admin$ - - - rundll32.exe - ,;StartW - - - rundll32.exe - ,;update;appdata;temp;/i: - - - rundll32.exe - ,;update;appdata;temp;-i: - - - dllhost.exe - {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} - - - dllhost.exe - {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} - - - - winlogon.exe;services.exe;lsass.exe;csrss.exe;wininit.exe;spoolsv.exe;searchindexer.exe - powershell.exe;pwsh.exe;cmd.exe - AUTHORI;AUTORI - route ; ADD - - - - eventvwr.exe - c:\windows\system32\mmc.exe - - fodhelper.exe - InstallUtil.exe - Invoke-PsUaCme - BypassUAC - PowerUp - computerdefaults.exe - dism.exe - fodhelper.exe - - - NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC - NT AUTHORITY\SYSTEM;СИСТЕМА;NT-AUTORITÄT\SYSTEM;AUTORITE NT\SYSTEM - - c:\windows\system32\svchost.exe -k netsvcs -s Appinfo - runas.exe - - - - - - - - Cmd.Exe - winlogon.exe - utilman.exe - - - Cmd.Exe - winlogon.exe - sethc.exe - - - utilman.exe - C:\Windows\System32\ATBroker.exe;Magnify.exe;C:\Windows\System32\osk.exe - - sethc.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe - - sdbinst.exe - - - cmd.exe /c C:\Windows\Setup\Scripts\SetupComplete.cmd;cmd.exe /c C:\Windows\Setup\Scripts\PartnerSetupComplete.cmd - C:\Windows\Setup - C:\Windows\SysWOW64 - C:\Windows\System32 - C:\Windows\WinSxS - - - consent.exe - http - iexplore.exe - SYSTEM - - - dwm.exe - - - cmd.exe - 7zFM.exe - ;/c;-c - - - cmd.exe - elevation_service.exe - System - - - - - - - - unknown process - \LocalState\rootfs\ - \LocalState\rootfs\ - - - - - - - - - - - auditpol - /set;-set;/restore;-restore;/clear;-clear;/remove;-remove;/resourceSACL;-resourceSACL - - - - - - - +s;+h - attrib.exe - - - Hidden;Attributes - powershell.exe - - - - - Sysinternals Sysmon - /u;/c;-u;-c - C:\ProgramdData\sysmon\ - - - MpCmdRun.exe - Add-MpPreference;RemoveDefinitions;DisableIOAVProtection - - - - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE - - - IMPHASH=19584675D94829987952432E018D5056 - - - IMPHASH=330768a4f172e10acb6287b87289d83b - - - PsKill.exe - - Set-MpPreference;Add-MpPreference;Remove-MpPreference;MpCmdRun.exe - RemoveDefinitions;RemoveDynamicSignature;DisableIOAVProtection;DisableRealTimeMonitoring;DisableBehaviorMonitoring;DisableBlockAtFirstSeen;DisableIOAVProtection;DisablePrivacyMode;DisableScriptScanning;DisableRealtimeMonitoring;DisableScanningNetworkFiles;DisableScanningMappedNetworkDrivesForFullScan;DisableRestorePoint;DisableRemovableDriveScanning;SignatureDisableUpdateOnStartupWithoutEngine;DisableIntrusionPreventionSystem;DisableScanOnRealtimeEnable;DisableArchiveScanning;DisableIntrusionPreventionSystem;DisableScriptScanning;DisableOnAccessProtection;ExclusionExtension;ExclusionPath;ExclusionProcess;ThreatDefaultAction;TamperProtection - - interface ipv6 set - interface ipv4 set - taskkill.exe - - firewall delete - firewall add - firewall set opmode disable - Core Networking - Router Solicitation - netsh advfirewall firewall - - - wevtutil.exe - cl - wevtutil im - wevtutil.exe im - ClickToRun - - - fltMC.exe - detach;unload - - - appcmd.exe - DontLog;True - iisetup.exe - - - set;NGenAssemblyUsageLog - New-ItemProperty;NGenAssemblyUsageLog - reg;add;dword;NGenAssemblyUsageLog - $env;NGenAssemblyUsageLog - - - set;COMPlus_ETWEnabled - New-ItemProperty;COMPlus_ETWEnabled - reg;add;dword;COMPlus_ETWEnabled - $env;COMPlus_ETWEnabled - - - - bash.exe;wsl.exe;ubuntu.exe;kali.exe - -e;/e;-u root;--exec bash;dev/tcp - - wsl.exe - wsl.exe - wslhost.exe - wslhost.exe - ubuntu.exe - ubuntu.exe - kali.exe - kali.exe - - pcalua.exe - pcalua.exe - bash.exe - bash.exe - forfiles.exe - forfiles.exe - .com - -appvscript - - - - C:\Users\NetworkService\;C:\Users\NetworkService\;HarddiskVolumeShadowCopy;C:\Users\Default\;C:\Users\Public;C:\Users\Guest\;\administrateur\;C:\Windows\Media\;C:\Windows\addins\;tsclient\;\htdocs\;\config\systemprofile\;C:\PerfLogs\;c:\windows\ServiceProfiles\;C:\Intel\Logs\;C:\Windows\repair\;C:\Windows\Help\;$Recycle;C:\Windows\Debug\;C:\Windows\Security\;C:\Windows\Fonts\;\wwwroot\;\Contacts;C:\Windows\vss\ - - - - - reg add hkcu\software\classes\ - reg.exe add hkcu\software\classes\ - C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry - - regedit.exe - : - - - reg.exe - delete - - - regedit.exe - /d;-d - - - HKCU:;HKLM - remove-item - - - HKCU:;HKLM - set-item;new-item - - - - - - chcp.exe - 936 - 1256 - 864 - 1258 - 855 - 866 - - - powershell.exe - -e ;-en;-enc;-enco;-encod;-encode;-encoded;-encodedc;-encodedco;-encodedcom;-encodedcomm;-encodedcomma;-encodedcomman;-encodedcommand;/e ;/en;/enc;/enco;/encod;/encode;/encoded;/encodedc;/encodedco;/encodedcom;/encodedcomm;/encodedcomma;/encodedcomman;/encodedcommand - - - powershell.exe - -w h;-wi h;-win h;-wind h;-windo h;-window h;-windows h;-windowst h;-windowsty h;-windowstyl h;-windowstyle h;/w h;/wi h;/win h;/wind h;/windo h;/window h;/windows h;/windowst h;/windowsty h;/windowstyl h;/windowstyle h - - - powershell.exe - -ex;/ex - bypass - - - powershell.exe - -noni;/noni - Import-Module FileServerResourceManager - C:\Program Files\LogicMonitor - - - powershell.exe - hextobin;iex;io.filestream;system.text;base64;system.io;io.file;IMAGE_SUBSYSTEM_WINDOWS_GUI;IMAGE_NT_OPTIONAL_HDR32;IMAGE_NT_OPTIONAL_HDR64;DllCharacteristicsType;GetDelegateForFunctionPointer;WriteProcessMemory;ReadProcessMemory;ImpersonateSelf;AdjustTokenPrivileges;NtCreateThreadEx;CreateRemoteThread;io.seek;iwr;-bxor;invoke-expression;remove.to.string;shellcode;System.Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;unicode;-useb;msxml2.serverxmlhttp;wscript.shell;-comobject;frombase64;io.compression;system.convert;io.streamreader;io.memorystream;compression.gzipstream;text.encoding;executioncontext;text.enc;convertto-securestring;runtime.interop;verbosepreference;[[string]]::join - - - powershell.exe - SUVYI;aWV4I;SQBFAFgA;aQBlA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC;UwB0AGE - - - C^om^S^pEc;^c^o^m^S^p^E^c^;Wscript.Shell;-ComObject;MsXml2.ServerXmlHttp;Remove.ToString;System.Convert;-UseB;[Byte[];^h^t^t^p;h"t"t"p - - IwAjACMAd;IyM=;SUVYI;aWV4I;SQBFAFgA;aQBlAHgA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC - WindowStyle Hidden function;WindowStyle Hidden;windowstyle h;windowstyl h;windowsty h;windowst h;windows h;window h;windo h;wind h;win h;wi h;-w h;/w h;win hi;win hid;win hidd;win hidde;win hidden - ^ - TYPE CON > - copy CON > - FromBase64String;action=create keyvalue=;VerbosePreference.ToString;SecureString;CSharpCodeProvider;runtime.interopservices.marshal;system.globalization.numberstyles;system.reflection.assembly;hextobin;VerbosePreference.ToString;system.text.encoding;io.filestream;io.filestream;io.seekorigin;text.encoding;unicode.getstring;FromBase64;[Convert]::;System.IO.File]::ReadAllText;|iex - - certutil - decode;encode - - - - ping.exe - 0x - - - - csc.exe - \AppData\;\Windows\Temp\ - - - csc.exe - wscript.exe - cscript.exe - mshta.exe - - - mofcomp.exe - .mof - C:\WINDOWS\Installer\MSI - MsMpEng.exe - aspnet_regiis.exe - msiexec.exe - - - csc.exe - out:;target:library - - Microsoft.Workflow.Compiler.exe - - - - - autochk.exe - \smss.exe;\fontdrvhost.exe;\dwm.exe - - - \consent.exe;\Runtimebroker.exe;\TiWorker.exe - \svchost.exe - - - - - \consent.exe;\Runtimebroker.exe;\TiWorker.exe - svchost.exe - - - - - SearchProtocolHost.exe - \SearchIndexer.exe;\dllhost.exe - - - - - dllhost.exe - \services.exe;\svchost.exe - - - - - smss.exe - \smss.exe - System - - - - - csrss.exe - - - \smss.exe;svchost.exe - - - wininit.exe - - - \smss.exe - - - winlogon.exe - \smss.exe - - - \lsass.exe;LsaIso.exe - \wininit.exe - - - LogonUI.exe - \wininit.exe;\winlogon.exe - - - services.exe - \wininit.exe - - - svchost.exe - - - \MsMpEng.exe;\services.exe - - - spoolsv.exe - \services.exe - - - taskhost.exe - \services.exe;\svchost.exe - - - userinit.exe - \dwm.exe;\winlogon.exe - - - \wmiprvse.exe;\wsmprovhost.exe;\winrshost.exe - - - \svchost.exe - - - \SearchProtocolHost.exe;\taskhost.exe;\csrss.exe - \werfault.exe;\wermgr.exe;\WerFaultSecure.exe - - - autochk.exe - \chkdsk.exe;\doskey.exe;\WerFault.exe - - - smss.exe - \autochk.exe;\smss.exe;\csrss.exe;\wininit.exe;\winlogon.exe;\setupcl.exe;\WerFault.exe - - - wermgr.exe - \WerFaultSecure.exe;\wermgr.exe;\WerFault.exe - - - conhost.exe - \mscorsvw.exe;\wermgr.exe;\WerFault.exe;\WerFaultSecure.exe - - System.Management.Automation - - - - - - - InstallUtil.exe - /logfile=;/LogToConsole=false;/U - - - InstallUtil.exe - -logfile=;-LogToConsole=false;-U - - - Mavinject.exe;mavinject64.exe - INJECTRUNNING - - - CMSTP.exe - /ni;/s - - - CMSTP.exe - /ns;/s - - - CMSTP.exe - -ni;-s - - - CMSTP.exe - -ns;-s - - - rundll32.exe;shell32.dll;_RunDLL - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - - - odbcconf.exe - /S /A {REGSVR;-S -A {REGSVR - - script:http - Register-cimprovider - Scriptrunner.exe -appvscript - bginfo - cbd - runscripthelper.exe surfacecheck - xwizard RunWizard - PresentationHost - driver executeinf - control.exe /name;control.exe -name - Control_RunDLL - SyncAppvPublishingServer.exe - Scriptrunner.exe - ATBroker.exe - Appvlp.exe - InfDefaultInstall.EXE - PresentationHost.exe - RegisterCimProvider2.exe - RegisterCimProvider.exe - ScriptRunner.exe - csi.exe - extexport.exe - msconfig.EXE - rasdlui.exe - tttracer.exe - verclsid.exe - wab.exe - Register-cimprovider.exe - csi.exe - devtoolslauncher.exe LaunchForDeploy - bginfo - devtoolslauncher.exe - wab.exe - wsreset.exe - - cmstp.exe /ni /s;cmstp.exe -ni -s - cmstp /ni /s;cmstp -ni -s - - Mavinject.exe - INJECTRUNNING - - - rundll32.exe - DllRegisterServer - xapauthenticodesip.dll - - - regsvr32.exe - C:\Users;Appdata;Temp - - - regsvr32.exe - C:\Users;Public - - Microsoft(C) Register Server - SyncAppvPublishingServer.exe - control.exe - rasautou.exe - control.exe /name;control.exe -name - Control_RunDLL - - - msiexec.exe - /y;-y - C:\Windows\SysWOW64\DartSock.dll - C:\Windows\SysWOW64\ImageViewer2.OCX - C:\Windows\SysWOW64\SysTray.ocx - C:\Windows\SysWOW64\tdbg6.ocx - C:\Windows\SysWOW64\tdbg7.ocx - C:\Windows\SysWOW64\tdbg7.ocx - C:\Windows\SysWOW64\todg7.ocx - C:\Windows\SysWOW64\todgub7.dll - C:\Windows\SysWOW64\xarraydb.ocx - - - msiexec.exe - /i;-i - http - - - - RUNDLL32.EXE - ,;# - C:\Windows\resources\themes\Aero\AeroLite.msstyles - uxtheme.dll - ImageView_Fullscreen - EDGEHTML.dll - PhotoViewer.dll - \AppData\Local\WebEx\WebEx\ - - - RUNDLL32.EXE - -sta;/sta - - - RUNDLL32.EXE - shell32.dll;OpenAs_RunDLL - - - RUNDLL32.EXE - powershell - - - RUNDLL32.EXE - url.dll;OpenURL - - - RUNDLL32.EXE - url.dll;FileProtocolHandler - - - RUNDLL32.EXE - zipfldr.dll;RouteTheCall - - - RUNDLL32.EXE - Shell32.dll;Control_RunDLL - - - RUNDLL32.EXE - javascript: - - - RUNDLL32.EXE - RegisterXLL - - - rundll32.exe - C:\Users;Public - rdpinit.exe - rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe - - - rundll32.exe - C:\Users;Appdata;Temp - ImageView_ - rdpinit.exe - rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe - - advpack.dll;LaunchINFSection - ieadvpack.dll;LaunchINFSection - syssetup.dll;SetupInfObjectInstallAction - setupapi.dll;InstallHinfSection - InstallHinfSection - infDefaultInstall.exe - rundll32.exe "C:\Windows\twain_64.dll" - shdocvw.dll;OpenURL - advpack.dll;RegisterOCX - Zipfldr.dll;RouteTheCall - url.dll;FileProtocolHandler - url.dll;FileProtocolHandler - OpenURLA;file: - OpenURL;file: - - - mshta.exe - cmd.exe;powershell.exe;wscript.exe;cscript.exe;sh.exe;bash.exe;reg.exe;regsvr32.exe;bitsadmin - - - mshta.exe - - RunHTMLApplication - mshtml - vbscript:CreateObject - - odbcconf.exe - - - manage-bde.wsf - - - - - powershell.exe;powershell_ise.exe - msbuild.exe - - - msbuild.exe - regasm - - - msbuild.exe - userinit.exe - - - msbuild.exe - .xml - - - regasm.exe - \conhost.exe - - - msbuild.exe - .lnk - - .csproj - - - - - - - msxsl.exe - msxsl.exe - - - - - - - - - /stext - keylog - keyscan_ - Get-Keystrokes - /scomma - - - - - - sniff - C:\Program Files\Adobe\ - - - tcpdump.exe;tcpdump.c;tshark.exe;tshark.c;windump.exe;windump.c;wireshark.c;wireshark.exe - windump;tshark;tcpdump;windump;wireshark - netsh;trace;start;capture=yes - - - - vssadmin.exe - create;shadow - - - wmic.exe - shadowcopy;call;create - - - wmic.exe - call;create;esentutl;vss - - - win32_shadowcopy;create;clientaccessible - - - mklink;GLOBALROOT;Shadow - - - copy;NTDS\ntds.dit - - - ntdsutil.exe - - - copy;System32\config\SYSTEM - - - reg;save;HKLM - - - mimikatz;mimidrv;mimilove;mimilib;sekurlsa;lsadump;dumpcreds;privilege::;token::;logonpasswords;mimikittenz;mimiauth;::;kerberos::;misc::skeleton;privilege::debug;dpapi::cred;vault::cred;lsadump;misc::;Krbtgt;TOKEN::;invoke-mimi - - - cmdkey - - rpcping.exe - nltest.exe - - -ma lsass.exe;Do-Exfiltration;Powersploit;GPPPassword;gpprefdecrypt;gsecdump;hashdump;laZagne;ntds.dit;ppldump;pwdump;pwdumpx;secretsdump;/listcreds:;-listcreds: - - VaultCloseVault - VaultEnumerateItem - VaultFree - VaultGetItem - VaultOpenVault - Vaultcmd - vaultcli.dll - select * from moz_login - Invoke-WinEnum - System.Net.CredentialCache - create shadow - wlan;export;profile;key=clear - dcsync - HKCU /f password;HKCU -f password - HKLM /f password;HKLM -f password - nltest.exe - ProcDump.exe - ProcDump - - - asktgt;asktgs - createnetonly /program:;createnetonly -program: - dump /service:krbtgt;dump -service:krbtgt - harvest /interval:;harvest -interval: - renew /ticket:;renew -ticket: - asreproast - impersonateuser: - kerberoast - ptt /ticket: - klist.exe - hh.exe - - - - appcmd.exe - list;text;password - - - - quser.exe - - net.exe;net1.exe;net2.exe - group;localgroup; user - /domain - SUService - \users - tvsu_tmp - - - net.exe;net1.exe;net2.exe - group;localgroup; user - /domain - SUService - \users - tvsu_tmp - - - sharphound;bloodhound;azurehound;CollectionMethod;encryptzip;randomizefilenames;dumpcomputerstatus - sharphound;bloodhound - sharphound;bloodhound - sharphound;bloodhound - sharphound;bloodhound - sharphound;bloodhound - sharphound;bloodhound - - dscl . list /Groups;dscl . list -Groups - dscl . list /Users;dscl . list -Users - dsquery.exe - query.exe - - - - - - - - - - - tree.com - - - auditpol - /get;-get;/list;-list;/backup;-backup - - gpresult.exe - get-gpo;get-gpresult;get-gpreg - - - - - - - - tasklist.exe - qprocess.exe - - reg query - reg.exe query - driverquery.exe - - - tracert.exe - pathping.exe - - - - find;385201 - select-string;385201 - - - find;virus - select-string;virus - process;Description;virus - find;cb - select-string;cb - process;Description;cb - find;defender - select-string;defender - process;Description;defender - find;crowdstrike - select-string;crowdstrike - process;Description;crowdstrike - find;sentinel - select-string;sentinel - process;Description;sentinel - find;nessusd - select-string;nessusd - process;Description;nessusd - find;td-agent - select-string;td-agent - process;Description;td-agent - find;cbagentd - select-string;cbagentd - process;Description;cbagentd - find;sysmon - select-string;sysmon - process;Description;sysmon - find;winlogbeat - select-string;winlogbeat - process;Description;winlogbeat - find;winlogbeat - select-string;winlogbeat - process;Description;winlogbeat - find;csfalcon - select-string;csfalcon - process;Description;csfalcon - find;splunk - select-string;splunk - process;Description;splunk - find;sidecar - select-string;sidecar - process;Description;sidecar - - - fltMC.exe - misc::mflt - - AntiVirusProduct - root\SecurityCenter2 - - sysinfo.exe - systeminfo - - - - netsh.exe - get;list;show - - - netsh.exe - get;list;show - - ipconfig.exe - - netstat.exe - arp -a - arp.exe -a - arp -a - - - whoami.exe;whoami1.exe - - - wmic.exe - get;useraccount - - - netsh.exe - add;del;set - - - nbtstat - nessus - - - route.exe - print - - - route.exe - ADD;DEL;CHANGE;-f - - qwinsta.exe - rwinsta.exe - - - - - - - - Microsoft Office\root\Office - Microsoft Office\root\Office - automation;Embedding - - - admin$ - davclnt.dll - WebClientGroup - - - - - - - /shadow;-shadow - noConsentPrompt - - - tscon.exe - dest:rdp-tcp: - - - powershell.exe - WmiPrvSE.exe - - - WmiPrvSE.exe - \Users\ - - - NetworkDetective - WmiPrvSE.exe - - - sc.exe - tenable - WmiPrvSE.exe - - - cmd.exe - WmiPrvSE.exe - do_vbsUpload;Spiceworks - - - regsvr32.exe - WmiPrvSE.exe - - - cmd.exe - WmiPrvSE.exe - - - powershell.exe - WmiPrvSE.exe - - - dsa.msc - - - virtmgmt.msc - - - wmiprvse.exe - CompMgmtLauncher.exe - DismHost.exe - Microsoft.NET\Framework - NetEvtFwdr.exe - ServerManager.exe - WerFault.exe - chcp.com - g2mupdate.exe - slack.exe - - - wsmprovhost.exe - cmd.exe - sh.exe - bash.exe - wsl.exe - powershell.exe - powershell_ise.exe - schtasks.exe - at.exe - certutil.exe - mshta.exe - whoami.exe - ping.exe - ping.exe - bitsadmin.exe - - winrm.cmd - winrs.exe - winrshost.exe - waitfor.exe - wsmprovhost.exe - winrshost.exe - wsmprovhost.exe - - wmiprvse.exe - mshta.exe - - - ssh.exe;putty.exe;kitty.exe;kitty_portable.exe - - PuTTY suite - - sftp;psftp - - - rundll32.exe - - - rundll32.exe - ..\;, - - - rundll32.exe - ,StartW - - psshutdown - psservice - PsPasswd - mstsc.exe - telnet.exe - tftp.exe - powershellcustomhost - - - -Embedding - c:\windows\system32\mmc.exe - - --execm;atexec - {4991d34b-80a1-4291-83b6-3328366b9097} - {00020812-0000-0000-C000-000000000046} - {40AEEAB6-8FDA-41e3-9A5F-8350D4CFCA91} - {7e0423cd-1119-0928-900c-e6d4a52a0715} - {0006F04A-0000-0000-C000-000000000046} - {048EB43E-2059-422F-95E0-557DA96038AF} - {13709620-C279-11CE-A49E-444553540000} - {c08afd90-f2a1-11d1-8455-00a0c91f3880} - 9BA05972-F6A8-11CF-A442-00A0C90A8F39 - {00021A20-0000-0000-C000-000000000046} - {72C24DD5-D70A-438B-8A42-98424B88AFB8} - {00020906-0000-0000-C000-000000000046} - {cc5bbec3-db4a-4bed-828d-08d78ee3e1ed} - {1b7cd997-e5ff-4932-a7a6-2a9e636da385} - {16d51579-a30b-4c8b-a276-0ff4dc41e755} - rundll32.exe -sta;rundll32.exe /sta;rundll32 -sta;rundll32 /sta - shell32.dll;SHCreateLocalServerRunDll - -k DcomLaunch;/k DcomLaunch - - - - - - - - - - 7z.exe - a -mx9 -r0 -p;a -v500m -mx9 -r0 -p - - - WindowsAudioDevice-Powershell-Cmdlet - SoundRecorder.exe - - - - clip.exe - get-clipboard - - - - - - - - - - New-MailboxExportRequest - - - - screencapture - system.drawing.Imaging - system.drawing.bitmap - system.windows.forms.screen - - - - - - - odHRwczovL;aHR0cDovL;h0dHA6Ly;odHRwOi8v;aHR0cHM6Ly;h0dHBzOi8v - ie_to_edge_stub.exe;chrome.exe;firefox.exe;iexplore.exe;brave.exe;vivaldi.exe;msedge.exe;webex;teams.exe;goto opener.exe;lynx.exe;\Webex\webexAppLauncherLatest.exe;\WebEx\webexAppLauncher.exe;\WebEx\Applications\webexAppLauncher.exe;WebEx\webex.exe - wbx:;/SITE_TOKEN=;msteams:;PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSI - msedgeupdate.dll - - - VFZvQUFBQ;RWb0FBQU;UVm9BQUFB;VFZxQUFBR;RWcUFBQU;UVnFBQUFF;VFZwUUFBS;RWcFFBQU;UVnBRQUFJ;VFZxUUFBT;RWcVFBQU;UVnFRQUFN;VFZwVEFRR;RWcFRBUU;UVnBUQVFF - - - powershell.exe - AAAAYInlM;OiCAAAAYInlM;OiJAAAAYInlM;RwBlAHQAL;WwBOAGUAdAAuAFM;W05ldC5TZXJ2aWNl - - - Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք - - - - - - - - certutil.exe - urlcache;split;f - - - DownloadFile;DownloadString;Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;Invoke-Expression;Invoke-WebRequest - powershell.exe;cmd.exe - - - bitsadmin.exe - CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME - util;setieproxy;localsystem;AUTODETECT - - - BITS administration utility - CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME - - - \curl.exe;\wget.exe;\www.exe - - - \curl.exe;\wget.exe;\www.exe - - - certutil - split;f - - - certutil - verifyctl;URL - - start-bitstransfer - expand \\ - expand.exe \\ - ieexec http - ieexec.exe http - powercat - esentutl /y \\;esentutl -y \\ - esentutl.exe /y \\;esentutl.exe -y \\ - extrac32 \\ - extrac32.exe \\ - - - - - - portproxy - tor.exe - - TeamViewer_Desktop.exe - - psexec - - - - - - - winscp.exe;winscp.com;scp.exe;pscp - - - - bitch.exe;bitch.bat;bitch_lasagna.exe;Admin Cracker.exe;BulletsPassView.exe;ChromePass.exe;Dialupass.exe;LSASecretsView.exe;OpenedFilesView.exe;OperaPassView.exe;PasswordFox.exe;ProduKey.exe;RouterPassView.exe;USBDeview.exe;USBStealer.exe;VNCPassView.exe;WebBrowserPassView.exe;WirelessKeyView.exe;WirelessKeyView.exe;empv.exe;netpass.exe;pspv.exe;usbdll.exe;rdpv.exe;WirelessKeyView.exe;lasagna.exe;all -vvv >>;rsync -r - - - CredsLeaker;Windows.Security.Credentials.UI.CredentialPicker;function Leaker;function Await - - - .exe -url https://;dll,Run https://;Invoke-Merlin;-m SimpleHTTPServer;/m SimpleHTTPServer - - - - - -q=txt;/q=txt - nslookup.exe - - - rclone - Rsync for cloud storage - rclone - rclone - \rclone - - - s3browser - s3browser - s3browser - s3browser - - - add-ftp;.UploadFile( - ftp.exe - - - rundll32.exe - davclnt.dll;DavSetCookie - - - - - - - - - - - - bcdedit.exe - safeboot - - - bootcfg.exe - safeboot - - - -startvm;vrun.exe -vm - - - - - vssadmin.exe - delete;resize - - - wmic.exe - shadowcopy;delete - - - wbadmin.exe - SYSTEMSTATEBACKUP;delete - - - wmic.exe - wmic shadowstorage SET MaxSpace= - - - wmic.exe - cleareventlog;call disable;nteventlog where filename - - - diskpart.exe - format;clean;delete;remove - - - manage-bde.exe - changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw - - - manage-bde.wsf - changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw - - format - format - bootstatuspolicy ignoreallfailures - recoveryenabled No - Win32_Shadowcopy - sdelete - delete catalog - wbadmin delete catalog - erase - -nw -exec= - -p -nw - shred - diskshadow - - del ; /f - del ; -f - rmdir ; /s ; /q - rmdir ; -s ; -q - rd ; /s ; /q - rd ; -s ; -q - - - usn deletejournal - - - - - fsutil.exe - deletejournal - usn - - - - - - - - - - AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz - - - ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool - CPU miner;GPU miner;Lime Miner;XMRig CPU miner; miner - - - - b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 - - 87AECF008D87EC86EC8B00A2394B3E6C - FB3F0D0DE8B80EA8CFAB2A025EC6B833 - F4067FBF7FFF6945D0BB485B727B39AA - 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee - e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f - d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b - 53841a0c6a3ff92976db08bfdf95e083 - - - zoommtg - pwd= - - - zoommtg - zc=0 - - - zoommtg - zc=1 - - - msteams: - - - wbx: - - - C:\Users\ - \Downloads\ - - - C:\Users\ - \Desktop\ - - - \awk.exe;\sed.exe - - listena - -s -n -u -i:http: - /s /n /u /i:http: - assoc - del - expand - md - move - rd - ren - set - setx - bginfo.bgi /popup /nolicprompt;bginfo.bgi -popup -nolicprompt - find.exe - grabff - routerscan - pythonEngine.Execute - sesshijack - file:// - HTML Application host - Manager Profile Installer - Microsoft Application Virtualization Injector - Application Compatibility Database Installer - popd.exe - pushd.exe - subst.exe - doskey.exe - cls.exe - \ - C:\Windows\system32\svchost.exe -k iissvcs - \ - acrobat.exe - acrord32.exe - java.exe - javaw.exe - - - - - C:\Windows\system32\svchost.exe - - cacls - takeown - /x Macro - - \pipe\ - > - - /noprofile - /sc ONEVENT - \\VBOXSVR - | more - |more - \\tsclient - %PROCESSOR_ARCHITECTURE% - sysnative - AutoIt - Microsoft Filter Loader - more.com - :\Windows\Microsoft.NET\ - acrord32.exe - gpupdate.exe - :\Windows\Microsoft.NET\ - - - - - - - - C:\Windows\System32\WerFault.exe - C:\Windows\System32\wbem\WmiPrvSE.exe - - - - - - - C:\Users - C:\ProgramData - \Temp\ - \tmp\ - \drivers\ - \Download - - - - - C:\Windows\system32\backgroundTaskHost.exe - TrustedInstaller.exe - OneDrive.exe - vivaldi.exe - chrome.exe - C:\WINDOWS\system32\backgroundTaskHost.exe - setup - AppData\Local\Microsoft\Teams\current\Teams.exe - \AppData\Local\Microsoft\Edge SxS\Application\msedge.exe - - - - - - - - census - researchscan - scanhub - shadow - shodan - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - wscript.exe - - - - - - - - at.exe - schtasks.exe - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \temp\ - 127.0.0.1 - - - \wwwroot\ - - \Windows\addins\ - C:\Windows\repair\ - \htdocs\ - C:\Windows\system32\config\systemprofile\ - C:\Intel\Logs\ - C:\Windows\addins\ - C:\Windows\security\ - C:\Windows\Help\ - $RECYCLE.BIN - C:\Windows\Debug\ - C:\Windows\Fonts\ - C:\PerfLogs\ - :\$Recycle.bin\ - :\Users\Default\ - C:\Users\NetworkService\ - C:\Users\Public\ - C:\Windows\Media\ - \Windows\IME\ - C:\ProgramData - - - - - - - - CSC.exe - - - - - - - - - - infDefaultInstall.exe - SyncAppvPublishingServer.exe - - - InstallUtil.exe - - msiexec.exe - - - regasm.exe;regsvcs.exe - - - Mavinject.exe - - - - - - msbuild.exe - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - dsquery.exe - - - - - - - - - - - - - driverquery.exe - - - - nbtstat - - net.exe - net1.exe - - qwinsta.exe - rwinsta.exe - - - - - - - - - - - - true - 3389 - AutomationManager.ScriptRunner64.exe - C:\Program Files (x86)\VMware\VMware Remote Console\vmrc.exe - C:\Program Files\VMware\VMware Remote Console\vmrc.exe - C:\Program Files\WindowsApps\Microsoft.RemoteDesktop_ - CtxLicUsageRecorder.exe - FSAssessment.exe - FSDiscovery.exe - MobaRTE.exe - RDCMan.exe - RSSensor.exe - RTS2App.exe - RTSApp.exe - RemoteDesktopManager64.exe - RemoteDesktopManager.exe - RemoteDesktopManagerFree.exe - Terminals.exe - chrome.exe - mRemote.exe - mRemoteNG.exe - mstsc.exe - spiceworks-finder.exe - svchost.exe - thor64.exe - thor.exe - - - true - 3391 - AutomationManager.ScriptRunner64.exe - C:\Program Files (x86)\VMware\VMware Remote Console\vmrc.exe - C:\Program Files\VMware\VMware Remote Console\vmrc.exe - C:\Program Files\WindowsApps\Microsoft.RemoteDesktop_ - CtxLicUsageRecorder.exe - FSAssessment.exe - FSDiscovery.exe - MobaRTE.exe - RDCMan.exe - RSSensor.exe - RTS2App.exe - RTSApp.exe - RemoteDesktopManager64.exe - RemoteDesktopManager.exe - RemoteDesktopManagerFree.exe - Terminals.exe - chrome.exe - mRemote.exe - mRemoteNG.exe - mstsc.exe - spiceworks-finder.exe - svchost.exe - thor64.exe - thor.exe - - - true - 3389 - 127.0.0.1;0:0:0:0:0:0:0:1 - - - true - 3389 - fe80:0 - - - putty.exe;kitty.exe;kitty_portable.exe - - - wsmprovhost.exe - - - psftp.exe - - reg.exe - psshutdown - PsPasswd - psservice - ssh.exe - psexe - tftp.exe - telnet.exe - mstsc.exe - wmic.exe - sc.exe - pskill - dsquery.exe - plink.exe - vnc.exe - vncviewer.exe - vncservice.exe - omniinet.exe - hpsmhd.exe - - - - - - - - - - - - - - - - - - - - - - - - - - - 50050 - true - - - 25 - \Bin\EdgeTransport.exe;Bin\MSExchangeFrontendTransport.exe - true - - - - - - - - - - - powershell.exe - 0:0:0:0:0:0:0:;127.0.0.1 - - mshta.exe - cmd.exe - certutil.exe - certutil.exe - notepad.exe - regsvcs.exe - regsvr32.exe - rundll32.exe - - - - - - - tor.exe - hiddenservice.net;onion.city;onion.direct;onion.direct;onion.link;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org;onion.to - - - - - - - - - - dns.google;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;doh.opendns.com;.quad9.net;dns.cleanbrowsing.org;dns-family.adguard.com;dns.adguard.com;.233py.com;dnscrypt;dnscrypt-cert.oszx.co;dns.oszx.co;doh.dns.sb;doh.defaultroutes.de;doh.tiarap.org;doh.tiar.app;doh.captnemo.in;.aaflalo.me;doh.appliedprivacy.net;doh.dnswarden.com;commons.host;dns.twnic.tw;ibuki.cgnat.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;.seby.io;rdns.faelix.net;doh.li;.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk;adblock.mydns.network;ibksturm.synology.me;jcdns.fun - - - - - - - privatlab.com - mega.nz;mega.co.nz - .pcloud.com - - - - - - - - - - - - - 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool - - - - - C:\Windows\system32\svchost.exe - 3389 - 22 - 21 - 5985 - false - - - C:\Windows\system32\svchost.exe - true - 135 - 445 - 5985 - - - System - svchost.exe - 445 - - - System - svchost.exe;lsass.exe - 389 - - - C:\Windows\System32\lsass.exe - 389 - 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 - EXCH - 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 - false - - - notepad.exe - 127.0.0.1 - - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - 80 - 443 - true - - github - githubusercontent.com - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - 80 - true - - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - 443 - true - - - apache.exe - - - java.exe - - - w3wp.exe - - - \php-cgi.exe;\php.exe - - - setup - - - tomcat - - - unins - - - unknown process - - - explorer.exe - - - inetinfo.exe - - - netcat.exe;nc.exe;nc64.exe;ncat.exe - procdump - psexe - vnc;vncs;vncv - - rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe;advanced_port_scanner.exe;rcpping.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe - - - 0 - 5985 - 5986 - 1293 - 1701 - 1194 - 3540 - 3389 - 22 - 1080 - 3128 - 8080 - 1723 - 23 - 4500 - 9001 - 9030 - 5900 - 5800 - - 0 - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - 443 - true - - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - 80 - true - - 80 - 443 - 636 - 5900 - 443 - - afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com - - - - - udp - - - System;svchost.exe;oracle.exe;apache.exe;java.exe;php-cgi.exe;w3wp.exe;httpd;ServerManager.exe;unknown process;sql;wscript;cscript;schtasks;at.exe;reg.exe;C:\Windows\System32\find.exe - 127.0.0.1;0:0:0:0:0:0:0:1 - 127.0.0.1;0:0:0:0:0:0:0:1 - - - - C:\Windows\System32\lsass.exe - 88 - - - epmap - llmnr - microsoft-ds - netbios-dgm - ntp - ssdp - epmap - llmnr - microsoft-ds - netbios-dgm - ntp - ssdp - - 53 - 67 - 68 - 1434 - 1812 - 3544 - 3702 - 5228 - 5353 - 5357 - 5989 - 6007 - 49154 - 49209 - 52176 - 59241 - 53 - 67 - 68 - 1812 - 3702 - 6007 - 49154 - 49209 - 50646 - 52176 - 59241 - - .bing.com - .cloudapp.net - .lync.com - .microsoft.com - .outlook.com - .search.msn.com - .wns.windows.com - aps.windows.com - arc.msn.com.nsatc.net - arc.msn.com - atson.telemetry.microsoft.com - au.download.windowsupdate.com - b.akamaiedge.net - bingforbusiness.com - client-office365-tas.msedge.net - config.edge.skype.com - csp.digicert.com - ctldl.windowsupdate.com - cy2.licensing.md.mp.microsoft.com.akadns.net - cy2.settings.data.microsoft.com.akadns.net - displaycatalog.mp.microsoft.com - download.windowsupdate.com - e-msedge.net - e3.delivery.dsp.mp.microsoft.com.nsatc.net - emdl.ws.microsoft.com - ettings-win.data.microsoft.com - fe2.update.microsoft.com - fe3.delivery.dsp.mp.microsoft.com.nsatc.net - fe3.delivery.mp.microsoft.com - g.akamaiedge.net - g.live.com - g.msn.com.nsatc.net - geo-prod.do.dsp.mp.microsoft.com - geo-prod.dodsp.mp.microsoft.com.nsatc.net - ile-service.weather.microsoft.com - ip5.afdorigin-prod-am02.afdogw.com - ipv4.login.msa.akadns6.net - licensing.mp.microsoft.com - m3p.wns.notify.windows.com.akadns.net - microsoft.com.akadns.net - microsoft.com.nsatc.net - microsoft.com - modern.watson.data.microsoft.com.akadns.net - msedge.net - msn.com.nsatc.net - msn.com - ocation-inference-westus.cloudapp.net - ocos-office365-s2s.msedge.net - ocsp.digicert.com - odern.watson.data.microsoft.com.akadns.net - oneclient.sfx.ms - pv4.login.msa.akadns6.net - query.prod.cms.rt.microsoft.com - ris.api.iris.microsoft.com.akadns.net - ris.api.iris.microsoft.com - s-msedge.net - settings.data.microsoft.com - sfe.trafficshaping.dsp.mp.microsoft.com - sls.update.microsoft.com - storecatalogrevocation.storequality.microsoft.com - storeedgefd.dsx.mp.microsoft.com - telecommand.telemetry.microsoft.com.akadns.net - tile-service.weather.microsoft.com - tlu.dl.delivery.mp.microsoft.com - tsfe.trafficshaping.dsp.mp.microsoft.com - vip5.afdorigin-prod-am02.afdogw.com - vip5.afdorigin-prod-ch02.afdogw.com - virtualearth.net - windows.net - windowsupdate.com - y2.displaycatalog.md.mp.microsoft.com.akadns.net - y2.licensing.md.mp.microsoft.com.akadns.net - y2.settings.data.microsoft.com.akadns.net - EdgeTransport.exe - MSExchangeDelivery.exe - MSExchangeFrontendTransport.exe - MSExchangeHMWorker.exe - MSExchangeSubmission.exe - \ - - - - - - - - - - - - - C:\Windows\ - \System32\;Syswow64;sysmon.exe;sysmon64.exe - - - C:\Windows\system32\ - config\systemprofile\ - - - C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe - - - A:\;B:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;N:\;O:\;P:\;Q:\;R:\;S:\;T:\;U:\;V:\;W:\;X:\;Y:\;Z:\;AA:\;BB:\;CC:\;DD:\;EE:\;FF:\;GG:\;HH:\;II:\;JJ:\;KK:\;LL:\;MM:\;NN:\;OO:\;PP:\;QQ:\;RR:\;SS:\;TT:\;UU:\;VV:\;WW:\;XX:\;YY;ZZ:\ - :\PROGRA~ - :\Program Files - :\Program Files - :\Program Files - :\ProgramData\ - :\Users\ - :\Windows\ - :\inetpub\ - :\$SysReset - :\$WinREAgent - :\inetpub\ - - - \ - - - C:\Users\ - - - C:\ProgramData\ - C:\ProgramData\sysmon\sysmon64.exe;C:\ProgramData\sysmon\sysmon.exe - - - C:\Program Files;C:\PROGRA~ - - - C:\inetpub\ - - - $RECYCLE.BIN - packetbeat.exe;metricbeat.exe;filebeat.exe;winlogbeat.exe;o365beat.exe;graylog-sidecar.exe;graylog-collector-sidecar.exe;splunkd.exe;splunk.exe;syslogng.exe;syslog-ng.exe;nxlog-processor.exe;snarecore.exe;fluentd;td-agent - C:\Windows\system32\config\systemprofile\ - C:\Windows\sysWOW64\config\systemprofile\ - \Temp\ - C:\Users\ - - - - - Microsoft\Teams\current\Teams.exe - \git.exe - Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe - C:\ProgramData\Lenovo\ImController\ - - - - - - - 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - - - 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5;c948ae14761095e4d76b55d9de86412258be7afd;c996d7971c49252c582171d9380360f2;ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1;10b30bdee43b3a2ec4aa63375577ade650269d25;d2fd132ab7bbc6bbb87a84f026fa0244 - - DumpExt.dll - mimidrv - lsremora - wceaux.dll - npcap - \Temp - :\Users - ChongKim Chan - ? - Revoked - Unavailable - Valid - false - - - - - - - - - - - - - - msdt.exe - sdiageng.dll - - - WINWORD.exe;EXCEL.EXE - VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wshom.ocx - wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - - - ntkrnlmp.exe - - - \spool\drivers\x64\3\;\spool\drivers\W32X86\3\;\spool\drivers\IA64\3\ - spoolsv.exe;printisolationhost.exe - Valid - Brother Industries;Canon;Sharp;Microsoft Corporation;DYMO;Euro Plus d.o.o;HP Inc;Hewlett-Packard - - - C:\Windows\ - \Users\Public\;\Desktop\;\Downloads\;\AppData\Local\Temp\;\PerfLogs\;$Recycle;\Fonts\ - \Program Files - - - EQNEDT32.EXE - EQNEDT32.EXE - - - ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll - C:\Users;\Temp\;\ProgramData\ - - - ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll - wscript.exe;cscript.exe;powershell.exe;rundll32.exe;msbuild.exe;msiexec.exe;csc.exe - - - WINWORD.exe;EXCEL.EXE - VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wshom.ocx - wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll;fastprox.dll - - - WINWORD.exe;EXCEL.EXE - VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - - - WINWORD.exe;EXCEL.EXE - VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - - - WINWORD.exe;EXCEL.EXE - taskschd.dll - - - wscript.exe;cscript.exe - taskschd.dll - - - wmiprvse.exe - taskschd.dll - - - powershell.exe - msi.dll - - - powershell - amsi.dll - - - powershell - amsi.dll - - - WINWORD.exe;EXCEL.EXE - clr.dll - - - clr.dll;System.Management.ni.dll;Microsoft.Build.Utilities - - - wscript.exe;cscript.exe - msxml;wshom.ocx - - - wscript.exe;cscript.exe - winhttp.dll;mswsock.dll;IPHLPAPI.DLL - - - installutil.exe - CustomMarshalers.dll;CustomMarshalers.ni.dll;System.Management.ni.dll;WMINet_Utils.dll;mswsock.dll - - - System.Management.Automation.ni.dll - C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ - - - System.Management.Automation.dll - C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ - Lenovo.Vantage.AddinHost;\Microsoft.Sara.exe;C:\Program Files\CONEXANT - - - C:\Windows\System32\vaultcli.dll - \svchost.exe;\GameBar.exe;C:\Program Files\WindowsApps;\Microsoft\Teams\current\Teams.exe - - - \\ - - - \Microsoft\Word\Startup\ - .wll - - - \Microsoft\Excel\Startup\ - .xll - - - \Microsoft\Addins\ - .xla - - - tor-lib.dll - - - C:\Windows\System32\WinSCard.dll;C:\Windows\System32\cryptdll.dll;C:\Windows\System32\hid.dll;C:\Windows\System32\samlib.dll;C:\Windows\System32\vaultcli.dll - - - rundll32.exe - vaultcli.dll;wlanapi.dll - combase.dll - cryptdll.dll - imm32.dll - logoncli.dll - netapi32.dll - ntasn1.dll - ntdsapi.dll - samlib.dll - shcore.dll - srvcli.dll - - - odbc32.dll;winhttp.dll;netapi32.dll;SHLWAPI.dll - - - C:\Windows\Explorer.EXE - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - - - C:\ProgramData\ - C:\ProgramData\ - .exe - Adobe - C:\ProgramData\Lenovo\ - C:\ProgramData\Microsoft\Windows Defender\ - C:\ProgramData\sysmon\sysmon64.exe - - - C:\Users\Default\;C:\Users\Public\ - .exe - - - 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - - - C:\Windows\System32\svchost.exe - false - - - Revoked - - - Expired - - - jscript9.dll - mshta.exe - - scrobj.dll - crypt0.dll - - C:\Windows\System32\wlanapi.dll - C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe - C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe - C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\System32\AppHostRegistrationVerifier.exe - C:\Windows\System32\CompatTelRunner.exe - C:\Windows\System32\DeviceCensus.exe - C:\Windows\System32\DriverStore\FileRepository\ - C:\Windows\System32\LogonUI.exe - C:\Windows\System32\MoNotificationUx.exe - C:\Windows\System32\SystemSettingsBroker.exe - C:\Windows\System32\dxgiadaptercache.exe - C:\Windows\System32\netsh.exe - C:\Windows\System32\wlanext.exe - C:\Windows\UUS\amd64\MoUsoCoreWorker.exe - C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_ - C:\Windows\explorer.exe - - C:\Windows\Microsoft.NET\assembly\GAC_MSIL - - - - - - \Microsoft Office\ - \mscorlib.ni.dll - - - \Microsoft Office\ - \sppc.dll - - - C:\Windows\System32\svchost.exe - true - - - Fortinet - Lenovo - Sophos - mscorsvw.exe - C:\Program Files (x86)\Microsoft Office\root\Office15\officebackgroundtaskhandler.exe - C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe - C:\Program Files\Microsoft Office\root\Office15\officebackgroundtaskhandler.exe - C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe - C:\Windows\SysWOW64\SearchProtocolHost.exe - C:\Windows\System32\InstallAgentUserBroker.exe - C:\Windows\System32\RuntimeBroker.exe - C:\Windows\System32\SearchIndexer.exe - C:\Windows\System32\SettingSyncHost.exe - C:\Windows\System32\backgroundTaskHost.exe - C:\Windows\System32\sppsvc.exe - C:\Windows\System32\taskhost.exe - C:\Windows\System32\taskhostw.exe - C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe - C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe - HxTsr.exe - SearchUI.exe - C:\Program Files (x86)\Common Files\BIExcelFunctions1.1\32bit\Sage. - C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Pfx. - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Adist64.dll - C:\Program Files (x86)\Microsoft Office\Office15\Library\Analysis\ANALYS32.XLL - C:\Program Files (x86)\Microsoft Office\Office16\Library\Analysis\ANALYS32.XLL - C:\Program Files\Microsoft Office\Office15\Library\Analysis\ANALYS32.XLL - C:\Program Files\Microsoft Office\Office16\Library\Analysis\ANALYS32.XLL - C:\Windows\SysWOW64\sppc.dll - Microsoft.Office.Interop.VisOcx.dll - Microsoft.Office.Interop.Word.dll - Microsoft.Vbe.Interop.dll - OFFICE.DLL - - - - - - - - 0x001A0000 - c:\windows\system32\lsass.exe - - - msiexec.exe - - - chrome.exe;firefox.exe;edge.exe;browser_broker.exe;iexplore.exe - - - 0x001A0000 - c:\windows\system32\lsass.exe - - - c:\windows\system32\lsass.exe - c:\windows\system32\rundll32.exe - - - DbgUiRemoteBreakin - nacl64.exe - - - QueryProcessDebugInformationRemote - nacl64.exe - - - isdebuggerpresent - nacl64.exe - - - DebugActiveProcess - nacl64.exe - - - LoadLibrary - C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\System32\DriverStore\FileRepository\ - C:\Windows\System32\igfxEM.exe - C:\Windows\System32\igfxHK.exe - Enterprise\Common7\IDE\devenv.exe - C:\Program Files (x86)\ASUS\ROG Live Service\FileOperator.exe - C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe - - - CreateFileMapping;MapViewOfFile - - - LdrLoadDll - - - CryptAcquireContextA;CryptDecodeObjectEx;CryptImportPublicKeyInfo;CryptEncrypt;CryptGenKey;CryptDecrypt;CryptStringToBinary;CryptBinaryToString;CryptImportKey - - - c:\windows\system32\csrss.exe - CrtlRoutine - - 0B80 - 0C7C - 0C88 - c:\windows\system32\mstsc.exe - - C:\WINDOWS\SYSTEM32\ntdll.dll - EtwEventWrite - - - - - - - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe - C:\Windows\system32\audiodg.exe - C:\Windows\system32\services.exe - C:\Windows\system32\svchost.exe - C:\Windows\system32\wbem\WmiPrvSE.exe - C:\Windows\system32\wininit.exe - C:\Windows\system32\winlogon.exe - - - - - - - - - - - - - C:\Windows\System32\SHELL32.dll+9b5bd - \LocalBridge.exe - - - C:\Windows\System32\wshom.ocx+c8a0;C:\Windows\System32\wshom.ocx+c39d - - - C:\Windows\SYSTEM32\framedynos.dll+2cb3e - C:\Windows\system32\SgrmBroker.exe;C:\Windows\system32\SecurityHealthService.exe;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Windows\system32\services.exe;C:\Windows\system32\wininit.exe;C:\Windows\system32\sppsvc.exe;C:\Windows\System32\smss.exe;C:\Windows\system32\csrss.exe;C:\Windows\System32\svchost.exe - - - C:\Windows\SYSTEM32\framedynos.dll+2b496 - - - C:\Windows\SYSTEM32\dbgcore.DLL+6cfb - - - C:\Windows\System32\KernelBase.dll+de67e - - - ntdll.dll+a0044 - - - clr.dll+6c23;clr.dll+6b38 - - - C:\Windows\\SYSTEM32\ntdll.dll+;|C:\Windows\System32\KERNELBASE.dll+;|UNKNOWN( - ) - - - "UNKNOWN(;)|UNKNOWN( - ) - - - "UNKNOWN - 0x1F0FFF;0x1F1FFF;0x143A;0x1410;0x1010;0x1F2FFF;0x1F3FFF;0x1FFFFF - - - C:\Program Files;\Microsoft Office\Root\Office - \Microsoft Shared\VBA - C:\Program Files (x86)\Intuit\ - - - C:\Windows\system32\lsass.exe - 0x1FFFFF - UNKNOWN - WmiPerfClass.dll - C:\Windows\sysWOW64\wbem\wmiprvse.exe;C:\Windows\system32\wbem\wmiprvse.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe;WmiPerfClass.dll;C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files (x86)\Common Files\Adobe - - - C:\Windows\system32\lsass.exe - C:\Windows\system32\wsmprovhost.exe - - - C:\Windows\system32\lsass.exe - 0x1FFFFF - python27.dll;_ctypes.pyd;KERNELBASE.dll;ntdll.dll - - - C:\Windows\system32\lsass.exe - C:\Windows\SYSTEM32\ntdll.dll+4595c|C:\Windows\system32\KERNELBASE.dll+8185 - - - C:\Windows\system32\lsass.exe - C:\WINDOWS\SYSTEM32\ntdll.dll+ - ) - |C:\WINDOWS\System32\KERNELBASE.dll+;|UNKNOWN( - wow64.dll;)|C;Exchange.Diagnostics;Microsoft.Exchange - C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe;c:\windows\system32\inetsrv\w3wp.exe;MSExchangeHMHost.exe;C:\Windows\sysWOW64\wbem\wmiprvse.exe - - - C:\Windows\system32\winlogon.exe - 0x1F3FFF - C:\Windows\Microsoft.NET;UNKNOWN - - - .exe - C:\Windows\sysmon64.exe;C:\Windows\sysmon64.exe - 0x1C00 - - - C:\Windows\system32\lsass.exe - 0x1F1FFF - UNKNOWN - - - C:\Windows\system32\lsass.exe - 0x1010 - UNKNOWN - - - C:\Windows\system32\lsass.exe - 0x143A - UNKNOWN - - - C:\Windows\system32\lsass.exe - 0x1fffff - dbghelp.dll;dbgcore.dll - - - dbghelp.dll;dbgcore.dll - C:\Windows\system32\lsass.exe - C:\wfx32\ - - - powershell.exe - C:\Programdata\sysmon\sysmon64.exe;C:\Programdata\sysmon\sysmon.exe;C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe;\dismhost.exe - - - getasynckeystate - - - cmlua.dll - - - System.Management.Automation - C:\ProgramData\Microsoft\Windows Defender\platform\ - ctiuser.dll - C:\Program Files\Citrix\ConfigSync\ConfigSyncRun.exe - C:\Program Files\Microsoft\Exchange Server\V14\bin\ExSetupUI.exe - C:\Program Files\Microsoft\Exchange Server\V15\bin\ExSetupUI.exe - C:\Program Files\Microsoft\Exchange Server\V16\bin\ExSetupUI.exe - C:\Windows\SysWOW64\sdiagnhost.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\Temp\ExchangeSetup\ExSetupUI.exe - C:\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe - C:\Program Files\Microsoft Azure Active Directory Connect\AzureADConnect.exe - C:\Windows\system32\HOSTNAME.EXE - C:\Windows\system32\ROUTE.exe - C:\Windows\system32\query.exe - MsMpEng.exe - - - C:\Windows\system32\lsass.exe - comsvcs.dll - - - VBE7.dll;VBEUI.DLL;VBE7INTL.DLL - - - VBE6.dll;VBEUI.DLL;VBE6INTL.DLL - - - Office - verclsid.exe - VBE7.dll;VBEUI.DLL;VBE7INTL.DLL - |UNKNOWN( - 0x1FFFFF - - - C:\Program Files\Microsoft Office\Root\Office - C:\Windows\System32\KERNELBASE.dll+76516 - - - C:\Windows\System32\SHELL32.dll+ae3b9 - C:\WINDOWS\system32\sihost.exe - C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub - - UNKNOWN - - |UNKNOWN( - C:\WINDOWS\SYSTEM32\ntdll.dll+ - |C:\WINDOWS\System32\KERNELBASE.dll+ - ) - 0x1028;0x1fffff - C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git\ - - - winword.exe;excel.exe;powerpnt.exe - :\Windows\Microsoft.NET\Framework64\v2.;UNKNOWN - - - UNKNOWN - 0x147a - - - C:\Windows\Sysmon64.exe;C:\Windows\Sysmon.exe - C:\WINDOWS\system32\wbem\wmiprvse.exe - C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe - C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe;C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe;C:\Program Files (x86)\Google\Update\GoogleUpdate.exe - 0x1400 - - - 0x0800 - - 0x0810 - - 0x0820 - - 0x810 - - 0x820 - cscript.exe - wscript.exe - jjs.exe - dump - mimikatz - CorperfmontExt.dll - - - - - - wmiprvse.exe - lsass.exe - - - lsass.exe - winlogon.exe - - - - lsass.exe - C:\Windows\system32\w32tm.exe;C:\Windows\System32\ping.exe;C:\Windows\System32\net.exe;C:\Windows\System32\net1.exe;C:\Windows\SYSTEM32\HOSTNAME.EXE;C:\Programdata\sysmon\sysmon.exe;C:\Programdata\sysmon\sysmon64.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\Program Files (x86)\BeAnywhere Support Express\;C:\Program Files (x86)\CheckPoint\;C:\Program Files (x86)\Common Files\Intuit\QuickBooks\;C:\Program Files (x86)\Fortinet\;C:\Program Files (x86)\Trend Micro\;C:\Program Files\Adobe\Adobe Creative Cloud Experience\;C:\Program Files\CheckPoint\;C:\Program Files\Fortinet\;C:\Program Files\Realtek;C:\Program Files\Trend Micro\;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Program Files (x86)\Lenovo\;snmpd.exe;taskmgr;:\Windows\System32\smss.exe;:\Windows\system32\wininit.exe;\Bin\FMS.exe; \EMET_GUI.exe;\EMET_Service.exe;\Google\Update\GoogleUpdate.exe;\RAAGTAPP.EXE;\controls\cef\ConnectWise.exe;C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe;C:\Program Files\Hewlett-Packard\AMS\service\hpqams.exe;C:\Program Files\Intel\SUR\WILLAMETTE\ESRV\esrv_svc.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\WINDOWS\system32\WerFault.exe;C:\WINDOWS\system32\taskkill.exe;C:\Windows\SysWOW64\WerFault.exe;C:\Windows\System32\snmp.exe;C:\Windows\system32\msiexec.exe;C:\Windows\system32\spoolsv.exe;C:\Windows\system32\svchost.exe - - - :\Windows\system32\sppsvc.exe - :\Windows\system32\sdiagnhost.exe - - UNKNOWN(00007F - - C:\Windows\SYSTEM32\ntdll.dll - C:\Windows\SYSTEM32\win32u.dll - C:\Windows\SYSTEM32\wow64win.dll - - - - - - - - - - \TEMP\nessus_ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - solarwinds.businesslayerhost - .exe;.dll;.ps1;.mz;.jpg;.png - - - C:\WINDOWS\SysWOW64\netsetupsvc.dll - - - C:\Windows\SoftwareDistribution - C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_;.exe - .exe - - - proj - .targets - .build - .props - .tasks - .sln - .cs - - - - - - - .bat - .btm - .cmd - .com - .cmdline - .bas - .bin - C:\Windows\SysWOW64\Wbem - C:\Windows\System32\Wbem - .ws - .wsc - .wsf - .wsh - .pif - - .hta - - IronPython - .py - .pyc - .pyd - - - .cdxml - .ps1 - .ps1xml - .psc1 - .psd1 - .psm1 - .pssc - - - powershell.exe;powershell_ise.exe - - C:\Windows\SysWOW64\WindowsPowerShell - C:\Windows\System32\WindowsPowerShell - c:\Windows\System32\WindowsPowerShell\v1.0\profile - c:\Windows\Syswow64\WindowsPowerShell\v1.0\profile - \UsageLogs\powershell.exe.log - PSReadLine\ConsoleHost_history.txt - - .vbs - .oracle_jre_usage\ - .js - .jse - .vb - .vbe - .vbsript - - - - - Report.wer.tmp - \WER\ - C:\Windows\system32\wermgr.exe - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe - .exe - C:\Users - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe - .dll - C:\Users - - - - - - - - - - - !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;==READ==THIS==PLEASE==;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy - - crackmapexec - \Crypto.Cipher._AES.pyd - \Crypto.Cipher._DES.pyd - \Crypto.Hash._SHA256.pyd - \Crypto.Random.OSRNG.winrandom.pyd - \Crypto.Util.strxor.pyd - \crackmapexec.exe.manifest - \greenlet.pyd - BootStrapDLL.dll - C:\windows\temp\wininit.exe - lazycat;powerkatz;mimikatz;mimidrv;mimilove;mimilib;mimikittenz;mimiauth;invoke-mimi - rdpwrap.dll - winspool.drv - - C:\Windows\System32\Wbem - C:\Windows\SysWOW64\Wbem - C:\WINDOWS\system32\wbem\scrcons.exe - - - - - \Programs\Startup\ - \Startup\ - - - - - - - - - - - - \Word\STARTUP\ - \Microsoft\Templates\ - \Excel\XLSTART\ - .dotm - .XLSB - - - C:\Windows\Tasks\ - - - w3wp.exe - .aspx - \wwwroot\aspnet_client\ - - - w3wp.exe - .php - - - w3wp.exe - .aaa - - - \wwwroot\aspnet_client\ - .aspx;.php - - - \wwwroot\ - \wwwroot\aspnet_client\;jpg - - - .asp - \wwwroot\ - - - .aspx - \wwwroot\ - - \ecp\auth\ - \oab\auth\ - ClientAccess\Owa\ - \owa\auth\ - httpproxy\rpc\ - ClientAccess\ecp\ - \htdocs\ - - - - - - - - - - - - - - - .SPL - spoolsv.exe;printfilterpipelinesvc.exe;printisolationhost.exe;splwow64.exe;msiexec.exe;poqexec.exe - - - spoolsv.exe - .exe - C\:\Windows\System32\spool\;C\:\Windows\Temp\;C\:\Users\ - - - msiexec.exe - \Microsoft\Edge\Application - elevation_service.exe - - - - - - - - - - - - - - - - - - - - - - - - - \LocalState\rootfs\ - - - - C:\PerfLogs\ - C:\Temp\ - C:\Users\Default\ - C:\Users\Public\ - C:\Windows\Temp\ - \AppData\Temp\ - C:\WINDOWS\system32\dxgiadaptercache.exe - - $Recycle.Bin - $Recycle.Bin - - C:\Windows\ - \config\systemprofile\ - - - C:\Windows\ - \config\systemprofile\ - - - - - - - - - - - - - - - - - .chm - - - - - - - proj - .sln - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - UMWorkerProcess.exe;UMService.exe - . - .log;.cfg;.txt;cleanup;.HealthCheck;\wp.active;.db - - - - - - - - - - - - - - .7z - .7zip - .arj - .s7z - .a - .ace - .ar - .arc - .bin - .cab - .pak - .gz - .img - .iso - .lzm - .lzma - Temp\Rar$ - .rar - RarSFX - .sfx - .sz - .tar - .tar.gz - .xz - .zip - - - - - - - - - - - - - .ost - .eml - .msg - .pst - - - - - - - - - - Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք - - - - - - - Teamviewer.exe - rundll32.exe - mstsc.exe - cmd.exe - ipy.exe - WScript.exe - cscript.exe - mshta.exe - python.exe - wmic.exe - - - - - - - HiddenService - torrc - \tor.exe - tor-gencert - - - - - - - - - - - - - - - - rclone - s3browser - grabff.exe - grabff.exe - - - - - - RESTORE_;_FILES.txt - - - DECRYPT_;_FILES.txt - - - \run.dat;\task.dat;\storage.dat - AppData - Symantec - BlueJeans - - - VBoxRT.dll;VboxC.dll - - - - - - - - - - - - - - Content.IE5;INetCache - .exe;.zip;.ps1;.bat;.rar;.dll - - - MSForms.exd - - - .exe - C:\windows\system32\ - - - .exe - C:\windows\ - \system32\ - - - .dll;.exe - C:\windows\ - C:\Users\ - - - .dll;.exe - C:\Users\ - - - \Microsoft\Word\Startup\ - .wll - - - C:\windows\system32\CodeIntegrity\ - - - \Microsoft\Excel\Startup\ - .xll - - - \Microsoft\Outlook\VbaProject.OTM - - - \Microsoft\Addins\ - .xla - - - .vsto - - - .bat - C:\Windows\ - C:\ProgramData\Lenovo\SystemUpdate\sessionSE\ - - - .dll - C:\Windows\ - - - .sys - C:\Windows\ - - - .exe - C:\Windows\ - C:\Windows\System32\;C:\windows\syswow64\ - - - .exe - C:\Windows\System32\ - - - .exe - C:\Windows\SysWow64\ - - - .theme - - - \Packages\oice_ - - - VirtualboxVM.exe - - notepad++.exe - .lnk:Zone.Identifier - \UsageLogs\cscript.exe.log - \UsageLogs\mshta.exe.log - \UsageLogs\msiexec.exe.log - \UsageLogs\regsvr32.exe.log - \UsageLogs\rundll32.exe.log - \UsageLogs\svchost.exe.log - \UsageLogs\wmic.exe.log - \UsageLogs\wscript.exe.log - \regsvr32.exe.log - \UsageLogs\wsmprovhost.exe.log - .lnk - .url - - .sys - .inf - C:\Windows\SysWOW64\Drivers - C:\Windows\System32\Drivers - \Drivers\ - .drv - - .xlam - .xlsm - .xla - .xll - .xls - .xlsb - .xlsx - .xlt - .xltm - .xlw - \Microsoft\Templates\ - .eml - .msg - .pptm - .potm - .pptm - .pptm - .sldm - \Microsoft\Office\Recent - oleObject - \Downloads\ - \Content.Outlook\ - .docb - .wbk - .ped - .dot - .dotx - .doc - .docm - .docx - - .accdb - .accde - .accdr - .accdt - .mdb - .mde - .msc - .mst - .potx - .ppam - .ppsm - .ppsx - .ppt - .pptm - .pptx - .pub - .sldm - .sldx - .xls - .xps - - - - .pem - .crt - .ca-bundle - .cer - .csr - .der - .p7b - .p7r - .p7s - .pfx - .sto - .p12 - .crl - .sst - .key - - - - .hlp - ACLUI.DLL.UI - ACLUI.DLL - AFLogVw.exe - AShld.exe - AShldRes.DLL.asr - AShldRes.DLL - AhnI2.dll - CamMute.exe - CommFunc.dll - CommFunc.jax - DESqmWrapper.dll - DESqmWrapper.wrapper - FSPMAPI.dll.fsp - FSPMAPI.dll - Gadget.exe - LoLTWLauncher.exe - Mc.exe - McUtil.dll.ping - McUtil.dll.url - McUtil.dll - MpSvc.dll - MsMpEng.exe - NtUserEx.dat - NtUserEx.dat - NtUserEx.dll - NtUserEx.dll - NvSmart.exe - NvSmartMax.dll - NvSmartMax.dll - NvSmartMaxapp.dll - OInfo11.ISO - OInfo11.ocx - OInfoP11.exe - OleView.exe - OleView.exe - POETWLauncher.exe - RasTls.dll.config - RasTls.dll.msc - RasTls.dll - RasTls.exe - RunHelp.exe - Sidebar.dll.doc - Sidebar.dll - Ushata.dll - Ushata.exe - Ushata.fox - VeetlePlayer.exe - boot.ldr - chrome_frame_helper.dll.rom - chrome_frame_helper.dll - chrome_frame_helper.exe - dvcemumanager.exe - fsguidll.exe - fslapi.dll.gui - fslapi.dll - fsstm.exe - hccutils.dll.res - hccutils.dll - hha.dll.bak - hha.dll - hhc.exe - hkcmd.exe - iviewers.dll - jli.dll - libvlc.dll - mPclient.dll - mcf.ep - mcf.exe - mcupdui.exe - mcut.exe - mcutil.dll.bbc - mcvsmap.exe - msi.dll.dat - msi.dll - msseces.asm - msseces.exe - mtcReport.ktc - rc.dll - rc.exe - rc.hlp - sep_NE.exe - sep_NE.slf - tplcdclr.exe - winmm.dll - wts.chm - credwiz.exe - - ssMUIDLL.dll - aepic.dll - ftllib.dll - userenv.dll - \Terminal Server Client\Cache\ - C:\Windows\Prefetch - \\tsclient - C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ - \Temp\debug.bin - Temp\7z - C:\Windows\AppPatch\Custom - .chm - .cpl - .mht - \Chrome\User Data\Default\Extensions\ - .crx - .appref-ms - .gadget - .JSE - .exe - .scf - Exchange Server\ClientAccess\Owa\ - \Device\HarddiskVolumeShadowCopy - .zip\ - .FON - .FOT - C:\Windows\System32\GroupPolicy\Machine\Scripts - C:\Windows\System32\GroupPolicy\User\Scripts - .iqy - .ico - .isp - .msc - .manifest - MEMORY.dmp - .msi - .cs - .customDestinations-ms - C:\Windows\Minidump - .PAF - .bmc - .rdp - .rtf - .reg - .SHS - .slk - .SCR - .set - .SettingContent-ms - .SHD - .SPL - .scr - HammerDrillStatus.dll - Microsoft\Windows\WER\ - .ICL - .sdb - .SCT - .SHB - Temp\Temp1_ - - \Microsoft\;CLR_v;\UsageLogs\ - .ade - .adp - .application - .appref-ms - .asc - .bmf - .cer - .dmp - .gpg - .htm - .html - .json - .jsp - .key - .mof - .ocx - .p7b - .p12 - .pem - .pfx - .pgp - .php - .ppk - .war - .xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \Software\Microsoft\Terminal Server Client - DefaultPrinter - - - MountedDevices - Mountpoints2 - Active Setup\Installed Components - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} - - - - - - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\ - LoggedOnUser - - LastLoggedOnUser - LastLoggedOnProvider - - - - - - - HKCR\ms-msdt\ - - - HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck -
DWORD (0x00000001)
- - - - - - - - - SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - \print\ - \AzureAttestService\CoInitializeSecurityParam - C:\$WINDOWS.~BT\ - - - - \AccessVBOM - C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe - - - Security\VBAWarnings - C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe - - - Security\VBAWarnings - C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe - - - EXCEL.exe;WINWORD.exe - {8BD21D32-EC42-11CE-9E0D-00AA006002F3};{5B9D8FC8-4A71-101B-97A6-00000B65C08B} - - - - HKCU\di - - - HKCU\� - - - HKLM\SOFTWARE\Microsoft\AMSI\Providers\ - hklm\software\microsoft\windows script\settings\amsienable - hkcu\software\microsoft\windows script\settings\amsienable - - - - - - Google\Chrome\Extensions - update_url - SetValue - - - - ForcePasswordReset - - - HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC\CurrVal - - - HKLM\SAM\SAM\DOMAINS\Account\Users\ - Last Password Change - - - HKLM\SAM\SAM\DOMAINS\Account\Users\ - Account Expiration - - - HKLM\SAM\SAM\DOMAINS\Account\Users\ - Last Failed Logon - - - HKLM\SAM\SAM\Domains\Builtin\Aliases\00000220\ - - - HKLM\SAM\SAM\Domains\Builtin\Aliases\0000022B\ - - - - SOFTWARE\Microsoft\Wow64\x86\ - - SetValue - \CurrentVersion\Run\ - Add_exclusions_here - - \Microsoft\System\Scripts - \Windows\System\Scripts - HKLM\SYSTEM\Setup\CmdLine - - \Start -
DWORD (0x00000000)
- - - \Start -
DWORD (0x00000001)
- - - \Start -
DWORD (0x00000002)
- - - \Start -
DWORD (0x00000003)
- - - \Start -
DWORD (0x00000004)
- - \ImagePath - \ServiceDll - \ServiceManifest - hkcu\software\microsoft\windows nt\currentversion\windows\run\ - hkcu\software\microsoft\windows\currentversion\explorer\shell folders\common startup - hkcu\software\microsoft\windows\currentversion\explorer\shell folders\startup - hklm\software\microsoft\command processor\autorun - hkcu\software\microsoft\windows nt\currentversion\accessibility\ATs\\*(1)\StartExe - Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup - - \Print\Monitors - - - - - - - HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ - $ - CreateKey - - - HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ - $ - CreateKey - - - - HKLM\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} - C:\WINDOWS\sysmon64.exe - C:\WINDOWS\sysmon.exe - C:\Programdata\sysmon\sysmon64.exe - - - - HKCR\ - (Default) - \shell\open\command\(Default) -
URL:
- - - HKCU\Software\Classes\ - (Default) - \shell\open\command\(Default) -
URL:
- - - HKCR\ - \shell\open\command\(Default) -
%1
- - - HKCU\Software\Classes\ - \shell\open\command\(Default) -
%1
- - - \shell\open\command\DelegateExecute - - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe - - - - Session Manager\KnownDlls - - - - - Outlook\Addins - - - Word\Addins - - - Excel\Addins - - - Powerpoint\Addins - - - Software\Microsoft\VSTO\Security\Inclusion\ - - - Software\Microsoft\VSTO\SolutionMetadata\ - - - - - - - - - - - cmmgr32.exe - - - - HKLU\Software\Microsoft\Command Processor\AutoRun - HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute - HKLM\System\CurrentControlSet\Control\Session Manager\Execute - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell - HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug - HKLM\Software\Microsoft\Command Processor\AutoRun - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup - UserInitMprLogonScript - HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath - - HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages - - - - - - - - \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default) -
C:\Users\Public\;$Recyclebin;\temp\;\Desktop\;\Downloads\;\Content.Outlook\;\Microsoft\Office\
-
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
- - - \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default) -
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
- - - \ProgID\(Default);\TreatAs\(Default) - - - - \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ - Debugger;ReportingMode;MonitorProcess - - - \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ - GlobalFlag -
DWORD (0x00000200)
- - - \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ - MonitorProcess - - - \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ - ReportingMode -
DWORD (0x00000001)
- - - \Microsoft\Windows NT\CurrentVersion\SilentProcessExit - CreateKey - - - \Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules\ - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{;}\EDGEMITMP_;.tmp\setup.exe - - - - - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree - SD - Microsoft\Windows\UpdateOrchestrator - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree - ID - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks - Author - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks - Path - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks - Date - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot - - - - - - SetValue - \Environment\ - - - - - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA -
DWORD (0x00000000)
- - - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin -
DWORD (0x00000000)
- - - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop -
DWORD (0x00000000)
- - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy - \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe - exefile\shell\runas\command\isolatedCommand - - - - - - - - - - - - - \Hidden - - SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\ - $ -
DWORD (0x00000000)
- - - - - HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Parameters - C:\WINDOWS\sysmon64.exe - C:\WINDOWS\sysmon.exe - C:\Programdata\sysmon\sysmon64.exe - - - - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel - MitigationOptions;MitigationAuditOptions - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options - MitigationOptions;MitigationAuditOptions - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmcompute.exe\0\MitigationOptions - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmwp.exe\0\MitigationOptions - msiexec.exe - TiWorker.exe - - - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options - MitigationOptions;MitigationAuditOptions - C:\Program Files\Microsoft Office 15\root\integration\integrator.exe - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acro - - - - DisableTaskMgr - C:\WINDOWS\system32\svchost.exe - C:\windows\SysWOW64\svchost.exe - - - HKLM\SYSTEM\CurrentControlSet\ - \Instances\;Altitude - HKLM\System\CurrentControlSet\Services\CldFlt\Instances\CldFlt\Altitude - SetValue - - - - \Security\Level -
DWORD (0x00000001)
- - - \Security\Level -
DWORD (0x00000002)
- - - \Security\Level -
DWORD (0x00000003)
- - - \Security\Level -
DWORD (0x00000004)
- - - \Outlook\Security - - \Security\Level - - \Word\Security - \Excel\Security - \Security\Level1Remove - - \HideSCAHealth - HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring - HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride - HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting - - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ - \Enabled -
DWORD (0x00000000)
- - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ - \Enabled -
DWORD (0x00000001)
- - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ - \Enabled - - - HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging - \EnableScriptBlockLogging -
DWORD (0x00000000)
- - - HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging - \EnableScriptBlockLogging - DeleteKey;DeleteValue - - - hklm\software\microsoft\windows\currentversion\policies\system\audit - \ProcessCreationIncludeCmdLine_Enabled -
DWORD (0x00000000)
- - - hklm\software\microsoft\windows\currentversion\policies\system\audit - \ProcessCreationIncludeCmdLine_Enabled - DeleteKey;DeleteValue - - - HKLM\System\CurrentControlSet\Services\Eventlog - \CustomSD - - - HKLM\System\CurrentControlSet\Services\Eventlog - \MaxSize - - - - globallyopenports - - EnableFirewall - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List - - - - \Microsoft\.NETFramework\ETWEnabled -
DWORD (0x00000000)
- - - \Microsoft\.NETFramework\NGenAssemblyUsageLog - - - SetValue - \Environment\NGenAssemblyUsageLog - - - SetValue - \Environment\COMPlus_ETWEnabled - - - - - - - - \LastKey - - - SymbolicLinkValue - - - \Software\Microsoft\Windows\CurrentVersion\Explorer - \AppData\;\ProgramData\;\Temp\;C:\users - - - ‮ - - HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg - - - - \Software\Policies\Microsoft\SystemCertificates\;\SOFTWARE\Microsoft\EnterpriseCertificates\;HKLM\SOFTWARE\Microsoft\SystemCertificates\;HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ - CreateKey - C:\WINDOWS\Sysmon64.exe - C:\WINDOWS\Sysmon.exe - C:\WINDOWS\system32\certsrv.exe - C:\WINDOWS\system32\CompatTelRunner.exe - C:\WINDOWS\system32\svchost.exe - C:\Windows\SysWOW64\SearchProtocolHost.exe - C:\Windows\system32\SearchProtocolHost.exe - C:\Windows\system32\taskhost.exe - C:\windows\SysWOW64\svchost.exe - C:\WINDOWS\System32\DriverStore\FileRepository\asus - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe - C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe - - fDenyTSConnections - Terminal Server\WinStations\RDP-Tcp - RDP-tcp\PortNumber - Control\Terminal Server\fSingleSessionPerUser - - - - � - - - Й;ќ;Л;я;К - - - - - - - - HKLM\HARDWARE\ACPI\DSDT - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Account Name - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Display Name - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Email - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP User - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP User - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\MAPI Provider - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 User - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP User - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP Password - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName - SecurityPasswordAES - OptionsPasswordAES - SecurityPasswordExported - PermanentPassword - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - HKLM\SOFTWARE\GitForWindows - - - - - - - - - - - - - - - - - - - - - - - - - HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ - DeleteKey - - - - - - - - - - - \Services\VSS\Diag\(Default) - - - - - - - - HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters - - - HKLM\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters - - - \LastKey - - - \WinStationsDisabled - - - \TSServerDrainMode - - - \TypedURLs - - - HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\disabledcomponents - - - HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage\Bind -
Binary Data
- - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards - - - services\http\parameters\urlaclinf - - - cRecentFiles\c1\ - tDIText - - - \File MRU\Item 1 - - - HKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHash - - - HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - HKLM\Software\Microsoft\Windows\CurrentVersion\RunService - HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - CurrentVersion\Windows\Load - CurrentVersion\Windows\Run - CurrentVersion\Winlogon\Shell - CurrentVersion\Winlogon\System - \Software\Microsoft\Windows NT\CurrentVersion\Windows\load - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - SOFTWARE\Microsoft\.NETFramework\ETWEnabled - \Group Policy\Scripts - Terminal Server\Wds\rdpwd\StartupPrograms - Winlogon\AlternateShells\AvailableShells - Policies\System\Shell - Windows CE Services\AutoStartOnConnect - Windows CE Services\AutoStartOnDisconnect - PreferenceMACs\Default\extensions.settings - CurrentVersion\URL - \CurrentVersion\Font Drivers - HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown - CurrentVersion\Windows\IconServiceLib - Active Setup\Installed Components - NullSessionShares - NullSessionPipes - PasswordExpiryNotification - SafeBoot\AlternateShell - Desktop\Scrnsave.exe - \DisplayVersion - \ModifyPath - \Microsoft\Windows\CurrentVersion\Uninstall\ - \UninstallString - Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman - - \Explorer\FileExts\ - \shell\install\command\ - \ProfileImagePath - - \Classes\AllFilesystemObjects\ - \Classes\*\ - \Software\Microsoft\Ctf\LangBarAddin - \ContextMenuHandlers\ - \CurrentVersion\Shell - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers - \Classes\Directory\ - \Classes\Drive\ - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - \Classes\Folder\ - \Hidden - \HideFileExt - \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components - \SOFTWARE\Classes\Protocols\Filter - \SOFTWARE\Classes\Protocols\Handler - \SharedTaskScheduler - \ShowSuperHidden - \ColumnHandlers - \CopyHookHandlers - \ExtShellFolderViews - \PropertySheetHandlers - \ShellServiceObjectDelayLoad - \ShellServiceObjects - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ - HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand - - HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ - - \3\1809 - \3\2500 - \3\1206 - \DisableSecuritySettingsCheck - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries - HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ - \ProxyServer - SavedLegacySettings - Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy - EnableConsoleTracing - EnableFileTracing - - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ - HKLM\SOFTWARE\Microsoft\Netsh - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ - - HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - - - Office Test\ - - - \Internet Explorer\Toolbar\ - \Internet Explorer\Extensions\ - - \Browser Helper Objects\ - {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ - - \UrlUpdateInfo - \InstallSource - - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ - TamperProtection - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff - \Software\Policies\Microsoft\Windows\System\Scripts\Logoff - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon - \Software\Policies\Microsoft\Windows\System\Scripts\Logon - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup - - Domain - DHCPDefaultGateway - DhcpIPAddress - DhcpNameserver - Dhcpserver - DhcpSubnetMask - Nameserver - \DefaultGateway - PersistentRoutes - }\Category - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - SubnetMask - \Trusted Documents\TrustRecords - Software\Microsoft\VBA\7.1\Common - Software\Microsoft\VBA\7.1\Trusted - \Security\DontTrustInstalledFiles - \Security\Trusted Locations - Security\ProtectedView\DisableInternetFilesInPV - Security\ProtectedView\DisableAttachmentsInPV - Security\ProtectedView\DisableUnsafeLocationsInPV - Software\WinRAR\ArcHistory - WinZip\mru\ - Recent File List - Outlook\WebView\Inbox - Outlook\Today\UserDefinedUrl - Outlook\WebView\Calendar - \Place MRU - \LinkDate - \DriverVerVersion - \DriverVersion - \LowerCaseLongPath - \Publisher - Compatibility Assistant\Store\ - \BinProductVersion - Root\InventoryApplicationShortcut\ - Root\InventoryDriverBinary\ - Root\InventoryDeviceContainer\ - - Root\InventoryApplication\ - ProgramID;Name;Version;Publisher;Language;InstallDate;Source;RootDirPath;HiddenArp;UninstallString;RegistryKeyPath;UserSID;sha256 - - - Root\InventoryApplicationFile\ - ProgramId;FileId;LowerCaseLongPath;Name;OriginalFileName;Publisher;Version;binfileversion;LinkDate;Size;Language;USN;IsPeFile;IsOsComponent;sha256;AppxPackageFullName - - - Root\InventoryApplicationAppV\ - - - Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations - - \Explorer\MountPoints2 - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices - - HKLM\System\CurrentControlSet\services\ - \DeleteFlag -
DWORD (0x00000001)
- - - \ConsentStore\bluetooth - \ConsentStore\contacts - \ConsentStore\hunmanInterfaceDevice - \ConsentStore\location - \ConsentStore\microphone - \ConsentStore\usb\ - \ConsentStore\webcam - \ConsentStore\humanInterfaceDevice - LastVisitedMRU - SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit - \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU - HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR - HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ - HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\Microsoft\Cryptography\OID - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID - HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll - Classes\exefile\shell\runas\command\isolatedCommand - \FriendlyName - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ - \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB - HKLM\SOFTWARE\Microsoft\Tracing\ - - - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318} -
ndis;rndis
- - HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 - - \Software\AppDataLow\Software\Microsoft\ -
.exe;.dll;powershell;wmic
- - Software\Microsoft\Office test\Special\Perf - \CurrentControlSet\Services\NTDS\LsaDbExtPt - \Services\NTDS\DirectoryServiceExtPt - GoToMyPc\FileTransfer\history - GoToMyPc\GuestInvite - Filesharing - DesktopSharing - LogIncomingConnections - LogOutgoingConnections - PermanentPasswordDate - Security_Adminrights - vncviewer\MRU - Autostart_GUI - Meeting_UserName - BuddyLoginName - BuddyLoginTokenID - Always_Online - HKLM\SOFTWARE\Microsoft\CurrentVersion\Policies\System\EnableLinkedConnections - Software\recfg - \Keyboard Layout\Preload\ - \Keyboard Layout\Substitutes\ - HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ - \Client\Enabled - \Server\Enabled - Kitty\Sessions - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel - PuTTY\Sessions - Terminal Server Client\Servers - WinSCP 2\Sessions - WinSCP 2\Sessions - - - - - - - - Content.IE5;INetCache - .exe;.zip;.ps1;.bat;.rar;.vbs;.hta - - - :Zone.Identifier - blob:;about:internet - - - 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - - - Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf - - - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE - - - IMPHASH=19584675D94829987952432E018D5056 - - - IMPHASH=330768a4f172e10acb6287b87289d83b - - - - - - IMPHASH=00000000000000000000000000000000 - AppData\Local\Microsoft\Windows\AppCache\ - \Microsoft\Windows\INetCache\ - \Microsoft\Windows\Temporary Internet Files\Content.IE5 - \Mozilla\Firefox\Profiles\ - .default\prefs-1.js - Microsoft\Windows\Start Menu\Programs\Startup - - - - - - - - - - - - - - - - msagent_;\MSSE-;postex;\status_ - - - \atctl;\userpipe;\iehelper;\sdlrpc;\comnap - - - \PSEXESVC - -stdin - -stdout - - - \svcctl - - - \ntsvcs - - \9f81f59bc58452127884ce513865ed20 - \46a676ab7f179e511e30dd2dc41bd388 - tssmp_endpoint - \NamePipe_MoreWindows - \WCEServicePipe - \ahexec - \cachedumppipe - \csexec - \e710f28d59aa529d6792ca6ff0ca1b34 - \isapi_dg - \isapi_http - \isapi_http - \lsadump - \lsassw - \paexec - \pcheap_reuse - \gruntsvc - \remcom - \rpchlp_3 - \sdlrpc - \winsession - msf-pipe - \atsvc - \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc - \atctl;\userpipe;\iehelper;\sdlrpc;\comnap - \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester - - \pipe\ - CtxSharefilepipe0 - - - \winreg - Anonymous Pipe - - - - - - - ConnectPipe - - - - - lsass - \SQLLocal\RTCLOCAL - \spoolss - C:\Windows\system32\wbem\wmiprvse.exe - C:\Windows\System32\LxRun.exe - C:\Windows\System32\SearchIndexer.exe - C:\Windows\System32\smss.exe - C:\Windows\System32\spoolsv.exe - C:\Windows\System32\wininit.exe - C:\Windows\system32\DFSRs.exe - C:\Windows\SystemApps\Microsoft.Windows - - C:\Windows\Microsoft.NET\Framework - \ngen.exe - - - C:\Windows\SystemApps\ShellExperienceHost_ - \ShellExperienceHost.exe - - C:\Windows\system32\SearchProtocolHost.exe - \System - ProtectedPrefix\LocalService\FTHPIPE - - Exchange Server - - C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\BIN\OWSTIMER.EXE - C:\Windows\syswow64\snmp.exe - c:\windows\system32\inetsrv\w3wp.exe - \M.E.C.Core.WinRMDataCommunicator.NamedPipe. - - C:\Windows\system32\dns.exe - - \sql\query - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe - \TDLN- - vmware- - \InitShutdown - \MsFteWds - \W32TIME_ALT - \WiFiNetworkManagerTask - \Winsock2CatelogChangeListener - \browser - \epmapper - \eventlog - \scerpc - \wkssvc - \ntapvsrq - Anonymous Pipe - - - - - - - - - - Created - - - - - - - type: 16;type: 16 - powershell.exe - - - github - powershell.exe - - - powershell;cscript.exe;wscript.exe;mshta.exe;bitsadmin.exe;\cmd.exe - . - - - dropboxapi.com - \Dropbox\Client\Dropbox.exe;\Dropbox\bin\Dropbox.exe;\Oracle\Java\ - - - 1drv - \AppData\Local\Microsoft\OneDrive\OneDrive.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe;\Internet Explorer\iexplore.exe;C:\Windows\System32\AppHostRegistrationVerifier.exe;C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe;C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe;C:\Program Files\Mozilla Firefox\firefox.exe - - - .box.com;upload - - - mega.nz;mega.co.nz - - - privatlab.com - - - thedoccloud.com;deftsecurity.com;websitetheme.com;highdatabase.com;incomeupdate.com;zupertech.com;panhardware.com;databasegalore.com;avsvmcloud.com;freescanonline.com - - - tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat - - - efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet - - - .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com - - - - 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.nimpool.io;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool;analytics.blue;estream.to - - graph.microsoft.com - dl.dropboxusercontent.com - api.onedrive.com - zoom.us - teamviewer - Screenconnect - - - census - researchscan - scanhub - shadow - shodan - - .download - .kp - .su - .ss - .xn - .sy - .ve - .xxx - .cn - .click - .club - .ir - .ru - .host - .icu - .pw - .website - .ninja - .rocks - .top - .ua - .xyz - - - kuternull.com;rimrun.com;0ffice36o;asushotfix;infestexe;rahasn.webhop.org;rahasn.akamake.net;rahasn.homewealth.biz;winodwsupdates;israirairlines - - githubusercontent.com;github.com - - api.ipify.org;whatismyipaddress.com;edns.ip-api.com;checkip.dyndns.org;icanhazip.com;ifconfig.me;ifconfig.co;ipaddress.com;ipecho.net;ident.me;api.ip.sb;www.myexternalip.com;ip.anysrc.net;wtfismyip.com;myexternalip.com;ipecho.net;checkip.amazonaws.com;goo.gl;git.io;bit.ly;ow.ly;ip-api.com - - tiny-share.com;paste.ee;pastebin.com - - afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com - darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org - adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk - gc._msdcs. - _kerberos._tcp.dc._msdcs. - _kerberos._udp.dc._msdcs. - _ldap._tcp.pdc._msdcs. - wpad - - _ldap. - C:\Windows\ - unknown process - C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe - - - System;svchost.exe;services.exe;unknown process;\;; - - - - - - C:\Program Files (x86)\Admin Arsenal\ - C:\Program Files (x86)\CheckPoint\ - C:\Program Files (x86)\Fortinet\ - C:\Program Files (x86)\OpenDNS\OpenDNS Connector - C:\Program Files (x86)\Razer\Razer Services\ - C:\Program Files (x86)\Trend Micro\ - C:\Program Files (x86)\VMware - C:\Program Files (x86)\Veeam\ - C:\Program Files\CheckPoint\ - C:\Program Files\Trend Micro\ - Slack.exe - \controls\cef\ConnectWise.exe - git-remote-https.exe - C:\Program Files (x86)\Enpass\Enpass.exe - C:\Program Files (x86)\Fiserv\Vision\VisionGUI.NET.exe - C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe - C:\Program Files (x86)\Lenovo\System Update\Tvsukernel.exe - C:\Program Files\VMware\vCenter Server\jre\bin\java.exe - C:\Program Files\VMware\vCenter Server\python\python.exe - C:\Windows\SysWOW64\SearchProtocolHost.exe - C:\Windows\System32\dsregcmd.exe - C:\Windows\sysmon64.exe - C:\Windows\sysmon.exe - brave-sync.s3.dualstack. - .salesforceliveagent.com - ads-serve.brave.com - - .msftncsi.com - ..localmachine - - -pushp.svc.ms - .b-msedge.net - .bing.com - .hotmail.com - .live.com - .live.net - .microsoft.com - .microsoftonline.com - .microsoftstore.com - .ms-acdc.office.com - .msedge.net - .msn.com - .msocdn.com - .s-microsoft.com - .skype.com - .skype.net - .windows.com - .windows.net.nsatc.net - .windowsupdate.com - .xboxlive.com - login.windows.net - - .activedirectory.windowsazure.com - .msauth.net - .msftauth.net - .opinsights.azure.com - management.azure.com - outlook.office365.com - portal.azure.com - - .mozaws.net - .mozilla.com - .mozilla.net - .mozilla.org - .spotify.com - .spotify.map.fastly.net - googleapis.com - clients1.google.com - clients2.google.com - clients3.google.com - clients4.google.com - clients5.google.com - clients6.google.com - cloudsearch.googleapis.com - id.google.com - safebrowsing.googleapis.com - www.googleapis.com - - .akadns.net - .netflix.com - .typekit.net - aspnetcdn.com - ajax.googleapis.com - cdnjs.cloudflare.com - cdnjs.cloudflare.com - fonts.googleapis.com - - .steamcontent.com - - .disqus.com - .fontawesome.com - disqus.com - - .1rx.io - .2mdn.net - .adadvisor.net - .adap.tv - .addthis.com - .adform.net - .adnxs.com - .adroll.com - .adrta.com - .adsafeprotected.com - .adsrvr.org - .advertising.com - .amazon-adsystem.com - .amazon-adsystem.com - .analytics.yahoo.com - .aol.com - .betrad.com - .bidswitch.net - .casalemedia.com - .chartbeat.net - .cnn.com - .convertro.com - .criteo.com - .criteo.net - .crwdcntrl.net - .demdex.net - .domdex.com - .dotomi.com - .doubleclick.net - .doubleverify.com - .emxdgt.com - .exelator.com - .google-analytics.com - .googleadservices.com - .googlesyndication.com - .googletagmanager.com - .googlevideo.com - .gstatic.com - .gvt1.com - .gvt2.com - .ib-ibi.com - .jivox.com - .mathtag.com - .moatads.com - .moatpixel.com - .mookie1.com - .myvisualiq.net - .netmng.com - .nexac.com - .nexac.com - .openx.net - .optimizely.com - .outbrain.com - .pardot.com - .phx.gbl - .pinterest.com - .pubmatic.com - .quantcount.com - .quantserve.com - .revsci.net - .rfihub.net - .rlcdn.com - .rubiconproject.com - .scdn.co - .scorecardresearch.com - .serving-sys.com - .sharethrough.com - .simpli.fi - .sitescout.com - .smartadserver.com - .snapads.com - .spotxchange.com - .taboola.com - .taboola.map.fastly.net - .tapad.com - .tidaltv.com - .trafficmanager.net - .tremorhub.com - .tribalfusion.com - .turn.com - .twimg.com - .tynt.com - .w55c.net - .ytimg.com - .zorosrv.com - ads.yahoo.com - 1rx.io - adservice.google.com - ampcid.google.com - clientservices.googleapis.com - d29x207vrinatv.cloudfront.net - googleadapis.l.google.com - imasdk.googleapis.com - l.google.com - ml314.com - mtalk.google.com - update.googleapis.com - www.googletagservices.com - - .pscp.tv - - adsniper.ru - cdnvideo.ru - chat.minergate.com - cwsa.minergate.com - forum.minergate.com - leadlab.click - mc.yandex.ru - pool.ntp.org - vmg.host - yandex.ru - .adobe.com - .autodesk.com - .avast.com - .avcdn.net - .cdn.bitdefender.net - .digicert.com - .eset.com - .globalsign.com - .globalsign.net - .intuit.com - .java.com - .macromedia.com - .oracle.com - .quickbooks.com - .usertrust.com - amazontrust.com - ocsp.identrust.com - pki.goog - ads.playground.xyz - citrixupdates.cloud.com - forticlient.fortinet.net - mft10.onbaseonline.com - msocsp.com - ocsp.comodoca.com - ocsp.cybertrust.ne.jp - ocsp.entrust.net - ocsp.entrust.net - ocsp.godaddy.com - ocsp.int-x3.letsencrypt.org - ocsp.intel.com - ocsp.msocsp.com - ocsp.quovadisglobal.com - ocsp.quovadisoffshore.com - ocsp.sectigo.com - ocsp.starfieldtech.com - ocsp.thawte.com - ocsp.trustwave.com - ocsp.verisign.com - pki-goog.l.google.com - pki.intel.com - scrootca1.ocsp.secomtrust.net - scrootca2.ocsp.secomtrust.net - stats.anchor.host - status.rapidssl.com - status.thawte.com - ts-ocsp.ws.symantec.com - upgrade.bitdefender.com - - - - - - - - - - - - - - - - - .;>;unknown;anonymous - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Symantec\ - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files\Symantec\ - - - - - - - \BHO\ie_to_edge_stub.exe;\Microsoft\Teams\;\Vivaldi\Application\;Google\Chrome\;Google\Update;BraveSoftware\Brave-Browser\;Edge\Application\;EdgeUpdate\Install\;Program Files\SmartGit\ - - - - - - - - - - - \appdata\local\google\chrome\user data\swreporter\;software_reporter_tool.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - NETWORK SERVICE; LOCAL SERVICE - - - - - - - OUTLOOK.exe;WINWORD.exe;EXCEL.EXE;powerpnt.exe;msaccess.exe;mspub.exe;eqnedt32.exe;visio.exe;wordpad.exe;wordview.exe;msohtmed.exe;lync.exe;teams.exe - :\Program Files\Microsoft Office\;:\Program Files (x86)\Microsoft Office\ - - - w3wp.exe;tomcat;apache;nginx;httpd - whitelist_me_here - - - powershell.exel;powershell_ise.exe - whitelist_me_here - - - .exe - .pdf;.doc;.xls;.doc;.ppt;.txt;.rtf;.htm;.iso;.zip;.rar;.7z - - - psexesvc - psexec - - - wmiprvse.exe - - - C:\Users\Public\ - amdsfhdcd.bin - intuit - - - AcroRd32.exe;notepad.exe;mshta.exe;hh.exe;certutil.exe;certoc.exe;certreq.exe;desktopimgdownldr.exe;esentutl.exe;finger.exe;presentationhost.exe;cscript.exe;wscript.exe;mspaint.exe;RdrCEF.exe - - - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 - IMPHASH=3A19059BD7688CB88E70005F18EFC439 - IMPHASH=bf6223a49e45d99094406777eb6004ba - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF - IMPHASH=4C1B52A19748428E51B14C278D0F58E3 - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A - IMPHASH=672B13F4A0B6F27D29065123FE882DFC - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 - IMPHASH=D21BBC50DCC169D7B4D0F01962793154 - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC - IMPHASH=6118619783FC175BC7EBECFF0769B46E - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA - IMPHASH=563233BFA169ACC7892451F71AD5850A - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 - IMPHASH=13F08707F759AF6003837A150A371BA1 - IMPHASH=1781F06048A7E58B323F0B9259BE798B - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 - IMPHASH=713C29B396B907ED71A72482759ED757 - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E - IMPHASH=8B114550386E31895DFAB371E741123D - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 - IMPHASH=9D68781980370E00E0BD939EE5E6C141 - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE - IMPHASH=CB567F9498452721D77A451374955F5F - IMPHASH=730073214094CD328547BF1F72289752 - IMPHASH=17B461A082950FC6332228572138B80C - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 - IMPHASH=819B19D53CA6736448F9325A85736792 - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 - IMPHASH=0588081AB0E63BA785938467E1B10CCA - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 - IMPHASH=4DA924CF622D039D58BCE71CDF05D242 - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E - IMPHASH=E6F9D5152DA699934B30DAAB206471F6 - IMPHASH=3AD59991CCF1D67339B319B15A41B35D - IMPHASH=FFDD59E0318B85A3E480874D9796D872 - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 - IMPHASH=0E2216679CA6E1094D63322E3412D650 - IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB - IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 - IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 - IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 - IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F - IMPHASH=767637C23BB42CD5D7397CF58B0BE688 - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC - IMPHASH=7D010C6BB6A3726F327F7E239166D127 - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F - IMPHASH=5834ED4291BDEB928270428EBBAF7604 - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 - IMPHASH=3DE09703C8E79ED2CA3F01074719906B - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F - IMPHASH=E96A73C7BF33A464C510EDE582318BF2 - IMPHASH=32089B8851BBF8BC2D014E9F37288C83 - IMPHASH=09D278F9DE118EF09163C6140255C690 - IMPHASH=03866661686829D806989E2FC5A72606 - IMPHASH=E57401FBDADCD4571FF385AB82BD5D6D - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE - IMPHASH=19584675D94829987952432E018D5056 - IMPHASH=330768A4F172E10ACB6287B87289D83B - - - \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll - - - certutil.exe - certoc.exe - CertReq.exe - - Desktopimgdownldr.exe - esentutl.exe - - finger.exe - presentationhost.exe - - - bitsadmin.exe - C:\Windows;$WINDOWS.;\SoftwareDistribution\ - System - TrustedInstaller;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC - - - \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll - - - - - \ No newline at end of file From 56e1b071dde84162bd43a711b8bcaeb791ea78e0 Mon Sep 17 00:00:00 2001 From: cyberkryption Date: Sun, 25 Sep 2022 16:12:28 +0100 Subject: [PATCH 367/471] Update sysmonconfig-export.xml --- sysmonconfig-export.xml | 1294 +++++++++++++++++++-------------------- 1 file changed, 647 insertions(+), 647 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 50017341..16064f68 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -287,19 +287,19 @@ explorer.exe --> - + svchost.exe;taskhostw.exe;userinit.exe;smss.exe;csrss.exe;wininit.exe;winlogon.exe;lsass.exe;logonui.exe;services.exe C:\windows\System32\;C:\windows\syswow64\ wininit.exe;winlogon.exe;services.exe;dwm.exe;System;smss.exe;svchost.exe - + \spoolsv.exe;\PrintIsolationHost.exe C:\Windows\System32\spoolsv.exe;\GPLGS\gswin32c.exe;C:\Windows\System32\spool\drivers\;\bin\gswin64c.exe;C:\PROGRA~2\CUTEPD~1\;C:\Windows\EEFPrinter.exe C:\Windows\system32\spool\DRIVERS Brother Industries;Thomson Reuters COMSPEC - ScriptFile + ScriptFile AppData\Local\Temp\7z AppData\Local\Temp\Temp1_ \AppData\Local\Temp\Rar$ @@ -312,8 +312,8 @@ Shellcode - ipy.exe - python.exe + ipy.exe + python.exe -agentpath: -agentlib: @@ -637,7 +637,7 @@ NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC NT AUTHORITY\SYSTEM;СИСТЕМА;NT-AUTORITÄT\SYSTEM;AUTORITE NT\SYSTEM - c:\windows\system32\svchost.exe -k netsvcs -s Appinfo + c:\windows\system32\svchost.exe -k netsvcs -s Appinfo runas.exe @@ -701,8 +701,8 @@ unknown process - \LocalState\rootfs\ - \LocalState\rootfs\ + \LocalState\rootfs\ + \LocalState\rootfs\ @@ -750,8 +750,8 @@ IMPHASH=330768a4f172e10acb6287b87289d83b - PsKill.exe - + PsKill.exe + Set-MpPreference;Add-MpPreference;Remove-MpPreference;MpCmdRun.exe RemoveDefinitions;RemoveDynamicSignature;DisableIOAVProtection;DisableRealTimeMonitoring;DisableBehaviorMonitoring;DisableBlockAtFirstSeen;DisableIOAVProtection;DisablePrivacyMode;DisableScriptScanning;DisableRealtimeMonitoring;DisableScanningNetworkFiles;DisableScanningMappedNetworkDrivesForFullScan;DisableRestorePoint;DisableRemovableDriveScanning;SignatureDisableUpdateOnStartupWithoutEngine;DisableIntrusionPreventionSystem;DisableScanOnRealtimeEnable;DisableArchiveScanning;DisableIntrusionPreventionSystem;DisableScriptScanning;DisableOnAccessProtection;ExclusionExtension;ExclusionPath;ExclusionProcess;ThreatDefaultAction;TamperProtection @@ -772,7 +772,7 @@ wevtutil.exe im ClickToRun - + fltMC.exe detach;unload @@ -825,7 +825,7 @@ reg add hkcu\software\classes\ reg.exe add hkcu\software\classes\ - C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry + C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry regedit.exe : @@ -904,7 +904,7 @@ 0x - + csc.exe \AppData\;\Windows\Temp\ @@ -926,7 +926,7 @@ csc.exe out:;target:library - Microsoft.Workflow.Compiler.exe + Microsoft.Workflow.Compiler.exe @@ -1028,17 +1028,17 @@ conhost.exe \mscorsvw.exe;\wermgr.exe;\WerFault.exe;\WerFaultSecure.exe - System.Management.Automation + System.Management.Automation - + InstallUtil.exe /logfile=;/LogToConsole=false;/U - + InstallUtil.exe -logfile=;-LogToConsole=false;-U @@ -1214,7 +1214,7 @@ syssetup.dll;SetupInfObjectInstallAction setupapi.dll;InstallHinfSection InstallHinfSection - infDefaultInstall.exe + infDefaultInstall.exe rundll32.exe "C:\Windows\twain_64.dll" shdocvw.dll;OpenURL advpack.dll;RegisterOCX @@ -1266,7 +1266,7 @@ msbuild.exe .lnk - .csproj + .csproj @@ -1442,7 +1442,7 @@ reg query reg.exe query - driverquery.exe + driverquery.exe tracert.exe @@ -1547,14 +1547,14 @@ ADD;DEL;CHANGE;-f qwinsta.exe - rwinsta.exe + rwinsta.exe - + Microsoft Office\root\Office Microsoft Office\root\Office automation;Embedding @@ -1677,9 +1677,9 @@ psshutdown psservice PsPasswd - mstsc.exe + mstsc.exe telnet.exe - tftp.exe + tftp.exe powershellcustomhost @@ -1928,8 +1928,8 @@ delete catalog wbadmin delete catalog erase - -nw -exec= - -p -nw + -nw -exec= + -p -nw shred diskshadow @@ -1960,7 +1960,7 @@ AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz - + ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool CPU miner;GPU miner;Lime Miner;XMRig CPU miner; miner @@ -1968,9 +1968,9 @@ b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 - 87AECF008D87EC86EC8B00A2394B3E6C - FB3F0D0DE8B80EA8CFAB2A025EC6B833 - F4067FBF7FFF6945D0BB485B727B39AA + 87AECF008D87EC86EC8B00A2394B3E6C + FB3F0D0DE8B80EA8CFAB2A025EC6B833 + F4067FBF7FFF6945D0BB485B727B39AA 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b @@ -2024,54 +2024,54 @@ pythonEngine.Execute sesshijack file:// - HTML Application host - Manager Profile Installer - Microsoft Application Virtualization Injector - Application Compatibility Database Installer + HTML Application host + Manager Profile Installer + Microsoft Application Virtualization Injector + Application Compatibility Database Installer popd.exe pushd.exe subst.exe doskey.exe cls.exe \ - C:\Windows\system32\svchost.exe -k iissvcs + C:\Windows\system32\svchost.exe -k iissvcs \ acrobat.exe acrord32.exe - java.exe - javaw.exe + java.exe + javaw.exe - + C:\Windows\system32\svchost.exe cacls takeown - /x Macro - + /x Macro + \pipe\ > - /noprofile - /sc ONEVENT - \\VBOXSVR - | more - |more - \\tsclient - %PROCESSOR_ARCHITECTURE% - sysnative - AutoIt - Microsoft Filter Loader - more.com - :\Windows\Microsoft.NET\ - acrord32.exe - gpupdate.exe - :\Windows\Microsoft.NET\ + /noprofile + /sc ONEVENT + \\VBOXSVR + | more + |more + \\tsclient + %PROCESSOR_ARCHITECTURE% + sysnative + AutoIt + Microsoft Filter Loader + more.com + :\Windows\Microsoft.NET\ + acrord32.exe + gpupdate.exe + :\Windows\Microsoft.NET\ @@ -2230,7 +2230,7 @@ \wwwroot\ - \Windows\addins\ + \Windows\addins\ C:\Windows\repair\ \htdocs\ C:\Windows\system32\config\systemprofile\ @@ -2247,8 +2247,8 @@ C:\Users\NetworkService\ C:\Users\Public\ C:\Windows\Media\ - \Windows\IME\ - C:\ProgramData + \Windows\IME\ + C:\ProgramData @@ -2475,11 +2475,11 @@ - + 50050 true - + 25 \Bin\EdgeTransport.exe;Bin\MSExchangeFrontendTransport.exe true @@ -2543,11 +2543,11 @@ - 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool - + C:\Windows\system32\svchost.exe 3389 22 @@ -2555,24 +2555,24 @@ 5985 false - + C:\Windows\system32\svchost.exe true 135 445 5985 - + System svchost.exe 445 - + System svchost.exe;lsass.exe 389 - + C:\Windows\System32\lsass.exe 389 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 @@ -2580,103 +2580,103 @@ 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 false - + notepad.exe 127.0.0.1 - + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 80 443 true - github - githubusercontent.com - + github + githubusercontent.com + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 80 true - + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 443 true - + apache.exe - + java.exe - + w3wp.exe - + \php-cgi.exe;\php.exe - + setup - + tomcat - + unins - + unknown process - + explorer.exe - + inetinfo.exe - netcat.exe;nc.exe;nc64.exe;ncat.exe - procdump - psexe - vnc;vncs;vncv + netcat.exe;nc.exe;nc64.exe;ncat.exe + procdump + psexe + vnc;vncs;vncv rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe;advanced_port_scanner.exe;rcpping.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe - 0 + 0 5985 5986 - 1293 - 1701 - 1194 - 3540 - 3389 - 22 - 1080 - 3128 - 8080 - 1723 - 23 - 4500 - 9001 - 9030 - 5900 - 5800 + 1293 + 1701 + 1194 + 3540 + 3389 + 22 + 1080 + 3128 + 8080 + 1723 + 23 + 4500 + 9001 + 9030 + 5900 + 5800 - 0 - + 0 + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 443 true - + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 80 true - 80 - 443 - 636 - 5900 - 443 + 80 + 443 + 636 + 5900 + 443 afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com @@ -2815,7 +2815,7 @@ MSExchangeFrontendTransport.exe MSExchangeHMWorker.exe MSExchangeSubmission.exe - \ + \ @@ -2827,18 +2827,18 @@ - + C:\Windows\ \System32\;Syswow64;sysmon.exe;sysmon64.exe - + C:\Windows\system32\ config\systemprofile\ - + C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe - + A:\;B:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;N:\;O:\;P:\;Q:\;R:\;S:\;T:\;U:\;V:\;W:\;X:\;Y:\;Z:\;AA:\;BB:\;CC:\;DD:\;EE:\;FF:\;GG:\;HH:\;II:\;JJ:\;KK:\;LL:\;MM:\;NN:\;OO:\;PP:\;QQ:\;RR:\;SS:\;TT:\;UU:\;VV:\;WW:\;XX:\;YY;ZZ:\ :\PROGRA~ :\Program Files @@ -2852,29 +2852,29 @@ :\$WinREAgent :\inetpub\ - + \ - + C:\Users\ - + C:\ProgramData\ C:\ProgramData\sysmon\sysmon64.exe;C:\ProgramData\sysmon\sysmon.exe - + C:\Program Files;C:\PROGRA~ - + C:\inetpub\ $RECYCLE.BIN packetbeat.exe;metricbeat.exe;filebeat.exe;winlogbeat.exe;o365beat.exe;graylog-sidecar.exe;graylog-collector-sidecar.exe;splunkd.exe;splunk.exe;syslogng.exe;syslog-ng.exe;nxlog-processor.exe;snarecore.exe;fluentd;td-agent - C:\Windows\system32\config\systemprofile\ - C:\Windows\sysWOW64\config\systemprofile\ + C:\Windows\system32\config\systemprofile\ + C:\Windows\sysWOW64\config\systemprofile\ \Temp\ - C:\Users\ + C:\Users\ @@ -2899,14 +2899,14 @@ lsremora wceaux.dll npcap - \Temp - :\Users + \Temp + :\Users ChongKim Chan ? Revoked Unavailable Valid - false + false @@ -2924,12 +2924,12 @@ msdt.exe sdiageng.dll - + WINWORD.exe;EXCEL.EXE VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wshom.ocx wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - + ntkrnlmp.exe @@ -2943,7 +2943,7 @@ \Users\Public\;\Desktop\;\Downloads\;\AppData\Local\Temp\;\PerfLogs\;$Recycle;\Fonts\ \Program Files - + EQNEDT32.EXE EQNEDT32.EXE @@ -2955,87 +2955,87 @@ ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll wscript.exe;cscript.exe;powershell.exe;rundll32.exe;msbuild.exe;msiexec.exe;csc.exe - + WINWORD.exe;EXCEL.EXE VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wshom.ocx wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll;fastprox.dll - + WINWORD.exe;EXCEL.EXE VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - + WINWORD.exe;EXCEL.EXE VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - + WINWORD.exe;EXCEL.EXE taskschd.dll - + wscript.exe;cscript.exe taskschd.dll - + wmiprvse.exe taskschd.dll - + powershell.exe msi.dll - + powershell amsi.dll - + powershell amsi.dll - + WINWORD.exe;EXCEL.EXE clr.dll - + clr.dll;System.Management.ni.dll;Microsoft.Build.Utilities - + wscript.exe;cscript.exe msxml;wshom.ocx - + wscript.exe;cscript.exe winhttp.dll;mswsock.dll;IPHLPAPI.DLL - + installutil.exe CustomMarshalers.dll;CustomMarshalers.ni.dll;System.Management.ni.dll;WMINet_Utils.dll;mswsock.dll - + System.Management.Automation.ni.dll C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ - + System.Management.Automation.dll C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ Lenovo.Vantage.AddinHost;\Microsoft.Sara.exe;C:\Program Files\CONEXANT - + C:\Windows\System32\vaultcli.dll \svchost.exe;\GameBar.exe;C:\Program Files\WindowsApps;\Microsoft\Teams\current\Teams.exe - + \\ - + \Microsoft\Word\Startup\ .wll - + \Microsoft\Excel\Startup\ .xll - + \Microsoft\Addins\ .xla @@ -3059,14 +3059,14 @@ shcore.dll srvcli.dll - + odbc32.dll;winhttp.dll;netapi32.dll;SHLWAPI.dll - + C:\Windows\Explorer.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - + C:\ProgramData\ C:\ProgramData\ .exe @@ -3075,24 +3075,24 @@ C:\ProgramData\Microsoft\Windows Defender\ C:\ProgramData\sysmon\sysmon64.exe - + C:\Users\Default\;C:\Users\Public\ .exe 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - + C:\Windows\System32\svchost.exe false - + Revoked - + Expired - + jscript9.dll mshta.exe @@ -3119,20 +3119,20 @@ C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_ C:\Windows\explorer.exe - C:\Windows\Microsoft.NET\assembly\GAC_MSIL + C:\Windows\Microsoft.NET\assembly\GAC_MSIL - + \Microsoft Office\ \mscorlib.ni.dll - + \Microsoft Office\ \sppc.dll - + C:\Windows\System32\svchost.exe true @@ -3286,10 +3286,10 @@ C:\Windows\System32\KernelBase.dll+de67e - + ntdll.dll+a0044 - + clr.dll+6c23;clr.dll+6b38 @@ -3342,7 +3342,7 @@ 0x1F3FFF C:\Windows\Microsoft.NET;UNKNOWN - + .exe C:\Windows\sysmon64.exe;C:\Windows\sysmon64.exe 0x1C00 @@ -3372,11 +3372,11 @@ C:\Windows\system32\lsass.exe C:\wfx32\ - + powershell.exe C:\Programdata\sysmon\sysmon64.exe;C:\Programdata\sysmon\sysmon.exe;C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe;\dismhost.exe - + getasynckeystate @@ -3426,8 +3426,8 @@ C:\WINDOWS\system32\sihost.exe C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub - UNKNOWN - + UNKNOWN + |UNKNOWN( C:\WINDOWS\SYSTEM32\ntdll.dll+ |C:\WINDOWS\System32\KERNELBASE.dll+ @@ -3435,11 +3435,11 @@ 0x1028;0x1fffff C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git\ - + winword.exe;excel.exe;powerpnt.exe :\Windows\Microsoft.NET\Framework64\v2.;UNKNOWN - + UNKNOWN 0x147a @@ -3460,12 +3460,12 @@ 0x810 0x820 - cscript.exe - wscript.exe + cscript.exe + wscript.exe jjs.exe dump mimikatz - CorperfmontExt.dll + CorperfmontExt.dll @@ -3488,7 +3488,7 @@ :\Windows\system32\sdiagnhost.exe UNKNOWN(00007F - + C:\Windows\SYSTEM32\ntdll.dll C:\Windows\SYSTEM32\win32u.dll C:\Windows\SYSTEM32\wow64win.dll @@ -3673,7 +3673,7 @@ .XLSB - C:\Windows\Tasks\ + C:\Windows\Tasks\ w3wp.exe @@ -3704,13 +3704,13 @@ .aspx \wwwroot\ - \ecp\auth\ - \oab\auth\ - ClientAccess\Owa\ - \owa\auth\ - httpproxy\rpc\ - ClientAccess\ecp\ - \htdocs\ + \ecp\auth\ + \oab\auth\ + ClientAccess\Owa\ + \owa\auth\ + httpproxy\rpc\ + ClientAccess\ecp\ + \htdocs\ @@ -3761,7 +3761,7 @@ - \LocalState\rootfs\ + \LocalState\rootfs\ @@ -3773,8 +3773,8 @@ \AppData\Temp\ C:\WINDOWS\system32\dxgiadaptercache.exe - $Recycle.Bin - $Recycle.Bin + $Recycle.Bin + $Recycle.Bin C:\Windows\ \config\systemprofile\ @@ -3899,9 +3899,9 @@ .iso .lzm .lzma - Temp\Rar$ + Temp\Rar$ .rar - RarSFX + RarSFX .sfx .sz .tar @@ -3941,11 +3941,11 @@ Teamviewer.exe - rundll32.exe + rundll32.exe mstsc.exe - cmd.exe - ipy.exe - WScript.exe + cmd.exe + ipy.exe + WScript.exe cscript.exe mshta.exe python.exe @@ -4009,88 +4009,88 @@ - + Content.IE5;INetCache .exe;.zip;.ps1;.bat;.rar;.dll - + MSForms.exd - + .exe C:\windows\system32\ - + .exe C:\windows\ \system32\ - + .dll;.exe C:\windows\ C:\Users\ - + .dll;.exe C:\Users\ - + \Microsoft\Word\Startup\ .wll - + C:\windows\system32\CodeIntegrity\ - + \Microsoft\Excel\Startup\ .xll - + \Microsoft\Outlook\VbaProject.OTM - + \Microsoft\Addins\ .xla - + .vsto - + .bat C:\Windows\ C:\ProgramData\Lenovo\SystemUpdate\sessionSE\ - + .dll C:\Windows\ - + .sys C:\Windows\ - + .exe C:\Windows\ C:\Windows\System32\;C:\windows\syswow64\ - + .exe C:\Windows\System32\ - + .exe C:\Windows\SysWow64\ - + .theme - + \Packages\oice_ - + VirtualboxVM.exe - notepad++.exe + notepad++.exe .lnk:Zone.Identifier \UsageLogs\cscript.exe.log \UsageLogs\mshta.exe.log @@ -4102,47 +4102,47 @@ \UsageLogs\wscript.exe.log \regsvr32.exe.log \UsageLogs\wsmprovhost.exe.log - .lnk - .url + .lnk + .url - .sys - .inf - C:\Windows\SysWOW64\Drivers - C:\Windows\System32\Drivers - \Drivers\ + .sys + .inf + C:\Windows\SysWOW64\Drivers + C:\Windows\System32\Drivers + \Drivers\ .drv - .xlam - .xlsm - .xla - .xll - .xls - .xlsb - .xlsx - .xlt - .xltm - .xlw - \Microsoft\Templates\ - .eml - .msg - .pptm - .potm - .pptm - .pptm - .sldm - \Microsoft\Office\Recent - oleObject - \Downloads\ - \Content.Outlook\ - .docb - .wbk - .ped - .dot - .dotx - .doc - .docm - .docx - + .xlam + .xlsm + .xla + .xll + .xls + .xlsb + .xlsx + .xlt + .xltm + .xlw + \Microsoft\Templates\ + .eml + .msg + .pptm + .potm + .pptm + .pptm + .sldm + \Microsoft\Office\Recent + oleObject + \Downloads\ + \Content.Outlook\ + .docb + .wbk + .ped + .dot + .dotx + .doc + .docm + .docx + .accdb .accde .accdr @@ -4165,7 +4165,7 @@ .xps - + .pem .crt .ca-bundle @@ -4183,7 +4183,7 @@ .key - + .hlp ACLUI.DLL.UI ACLUI.DLL @@ -4272,64 +4272,64 @@ wts.chm credwiz.exe - ssMUIDLL.dll + ssMUIDLL.dll aepic.dll ftllib.dll userenv.dll \Terminal Server Client\Cache\ C:\Windows\Prefetch - \\tsclient - C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ + \\tsclient + C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ \Temp\debug.bin - Temp\7z - C:\Windows\AppPatch\Custom - .chm - .cpl - .mht - \Chrome\User Data\Default\Extensions\ - .crx - .appref-ms - .gadget - .JSE - .exe - .scf - Exchange Server\ClientAccess\Owa\ - \Device\HarddiskVolumeShadowCopy - .zip\ - .FON - .FOT - C:\Windows\System32\GroupPolicy\Machine\Scripts - C:\Windows\System32\GroupPolicy\User\Scripts - .iqy - .ico - .isp - .msc - .manifest - MEMORY.dmp - .msi - .cs - .customDestinations-ms - C:\Windows\Minidump - .PAF + Temp\7z + C:\Windows\AppPatch\Custom + .chm + .cpl + .mht + \Chrome\User Data\Default\Extensions\ + .crx + .appref-ms + .gadget + .JSE + .exe + .scf + Exchange Server\ClientAccess\Owa\ + \Device\HarddiskVolumeShadowCopy + .zip\ + .FON + .FOT + C:\Windows\System32\GroupPolicy\Machine\Scripts + C:\Windows\System32\GroupPolicy\User\Scripts + .iqy + .ico + .isp + .msc + .manifest + MEMORY.dmp + .msi + .cs + .customDestinations-ms + C:\Windows\Minidump + .PAF .bmc .rdp - .rtf - .reg - .SHS - .slk - .SCR - .set - .SettingContent-ms - .SHD - .SPL - .scr - HammerDrillStatus.dll - Microsoft\Windows\WER\ - .ICL - .sdb - .SCT - .SHB - Temp\Temp1_ + .rtf + .reg + .SHS + .slk + .SCR + .set + .SettingContent-ms + .SHD + .SPL + .scr + HammerDrillStatus.dll + Microsoft\Windows\WER\ + .ICL + .sdb + .SCT + .SHB + Temp\Temp1_ \Microsoft\;CLR_v;\UsageLogs\ .ade @@ -4387,33 +4387,33 @@ - + \Software\Microsoft\Terminal Server Client DefaultPrinter - MountedDevices - Mountpoints2 - Active Setup\Installed Components - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} + MountedDevices + Mountpoints2 + Active Setup\Installed Components + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\ LoggedOnUser - LastLoggedOnUser - LastLoggedOnProvider + LastLoggedOnUser + LastLoggedOnProvider @@ -4459,10 +4459,10 @@ HKCU\di - + HKCU\� - + HKLM\SOFTWARE\Microsoft\AMSI\Providers\ hklm\software\microsoft\windows script\settings\amsienable hkcu\software\microsoft\windows script\settings\amsienable @@ -4470,34 +4470,34 @@ - + Google\Chrome\Extensions update_url SetValue - + ForcePasswordReset - + HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC\CurrVal - + HKLM\SAM\SAM\DOMAINS\Account\Users\ Last Password Change - + HKLM\SAM\SAM\DOMAINS\Account\Users\ Account Expiration - + HKLM\SAM\SAM\DOMAINS\Account\Users\ Last Failed Logon - + HKLM\SAM\SAM\Domains\Builtin\Aliases\00000220\ - + HKLM\SAM\SAM\Domains\Builtin\Aliases\0000022B\ @@ -4542,12 +4542,12 @@ Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup \Print\Monitors - + @@ -4563,7 +4563,7 @@ CreateKey - + HKLM\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} C:\WINDOWS\sysmon64.exe C:\WINDOWS\sysmon.exe @@ -4604,7 +4604,7 @@ - Session Manager\KnownDlls + Session Manager\KnownDlls @@ -4657,12 +4657,12 @@ UserInitMprLogonScript HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath - HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages + HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages @@ -4717,26 +4717,26 @@ SD Microsoft\Windows\UpdateOrchestrator - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree ID - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks Author - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks Path - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks Date - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot @@ -4760,7 +4760,7 @@ HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop
DWORD (0x00000000)
 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe exefile\shell\runas\command\isolatedCommand @@ -4775,7 +4775,7 @@ - \Hidden + \Hidden SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\ $ @@ -4809,7 +4809,7 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acro - + DisableTaskMgr C:\WINDOWS\system32\svchost.exe C:\windows\SysWOW64\svchost.exe @@ -4837,45 +4837,45 @@ \Security\Level
DWORD (0x00000004)
 - + \Outlook\Security \Security\Level - \Word\Security - \Excel\Security - \Security\Level1Remove + \Word\Security + \Excel\Security + \Security\Level1Remove - \HideSCAHealth - HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring - HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride - HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled + \HideSCAHealth + HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring + HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride + HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled
DWORD (0x00000000)
 - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled
DWORD (0x00000001)
 - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled @@ -4908,11 +4908,11 @@ \MaxSize - + globallyopenports EnableFirewall - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List @@ -4935,23 +4935,23 @@ - + \LastKey - + SymbolicLinkValue - + \Software\Microsoft\Windows\CurrentVersion\Explorer \AppData\;\ProgramData\;\Temp\;C:\users - + ‮ - HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg + HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg - + \Software\Policies\Microsoft\SystemCertificates\;\SOFTWARE\Microsoft\EnterpriseCertificates\;HKLM\SOFTWARE\Microsoft\SystemCertificates\;HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ CreateKey C:\WINDOWS\Sysmon64.exe @@ -4968,16 +4968,16 @@ C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe - fDenyTSConnections - Terminal Server\WinStations\RDP-Tcp - RDP-tcp\PortNumber - Control\Terminal Server\fSingleSessionPerUser + fDenyTSConnections + Terminal Server\WinStations\RDP-Tcp + RDP-tcp\PortNumber + Control\Terminal Server\fSingleSessionPerUser - + � - + Й;ќ;Л;я;К @@ -5111,7 +5111,7 @@ - + HKLM\SOFTWARE\GitForWindows @@ -5156,45 +5156,45 @@ - + HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters - + HKLM\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters - + \LastKey - + \WinStationsDisabled - + \TSServerDrainMode - + \TypedURLs - + HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\disabledcomponents - + HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage\Bind
Binary Data
 - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards - + services\http\parameters\urlaclinf - + cRecentFiles\c1\ tDIText - + \File MRU\Item 1 - + HKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHash @@ -5212,207 +5212,207 @@ SOFTWARE\Microsoft\.NETFramework\ETWEnabled \Group Policy\Scripts Terminal Server\Wds\rdpwd\StartupPrograms - Winlogon\AlternateShells\AvailableShells - Policies\System\Shell - Windows CE Services\AutoStartOnConnect - Windows CE Services\AutoStartOnDisconnect - PreferenceMACs\Default\extensions.settings - CurrentVersion\URL - \CurrentVersion\Font Drivers - HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown - CurrentVersion\Windows\IconServiceLib - Active Setup\Installed Components - NullSessionShares - NullSessionPipes - PasswordExpiryNotification - SafeBoot\AlternateShell - Desktop\Scrnsave.exe - \DisplayVersion - \ModifyPath - \Microsoft\Windows\CurrentVersion\Uninstall\ - \UninstallString - Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman + Winlogon\AlternateShells\AvailableShells + Policies\System\Shell + Windows CE Services\AutoStartOnConnect + Windows CE Services\AutoStartOnDisconnect + PreferenceMACs\Default\extensions.settings + CurrentVersion\URL + \CurrentVersion\Font Drivers + HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown + CurrentVersion\Windows\IconServiceLib + Active Setup\Installed Components + NullSessionShares + NullSessionPipes + PasswordExpiryNotification + SafeBoot\AlternateShell + Desktop\Scrnsave.exe + \DisplayVersion + \ModifyPath + \Microsoft\Windows\CurrentVersion\Uninstall\ + \UninstallString + Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman - \Explorer\FileExts\ - \shell\install\command\ - \ProfileImagePath + \Explorer\FileExts\ + \shell\install\command\ + \ProfileImagePath - \Classes\AllFilesystemObjects\ - \Classes\*\ - \Software\Microsoft\Ctf\LangBarAddin - \ContextMenuHandlers\ - \CurrentVersion\Shell - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers - \Classes\Directory\ - \Classes\Drive\ - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - \Classes\Folder\ - \Hidden - \HideFileExt - \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components - \SOFTWARE\Classes\Protocols\Filter - \SOFTWARE\Classes\Protocols\Handler - \SharedTaskScheduler - \ShowSuperHidden - \ColumnHandlers - \CopyHookHandlers - \ExtShellFolderViews - \PropertySheetHandlers - \ShellServiceObjectDelayLoad - \ShellServiceObjects + \Classes\AllFilesystemObjects\ + \Classes\*\ + \Software\Microsoft\Ctf\LangBarAddin + \ContextMenuHandlers\ + \CurrentVersion\Shell + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers + \Classes\Directory\ + \Classes\Drive\ + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + \Classes\Folder\ + \Hidden + \HideFileExt + \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components + \SOFTWARE\Classes\Protocols\Filter + \SOFTWARE\Classes\Protocols\Handler + \SharedTaskScheduler + \ShowSuperHidden + \ColumnHandlers + \CopyHookHandlers + \ExtShellFolderViews + \PropertySheetHandlers + \ShellServiceObjectDelayLoad + \ShellServiceObjects - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ - HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ + HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand - HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ - \3\1809 - \3\2500 - \3\1206 - \DisableSecuritySettingsCheck - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries - HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ - \ProxyServer - SavedLegacySettings - Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy - EnableConsoleTracing - EnableFileTracing + \3\1809 + \3\2500 + \3\1206 + \DisableSecuritySettingsCheck + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries + HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ + \ProxyServer + SavedLegacySettings + Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy + EnableConsoleTracing + EnableFileTracing HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ - HKLM\SOFTWARE\Microsoft\Netsh - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ + HKLM\SOFTWARE\Microsoft\Netsh + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ - HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - Office Test\ + Office Test\ - \Internet Explorer\Toolbar\ - \Internet Explorer\Extensions\ + \Internet Explorer\Toolbar\ + \Internet Explorer\Extensions\ - \Browser Helper Objects\ - {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ + \Browser Helper Objects\ + {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ - \UrlUpdateInfo - \InstallSource + \UrlUpdateInfo + \InstallSource - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ - TamperProtection - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ + TamperProtection + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff - \Software\Policies\Microsoft\Windows\System\Scripts\Logoff - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon - \Software\Policies\Microsoft\Windows\System\Scripts\Logon - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff + \Software\Policies\Microsoft\Windows\System\Scripts\Logoff + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon + \Software\Policies\Microsoft\Windows\System\Scripts\Logon + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup - Domain - DHCPDefaultGateway - DhcpIPAddress - DhcpNameserver - Dhcpserver - DhcpSubnetMask - Nameserver - \DefaultGateway - PersistentRoutes - }\Category - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - SubnetMask - \Trusted Documents\TrustRecords - Software\Microsoft\VBA\7.1\Common - Software\Microsoft\VBA\7.1\Trusted - \Security\DontTrustInstalledFiles - \Security\Trusted Locations - Security\ProtectedView\DisableInternetFilesInPV - Security\ProtectedView\DisableAttachmentsInPV - Security\ProtectedView\DisableUnsafeLocationsInPV - Software\WinRAR\ArcHistory - WinZip\mru\ - Recent File List + Domain + DHCPDefaultGateway + DhcpIPAddress + DhcpNameserver + Dhcpserver + DhcpSubnetMask + Nameserver + \DefaultGateway + PersistentRoutes + }\Category + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + SubnetMask + \Trusted Documents\TrustRecords + Software\Microsoft\VBA\7.1\Common + Software\Microsoft\VBA\7.1\Trusted + \Security\DontTrustInstalledFiles + \Security\Trusted Locations + Security\ProtectedView\DisableInternetFilesInPV + Security\ProtectedView\DisableAttachmentsInPV + Security\ProtectedView\DisableUnsafeLocationsInPV + Software\WinRAR\ArcHistory + WinZip\mru\ + Recent File List Outlook\WebView\Inbox Outlook\Today\UserDefinedUrl Outlook\WebView\Calendar - \Place MRU - \LinkDate - \DriverVerVersion - \DriverVersion - \LowerCaseLongPath - \Publisher - Compatibility Assistant\Store\ - \BinProductVersion - Root\InventoryApplicationShortcut\ - Root\InventoryDriverBinary\ - Root\InventoryDeviceContainer\ - + \Place MRU + \LinkDate + \DriverVerVersion + \DriverVersion + \LowerCaseLongPath + \Publisher + Compatibility Assistant\Store\ + \BinProductVersion + Root\InventoryApplicationShortcut\ + Root\InventoryDriverBinary\ + Root\InventoryDeviceContainer\ + Root\InventoryApplication\ ProgramID;Name;Version;Publisher;Language;InstallDate;Source;RootDirPath;HiddenArp;UninstallString;RegistryKeyPath;UserSID;sha256 - + Root\InventoryApplicationFile\ ProgramId;FileId;LowerCaseLongPath;Name;OriginalFileName;Publisher;Version;binfileversion;LinkDate;Size;Language;USN;IsPeFile;IsOsComponent;sha256;AppxPackageFullName - + Root\InventoryApplicationAppV\ - + Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations - \Explorer\MountPoints2 - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices + \Explorer\MountPoints2 + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices HKLM\System\CurrentControlSet\services\ \DeleteFlag
DWORD (0x00000001)
 - \ConsentStore\bluetooth - \ConsentStore\contacts - \ConsentStore\hunmanInterfaceDevice - \ConsentStore\location - \ConsentStore\microphone - \ConsentStore\usb\ - \ConsentStore\webcam - \ConsentStore\humanInterfaceDevice - LastVisitedMRU - SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit - \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU - HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR + \ConsentStore\bluetooth + \ConsentStore\contacts + \ConsentStore\hunmanInterfaceDevice + \ConsentStore\location + \ConsentStore\microphone + \ConsentStore\usb\ + \ConsentStore\webcam + \ConsentStore\humanInterfaceDevice + LastVisitedMRU + SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit + \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU + HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ - HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\Microsoft\Cryptography\OID - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID - HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll - Classes\exefile\shell\runas\command\isolatedCommand - \FriendlyName - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ - \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\Microsoft\Cryptography\OID + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID + HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll + Classes\exefile\shell\runas\command\isolatedCommand + \FriendlyName + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB - HKLM\SOFTWARE\Microsoft\Tracing\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + HKLM\SOFTWARE\Microsoft\Tracing\ HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318} @@ -5444,33 +5444,33 @@ Software\recfg \Keyboard Layout\Preload\ \Keyboard Layout\Substitutes\ - HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ - \Client\Enabled - \Server\Enabled - Kitty\Sessions - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel - PuTTY\Sessions - Terminal Server Client\Servers - WinSCP 2\Sessions - WinSCP 2\Sessions + HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ + \Client\Enabled + \Server\Enabled + Kitty\Sessions + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel + PuTTY\Sessions + Terminal Server Client\Servers + WinSCP 2\Sessions + WinSCP 2\Sessions - + Content.IE5;INetCache .exe;.zip;.ps1;.bat;.rar;.vbs;.hta - + :Zone.Identifier blob:;about:internet @@ -5553,7 +5553,7 @@ \sdlrpc \winsession msf-pipe - \atsvc + \atsvc \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc \atctl;\userpipe;\iehelper;\sdlrpc;\comnap \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester @@ -5562,13 +5562,13 @@ CtxSharefilepipe0 - \winreg - Anonymous Pipe + \winreg + Anonymous Pipe @@ -5650,7 +5650,7 @@ github powershell.exe - + powershell;cscript.exe;wscript.exe;mshta.exe;bitsadmin.exe;\cmd.exe . @@ -5674,25 +5674,25 @@ thedoccloud.com;deftsecurity.com;websitetheme.com;highdatabase.com;incomeupdate.com;zupertech.com;panhardware.com;databasegalore.com;avsvmcloud.com;freescanonline.com - + tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat - + efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet - + .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com - + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.nimpool.io;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool;analytics.blue;estream.to - graph.microsoft.com - dl.dropboxusercontent.com - api.onedrive.com - zoom.us - teamviewer - Screenconnect + graph.microsoft.com + dl.dropboxusercontent.com + api.onedrive.com + zoom.us + teamviewer + Screenconnect census @@ -5701,33 +5701,33 @@ shadow shodan - .download - .kp - .su - .ss - .xn - .sy - .ve - .xxx - .cn - .click - .club - .ir - .ru - .host - .icu - .pw - .website - .ninja - .rocks - .top - .ua - .xyz + .download + .kp + .su + .ss + .xn + .sy + .ve + .xxx + .cn + .click + .club + .ir + .ru + .host + .icu + .pw + .website + .ninja + .rocks + .top + .ua + .xyz - + kuternull.com;rimrun.com;0ffice36o;asushotfix;infestexe;rahasn.webhop.org;rahasn.akamake.net;rahasn.homewealth.biz;winodwsupdates;israirairlines - githubusercontent.com;github.com + githubusercontent.com;github.com api.ipify.org;whatismyipaddress.com;edns.ip-api.com;checkip.dyndns.org;icanhazip.com;ifconfig.me;ifconfig.co;ipaddress.com;ipecho.net;ident.me;api.ip.sb;www.myexternalip.com;ip.anysrc.net;wtfismyip.com;myexternalip.com;ipecho.net;checkip.amazonaws.com;goo.gl;git.io;bit.ly;ow.ly;ip-api.com @@ -5736,26 +5736,26 @@ afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk - gc._msdcs. - _kerberos._tcp.dc._msdcs. - _kerberos._udp.dc._msdcs. - _ldap._tcp.pdc._msdcs. - wpad - + gc._msdcs. + _kerberos._tcp.dc._msdcs. + _kerberos._udp.dc._msdcs. + _ldap._tcp.pdc._msdcs. + wpad + _ldap. C:\Windows\ unknown process C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe System;svchost.exe;services.exe;unknown process;\;; @@ -6029,7 +6029,7 @@ - + .;>;unknown;anonymous C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Symantec\ @@ -6040,7 +6040,7 @@ - + \BHO\ie_to_edge_stub.exe;\Microsoft\Teams\;\Vivaldi\Application\;Google\Chrome\;Google\Update;BraveSoftware\Brave-Browser\;Edge\Application\;EdgeUpdate\Install\;Program Files\SmartGit\ @@ -6060,35 +6060,35 @@ - + OUTLOOK.exe;WINWORD.exe;EXCEL.EXE;powerpnt.exe;msaccess.exe;mspub.exe;eqnedt32.exe;visio.exe;wordpad.exe;wordview.exe;msohtmed.exe;lync.exe;teams.exe :\Program Files\Microsoft Office\;:\Program Files (x86)\Microsoft Office\ - + w3wp.exe;tomcat;apache;nginx;httpd whitelist_me_here - + powershell.exel;powershell_ise.exe whitelist_me_here - + .exe .pdf;.doc;.xls;.doc;.ppt;.txt;.rtf;.htm;.iso;.zip;.rar;.7z - + psexesvc psexec - + wmiprvse.exe - + C:\Users\Public\ amdsfhdcd.bin intuit - + AcroRd32.exe;notepad.exe;mshta.exe;hh.exe;certutil.exe;certoc.exe;certreq.exe;desktopimgdownldr.exe;esentutl.exe;finger.exe;presentationhost.exe;cscript.exe;wscript.exe;mspaint.exe;RdrCEF.exe From f77cc8b9de2000834c6a54852bbcc35ed594fe51 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 26 Sep 2022 09:34:50 -0400 Subject: [PATCH 368/471] Add Impacket PSExec.py named pipe detection. --- sysmonconfig-export.xml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 16064f68..00f05396 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5525,6 +5525,10 @@ -stdin -stdout + + RemCom_ + stdin;stdout;stderr;communication + \svcctl From 246d73d59f5791ec6991e157560df847a234509e Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 26 Sep 2022 09:51:21 -0400 Subject: [PATCH 369/471] Cobalt Strike detection improvements --- sysmonconfig-export.xml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 00f05396..9f1af729 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5560,7 +5560,20 @@ \atsvc \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc \atctl;\userpipe;\iehelper;\sdlrpc;\comnap - \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester + + \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester;demoagent_ + \wkssvc + \spoolss + \scerpc + \ntsvcs + \SearchTextHarvester + \PGMessagePipe + \MsFteWds + + + \Winsock2\CatalogChangeListener- + -0, + \pipe\ CtxSharefilepipe0 From 35bb32807d2841e4cb5333addd44c029715bf4dc Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 26 Sep 2022 10:24:13 -0400 Subject: [PATCH 370/471] remove msdt command line options that are not always needed. --- sysmonconfig-export.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 9f1af729..ba889d48 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -390,7 +390,6 @@ msdt.exe pcwrun.exe PCWDiagnostic - /af;-af msdt.exe From 3919a29546f5965765809a3a7fc0339085df1675 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 26 Sep 2022 13:35:45 -0400 Subject: [PATCH 371/471] Fixed a few typo's, thanks to VadimKutia and PiRomant --- sysmonconfig-export.xml | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ba889d48..3b00d8b1 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -423,6 +423,8 @@ schtasks.exe + schtasks /TN RtkAudUService64_BG + -change;/change;-delete;/delete;-create;/create at.exe at.exe @@ -3432,7 +3434,8 @@ |C:\WINDOWS\System32\KERNELBASE.dll+ ) 0x1028;0x1fffff - C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git\ + C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git;\Intel\Driver and Support Assistant\DSAService.exe + \Intel\Driver and Support Assistant\ winword.exe;excel.exe;powerpnt.exe @@ -3446,7 +3449,8 @@ C:\Windows\Sysmon64.exe;C:\Windows\Sysmon.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe - C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe;C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe;C:\Program Files (x86)\Google\Update\GoogleUpdate.exe + C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe + C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe;C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe;C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 0x1400 @@ -3630,6 +3634,8 @@ !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;=READ=THIS=PLEASE=;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy + C:\Users\;\Google\Chrome Beta\User Data\;\IndexedDB\ + C:\Program Files\WindowsApps\Microsoft.YourPhone_;C:\Program Files\dotnet\shared\Microsoft.NETCore.App\ crackmapexec \Crypto.Cipher._AES.pyd @@ -3770,7 +3776,6 @@ C:\Users\Public\ C:\Windows\Temp\ \AppData\Temp\ - C:\WINDOWS\system32\dxgiadaptercache.exe $Recycle.Bin $Recycle.Bin @@ -5761,7 +5766,7 @@ _ldap. C:\Windows\ unknown process - C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe + C:\ProgramData\Microsoft\Windows Defender\Platform\;\Windows Defender\MsMpEng.exe;C:\Windows\ From 1ca9915e105a4d87b45121f6d9ebdd05dd33a98c Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 29 Sep 2022 14:11:30 -0400 Subject: [PATCH 374/471] FileBlockExecutable was blocking windows updates due to an issue with double extension executable rules, re-wrote those and added some exploit detection for some network services. --- sysmonconfig-export.xml | 71 +++++++++++++++++++++++++++++++++++++++-- 1 file changed, 68 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 3b810a59..99d2f474 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -263,6 +263,16 @@ .vba .vbe + + \wscript.exe;\cscript.exe + \rundll32.exe;regsvr32.exe + + + \rundll32.exe;regsvr32.exe + .dll;.cpl;.ocx;localserver;enable-speech-input;auto-scan-plugin;enable-media-stream;CastMediaRouteProvider;-eoim;/eoim + setupapi;InstallHinfSection;DefaultInstall;SplunkUniversalForwarder\bin\spl;rundll32.exe "C:\Windows\Installer\MSI + \MSI;.tmp",zzzInvokeManagerCustomActionOutOfProc + cscript.exe .js @@ -488,9 +498,22 @@ psexec.exe pskill.exe pskill + + C:\WINDOWS\system32\svchost.exe -k NetworkService -p + + + C:\WINDOWS\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation + + + C:\WINDOWS\System32\svchost.exe -k netprofm -p -s netprofm + C:\WINDOWS\system32\svchost.exe;RPCSS + + C:\WINDOWS\system32\svchost.exe;RPCSS + werfault.exe + && type @@ -1174,6 +1197,10 @@ RUNDLL32.EXE -sta;/sta + + RUNDLL32.EXE + -localserver;/localserver + RUNDLL32.EXE shell32.dll;OpenAs_RunDLL @@ -2087,6 +2114,7 @@ acrord32.exe gpupdate.exe :\Windows\Microsoft.NET\ + System @@ -6118,9 +6146,21 @@ powershell.exe;powershell_ise.exe whitelist_me_here - - .exe - .pdf;.doc;.xls;.doc;.ppt;.txt;.rtf;.htm;.iso;.zip;.rar;.7z + + .pdf.exe + .doc.exe + .docx.exe + .xls.exe + .xlsx.exe + .ppt.exe + .txt.exe + .rtf.exe + .iso.exe + .zip.exe + .rar.exe + .7z.exe + .ico.exe + .lnk.exe psexesvc @@ -6250,5 +6290,30 @@ + + + + C:\WINDOWS\system32\wuauclt.exe;C:\$WINDOWS.~BT\Sources\SetupHost.Exe + + + C:\Windows\SoftwareDistribution\;C:\$WINDOWS.~BT\NewOS\ + + + + + + \ No newline at end of file From 553b065aae1a5f5586c162d3b18b31fe5919485b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 29 Sep 2022 14:30:10 -0400 Subject: [PATCH 375/471] Merge in @frack113's Event Log tampering rule from the Sigma Project. --- sysmonconfig-export.xml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 99d2f474..a119a685 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -4927,15 +4927,21 @@ \Enabled
DWORD (0x00000000)
 - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled
DWORD (0x00000001)
 - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\ + \ChannelAccess +
(A;;0x1;;;SY);(A;;0x5;;;BA);(A;;0x1;;;LA)
+ C:\Windows\servicing\TrustedInstaller.exe;\TiWorker.exe + HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging \EnableScriptBlockLogging From 5bfe473d50ab25886db2ee4afe3f00e4584db071 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 29 Sep 2022 14:35:36 -0400 Subject: [PATCH 376/471] Fix tagging for safe paths --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index a119a685..c62e660e 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -6302,7 +6302,7 @@ C:\WINDOWS\system32\wuauclt.exe;C:\$WINDOWS.~BT\Sources\SetupHost.Exe - C:\Windows\SoftwareDistribution\;C:\$WINDOWS.~BT\NewOS\ + C:\Windows\SoftwareDistribution\;C:\$WINDOWS.~BT\NewOS\ @@ -3129,6 +3135,14 @@ 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e + + SHA256=074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 + SHA256=45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 + SHA256=9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 + SHA256=29b75f0db3006440651c6342dc3c0672210cfb339141c75e12f6c84d990931c3 + SHA256=c8c907a67955bcdf07dd11d35f2a23498fb5ffe5c6b5d7f36870cf07da47bff2 + SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e + C:\Windows\System32\svchost.exe false @@ -3733,10 +3747,12 @@ C:\Windows\Tasks\ + + RedirSuiteServiceProxy.aspx + w3wp.exe .aspx - \wwwroot\aspnet_client\ w3wp.exe @@ -3747,8 +3763,8 @@ .aaa - \wwwroot\aspnet_client\ - .aspx;.php + \wwwroot\aspnet_client\;\FrontEnd\HttpProxy\owa\auth + .aspx;.php;.ashx \wwwroot\ @@ -5540,6 +5556,14 @@ 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e + + SHA256=074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 + SHA256=45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 + SHA256=9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 + SHA256=29b75f0db3006440651c6342dc3c0672210cfb339141c75e12f6c84d990931c3 + SHA256=c8c907a67955bcdf07dd11d35f2a23498fb5ffe5c6b5d7f36870cf07da47bff2 + SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e + Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf @@ -6183,7 +6207,7 @@ AcroRd32.exe;notepad.exe;mshta.exe;hh.exe;certutil.exe;certoc.exe;certreq.exe;desktopimgdownldr.exe;esentutl.exe;finger.exe;presentationhost.exe;cscript.exe;wscript.exe;mspaint.exe;RdrCEF.exe - + IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 IMPHASH=3A19059BD7688CB88E70005F18EFC439 IMPHASH=bf6223a49e45d99094406777eb6004ba @@ -6270,6 +6294,15 @@ IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE IMPHASH=19584675D94829987952432E018D5056 IMPHASH=330768A4F172E10ACB6287B87289D83B + SHA256=074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 + SHA256=45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 + SHA256=9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 + SHA256=29b75f0db3006440651c6342dc3c0672210cfb339141c75e12f6c84d990931c3 + SHA256=c8c907a67955bcdf07dd11d35f2a23498fb5ffe5c6b5d7f36870cf07da47bff2 + SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e + + + \DrSDKCaller.exe;C:\Users\Public\all.exe;C:\Users\Public\dump.dll;C:\Users\Public\ad.exe;C:\PerfLogs\gpg-error.exe;C:\PerfLogs\cm.exe;C:\Program Files\Common Files\system\ado\msado32.tlb \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll From 97b60decfc578707d2e8becfc664d9c96c9ea285 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 29 Sep 2022 22:37:23 -0400 Subject: [PATCH 378/471] Living in the future lol, fixed the date --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 384b6eb0..18e94fd5 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -3135,7 +3135,7 @@ 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - + SHA256=074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 SHA256=45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 SHA256=9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 @@ -5556,7 +5556,7 @@ 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - + SHA256=074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 SHA256=45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 SHA256=9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 From 93cb04e117870e91249f5a852f15049f2e37858b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 30 Sep 2022 08:15:38 -0400 Subject: [PATCH 379/471] Push update to include Certutil.exe for w3wp.exe subprocesses --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 18e94fd5..9e8d50d9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -374,7 +374,7 @@ apache;w3wp.exe;php-cgi.exe;nginx.exe;httpd.exe;tomcat;php.exe - arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe + arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;certutil.exe cmd.exe From 45430a2f2db5a46b46429da1189e5360bad0cc90 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 30 Sep 2022 08:31:26 -0400 Subject: [PATCH 380/471] Update to Break out IIS Rule from Web Server Exploitation rule to be more specific to IIS. Add appcmd detection complements to Florian Roth and Microsoft for the idea. --- sysmonconfig-export.xml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 9e8d50d9..7605849d 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -373,9 +373,20 @@ tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe - apache;w3wp.exe;php-cgi.exe;nginx.exe;httpd.exe;tomcat;php.exe + apache;php-cgi.exe;nginx.exe;httpd.exe;tomcat;php.exe arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;certutil.exe + + w3wp.exe + \csc.exe;\TranscodingService.exe;\werfault.exe;\appcmd.exe + + + + + \w3wp.exe + \appcmd.exe + appcmd.exe add module;system.enterpriseservices.internal.publish;\gacutil.exe /I;gacutil.exe -I + cmd.exe ping 127.0.0.1 From 31c69e358d8aed7d91568509e8eaeaec503c8528 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 30 Sep 2022 08:41:25 -0400 Subject: [PATCH 381/471] Improve detection targeting by utilizing image filter rather than contains for new IIS detections split from generic Web Server exploitation rule. --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 7605849d..48125eba 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -383,8 +383,8 @@ - \w3wp.exe - \appcmd.exe + w3wp.exe + appcmd.exe appcmd.exe add module;system.enterpriseservices.internal.publish;\gacutil.exe /I;gacutil.exe -I From 894a4e4be3ace0600f32639ecca3b128bf4678f2 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 30 Sep 2022 09:29:15 -0400 Subject: [PATCH 382/471] Per @VadimKutia kaspersky AV noise reduction exclusions added. - Thank you! --- sysmonconfig-export.xml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 48125eba..d89eb4d2 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -2876,6 +2876,11 @@ MSExchangeHMWorker.exe MSExchangeSubmission.exe \ + + + C:\Program Files (x86)\Kaspersky Lab + C:\Program Files\Kaspersky Lab + @@ -3547,6 +3552,10 @@ dump mimikatz CorperfmontExt.dll + + C:\Program Files (x86)\Kaspersky Lab + C:\Program Files\Kaspersky Lab + @@ -5550,6 +5559,10 @@ Terminal Server Client\Servers WinSCP 2\Sessions WinSCP 2\Sessions + + C:\Program Files (x86)\Kaspersky Lab + C:\Program Files\Kaspersky Lab + From 01b73eab1d6660a9953c481dab3145d6627f1611 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 30 Sep 2022 09:31:03 -0400 Subject: [PATCH 383/471] Per @VadimKutia added Opera to browser based detections, thank you for the contribution! --- sysmonconfig-export.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index d89eb4d2..6a3b1c67 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -2653,12 +2653,12 @@ github githubusercontent.com - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe 80 true - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe 443 true @@ -3268,7 +3268,7 @@ msiexec.exe - chrome.exe;firefox.exe;edge.exe;browser_broker.exe;iexplore.exe + chrome.exe;firefox.exe;edge.exe;browser_broker.exe;iexplore.exe;opera.exe 0x001A0000 From 4be2ec901b17ddc72dac2a523bb1510ffd022a55 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 30 Sep 2022 09:51:03 -0400 Subject: [PATCH 384/471] Detection accuracy improvement, matching "image" instead of "is", "is" must match full path instead of full path or image name. --- sysmonconfig-export.xml | 48 ++++++++++++++++++++--------------------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6a3b1c67..e986b813 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -398,33 +398,33 @@ winword.exe;powerpnt.exe;excel.exe - control.exe + control.exe input.dll - msdt.exe + msdt.exe msdt.exe BrowseForFile=;PCWDiagnostic /af;-af - msdt.exe + msdt.exe pcwrun.exe PCWDiagnostic - msdt.exe + msdt.exe /cab;-cab .diagcab powershell.exe;pwsh.exe;cmd.exe;mshta.exe;cscript.exe;wscript.exe;wsl.exe;rundll32.exe;regsvr32.exe - msdt.exe + msdt.exe EQNEDT32.EXE winword.exe;excel.exe;powerpnt.exe - FLTLDR.EXE + FLTLDR.EXE /dde;-dde @@ -666,7 +666,7 @@ PowerUp computerdefaults.exe dism.exe - fodhelper.exe + fodhelper.exe NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC @@ -958,7 +958,7 @@ msiexec.exe - csc.exe + csc.exe out:;target:library Microsoft.Workflow.Compiler.exe @@ -1145,9 +1145,9 @@ csi.exe devtoolslauncher.exe LaunchForDeploy bginfo - devtoolslauncher.exe - wab.exe - wsreset.exe + devtoolslauncher.exe + wab.exe + wsreset.exe cmstp.exe /ni /s;cmstp.exe -ni -s cmstp /ni /s;cmstp -ni -s @@ -1776,7 +1776,7 @@ - clip.exe + clip.exe get-clipboard @@ -2986,7 +2986,7 @@ - msdt.exe + msdt.exe sdiageng.dll @@ -4033,16 +4033,16 @@ - Teamviewer.exe - rundll32.exe - mstsc.exe - cmd.exe - ipy.exe - WScript.exe - cscript.exe - mshta.exe - python.exe - wmic.exe + Teamviewer.exe + rundll32.exe + mstsc.exe + cmd.exe + ipy.exe + WScript.exe + cscript.exe + mshta.exe + python.exe + wmic.exe @@ -6221,7 +6221,7 @@ psexec - wmiprvse.exe + wmiprvse.exe C:\Users\Public\ From b4aeaa9bc19425167b118862b2a3cbd5d1d6df29 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 30 Sep 2022 09:59:32 -0400 Subject: [PATCH 385/471] Target image instead of "contains" round 2 --- sysmonconfig-export.xml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e986b813..5ce40078 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1296,7 +1296,7 @@ msbuild.exe - regasm + regasm.exe msbuild.exe @@ -1407,7 +1407,7 @@ HKCU /f password;HKCU -f password HKLM /f password;HKLM -f password nltest.exe - ProcDump.exe + ProcDump.exe ProcDump @@ -2103,8 +2103,8 @@ C:\Windows\system32\svchost.exe - cacls - takeown + cacls.exe + takeown.exe /x Macro \pipe\ @@ -2399,7 +2399,7 @@ - nbtstat + nbtstat.exe net.exe net1.exe @@ -2687,7 +2687,7 @@ unknown process - explorer.exe + explorer.exe inetinfo.exe @@ -3570,7 +3570,7 @@ - lsass.exe + lsass.exe C:\Windows\system32\w32tm.exe;C:\Windows\System32\ping.exe;C:\Windows\System32\net.exe;C:\Windows\System32\net1.exe;C:\Windows\SYSTEM32\HOSTNAME.EXE;C:\Programdata\sysmon\sysmon.exe;C:\Programdata\sysmon\sysmon64.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\Program Files (x86)\BeAnywhere Support Express\;C:\Program Files (x86)\CheckPoint\;C:\Program Files (x86)\Common Files\Intuit\QuickBooks\;C:\Program Files (x86)\Fortinet\;C:\Program Files (x86)\Trend Micro\;C:\Program Files\Adobe\Adobe Creative Cloud Experience\;C:\Program Files\CheckPoint\;C:\Program Files\Fortinet\;C:\Program Files\Realtek;C:\Program Files\Trend Micro\;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Program Files (x86)\Lenovo\;snmpd.exe;taskmgr;:\Windows\System32\smss.exe;:\Windows\system32\wininit.exe;\Bin\FMS.exe; \EMET_GUI.exe;\EMET_Service.exe;\Google\Update\GoogleUpdate.exe;\RAAGTAPP.EXE;\controls\cef\ConnectWise.exe;C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe;C:\Program Files\Hewlett-Packard\AMS\service\hpqams.exe;C:\Program Files\Intel\SUR\WILLAMETTE\ESRV\esrv_svc.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\WINDOWS\system32\WerFault.exe;C:\WINDOWS\system32\taskkill.exe;C:\Windows\SysWOW64\WerFault.exe;C:\Windows\System32\snmp.exe;C:\Windows\system32\msiexec.exe;C:\Windows\system32\spoolsv.exe;C:\Windows\system32\svchost.exe From feabcbcc34ab39c103c6dc2adea3d54cdb97a039 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 30 Sep 2022 10:02:54 -0400 Subject: [PATCH 386/471] "end with" -> "image" where applicable for performance/detection improvement. --- sysmonconfig-export.xml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 5ce40078..4c8b8f1f 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1703,7 +1703,7 @@ winrshost.exe waitfor.exe wsmprovhost.exe - winrshost.exe + winrshost.exe wsmprovhost.exe wmiprvse.exe @@ -5720,11 +5720,11 @@ C:\Windows\SystemApps\Microsoft.Windows C:\Windows\Microsoft.NET\Framework - \ngen.exe + ngen.exe C:\Windows\SystemApps\ShellExperienceHost_ - \ShellExperienceHost.exe + ShellExperienceHost.exe C:\Windows\system32\SearchProtocolHost.exe \System @@ -5901,9 +5901,9 @@ C:\Program Files (x86)\Veeam\ C:\Program Files\CheckPoint\ C:\Program Files\Trend Micro\ - Slack.exe - \controls\cef\ConnectWise.exe - git-remote-https.exe + Slack.exe + ConnectWise.exe + git-remote-https.exe C:\Program Files (x86)\Enpass\Enpass.exe C:\Program Files (x86)\Fiserv\Vision\VisionGUI.NET.exe C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe From 390ec8f67bc4f98a37288c84d8871fa8fdfe7b14 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 30 Sep 2022 10:44:24 -0400 Subject: [PATCH 387/471] Split out System.Management.Automation Command line detection to new rule format with exclusion for ngen install of System.Management.Automation --- sysmonconfig-export.xml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 4c8b8f1f..60c505a9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1072,7 +1072,10 @@ conhost.exe \mscorsvw.exe;\wermgr.exe;\WerFault.exe;\WerFaultSecure.exe - System.Management.Automation + + System.Management.Automation + "C:\Windows\Microsoft.NET\Framework\;\ngen.exe;install + From 1cd834a587531d3f9799c64ae4da47e555531a84 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 30 Sep 2022 11:31:39 -0400 Subject: [PATCH 388/471] Block binaries from writing to C:\PerfLogs, add additional detections specific to original Exchange 0day attackers. --- sysmonconfig-export.xml | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 60c505a9..fca00b24 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1824,7 +1824,7 @@ - + certutil.exe urlcache;split;f @@ -1855,6 +1855,12 @@ certutil verifyctl;URL + + C:\Perflogs\;C:\Users\Public\;C:\root\ + + + C:\Perflogs\;C:\Users\Public\;C:\root\ + start-bitstransfer expand \\ expand.exe \\ @@ -3147,10 +3153,14 @@ C:\ProgramData\Microsoft\Windows Defender\ C:\ProgramData\sysmon\sysmon64.exe - + C:\Users\Default\;C:\Users\Public\ .exe + + C:\Users\Default\;C:\Users\Public\ + .dll + 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e @@ -4046,6 +4056,14 @@ mshta.exe python.exe wmic.exe + + C:\Users\Default\;C:\Users\Public\ + .dll + + + C:\Users\Default\;C:\Users\Public\ + .exe + @@ -6354,6 +6372,9 @@ \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll + + C:\PerfLogs\ + From 9baf0367595c3629a7e19515d54c46e16498c1cf Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 30 Sep 2022 12:10:24 -0400 Subject: [PATCH 389/471] Per @VadimKutia ESET noise reduction Exclusions added - ty! --- sysmonconfig-export.xml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index fca00b24..9179c70f 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -2889,6 +2889,8 @@ C:\Program Files (x86)\Kaspersky Lab C:\Program Files\Kaspersky Lab + C:\Program Files (x86)\ESET + C:\Program Files\ESET @@ -3568,6 +3570,8 @@ C:\Program Files (x86)\Kaspersky Lab C:\Program Files\Kaspersky Lab + C:\Program Files (x86)\ESET + C:\Program Files\ESET @@ -5583,6 +5587,8 @@ C:\Program Files (x86)\Kaspersky Lab C:\Program Files\Kaspersky Lab + C:\Program Files (x86)\ESET + C:\Program Files\ESET From 2184f799d6fe1d5640b4fb7b769f8204e80363c0 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 30 Sep 2022 12:25:36 -0400 Subject: [PATCH 390/471] Fix is any->contains any --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 9179c70f..bd88e34c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -298,9 +298,9 @@ --> - svchost.exe;taskhostw.exe;userinit.exe;smss.exe;csrss.exe;wininit.exe;winlogon.exe;lsass.exe;logonui.exe;services.exe + \svchost.exe;\taskhostw.exe;\userinit.exe;\smss.exe;\csrss.exe;\wininit.exe;\winlogon.exe;\lsass.exe;\logonui.exe;\services.exe C:\windows\System32\;C:\windows\syswow64\ - wininit.exe;winlogon.exe;services.exe;dwm.exe;System;smss.exe;svchost.exe + \wininit.exe;\winlogon.exe;\services.exe;\dwm.exe;System;\smss.exe;\svchost.exe \spoolsv.exe;\PrintIsolationHost.exe From 98f9b5e567ba3ccdd8db4136c71c91eddc86b1f8 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 3 Oct 2022 11:57:20 -0400 Subject: [PATCH 391/471] Comment Cleanup, use name= tags and Author=key value's for attribution and notes. --- sysmonconfig-export.xml | 350 +++++++++++++++++++++------------------- 1 file changed, 185 insertions(+), 165 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index bd88e34c..119828f7 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -76,7 +76,7 @@ Add exclusions in line enclosed within a Compound rule rather than a global exclusion list. --> - md5,sha256,imphash + md5,sha256,imphash @@ -495,7 +495,7 @@ psexesvc.exe Execute processes remotely - psexe + psexe PsExec Service PsExec Launched @@ -508,7 +508,7 @@ psexec.exe pskill.exe - pskill + pskill C:\WINDOWS\system32\svchost.exe -k NetworkService -p @@ -541,7 +541,6 @@ --disable-http2 --disable-quic /Client/Login?id= JABzA - 2f40abbb4f78e77745f0e657a19903fc953cc664;478dc5a5f934c62a9246f7d1fc275868f568bc07;37b4496e650b3994312c838435013560b3ca8571;37b4496e650b3994312c838435013560b3ca8571;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;807d86da63f0db1fc746d1f0b05bc357;849a2b0dc80aeca3d175c139efe5221c;86A4CAC227078B9C95C560C8F0370BF0;98908ce6f80ecc48628c8d2bf5b2a50c;a4b42c2c95d1f2ff12171a01c86cd64f;4abe604916c04fe3dd8b9cb3d501d3f;eac3e3ece94bc84e922ec077efb15edd;128CECC59C91C0D0574BC1075FE7CB40;88777aacd5f16599547926a4c9202862;0f49621b06f2cdaac8850c6e9581a594;17a36ac3e31f3a18936552aff2c80249;322cb39bc049aa69136925137906d855;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;3d129263f6a48647f103a04446fb0c2f;37cd353621b0f4fc6981b50071c94f01;1b60021baedc3f9201bcdb40e9b87f62;71345b139166482acaa568ac8816c7bc;5E022694C0DBD1FBBC263D608E577949;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc5733c013378fa418d13773f5bfe6f1;c579341f86f7e962719c7113943bb6e4;d326e629a90e78825645963b35e53a6a;5E022694C0DBD1FBBC263D608E577949;53841a0c6a3ff92976db08bfdf95e083;dc7e564809d6c2a2f3457c3c9b91f22b;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b;FE2CA1BE3BDA2A757036A89E54CC02DB;FE2CA1BE3BDA2A757036A89E54CC02DB @@ -672,7 +671,7 @@ NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC NT AUTHORITY\SYSTEM;СИСТЕМА;NT-AUTORITÄT\SYSTEM;AUTORITE NT\SYSTEM - c:\windows\system32\svchost.exe -k netsvcs -s Appinfo + c:\windows\system32\svchost.exe -k netsvcs -s Appinfo runas.exe @@ -928,12 +927,15 @@ ^ TYPE CON > copy CON > - FromBase64String;action=create keyvalue=;VerbosePreference.ToString;SecureString;CSharpCodeProvider;runtime.interopservices.marshal;system.globalization.numberstyles;system.reflection.assembly;hextobin;VerbosePreference.ToString;system.text.encoding;io.filestream;io.filestream;io.seekorigin;text.encoding;unicode.getstring;FromBase64;[Convert]::;System.IO.File]::ReadAllText;|iex + + FromBase64String;action=create keyvalue=;VerbosePreference.ToString;SecureString;CSharpCodeProvider;runtime.interopservices.marshal;system.globalization.numberstyles;system.reflection.assembly;hextobin;VerbosePreference.ToString;system.text.encoding;io.filestream;io.filestream;io.seekorigin;text.encoding;unicode.getstring;FromBase64;[Convert]::;System.IO.File]::ReadAllText;|iex + ngen.exe;install + + certutil decode;encode - ping.exe 0x @@ -1493,7 +1495,7 @@ reg query reg.exe query - driverquery.exe + driverquery.exe tracert.exe @@ -1713,11 +1715,11 @@ mshta.exe - ssh.exe;putty.exe;kitty.exe;kitty_portable.exe + ssh.exe;putty.exe;kitty.exe;kitty_portable.exe PuTTY suite - sftp;psftp + sftp;psftp rundll32.exe @@ -1745,15 +1747,15 @@ --execm;atexec {4991d34b-80a1-4291-83b6-3328366b9097} {00020812-0000-0000-C000-000000000046} - {40AEEAB6-8FDA-41e3-9A5F-8350D4CFCA91} - {7e0423cd-1119-0928-900c-e6d4a52a0715} - {0006F04A-0000-0000-C000-000000000046} + {40AEEAB6-8FDA-41e3-9A5F-8350D4CFCA91} + {7e0423cd-1119-0928-900c-e6d4a52a0715} + {0006F04A-0000-0000-C000-000000000046} {048EB43E-2059-422F-95E0-557DA96038AF} - {13709620-C279-11CE-A49E-444553540000} - {c08afd90-f2a1-11d1-8455-00a0c91f3880} - 9BA05972-F6A8-11CF-A442-00A0C90A8F39 - {00021A20-0000-0000-C000-000000000046} - {72C24DD5-D70A-438B-8A42-98424B88AFB8} + {13709620-C279-11CE-A49E-444553540000} + {c08afd90-f2a1-11d1-8455-00a0c91f3880} + 9BA05972-F6A8-11CF-A442-00A0C90A8F39 + {00021A20-0000-0000-C000-000000000046} + {72C24DD5-D70A-438B-8A42-98424B88AFB8} {00020906-0000-0000-C000-000000000046} {cc5bbec3-db4a-4bed-828d-08d78ee3e1ed} {1b7cd997-e5ff-4932-a7a6-2a9e636da385} @@ -1838,7 +1840,7 @@ util;setieproxy;localsystem;AUTODETECT - BITS administration utility + BITS administration utility CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME @@ -1877,7 +1879,7 @@ portproxy - tor.exe + tor.exe TeamViewer_Desktop.exe @@ -1990,8 +1992,8 @@ delete catalog wbadmin delete catalog erase - -nw -exec= - -p -nw + -nw -exec= + -p -nw shred diskshadow @@ -2019,14 +2021,12 @@ - - AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz + AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool CPU miner;GPU miner;Lime Miner;XMRig CPU miner; miner - b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 @@ -2102,7 +2102,7 @@ acrord32.exe java.exe javaw.exe - + + > /noprofile /sc ONEVENT @@ -2293,7 +2293,7 @@ - \temp\ + \temp\ 127.0.0.1 @@ -2492,13 +2492,13 @@ fe80:0 - putty.exe;kitty.exe;kitty_portable.exe + putty.exe;kitty.exe;kitty_portable.exe wsmprovhost.exe - psftp.exe + psftp.exe reg.exe psshutdown @@ -2589,7 +2589,6 @@ - dns.google;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;doh.opendns.com;.quad9.net;dns.cleanbrowsing.org;dns-family.adguard.com;dns.adguard.com;.233py.com;dnscrypt;dnscrypt-cert.oszx.co;dns.oszx.co;doh.dns.sb;doh.defaultroutes.de;doh.tiarap.org;doh.tiar.app;doh.captnemo.in;.aaflalo.me;doh.appliedprivacy.net;doh.dnswarden.com;commons.host;dns.twnic.tw;ibuki.cgnat.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;.seby.io;rdns.faelix.net;doh.li;.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk;adblock.mydns.network;ibksturm.synology.me;jcdns.fun @@ -2753,7 +2752,6 @@ udp - System;svchost.exe;oracle.exe;apache.exe;java.exe;php-cgi.exe;w3wp.exe;httpd;ServerManager.exe;unknown process;sql;wscript;cscript;schtasks;at.exe;reg.exe;C:\Windows\System32\find.exe 127.0.0.1;0:0:0:0:0:0:0:1 @@ -2778,33 +2776,33 @@ ntp ssdp - 53 - 67 - 68 - 1434 - 1812 - 3544 - 3702 - 5228 - 5353 - 5357 - 5989 - 6007 - 49154 - 49209 - 52176 - 59241 - 53 - 67 - 68 - 1812 - 3702 - 6007 - 49154 - 49209 - 50646 - 52176 - 59241 + 53 + 67 + 68 + 1434 + 1812 + 3544 + 3702 + 5228 + 5353 + 5357 + 5989 + 6007 + 49154 + 49209 + 52176 + 59241 + 53 + 67 + 68 + 1812 + 3702 + 6007 + 49154 + 49209 + 50646 + 52176 + 59241 .bing.com .cloudapp.net @@ -3029,7 +3027,7 @@ ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll - wscript.exe;cscript.exe;powershell.exe;rundll32.exe;msbuild.exe;msiexec.exe;csc.exe + \wscript.exe;\cscript.exe;\powershell.exe;\powershell_ise.exe;\rundll32.exe;\msbuild.exe;\csc.exe WINWORD.exe;EXCEL.EXE @@ -3533,7 +3531,9 @@ ) 0x1028;0x1fffff C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git;\Intel\Driver and Support Assistant\DSAService.exe + C:\Windows\Microsoft.NET\Framework\;\NGenTask.exe \Intel\Driver and Support Assistant\ + C:\Windows\Microsoft.NET\Framework\;\ngen.exe winword.exe;excel.exe;powerpnt.exe @@ -3782,7 +3782,7 @@ .XLSB - C:\Windows\Tasks\ + C:\Windows\Tasks\ RedirSuiteServiceProxy.aspx @@ -4620,7 +4620,7 @@ - SOFTWARE\Microsoft\Wow64\x86\ + SOFTWARE\Microsoft\Wow64\x86\ SetValue \CurrentVersion\Run\ @@ -4822,9 +4822,13 @@ \Microsoft\Windows NT\CurrentVersion\SilentProcessExit CreateKey - + \Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{;}\EDGEMITMP_;.tmp\setup.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Program Files\Microsoft Office\root\integration\integrator.exe + C:\Program Files\Google\Chrome Beta\Application\;\Installer\setup.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\;\OfficeClickToRun.exe @@ -4833,7 +4837,16 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree SD - Microsoft\Windows\UpdateOrchestrator + Microsoft\Windows\UpdateOrchestrator + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OneDrive Per-Machine Standalone Update Task\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Feature Updates\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Feature Updates Logon\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Performance Monitor\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\SnapshotCleanupTask\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office ClickToRun Service Monitor\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Automatic Updates 2.0\SD + Microsoft\Windows\UpdateOrchestrator HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree @@ -4906,7 +4919,7 @@ C:\WINDOWS\sysmon64.exe C:\WINDOWS\sysmon.exe C:\Programdata\sysmon\sysmon64.exe - + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel @@ -4963,8 +4976,7 @@ \Word\Security \Excel\Security \Security\Level1Remove - - \HideSCAHealth + \HideSCAHealth HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring @@ -4972,7 +4984,6 @@ HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange @@ -5110,7 +5121,7 @@ - HKLM\HARDWARE\ACPI\DSDT + HKLM\HARDWARE\ACPI\DSDT @@ -5359,26 +5370,26 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman \Explorer\FileExts\ - \shell\install\command\ - \ProfileImagePath + \shell\install\command\ + \ProfileImagePath - \Classes\AllFilesystemObjects\ - \Classes\*\ + \Classes\AllFilesystemObjects\ + \Classes\*\ \Software\Microsoft\Ctf\LangBarAddin - \ContextMenuHandlers\ - \CurrentVersion\Shell - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers - \Classes\Directory\ - \Classes\Drive\ - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - \Classes\Folder\ + \ContextMenuHandlers\ + \CurrentVersion\Shell + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers + \Classes\Directory\ + \Classes\Drive\ + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + \Classes\Folder\ \Hidden \HideFileExt \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components \SOFTWARE\Classes\Protocols\Filter \SOFTWARE\Classes\Protocols\Handler \SharedTaskScheduler - \ShowSuperHidden + \ShowSuperHidden \ColumnHandlers \CopyHookHandlers \ExtShellFolderViews @@ -5386,60 +5397,59 @@ \ShellServiceObjectDelayLoad \ShellServiceObjects - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ - HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ + HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ - \3\1809 - \3\2500 - \3\1206 + \3\1809 + \3\2500 + \3\1206 \DisableSecuritySettingsCheck HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries - HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ - \ProxyServer - SavedLegacySettings - Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy - EnableConsoleTracing - EnableFileTracing + HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ + \ProxyServer + SavedLegacySettings + Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy + EnableConsoleTracing + EnableFileTracing HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ - HKLM\SOFTWARE\Microsoft\Netsh - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ + HKLM\SOFTWARE\Microsoft\Netsh + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ - HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - Office Test\ - + Office Test\ - \Internet Explorer\Toolbar\ - \Internet Explorer\Extensions\ + \Internet Explorer\Toolbar\ + \Internet Explorer\Extensions\ - \Browser Helper Objects\ - {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ + \Browser Helper Objects\ + {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ - \UrlUpdateInfo - \InstallSource + \UrlUpdateInfo + \InstallSource - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ - TamperProtection - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ + TamperProtection + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff \Software\Policies\Microsoft\Windows\System\Scripts\Logoff @@ -5450,18 +5460,18 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup - Domain - DHCPDefaultGateway - DhcpIPAddress - DhcpNameserver - Dhcpserver - DhcpSubnetMask - Nameserver - \DefaultGateway - PersistentRoutes - }\Category + Domain + DHCPDefaultGateway + DhcpIPAddress + DhcpNameserver + Dhcpserver + DhcpSubnetMask + Nameserver + \DefaultGateway + PersistentRoutes + }\Category HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - SubnetMask + SubnetMask \Trusted Documents\TrustRecords Software\Microsoft\VBA\7.1\Common Software\Microsoft\VBA\7.1\Trusted @@ -5521,22 +5531,21 @@ SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR - HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ - HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\Microsoft\Cryptography\OID - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID + HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ + HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\Microsoft\Cryptography\OID + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll Classes\exefile\shell\runas\command\isolatedCommand \FriendlyName - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB - HKLM\SOFTWARE\Microsoft\Tracing\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + HKLM\SOFTWARE\Microsoft\Tracing\ HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318} @@ -5577,9 +5586,9 @@ \Client\Enabled \Server\Enabled Kitty\Sessions - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel PuTTY\Sessions Terminal Server Client\Servers WinSCP 2\Sessions @@ -5672,30 +5681,37 @@ \ntsvcs - - \9f81f59bc58452127884ce513865ed20 - \46a676ab7f179e511e30dd2dc41bd388 - tssmp_endpoint - \NamePipe_MoreWindows - \WCEServicePipe - \ahexec - \cachedumppipe - \csexec - \e710f28d59aa529d6792ca6ff0ca1b34 - \isapi_dg - \isapi_http - \isapi_http - \lsadump - \lsassw - \paexec - \pcheap_reuse - \gruntsvc - \remcom - \rpchlp_3 - \sdlrpc - \winsession + ConnectPipe + + \lsadump;\cachedump;\wceservicepipe + \9f81f59bc58452127884ce513865ed20 + \46a676ab7f179e511e30dd2dc41bd388 + tssmp_endpoint + \NamePipe_MoreWindows + \WCEServicePipe + \ahexec + \cachedumppipe + \csexec + \e710f28d59aa529d6792ca6ff0ca1b34 + \isapi_dg + \isapi_http + \isapi_http + \lsadump + \lsassw + \paexec + \pcheap_reuse + \gruntsvc + \remcom + \rpchlp_3 + \sdlrpc + \winsession + \adschemerpc + \AnonymousPipe + \bc367 + \bc31a7 + \testPipe msf-pipe - \atsvc + \atsvc \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc \atctl;\userpipe;\iehelper;\sdlrpc;\comnap @@ -5708,6 +5724,10 @@ \PGMessagePipe \MsFteWds + + ConnectPipe + \MICROSOFT##WID\tsql\query + \Winsock2\CatalogChangeListener- -0, @@ -5719,8 +5739,8 @@ - \winreg - Anonymous Pipe + \winreg + Anonymous Pipe - C:\Windows\System32\LxRun.exe + C:\Windows\system32\wbem\wmiprvse.exe + C:\Windows\System32\LxRun.exe C:\Windows\System32\SearchIndexer.exe C:\Windows\System32\smss.exe C:\Windows\System32\spoolsv.exe From adb10ce0e05031dcbbd38f512d9d779dfa787ede Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 3 Oct 2022 12:50:57 -0400 Subject: [PATCH 392/471] Update MITRE ATT&CK tagging round 1. --- sysmonconfig-export.xml | 178 ++++++++++++++++++++-------------------- 1 file changed, 89 insertions(+), 89 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 119828f7..e3b4db7f 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -154,6 +154,24 @@ gbb.exe + + iexplore.exe;chrome.exe;firefox.exe;browser_broker.exe;vivaldi.exe;microsoftedge.exe;microsoftedgecp.exe;brave.exe;vivaldi.exe + tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe + apt-config + + + cmd.exe /c C:\Windows\Setup\Scripts\SetupComplete.cmd;cmd.exe /c C:\Windows\Setup\Scripts\PartnerSetupComplete.cmd + C:\Windows\Setup + C:\Windows\SysWOW64 + C:\Windows\System32 + C:\Windows\WinSxS + + + consent.exe + http + iexplore.exe + SYSTEM + svchost.exe;termsvcs @@ -330,11 +348,6 @@ - - iexplore.exe;chrome.exe;firefox.exe;browser_broker.exe;vivaldi.exe;microsoftedge.exe;microsoftedgecp.exe;brave.exe;vivaldi.exe - tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe - apt-config - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe @@ -430,26 +443,26 @@ /dde;-dde - + schtasks.exe /create;-create;/change;-change C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - taskeng.exe - + taskeng.exe + schtasks.exe /Run;-run Sentinel\AutoRepair C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - + schtasks.exe schtasks /TN RtkAudUService64_BG -change;/change;-delete;/delete;-create;/create - at.exe - at.exe - + at.exe + at.exe + C:\Windows\System32\svchost.exe netsvcs;-p;-s;Schedule netsvcs;-p;-s;Schedule @@ -509,19 +522,19 @@ psexec.exe pskill.exe pskill - + C:\WINDOWS\system32\svchost.exe -k NetworkService -p - + C:\WINDOWS\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation - + C:\WINDOWS\System32\svchost.exe -k netprofm -p -s netprofm - + C:\WINDOWS\system32\svchost.exe;RPCSS - + C:\WINDOWS\system32\svchost.exe;RPCSS werfault.exe @@ -654,24 +667,24 @@ route ; ADD - + eventvwr.exe c:\windows\system32\mmc.exe - fodhelper.exe + fodhelper.exe InstallUtil.exe - Invoke-PsUaCme - BypassUAC - PowerUp + Invoke-PsUaCme + BypassUAC + PowerUp computerdefaults.exe dism.exe fodhelper.exe - + NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC NT AUTHORITY\SYSTEM;СИСТЕМА;NT-AUTORITÄT\SYSTEM;AUTORITE NT\SYSTEM - c:\windows\system32\svchost.exe -k netsvcs -s Appinfo + c:\windows\system32\svchost.exe -k netsvcs -s Appinfo runas.exe @@ -702,19 +715,6 @@ sdbinst.exe - - cmd.exe /c C:\Windows\Setup\Scripts\SetupComplete.cmd;cmd.exe /c C:\Windows\Setup\Scripts\PartnerSetupComplete.cmd - C:\Windows\Setup - C:\Windows\SysWOW64 - C:\Windows\System32 - C:\Windows\WinSxS - - - consent.exe - http - iexplore.exe - SYSTEM - dwm.exe @@ -1355,65 +1355,65 @@ netsh;trace;start;capture=yes - + vssadmin.exe create;shadow - + wmic.exe shadowcopy;call;create - + wmic.exe call;create;esentutl;vss - + win32_shadowcopy;create;clientaccessible - + mklink;GLOBALROOT;Shadow - + copy;NTDS\ntds.dit - + ntdsutil.exe - + copy;System32\config\SYSTEM - + reg;save;HKLM - + mimikatz;mimidrv;mimilove;mimilib;sekurlsa;lsadump;dumpcreds;privilege::;token::;logonpasswords;mimikittenz;mimiauth;::;kerberos::;misc::skeleton;privilege::debug;dpapi::cred;vault::cred;lsadump;misc::;Krbtgt;TOKEN::;invoke-mimi - + cmdkey - rpcping.exe - nltest.exe - + rpcping.exe + nltest.exe + -ma lsass.exe;Do-Exfiltration;Powersploit;GPPPassword;gpprefdecrypt;gsecdump;hashdump;laZagne;ntds.dit;ppldump;pwdump;pwdumpx;secretsdump;/listcreds:;-listcreds: - VaultCloseVault - VaultEnumerateItem - VaultFree - VaultGetItem - VaultOpenVault - Vaultcmd - vaultcli.dll - select * from moz_login - Invoke-WinEnum - System.Net.CredentialCache - create shadow + VaultCloseVault + VaultEnumerateItem + VaultFree + VaultGetItem + VaultOpenVault + Vaultcmd + vaultcli.dll + select * from moz_login + Invoke-WinEnum + System.Net.CredentialCache + create shadow wlan;export;profile;key=clear dcsync HKCU /f password;HKCU -f password HKLM /f password;HKLM -f password - nltest.exe - ProcDump.exe - ProcDump + nltest.exe + ProcDump.exe + ProcDump asktgt;asktgs @@ -3120,10 +3120,10 @@ tor-lib.dll - + C:\Windows\System32\WinSCard.dll;C:\Windows\System32\cryptdll.dll;C:\Windows\System32\hid.dll;C:\Windows\System32\samlib.dll;C:\Windows\System32\vaultcli.dll - + rundll32.exe vaultcli.dll;wlanapi.dll combase.dll @@ -3188,7 +3188,7 @@ scrobj.dll crypt0.dll - + C:\Windows\System32\wlanapi.dll C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe @@ -3273,7 +3273,7 @@ - + 0x001A0000 c:\windows\system32\lsass.exe @@ -3406,27 +3406,27 @@ \Microsoft Shared\VBA C:\Program Files (x86)\Intuit\ - + C:\Windows\system32\lsass.exe 0x1FFFFF UNKNOWN WmiPerfClass.dll C:\Windows\sysWOW64\wbem\wmiprvse.exe;C:\Windows\system32\wbem\wmiprvse.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe;WmiPerfClass.dll;C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files (x86)\Common Files\Adobe - + C:\Windows\system32\lsass.exe C:\Windows\system32\wsmprovhost.exe - + C:\Windows\system32\lsass.exe 0x1FFFFF python27.dll;_ctypes.pyd;KERNELBASE.dll;ntdll.dll - + C:\Windows\system32\lsass.exe C:\Windows\SYSTEM32\ntdll.dll+4595c|C:\Windows\system32\KERNELBASE.dll+8185 - + C:\Windows\system32\lsass.exe C:\WINDOWS\SYSTEM32\ntdll.dll+ ) @@ -3434,7 +3434,7 @@ wow64.dll;)|C;Exchange.Diagnostics;Microsoft.Exchange C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe;c:\windows\system32\inetsrv\w3wp.exe;MSExchangeHMHost.exe;C:\Windows\sysWOW64\wbem\wmiprvse.exe - + C:\Windows\system32\winlogon.exe 0x1F3FFF C:\Windows\Microsoft.NET;UNKNOWN @@ -3444,27 +3444,27 @@ C:\Windows\sysmon64.exe;C:\Windows\sysmon64.exe 0x1C00 - + C:\Windows\system32\lsass.exe 0x1F1FFF UNKNOWN - + C:\Windows\system32\lsass.exe 0x1010 UNKNOWN - + C:\Windows\system32\lsass.exe 0x143A UNKNOWN - + C:\Windows\system32\lsass.exe 0x1fffff dbghelp.dll;dbgcore.dll - + dbghelp.dll;dbgcore.dll C:\Windows\system32\lsass.exe C:\wfx32\ @@ -3476,7 +3476,7 @@ getasynckeystate - + cmlua.dll @@ -3497,7 +3497,7 @@ C:\Windows\system32\query.exe MsMpEng.exe - + C:\Windows\system32\lsass.exe comsvcs.dll @@ -3554,18 +3554,18 @@ 0x0800 - 0x0810 + 0x0810 0x0820 - 0x810 + 0x810 0x820 cscript.exe wscript.exe jjs.exe - dump - mimikatz + dump + mimikatz CorperfmontExt.dll C:\Program Files (x86)\Kaspersky Lab @@ -4892,8 +4892,8 @@
DWORD (0x00000000)
 HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy - \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe - exefile\shell\runas\command\isolatedCommand + \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe + exefile\shell\runas\command\isolatedCommand @@ -5683,7 +5683,7 @@ \ntsvcs ConnectPipe - \lsadump;\cachedump;\wceservicepipe + \lsadump;\cachedump;\wceservicepipe \9f81f59bc58452127884ce513865ed20 \46a676ab7f179e511e30dd2dc41bd388 tssmp_endpoint From cfb24e6b4cd1ba333cf936ca2ee0fd2e951d6596 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 3 Oct 2022 13:17:36 -0400 Subject: [PATCH 393/471] Correct MITRE Tagging for Exploit Public-Facing Applications --- sysmonconfig-export.xml | 48 ++++++++++++++++++++--------------------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e3b4db7f..18212d09 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -173,6 +173,26 @@ SYSTEM + + w3wp.exe + \csc.exe;\TranscodingService.exe;\werfault.exe;\appcmd.exe + + + + + w3wp.exe + appcmd.exe + appcmd.exe add module;system.enterpriseservices.internal.publish;\gacutil.exe /I;gacutil.exe -I + + + apache;php-cgi.exe;nginx.exe;httpd.exe;tomcat;php.exe + arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;certutil.exe + + + cmd.exe + ping 127.0.0.1 + c:\windows\system32\inetsrv\ + svchost.exe;termsvcs rdpclip.exe;csrss.exe;wininit.exe @@ -203,6 +223,10 @@ \Atlassian\Confluence\jre\bin\java.exe + + sqlservr + arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;sh.exe;bash.exe + keytool.exe cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe @@ -385,30 +409,6 @@ acrobat.exe;acrord32.exe tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe - - apache;php-cgi.exe;nginx.exe;httpd.exe;tomcat;php.exe - arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;certutil.exe - - - w3wp.exe - \csc.exe;\TranscodingService.exe;\werfault.exe;\appcmd.exe - - - - - w3wp.exe - appcmd.exe - appcmd.exe add module;system.enterpriseservices.internal.publish;\gacutil.exe /I;gacutil.exe -I - - - cmd.exe - ping 127.0.0.1 - c:\windows\system32\inetsrv\ - - - sqlservr - arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;sh.exe;bash.exe - winword.exe;powerpnt.exe;excel.exe control.exe From e8898f77bc51d79a92bc851b9d289af2340910f5 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 3 Oct 2022 13:24:34 -0400 Subject: [PATCH 394/471] Merge in Sigma Desktop Central CVE from Florian Roth. --- sysmonconfig-export.xml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 18212d09..1e3195aa 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -217,6 +217,10 @@ \Atlassian\Confluence\jre\bin\java.exe cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin + + DesktopCentral_Server\jre\bin\java.exe + cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin + \jre\bin\java.exe cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe @@ -1686,7 +1690,7 @@ g2mupdate.exe slack.exe - + wsmprovhost.exe cmd.exe sh.exe From a28488f20432d031cd7e099fdd57e9330ddcc796 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 3 Oct 2022 16:38:10 -0400 Subject: [PATCH 395/471] Added MITRE ATT&CK Datasource Tag: DS= and tagged most rules to identify Datasource Coverage. --- sysmonconfig-export.xml | 3391 ++++++++++++++++++++------------------- 1 file changed, 1697 insertions(+), 1694 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1e3195aa..5bc351b3 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -16,6 +16,7 @@ Attack: Mitre ATT&CK Identifier Technique: Mitre ATT&CK Technique Tactic: Mitre ATT&CK Tactic + DS: Mitre ATT&CK Datasource Alert: Alert Text for SIEM/XDR Info: Informational Alert Text Level: The level field contains one of five string values. It describes the criticality of a triggered rule. @@ -84,16 +85,16 @@ - + TEMP\nessus_;nessus_task_list TEMP\nessus_;nessus_task_list - + rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe advanced_port_scanner.exe;rcpping.exe;nc.exe;nc64.exe;netcat.exe;ncat.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe Network Scanner;Advanced IP Scanner - + adfind adfind -gcb -sc;/gcb /sc;-f (objectcategory=;/f (objectcategory=;trustdmp @@ -116,26 +117,26 @@ - /serverlevelplugindll + /serverlevelplugindll add;sslcert;http - http del sslcert + http del sslcert - + C:\Users\ Content.Outlook - + .SettingContent-ms immersivecontrolpanel - + .doc.exe .docx.exe .docx.exe @@ -149,98 +150,98 @@ .exe ______.exe - + Hwp.exe gbb.exe - + iexplore.exe;chrome.exe;firefox.exe;browser_broker.exe;vivaldi.exe;microsoftedge.exe;microsoftedgecp.exe;brave.exe;vivaldi.exe tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe apt-config - + cmd.exe /c C:\Windows\Setup\Scripts\SetupComplete.cmd;cmd.exe /c C:\Windows\Setup\Scripts\PartnerSetupComplete.cmd C:\Windows\Setup C:\Windows\SysWOW64 C:\Windows\System32 C:\Windows\WinSxS - + consent.exe http iexplore.exe SYSTEM - + w3wp.exe \csc.exe;\TranscodingService.exe;\werfault.exe;\appcmd.exe - + w3wp.exe appcmd.exe appcmd.exe add module;system.enterpriseservices.internal.publish;\gacutil.exe /I;gacutil.exe -I - + apache;php-cgi.exe;nginx.exe;httpd.exe;tomcat;php.exe arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;certutil.exe - + cmd.exe ping 127.0.0.1 c:\windows\system32\inetsrv\ - + svchost.exe;termsvcs rdpclip.exe;csrss.exe;wininit.exe - + dns.exe werfault.exe;conhost.exe;dnscmd.exe;dns.exe - + UMWorkerProcess.exe;UMService.exe perfenabled - + UMWorkerProcess.exe;UMService.exe perfenabled wemgr.exe;werfault.exe - + \wwwroot\ - + \Atlassian\Confluence\jre\bin\java.exe cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin - + DesktopCentral_Server\jre\bin\java.exe cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin - + \jre\bin\java.exe cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe \Atlassian\Confluence\jre\bin\java.exe - + sqlservr arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;sh.exe;bash.exe - + keytool.exe cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe - + bash.exe;cmd.exe;powershell.exe;pwsh.exe id -Gn `;id /Gn `;id -Gn ';id /Gn ' - + e=Access&;y=Guest&;&p=;&c=;&k= @@ -251,25 +252,25 @@ - + wmic.exe process;call;create - + wmic.exe call set priority;call terminate;product get name;bios, get serialNumber;BIOS GET SERIALNUMBER;onboarddevice get;useraccount where name;useraccount get;path win32_networkadapter where index=;process list;useraccount get /ALL;useraccount list;qfe get description,installedOn /format:csv;process get caption,executablepath,commandline;service get name,displayname,pathname,startmode;share list;win32_share - + C:\Users\;$Recycle;\Temp\;\Downloads\ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 conhost.exe - + svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe conhost.exe - + conhost.exe :\Windows\splwow64.exe;:\Windows\System32\WerFault.exe;:\Windows\System32\conhost.exe @@ -286,15 +287,15 @@ mysql server select-object displayversion,displayname - + cscript.exe;wscript.exe powershell.exe;powershell_ise.exe - + cscript.exe;wscript.exe powershell.exe;powershell_ise.exe - + powershell.exe;powershell_ise.exe mshta.exe @@ -302,35 +303,35 @@ wscript.exe;cscript.exe IEX;Net.WebClient;ospp.vbs;powershell;slmgr.vbs;spiceworks_upload - + wscript.exe .jse .js .vba .vbe - + \wscript.exe;\cscript.exe \rundll32.exe;regsvr32.exe - + \rundll32.exe;regsvr32.exe .dll;.cpl;.ocx;localserver;enable-speech-input;auto-scan-plugin;enable-media-stream;CastMediaRouteProvider;-eoim;/eoim setupapi;InstallHinfSection;DefaultInstall;SplunkUniversalForwarder\bin\spl;rundll32.exe "C:\Windows\Installer\MSI \MSI;.tmp",zzzInvokeManagerCustomActionOutOfProc - + cscript.exe .js .jse .vba .vbe - + mshta vbscript:CreateObject("Wscript.Shell");mshta vbscript:Execute("Execute;mshta vbscript:CreateObject("Wscript.Shell").Run("mshta.exe;javascript:a= .jpg;.png;.lnk;.xls;.doc;.zip;.sct;.hta - + C:\Windows\Temp\hpqhvind.exe;C:\ProgramData\DRM\;Test.exe C:\ProgramData\DRM;wmplayer.exe;C:\ProgramData\DRM\CLR\CLR.EXE @@ -339,7 +340,7 @@ explorer.exe @@ -354,29 +355,29 @@ C:\Windows\system32\spool\DRIVERS Brother Industries;Thomson Reuters - COMSPEC - ScriptFile - AppData\Local\Temp\7z - AppData\Local\Temp\Temp1_ - \AppData\Local\Temp\Rar$ + COMSPEC + ScriptFile + AppData\Local\Temp\7z + AppData\Local\Temp\Temp1_ + \AppData\Local\Temp\Rar$ - + powershell.exe;powershell_ise.exe C:\users\ Microsoft VS Code\Code.exe \Deployment tool extract\setupodt.exe - Shellcode + Shellcode - ipy.exe - python.exe + ipy.exe + python.exe - -agentpath: - -agentlib: + -agentpath: + -agentlib: - + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe .cmd;- @@ -409,37 +410,37 @@ Microsoft Teams Zoom Video - + acrobat.exe;acrord32.exe tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe - + winword.exe;powerpnt.exe;excel.exe control.exe input.dll - + msdt.exe msdt.exe BrowseForFile=;PCWDiagnostic /af;-af - + msdt.exe pcwrun.exe PCWDiagnostic - + msdt.exe /cab;-cab .diagcab - + powershell.exe;pwsh.exe;cmd.exe;mshta.exe;cscript.exe;wscript.exe;wsl.exe;rundll32.exe;regsvr32.exe msdt.exe - EQNEDT32.EXE - + EQNEDT32.EXE + winword.exe;excel.exe;powerpnt.exe FLTLDR.EXE @@ -447,26 +448,26 @@ /dde;-dde - + schtasks.exe /create;-create;/change;-change C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - taskeng.exe - + taskeng.exe + schtasks.exe /Run;-run Sentinel\AutoRepair C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - + schtasks.exe schtasks /TN RtkAudUService64_BG -change;/change;-delete;/delete;-create;/create - at.exe - at.exe - + at.exe + at.exe + C:\Windows\System32\svchost.exe netsvcs;-p;-s;Schedule netsvcs;-p;-s;Schedule @@ -474,130 +475,130 @@ - + net.exe;net1.exe;net2.exe stop tvsu_tmp - + net.exe;net1.exe;net2.exe start tvsu_tmp - + wmiprvse.exe;mmc.exe;explorer.exe;services.exe &1;cmd.exe;\\127.0.0.1\;/Q /c - + wmiprvse.exe;mmc.exe;explorer.exe;services.exe &1;cmd.exe;\\127.0.0.1\;-Q -c - + schtasks;Create;ONLOGON;TN;Updater;TR;powershell - + sc.exe create \NIC_Emulex_Firmware\;C:\Windows\Temp\ExchangeSetup\ - + sc.exe config;binpath - + cmd.exe;powershell.exe services.exe - new-service - psexesvc.exe - + new-service + psexesvc.exe + Execute processes remotely psexe PsExec Service PsExec Launched - + accepteula - + Execute processes remotely -s;/s - psexec.exe - pskill.exe - pskill - + psexec.exe + pskill.exe + pskill + C:\WINDOWS\system32\svchost.exe -k NetworkService -p - + C:\WINDOWS\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation - + C:\WINDOWS\System32\svchost.exe -k netprofm -p -s netprofm - + C:\WINDOWS\system32\svchost.exe;RPCSS - + C:\WINDOWS\system32\svchost.exe;RPCSS werfault.exe - + && type > cmd.exe" /c cd - + ntdsutil;/set {default} recoveryenabled no;telnet ;-dumpcr;putty;bash.exe;pssh;shareenum;sekurlsa;reg save;reg save;psscan;shellexec;vbscript:createobject;/output:clipboard;root\\default;root\\subscription;Wmiclass;WmiCl'+'as'+'s - + ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy - --disable-http2 --disable-quic - /Client/Login?id= - JABzA - + --disable-http2 --disable-quic + /Client/Login?id= + JABzA + 2f40abbb4f78e77745f0e657a19903fc953cc664;478dc5a5f934c62a9246f7d1fc275868f568bc07;37b4496e650b3994312c838435013560b3ca8571;37b4496e650b3994312c838435013560b3ca8571;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;807d86da63f0db1fc746d1f0b05bc357;849a2b0dc80aeca3d175c139efe5221c;86A4CAC227078B9C95C560C8F0370BF0;98908ce6f80ecc48628c8d2bf5b2a50c;a4b42c2c95d1f2ff12171a01c86cd64f;4abe604916c04fe3dd8b9cb3d501d3f;eac3e3ece94bc84e922ec077efb15edd;128CECC59C91C0D0574BC1075FE7CB40;88777aacd5f16599547926a4c9202862;0f49621b06f2cdaac8850c6e9581a594;17a36ac3e31f3a18936552aff2c80249;322cb39bc049aa69136925137906d855;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;3d129263f6a48647f103a04446fb0c2f;37cd353621b0f4fc6981b50071c94f01;1b60021baedc3f9201bcdb40e9b87f62;71345b139166482acaa568ac8816c7bc;5E022694C0DBD1FBBC263D608E577949;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc5733c013378fa418d13773f5bfe6f1;c579341f86f7e962719c7113943bb6e4;d326e629a90e78825645963b35e53a6a;5E022694C0DBD1FBBC263D608E577949;53841a0c6a3ff92976db08bfdf95e083;dc7e564809d6c2a2f3457c3c9b91f22b;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b;FE2CA1BE3BDA2A757036A89E54CC02DB;FE2CA1BE3BDA2A757036A89E54CC02DB - 22d142f11cf2a30ea4953e1fffb0fa7e;2317d65da4639f4246de200650a70753;27612cb03c89158225ca201721ea1aad;412956675fbc3f8c51f438c1abc100eb;daf2da52475fd8981b19ec3c321a983c;490a140093b5870a47edc29f33542fd2;51a7068640af42c3a7c1b94f1c11ab9d;533340c54bd25256873b3dca34d7f74e;684eca6b62d69ce899a3ec3bb04d0a5b;69a19abf5ba56ee07cdd3425b07cf8bf;6cfd131fef548fcd60fbcdb59317df8e;72dc98449b45a7f1ccdef27d51e31e91;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;80c37e062aa4c94697f287352acf2e9d;815f1f8a7bc1e6f94cb5c416e381a110;a43d3b31575846fa4c3992b4143a06da;08e82dc7bae524884b7dc2134942aadb;7bcd736a2394fc49f3e27b3987cce640;57314359df11ffdf476f809671ec0275;b72737b464e50aa3664321e8e001ff32;ce8ce92fb6565181572dce00d69c24f8;5985087678414143d33ffc6e8863b887;84730a6e426fbd3cf6b821c59674c8a0;d5377dc1821c935302c065ad8432c0d2;d8f1356bebda9e77f480a6a60eab36bb;92f8e3f0f1f7cc49fad797a62a169acd;9003cfaac523e94d5479dc6a10575e60;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;c1e7850da5604e081b9647b58248d7e8;99828721ac1a0e32e4582c3f615d6e57;f559c87b4a14a4be1bd84df6553aaf56;b9c208ea8115232bfd9ec2c62f32d6b8;061089d8cb0ca58e660ce2e433a689b3;0e9afd3a870906ebf34a0b66d8b07435;9c115e9a81d25f9d88e7aaa4313d9a8f;520ee02668a1c7b7c262708e12b1ba6b;7bfba2c69bed6b160261bdbf2b826401;77a745b07d9c453650dd7f683b02b3ed;3a771efb7ba2cd0df247ab570e1408b2;0969b2b399a8d4cd2d751824d0d842b4;fc53f2cd780cd3a01a4299b8445f8511;4e39620afca6f60bb30e031ddc5a4330;bfe3f6a79cad5b9c642bb56f8037c43b;3dfebce4703f30eed713d795b90538b5;9793afcea43110610757bd3b800de517;36db24006e2b492cafb75f2663f241b2;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;649ef1dd4a5411d3afcf108d57ff87af;320b2f1d9551b5d1df4fb19bd9ab253a;3d75c72144d873b3c1c4977fbafe9184;b9cf4301b7b186a75e82a04e87b30fe4;b4e67706103c3b8ee148394ebee3f268;7bfbd72441e1f2ed48fbc0f33be00f24;cdb303f61a47720c7a8c5086e6b2a743;2a6f7ec77ab6bd4297e7b15ae06e2e61;8403a28e0bffa9cc085e7b662d0d5412;3ffd2915d285ad748202469d4a04e1f5;04078ef95a70a04e95bda06cc7bec3fa;235d427f94630575a4ea4bff180ecf5d;8035a8a143765551ca7db4bc5efb5dfd;cacaa3bf3b2801956318251db5e90f3c;1aadf739782afcae6d1c3e4d1f315cbd;c3e255888211d74cc6e3fb66b69bbffb;d9e9f22988d43d73d79db6ee178d70a4;16ab79fb2fd92db0b1f38bedb2f02ed8;8da15a97eaf69ff7ee184fc446f19cf1;ffc7305cb24c1955f9625e525d58aeee;c0e72eb4c9f897410c795c1b360090ef;9ad6fa6fdedb2df8055b3d30bd6f64f1;44619a88a6cff63523163c6a4cf375dd;a571660c9cf1696a2f4689b2007a12c7;81229c1e272218eeda14892fa8425883;0ac48cfa2ff8351365e99c1d26e082ad;afcdf79be1557326c854b6e20cb900a7 - a53a02b997935fd8eedcb5f7abab9b9f - e96a73c7bf33a464c510ede582318bf2 - serialfunc.exe - + 22d142f11cf2a30ea4953e1fffb0fa7e;2317d65da4639f4246de200650a70753;27612cb03c89158225ca201721ea1aad;412956675fbc3f8c51f438c1abc100eb;daf2da52475fd8981b19ec3c321a983c;490a140093b5870a47edc29f33542fd2;51a7068640af42c3a7c1b94f1c11ab9d;533340c54bd25256873b3dca34d7f74e;684eca6b62d69ce899a3ec3bb04d0a5b;69a19abf5ba56ee07cdd3425b07cf8bf;6cfd131fef548fcd60fbcdb59317df8e;72dc98449b45a7f1ccdef27d51e31e91;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;80c37e062aa4c94697f287352acf2e9d;815f1f8a7bc1e6f94cb5c416e381a110;a43d3b31575846fa4c3992b4143a06da;08e82dc7bae524884b7dc2134942aadb;7bcd736a2394fc49f3e27b3987cce640;57314359df11ffdf476f809671ec0275;b72737b464e50aa3664321e8e001ff32;ce8ce92fb6565181572dce00d69c24f8;5985087678414143d33ffc6e8863b887;84730a6e426fbd3cf6b821c59674c8a0;d5377dc1821c935302c065ad8432c0d2;d8f1356bebda9e77f480a6a60eab36bb;92f8e3f0f1f7cc49fad797a62a169acd;9003cfaac523e94d5479dc6a10575e60;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;c1e7850da5604e081b9647b58248d7e8;99828721ac1a0e32e4582c3f615d6e57;f559c87b4a14a4be1bd84df6553aaf56;b9c208ea8115232bfd9ec2c62f32d6b8;061089d8cb0ca58e660ce2e433a689b3;0e9afd3a870906ebf34a0b66d8b07435;9c115e9a81d25f9d88e7aaa4313d9a8f;520ee02668a1c7b7c262708e12b1ba6b;7bfba2c69bed6b160261bdbf2b826401;77a745b07d9c453650dd7f683b02b3ed;3a771efb7ba2cd0df247ab570e1408b2;0969b2b399a8d4cd2d751824d0d842b4;fc53f2cd780cd3a01a4299b8445f8511;4e39620afca6f60bb30e031ddc5a4330;bfe3f6a79cad5b9c642bb56f8037c43b;3dfebce4703f30eed713d795b90538b5;9793afcea43110610757bd3b800de517;36db24006e2b492cafb75f2663f241b2;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;649ef1dd4a5411d3afcf108d57ff87af;320b2f1d9551b5d1df4fb19bd9ab253a;3d75c72144d873b3c1c4977fbafe9184;b9cf4301b7b186a75e82a04e87b30fe4;b4e67706103c3b8ee148394ebee3f268;7bfbd72441e1f2ed48fbc0f33be00f24;cdb303f61a47720c7a8c5086e6b2a743;2a6f7ec77ab6bd4297e7b15ae06e2e61;8403a28e0bffa9cc085e7b662d0d5412;3ffd2915d285ad748202469d4a04e1f5;04078ef95a70a04e95bda06cc7bec3fa;235d427f94630575a4ea4bff180ecf5d;8035a8a143765551ca7db4bc5efb5dfd;cacaa3bf3b2801956318251db5e90f3c;1aadf739782afcae6d1c3e4d1f315cbd;c3e255888211d74cc6e3fb66b69bbffb;d9e9f22988d43d73d79db6ee178d70a4;16ab79fb2fd92db0b1f38bedb2f02ed8;8da15a97eaf69ff7ee184fc446f19cf1;ffc7305cb24c1955f9625e525d58aeee;c0e72eb4c9f897410c795c1b360090ef;9ad6fa6fdedb2df8055b3d30bd6f64f1;44619a88a6cff63523163c6a4cf375dd;a571660c9cf1696a2f4689b2007a12c7;81229c1e272218eeda14892fa8425883;0ac48cfa2ff8351365e99c1d26e082ad;afcdf79be1557326c854b6e20cb900a7 + a53a02b997935fd8eedcb5f7abab9b9f + e96a73c7bf33a464c510ede582318bf2 + serialfunc.exe + e PAA;en PAA;enc PAA;enco PAA;encode PAA;encoded PAA;encodedco PAA;encodedcom PAA;encodedcomm PAA;encodedcomma PAA;encodedcomman PAA;encodedcommand PAA;e IAA;en IAA;enc IAA;enco IAA;encode IAA;encoded IAA;encodedco IAA;encodedcom IAA;encodedcomm IAA;encodedcomma IAA;encodedcomman IAA;encodedcommand IAA;e JAB;en JAB;enc JAB;enco JAB;encode JAB;encoded JAB;encodedco JAB;encodedcom JAB;encodedcomm JAB;encodedcomma JAB;encodedcomman JAB;encodedcommand JAB;e cwBFAFQA;en cwBFAFQA;enc cwBFAFQA;enco cwBFAFQA;encode cwBFAFQA;encoded cwBFAFQA;encodedco cwBFAFQA;encodedcom cwBFAFQA;encodedcomm cwBFAFQA;encodedcomma cwBFAFQA;encodedcomman cwBFAFQA;encodedcommand cwBFAFQA;e SQBFAF;en SQBFAF;enc SQBFAF;enco SQBFAF;encode SQBFAF;encoded SQBFAF;encodedco SQBFAF;encodedcom SQBFAF;encodedcomm SQBFAF;encodedcomma SQBFAF;encodedcomman SQBFAF;encodedcommand SQBFAF;e UwBFAFQA;en UwBFAFQA;enc UwBFAFQA;enco UwBFAFQA;encode UwBFAFQA;encoded UwBFAFQA;encodedco UwBFAFQA;encodedcom UwBFAFQA;encodedcomm UwBFAFQA;encodedcomma UwBFAFQA;encodedcomman UwBFAFQA;encodedcommand UwBFAFQA;e IABpAE4AdgBPAEsAZQAt;en IABpAE4AdgBPAEsAZQAt;enc IABpAE4AdgBPAEsAZQAt;enco IABpAE4AdgBPAEsAZQAt;encode IABpAE4AdgBPAEsAZQAt;encoded IABpAE4AdgBPAEsAZQAt;encodedco IABpAE4AdgBPAEsAZQAt;encodedcom IABpAE4AdgBPAEsAZQAt;encodedcomm IABpAE4AdgBPAEsAZQAt;encodedcomma IABpAE4AdgBPAEsAZQAt;encodedcomman IABpAE4AdgBPAEsAZQAt;encodedcommand IABpAE4AdgBPAEsAZQAt;e SQBmACgAJAB;en SQBmACgAJAB;enc SQBmACgAJAB;enco SQBmACgAJAB;encode SQBmACgAJAB;encoded SQBmACgAJAB;encodedco SQBmACgAJAB;encodedcom SQBmACgAJAB;encodedcomm SQBmACgAJAB;encodedcomma SQBmACgAJAB;encodedcomman SQBmACgAJAB;encodedcommand SQBmACgAJAB;e J;en J;enc J;enco J;encode J;encoded J;encodedco J;encodedcom J;encodedcomm J;encodedcomma J;encodedcomman J;encodedcommand J;e SUVY;en SUVY;enc SUVY;enco SUVY;encode SUVY;encoded SUVY;encodedco SUVY;encodedcom SUVY;encodedcomm SUVY;encodedcomma SUVY;encodedcomman SUVY;encodedcommand SUVY;e aWV4;en aWV4;enc aWV4;enco aWV4;encode aWV4;encoded aWV4;encodedco aWV4;encodedcom aWV4;encodedcomm aWV4;encodedcomma aWV4;encodedcomman aWV4;encodedcommand aWV4;e dmFy;en dmFy;enc dmFy;enco dmFy;encode dmFy;encoded dmFy;encodedco dmFy;encodedcom dmFy;encodedcomm dmFy;encodedcomma dmFy;encodedcomman dmFy;encodedcommand dmFy;e dgBhA;en dgBhA;enc dgBhA;enco dgBhA;encode dgBhA;encoded dgBhA;encodedco dgBhA;encodedcom dgBhA;encodedcomm dgBhA;encodedcomma dgBhA;encodedcomman dgBhA;encodedcommand dgBhA;e R2V0;en R2V0;enc R2V0;enco R2V0;encode R2V0;encoded R2V0;encodedco R2V0;encodedcom R2V0;encodedcomm R2V0;encodedcomma R2V0;encodedcomman R2V0;encodedcommand R2V0;e IAAgAH;en IAAgAH;enc IAAgAH;enco IAAgAH;encode IAAgAH;encoded IAAgAH;encodedco IAAgAH;encodedcom IAAgAH;encodedcomm IAAgAH;encodedcomma IAAgAH;encodedcomman IAAgAH;encodedcommand IAAgAH;e TVq;en TVq;enc TVq;enco TVq;encode TVq;encoded TVq;encodedco TVq;encodedcom TVq;encodedcomm TVq;encodedcomma TVq;encodedcomman TVq;encodedcommand TVq;e aQBIA;en aQBIA;enc aQBIA;enco aQBIA;encode aQBIA;encoded aQBIA;encodedco aQBIA;encodedcom aQBIA;encodedcomm aQBIA;encodedcomma aQBIA;encodedcomman aQBIA;encodedcommand aQBIA;e UEs;en UEs;enc UEs;enco UEs;encode UEs;encoded UEs;encodedco UEs;encodedcom UEs;encodedcomm UEs;encodedcomma UEs;encodedcomman UEs;encodedcommand UEs;e H4s;en H4s;enc H4s;enco H4s;encode H4s;encoded H4s;encodedco H4s;encodedcom H4s;encodedcomm H4s;encodedcomma H4s;encodedcomman H4s;encodedcommand H4s;e dXNpbm;en dXNpbm;enc dXNpbm;enco dXNpbm;encode dXNpbm;encoded dXNpbm;encodedco dXNpbm;encodedcom dXNpbm;encodedcomm dXNpbm;encodedcomma dXNpbm;encodedcomman dXNpbm;encodedcommand dXNpbm;e cwBhA;en cwBhA;enc cwBhA;enco cwBhA;encode cwBhA;encoded cwBhA;encodedco cwBhA;encodedcom cwBhA;encodedcomm cwBhA;encodedcomma cwBhA;encodedcomman cwBhA;encodedcommand cwBhA;JABzA - + FromBase64String JAB;SUVY;aWV4;dmFy;dgBhA;R2V0;SQBFAF;TVq;aQBIA;UEs;H4s;dXNpbm;cwBhA - + /v Word experienced;/v Excel experienced;-v Word experienced;-v Excel experienced - + JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ;QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA;kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA;IgAoACcAKgAnACkAOwAkA;IAKAAnACoAJwApADsAJA;iACgAJwAqACcAKQA7ACQA - + e^;^en^;^nc - + ^ - + ..\;\.. - + \cmd.exe /c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe /c del "C:\Users\*\Desktop\*.exe;\cmd.exe -c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe -c del "C:\Users\*\Desktop\*.exe - ping.exe -n 6 127.0.0.1 &ping.exe /n 6 127.0.0.1 & type - System.Net.Networkinformation.ping + ping.exe -n 6 127.0.0.1 &ping.exe /n 6 127.0.0.1 & type + System.Net.Networkinformation.ping - mofcomp.exe + mofcomp.exe - + net.exe;net1.exe;net2.exe user;group;localgroup remove;delete;active;del @@ -609,17 +610,17 @@ - + net.exe;net1.exe;net2.exe user add tvsu_tmp dsmod.exe - dsadd.exe + dsadd.exe - + WerFault.exe -s;/s @@ -635,36 +636,36 @@ - + cmd.exe echo;\pipe\;> - + cmd.exe /c;copy;dll;\\;admin$ - + rundll32.exe ,;StartW - + rundll32.exe ,;update;appdata;temp;/i: - + rundll32.exe ,;update;appdata;temp;-i: - + dllhost.exe {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} - + dllhost.exe {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} - + winlogon.exe;services.exe;lsass.exe;csrss.exe;wininit.exe;spoolsv.exe;searchindexer.exe powershell.exe;pwsh.exe;cmd.exe AUTHORI;AUTORI @@ -676,58 +677,58 @@ c:\windows\system32\mmc.exe fodhelper.exe - InstallUtil.exe - Invoke-PsUaCme - BypassUAC - PowerUp + InstallUtil.exe + Invoke-PsUaCme + BypassUAC + PowerUp computerdefaults.exe dism.exe fodhelper.exe - + NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC NT AUTHORITY\SYSTEM;СИСТЕМА;NT-AUTORITÄT\SYSTEM;AUTORITE NT\SYSTEM - c:\windows\system32\svchost.exe -k netsvcs -s Appinfo - runas.exe + c:\windows\system32\svchost.exe -k netsvcs -s Appinfo + runas.exe - + Cmd.Exe winlogon.exe utilman.exe - + Cmd.Exe winlogon.exe sethc.exe - + utilman.exe C:\Windows\System32\ATBroker.exe;Magnify.exe;C:\Windows\System32\osk.exe - sethc.exe + sethc.exe osk.exe Magnify.exe DisplaySwitch.exe Narrator.exe AtBroker.exe - sdbinst.exe + sdbinst.exe - + dwm.exe - + cmd.exe 7zFM.exe ;/c;-c - + cmd.exe elevation_service.exe System @@ -739,8 +740,8 @@ unknown process - \LocalState\rootfs\ - \LocalState\rootfs\ + \LocalState\rootfs\ + \LocalState\rootfs\ @@ -750,7 +751,7 @@ - + auditpol /set;-set;/restore;-restore;/clear;-clear;/remove;-remove;/resourceSACL;-resourceSACL @@ -758,136 +759,136 @@ - + +s;+h attrib.exe - + Hidden;Attributes powershell.exe - + Sysinternals Sysmon /u;/c;-u;-c C:\ProgramdData\sysmon\ - + MpCmdRun.exe Add-MpPreference;RemoveDefinitions;DisableIOAVProtection - + IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE - + IMPHASH=19584675D94829987952432E018D5056 - + IMPHASH=330768a4f172e10acb6287b87289d83b - PsKill.exe - + PsKill.exe + Set-MpPreference;Add-MpPreference;Remove-MpPreference;MpCmdRun.exe RemoveDefinitions;RemoveDynamicSignature;DisableIOAVProtection;DisableRealTimeMonitoring;DisableBehaviorMonitoring;DisableBlockAtFirstSeen;DisableIOAVProtection;DisablePrivacyMode;DisableScriptScanning;DisableRealtimeMonitoring;DisableScanningNetworkFiles;DisableScanningMappedNetworkDrivesForFullScan;DisableRestorePoint;DisableRemovableDriveScanning;SignatureDisableUpdateOnStartupWithoutEngine;DisableIntrusionPreventionSystem;DisableScanOnRealtimeEnable;DisableArchiveScanning;DisableIntrusionPreventionSystem;DisableScriptScanning;DisableOnAccessProtection;ExclusionExtension;ExclusionPath;ExclusionProcess;ThreatDefaultAction;TamperProtection - interface ipv6 set - interface ipv4 set - taskkill.exe + interface ipv6 set + interface ipv4 set + taskkill.exe - firewall delete - firewall add - firewall set opmode disable - Core Networking - Router Solicitation - netsh advfirewall firewall + firewall delete + firewall add + firewall set opmode disable + Core Networking - Router Solicitation + netsh advfirewall firewall - + wevtutil.exe cl wevtutil im wevtutil.exe im ClickToRun - + fltMC.exe detach;unload - + appcmd.exe DontLog;True iisetup.exe - + set;NGenAssemblyUsageLog New-ItemProperty;NGenAssemblyUsageLog reg;add;dword;NGenAssemblyUsageLog $env;NGenAssemblyUsageLog - + set;COMPlus_ETWEnabled New-ItemProperty;COMPlus_ETWEnabled reg;add;dword;COMPlus_ETWEnabled $env;COMPlus_ETWEnabled - + bash.exe;wsl.exe;ubuntu.exe;kali.exe -e;/e;-u root;--exec bash;dev/tcp - wsl.exe - wsl.exe - wslhost.exe - wslhost.exe - ubuntu.exe - ubuntu.exe - kali.exe - kali.exe + wsl.exe + wsl.exe + wslhost.exe + wslhost.exe + ubuntu.exe + ubuntu.exe + kali.exe + kali.exe - pcalua.exe - pcalua.exe - bash.exe - bash.exe - forfiles.exe - forfiles.exe + pcalua.exe + pcalua.exe + bash.exe + bash.exe + forfiles.exe + forfiles.exe .com - -appvscript + -appvscript - + C:\Users\NetworkService\;C:\Users\NetworkService\;HarddiskVolumeShadowCopy;C:\Users\Default\;C:\Users\Public;C:\Users\Guest\;\administrateur\;C:\Windows\Media\;C:\Windows\addins\;tsclient\;\htdocs\;\config\systemprofile\;C:\PerfLogs\;c:\windows\ServiceProfiles\;C:\Intel\Logs\;C:\Windows\repair\;C:\Windows\Help\;$Recycle;C:\Windows\Debug\;C:\Windows\Security\;C:\Windows\Fonts\;\wwwroot\;\Contacts;C:\Windows\vss\ - reg add hkcu\software\classes\ - reg.exe add hkcu\software\classes\ - C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry - + reg add hkcu\software\classes\ + reg.exe add hkcu\software\classes\ + C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry + regedit.exe : - + reg.exe delete - + regedit.exe /d;-d - + HKCU:;HKLM remove-item - + HKCU:;HKLM set-item;new-item - + chcp.exe 936 1256 @@ -896,66 +897,66 @@ 855 866 - + powershell.exe -e ;-en;-enc;-enco;-encod;-encode;-encoded;-encodedc;-encodedco;-encodedcom;-encodedcomm;-encodedcomma;-encodedcomman;-encodedcommand;/e ;/en;/enc;/enco;/encod;/encode;/encoded;/encodedc;/encodedco;/encodedcom;/encodedcomm;/encodedcomma;/encodedcomman;/encodedcommand - + powershell.exe -w h;-wi h;-win h;-wind h;-windo h;-window h;-windows h;-windowst h;-windowsty h;-windowstyl h;-windowstyle h;/w h;/wi h;/win h;/wind h;/windo h;/window h;/windows h;/windowst h;/windowsty h;/windowstyl h;/windowstyle h - + powershell.exe -ex;/ex bypass - + powershell.exe -noni;/noni Import-Module FileServerResourceManager C:\Program Files\LogicMonitor - + powershell.exe hextobin;iex;io.filestream;system.text;base64;system.io;io.file;IMAGE_SUBSYSTEM_WINDOWS_GUI;IMAGE_NT_OPTIONAL_HDR32;IMAGE_NT_OPTIONAL_HDR64;DllCharacteristicsType;GetDelegateForFunctionPointer;WriteProcessMemory;ReadProcessMemory;ImpersonateSelf;AdjustTokenPrivileges;NtCreateThreadEx;CreateRemoteThread;io.seek;iwr;-bxor;invoke-expression;remove.to.string;shellcode;System.Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;unicode;-useb;msxml2.serverxmlhttp;wscript.shell;-comobject;frombase64;io.compression;system.convert;io.streamreader;io.memorystream;compression.gzipstream;text.encoding;executioncontext;text.enc;convertto-securestring;runtime.interop;verbosepreference;[[string]]::join - + powershell.exe SUVYI;aWV4I;SQBFAFgA;aQBlA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC;UwB0AGE - + C^om^S^pEc;^c^o^m^S^p^E^c^;Wscript.Shell;-ComObject;MsXml2.ServerXmlHttp;Remove.ToString;System.Convert;-UseB;[Byte[];^h^t^t^p;h"t"t"p - IwAjACMAd;IyM=;SUVYI;aWV4I;SQBFAFgA;aQBlAHgA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC + IwAjACMAd;IyM=;SUVYI;aWV4I;SQBFAFgA;aQBlAHgA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC WindowStyle Hidden function;WindowStyle Hidden;windowstyle h;windowstyl h;windowsty h;windowst h;windows h;window h;windo h;wind h;win h;wi h;-w h;/w h;win hi;win hid;win hidd;win hidde;win hidden - ^ - TYPE CON > - copy CON > - + ^ + TYPE CON > + copy CON > + FromBase64String;action=create keyvalue=;VerbosePreference.ToString;SecureString;CSharpCodeProvider;runtime.interopservices.marshal;system.globalization.numberstyles;system.reflection.assembly;hextobin;VerbosePreference.ToString;system.text.encoding;io.filestream;io.filestream;io.seekorigin;text.encoding;unicode.getstring;FromBase64;[Convert]::;System.IO.File]::ReadAllText;|iex ngen.exe;install - + certutil decode;encode - - ping.exe + + ping.exe 0x - + csc.exe \AppData\;\Windows\Temp\ - + csc.exe wscript.exe cscript.exe mshta.exe - + mofcomp.exe .mof C:\WINDOWS\Installer\MSI @@ -963,122 +964,122 @@ aspnet_regiis.exe msiexec.exe - + csc.exe out:;target:library - Microsoft.Workflow.Compiler.exe + Microsoft.Workflow.Compiler.exe - + autochk.exe \smss.exe;\fontdrvhost.exe;\dwm.exe - + \consent.exe;\Runtimebroker.exe;\TiWorker.exe \svchost.exe - - + \consent.exe;\Runtimebroker.exe;\TiWorker.exe svchost.exe - - + SearchProtocolHost.exe \SearchIndexer.exe;\dllhost.exe - - + dllhost.exe \services.exe;\svchost.exe - - + smss.exe \smss.exe System - - + csrss.exe - \smss.exe;svchost.exe - + wininit.exe - \smss.exe - + winlogon.exe \smss.exe - + \lsass.exe;LsaIso.exe \wininit.exe - + LogonUI.exe \wininit.exe;\winlogon.exe - + services.exe \wininit.exe - + svchost.exe - \MsMpEng.exe;\services.exe - + spoolsv.exe \services.exe - + taskhost.exe \services.exe;\svchost.exe - + userinit.exe \dwm.exe;\winlogon.exe - + \wmiprvse.exe;\wsmprovhost.exe;\winrshost.exe - \svchost.exe - + \SearchProtocolHost.exe;\taskhost.exe;\csrss.exe \werfault.exe;\wermgr.exe;\WerFaultSecure.exe - + autochk.exe \chkdsk.exe;\doskey.exe;\WerFault.exe - + smss.exe \autochk.exe;\smss.exe;\csrss.exe;\wininit.exe;\winlogon.exe;\setupcl.exe;\WerFault.exe - + wermgr.exe \WerFaultSecure.exe;\wermgr.exe;\WerFault.exe - + wermgr.exe wermgr.exe - + \rundll32.exe;\regsvr32.exe \explorer.exe;\wermgr.exe;\msra.exe .exe - + conhost.exe \mscorsvw.exe;\wermgr.exe;\WerFault.exe;\WerFaultSecure.exe - + System.Management.Automation "C:\Windows\Microsoft.NET\Framework\;\ngen.exe;install @@ -1087,53 +1088,53 @@ - + InstallUtil.exe /logfile=;/LogToConsole=false;/U - + InstallUtil.exe -logfile=;-LogToConsole=false;-U - + Mavinject.exe;mavinject64.exe INJECTRUNNING - + CMSTP.exe /ni;/s - + CMSTP.exe /ns;/s - + CMSTP.exe -ni;-s - + CMSTP.exe -ns;-s - + rundll32.exe;shell32.dll;_RunDLL C:\Windows\ImmersiveControlPanel\SystemSettings.exe - + odbcconf.exe /S /A {REGSVR;-S -A {REGSVR - script:http - Register-cimprovider + script:http + Register-cimprovider Scriptrunner.exe -appvscript bginfo cbd - runscripthelper.exe surfacecheck - xwizard RunWizard - PresentationHost - driver executeinf - control.exe /name;control.exe -name - Control_RunDLL + runscripthelper.exe surfacecheck + xwizard RunWizard + PresentationHost + driver executeinf + control.exe /name;control.exe -name + Control_RunDLL SyncAppvPublishingServer.exe Scriptrunner.exe ATBroker.exe @@ -1150,7 +1151,7 @@ tttracer.exe verclsid.exe wab.exe - Register-cimprovider.exe + Register-cimprovider.exe csi.exe devtoolslauncher.exe LaunchForDeploy bginfo @@ -1159,32 +1160,32 @@ wsreset.exe cmstp.exe /ni /s;cmstp.exe -ni -s - cmstp /ni /s;cmstp -ni -s + cmstp /ni /s;cmstp -ni -s - Mavinject.exe - INJECTRUNNING + Mavinject.exe + INJECTRUNNING - + rundll32.exe DllRegisterServer xapauthenticodesip.dll - + regsvr32.exe C:\Users;Appdata;Temp - + regsvr32.exe C:\Users;Public Microsoft(C) Register Server - SyncAppvPublishingServer.exe - control.exe - rasautou.exe - control.exe /name;control.exe -name - Control_RunDLL + SyncAppvPublishingServer.exe + control.exe + rasautou.exe + control.exe /name;control.exe -name + Control_RunDLL - + msiexec.exe /y;-y C:\Windows\SysWOW64\DartSock.dll @@ -1197,13 +1198,13 @@ C:\Windows\SysWOW64\todgub7.dll C:\Windows\SysWOW64\xarraydb.ocx - + msiexec.exe /i;-i http - + RUNDLL32.EXE ,;# C:\Windows\resources\themes\Aero\AeroLite.msstyles @@ -1213,125 +1214,125 @@ PhotoViewer.dll \AppData\Local\WebEx\WebEx\ - + RUNDLL32.EXE -sta;/sta - + RUNDLL32.EXE -localserver;/localserver - + RUNDLL32.EXE shell32.dll;OpenAs_RunDLL - + RUNDLL32.EXE powershell - + RUNDLL32.EXE url.dll;OpenURL - + RUNDLL32.EXE url.dll;FileProtocolHandler - + RUNDLL32.EXE zipfldr.dll;RouteTheCall - + RUNDLL32.EXE Shell32.dll;Control_RunDLL - + RUNDLL32.EXE javascript: - + RUNDLL32.EXE RegisterXLL - + rundll32.exe C:\Users;Public rdpinit.exe rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe - + rundll32.exe C:\Users;Appdata;Temp ImageView_ rdpinit.exe rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe - advpack.dll;LaunchINFSection - ieadvpack.dll;LaunchINFSection - syssetup.dll;SetupInfObjectInstallAction - setupapi.dll;InstallHinfSection + advpack.dll;LaunchINFSection + ieadvpack.dll;LaunchINFSection + syssetup.dll;SetupInfObjectInstallAction + setupapi.dll;InstallHinfSection InstallHinfSection - infDefaultInstall.exe - rundll32.exe "C:\Windows\twain_64.dll" - shdocvw.dll;OpenURL - advpack.dll;RegisterOCX - Zipfldr.dll;RouteTheCall - url.dll;FileProtocolHandler - url.dll;FileProtocolHandler - OpenURLA;file: - OpenURL;file: + infDefaultInstall.exe + rundll32.exe "C:\Windows\twain_64.dll" + shdocvw.dll;OpenURL + advpack.dll;RegisterOCX + Zipfldr.dll;RouteTheCall + url.dll;FileProtocolHandler + url.dll;FileProtocolHandler + OpenURLA;file: + OpenURL;file: - + mshta.exe cmd.exe;powershell.exe;wscript.exe;cscript.exe;sh.exe;bash.exe;reg.exe;regsvr32.exe;bitsadmin - + mshta.exe - RunHTMLApplication - mshtml - vbscript:CreateObject + RunHTMLApplication + mshtml + vbscript:CreateObject - odbcconf.exe + odbcconf.exe - manage-bde.wsf + manage-bde.wsf - + powershell.exe;powershell_ise.exe msbuild.exe - + msbuild.exe regasm.exe - + msbuild.exe userinit.exe - + msbuild.exe .xml - + regasm.exe \conhost.exe - + msbuild.exe .lnk - .csproj + .csproj - msxsl.exe - msxsl.exe + msxsl.exe + msxsl.exe @@ -1340,107 +1341,107 @@ - /stext - keylog - keyscan_ - Get-Keystrokes - /scomma + /stext + keylog + keyscan_ + Get-Keystrokes + /scomma - + sniff C:\Program Files\Adobe\ - + tcpdump.exe;tcpdump.c;tshark.exe;tshark.c;windump.exe;windump.c;wireshark.c;wireshark.exe windump;tshark;tcpdump;windump;wireshark netsh;trace;start;capture=yes - + vssadmin.exe create;shadow - + wmic.exe shadowcopy;call;create - + wmic.exe call;create;esentutl;vss - + win32_shadowcopy;create;clientaccessible - + mklink;GLOBALROOT;Shadow - + copy;NTDS\ntds.dit - + ntdsutil.exe - + copy;System32\config\SYSTEM - + reg;save;HKLM - + mimikatz;mimidrv;mimilove;mimilib;sekurlsa;lsadump;dumpcreds;privilege::;token::;logonpasswords;mimikittenz;mimiauth;::;kerberos::;misc::skeleton;privilege::debug;dpapi::cred;vault::cred;lsadump;misc::;Krbtgt;TOKEN::;invoke-mimi - + cmdkey - rpcping.exe - nltest.exe - + rpcping.exe + nltest.exe + -ma lsass.exe;Do-Exfiltration;Powersploit;GPPPassword;gpprefdecrypt;gsecdump;hashdump;laZagne;ntds.dit;ppldump;pwdump;pwdumpx;secretsdump;/listcreds:;-listcreds: - VaultCloseVault - VaultEnumerateItem - VaultFree - VaultGetItem - VaultOpenVault - Vaultcmd - vaultcli.dll - select * from moz_login - Invoke-WinEnum - System.Net.CredentialCache - create shadow - wlan;export;profile;key=clear - dcsync - HKCU /f password;HKCU -f password - HKLM /f password;HKLM -f password - nltest.exe - ProcDump.exe - ProcDump + VaultCloseVault + VaultEnumerateItem + VaultFree + VaultGetItem + VaultOpenVault + Vaultcmd + vaultcli.dll + select * from moz_login + Invoke-WinEnum + System.Net.CredentialCache + create shadow + wlan;export;profile;key=clear + dcsync + HKCU /f password;HKCU -f password + HKLM /f password;HKLM -f password + nltest.exe + ProcDump.exe + ProcDump - asktgt;asktgs - createnetonly /program:;createnetonly -program: - dump /service:krbtgt;dump -service:krbtgt - harvest /interval:;harvest -interval: - renew /ticket:;renew -ticket: - asreproast - impersonateuser: - kerberoast - ptt /ticket: - klist.exe - hh.exe + asktgt;asktgs + createnetonly /program:;createnetonly -program: + dump /service:krbtgt;dump -service:krbtgt + harvest /interval:;harvest -interval: + renew /ticket:;renew -ticket: + asreproast + impersonateuser: + kerberoast + ptt /ticket: + klist.exe + hh.exe - + appcmd.exe list;text;password - quser.exe - + quser.exe + net.exe;net1.exe;net2.exe group;localgroup; user /domain @@ -1448,7 +1449,7 @@ \users tvsu_tmp - + net.exe;net1.exe;net2.exe group;localgroup; user /domain @@ -1456,7 +1457,7 @@ \users tvsu_tmp - + sharphound;bloodhound;azurehound;CollectionMethod;encryptzip;randomizefilenames;dumpcomputerstatus sharphound;bloodhound sharphound;bloodhound @@ -1465,10 +1466,10 @@ sharphound;bloodhound sharphound;bloodhound - dscl . list /Groups;dscl . list -Groups - dscl . list /Users;dscl . list -Users - dsquery.exe - query.exe + dscl . list /Groups;dscl . list -Groups + dscl . list /Users;dscl . list -Users + dsquery.exe + query.exe @@ -1479,14 +1480,14 @@ - tree.com + tree.com - + auditpol /get;-get;/list;-list;/backup;-backup - gpresult.exe - get-gpo;get-gpresult;get-gpreg + gpresult.exe + get-gpo;get-gpresult;get-gpreg @@ -1494,16 +1495,16 @@ - tasklist.exe - qprocess.exe + tasklist.exe + qprocess.exe - reg query - reg.exe query - driverquery.exe + reg query + reg.exe query + driverquery.exe - tracert.exe - pathping.exe + tracert.exe + pathping.exe @@ -1558,70 +1559,70 @@ fltMC.exe misc::mflt - AntiVirusProduct - root\SecurityCenter2 + AntiVirusProduct + root\SecurityCenter2 - sysinfo.exe - systeminfo + sysinfo.exe + systeminfo - + netsh.exe get;list;show - + netsh.exe get;list;show - ipconfig.exe + ipconfig.exe - netstat.exe - arp -a - arp.exe -a - arp -a + netstat.exe + arp -a + arp.exe -a + arp -a - + whoami.exe;whoami1.exe - + wmic.exe get;useraccount - + netsh.exe add;set encryption;dohtemplate - + netsh.exe add;del;set - + nbtstat nessus - + route.exe print - + route.exe ADD;DEL;CHANGE;-f - qwinsta.exe - rwinsta.exe + qwinsta.exe + rwinsta.exe - + Microsoft Office\root\Office Microsoft Office\root\Office automation;Embedding - + admin$ davclnt.dll WebClientGroup @@ -1631,54 +1632,54 @@ - /shadow;-shadow - noConsentPrompt + /shadow;-shadow + noConsentPrompt - - tscon.exe + + tscon.exe dest:rdp-tcp: - + powershell.exe WmiPrvSE.exe - + WmiPrvSE.exe \Users\ - + NetworkDetective WmiPrvSE.exe - + sc.exe tenable WmiPrvSE.exe - + cmd.exe WmiPrvSE.exe do_vbsUpload;Spiceworks - + regsvr32.exe WmiPrvSE.exe - + cmd.exe WmiPrvSE.exe - + powershell.exe WmiPrvSE.exe - + dsa.msc - + virtmgmt.msc - + wmiprvse.exe CompMgmtLauncher.exe DismHost.exe @@ -1690,7 +1691,7 @@ g2mupdate.exe slack.exe - + wsmprovhost.exe cmd.exe sh.exe @@ -1707,66 +1708,66 @@ ping.exe bitsadmin.exe - winrm.cmd - winrs.exe - winrshost.exe - waitfor.exe - wsmprovhost.exe - winrshost.exe - wsmprovhost.exe - + winrm.cmd + winrs.exe + winrshost.exe + waitfor.exe + wsmprovhost.exe + winrshost.exe + wsmprovhost.exe + wmiprvse.exe mshta.exe - + ssh.exe;putty.exe;kitty.exe;kitty_portable.exe - PuTTY suite - + PuTTY suite + sftp;psftp - + rundll32.exe - + rundll32.exe ..\;, - + rundll32.exe ,StartW - psshutdown - psservice - PsPasswd - mstsc.exe - telnet.exe - tftp.exe - powershellcustomhost + psshutdown + psservice + PsPasswd + mstsc.exe + telnet.exe + tftp.exe + powershellcustomhost -Embedding c:\windows\system32\mmc.exe - --execm;atexec - {4991d34b-80a1-4291-83b6-3328366b9097} - {00020812-0000-0000-C000-000000000046} - {40AEEAB6-8FDA-41e3-9A5F-8350D4CFCA91} - {7e0423cd-1119-0928-900c-e6d4a52a0715} - {0006F04A-0000-0000-C000-000000000046} - {048EB43E-2059-422F-95E0-557DA96038AF} - {13709620-C279-11CE-A49E-444553540000} - {c08afd90-f2a1-11d1-8455-00a0c91f3880} - 9BA05972-F6A8-11CF-A442-00A0C90A8F39 - {00021A20-0000-0000-C000-000000000046} - {72C24DD5-D70A-438B-8A42-98424B88AFB8} - {00020906-0000-0000-C000-000000000046} - {cc5bbec3-db4a-4bed-828d-08d78ee3e1ed} - {1b7cd997-e5ff-4932-a7a6-2a9e636da385} - {16d51579-a30b-4c8b-a276-0ff4dc41e755} - rundll32.exe -sta;rundll32.exe /sta;rundll32 -sta;rundll32 /sta - shell32.dll;SHCreateLocalServerRunDll - -k DcomLaunch;/k DcomLaunch + --execm;atexec + {4991d34b-80a1-4291-83b6-3328366b9097} + {00020812-0000-0000-C000-000000000046} + {40AEEAB6-8FDA-41e3-9A5F-8350D4CFCA91} + {7e0423cd-1119-0928-900c-e6d4a52a0715} + {0006F04A-0000-0000-C000-000000000046} + {048EB43E-2059-422F-95E0-557DA96038AF} + {13709620-C279-11CE-A49E-444553540000} + {c08afd90-f2a1-11d1-8455-00a0c91f3880} + 9BA05972-F6A8-11CF-A442-00A0C90A8F39 + {00021A20-0000-0000-C000-000000000046} + {72C24DD5-D70A-438B-8A42-98424B88AFB8} + {00020906-0000-0000-C000-000000000046} + {cc5bbec3-db4a-4bed-828d-08d78ee3e1ed} + {1b7cd997-e5ff-4932-a7a6-2a9e636da385} + {16d51579-a30b-4c8b-a276-0ff4dc41e755} + rundll32.exe -sta;rundll32.exe /sta;rundll32 -sta;rundll32 /sta + shell32.dll;SHCreateLocalServerRunDll + -k DcomLaunch;/k DcomLaunch @@ -1775,18 +1776,18 @@ - + 7z.exe a -mx9 -r0 -p;a -v500m -mx9 -r0 -p - WindowsAudioDevice-Powershell-Cmdlet - SoundRecorder.exe + WindowsAudioDevice-Powershell-Cmdlet + SoundRecorder.exe - clip.exe - get-clipboard + clip.exe + get-clipboard @@ -1795,34 +1796,34 @@ - + New-MailboxExportRequest - screencapture - system.drawing.Imaging - system.drawing.bitmap - system.windows.forms.screen + screencapture + system.drawing.Imaging + system.drawing.bitmap + system.windows.forms.screen - + odHRwczovL;aHR0cDovL;h0dHA6Ly;odHRwOi8v;aHR0cHM6Ly;h0dHBzOi8v ie_to_edge_stub.exe;chrome.exe;firefox.exe;iexplore.exe;brave.exe;vivaldi.exe;msedge.exe;webex;teams.exe;goto opener.exe;lynx.exe;\Webex\webexAppLauncherLatest.exe;\WebEx\webexAppLauncher.exe;\WebEx\Applications\webexAppLauncher.exe;WebEx\webex.exe wbx:;/SITE_TOKEN=;msteams:;PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSI msedgeupdate.dll - + VFZvQUFBQ;RWb0FBQU;UVm9BQUFB;VFZxQUFBR;RWcUFBQU;UVnFBQUFF;VFZwUUFBS;RWcFFBQU;UVnBRQUFJ;VFZxUUFBT;RWcVFBQU;UVnFRQUFN;VFZwVEFRR;RWcFRBUU;UVnBUQVFF - + powershell.exe AAAAYInlM;OiCAAAAYInlM;OiJAAAAYInlM;RwBlAHQAL;WwBOAGUAdAAuAFM;W05ldC5TZXJ2aWNl - + Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք @@ -1830,106 +1831,106 @@ - + certutil.exe urlcache;split;f - + DownloadFile;DownloadString;Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;Invoke-Expression;Invoke-WebRequest powershell.exe;cmd.exe - + bitsadmin.exe CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME util;setieproxy;localsystem;AUTODETECT - + BITS administration utility CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME - + \curl.exe;\wget.exe;\www.exe - + \curl.exe;\wget.exe;\www.exe - + certutil split;f - + certutil verifyctl;URL - + C:\Perflogs\;C:\Users\Public\;C:\root\ - + C:\Perflogs\;C:\Users\Public\;C:\root\ - start-bitstransfer - expand \\ - expand.exe \\ - ieexec http - ieexec.exe http - powercat - esentutl /y \\;esentutl -y \\ - esentutl.exe /y \\;esentutl.exe -y \\ - extrac32 \\ - extrac32.exe \\ + start-bitstransfer + expand \\ + expand.exe \\ + ieexec http + ieexec.exe http + powercat + esentutl /y \\;esentutl -y \\ + esentutl.exe /y \\;esentutl.exe -y \\ + extrac32 \\ + extrac32.exe \\ - portproxy - tor.exe + portproxy + tor.exe - TeamViewer_Desktop.exe - + TeamViewer_Desktop.exe + psexec - + winscp.exe;winscp.com;scp.exe;pscp - + bitch.exe;bitch.bat;bitch_lasagna.exe;Admin Cracker.exe;BulletsPassView.exe;ChromePass.exe;Dialupass.exe;LSASecretsView.exe;OpenedFilesView.exe;OperaPassView.exe;PasswordFox.exe;ProduKey.exe;RouterPassView.exe;USBDeview.exe;USBStealer.exe;VNCPassView.exe;WebBrowserPassView.exe;WirelessKeyView.exe;WirelessKeyView.exe;empv.exe;netpass.exe;pspv.exe;usbdll.exe;rdpv.exe;WirelessKeyView.exe;lasagna.exe;all -vvv >>;rsync -r - + CredsLeaker;Windows.Security.Credentials.UI.CredentialPicker;function Leaker;function Await - + .exe -url https://;dll,Run https://;Invoke-Merlin;-m SimpleHTTPServer;/m SimpleHTTPServer - + -q=txt;/q=txt nslookup.exe - + rclone Rsync for cloud storage rclone rclone \rclone - + s3browser s3browser s3browser s3browser - + add-ftp;.UploadFile( ftp.exe - + rundll32.exe davclnt.dll;DavSetCookie @@ -1942,65 +1943,65 @@ - + bcdedit.exe safeboot - + bootcfg.exe safeboot - + -startvm;vrun.exe -vm - + vssadmin.exe delete;resize - + wmic.exe shadowcopy;delete - + wbadmin.exe SYSTEMSTATEBACKUP;delete - + wmic.exe wmic shadowstorage SET MaxSpace= - + wmic.exe cleareventlog;call disable;nteventlog where filename - + diskpart.exe format;clean;delete;remove - + manage-bde.exe changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw - + manage-bde.wsf changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw - format - format - bootstatuspolicy ignoreallfailures - recoveryenabled No - Win32_Shadowcopy - sdelete - delete catalog - wbadmin delete catalog - erase - -nw -exec= - -p -nw - shred - diskshadow - + format + format + bootstatuspolicy ignoreallfailures + recoveryenabled No + Win32_Shadowcopy + sdelete + delete catalog + wbadmin delete catalog + erase + -nw -exec= + -p -nw + shred + diskshadow + del ; /f del ; -f rmdir ; /s ; /q @@ -2009,11 +2010,11 @@ rd ; -s ; -q - usn deletejournal + usn deletejournal - + fsutil.exe deletejournal usn @@ -2025,120 +2026,120 @@ - AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz + AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz - + ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool CPU miner;GPU miner;Lime Miner;XMRig CPU miner; miner - + b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 - 87AECF008D87EC86EC8B00A2394B3E6C - FB3F0D0DE8B80EA8CFAB2A025EC6B833 - F4067FBF7FFF6945D0BB485B727B39AA - 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee - e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f - d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b - 53841a0c6a3ff92976db08bfdf95e083 + 87AECF008D87EC86EC8B00A2394B3E6C + FB3F0D0DE8B80EA8CFAB2A025EC6B833 + F4067FBF7FFF6945D0BB485B727B39AA + 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee + e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f + d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b + 53841a0c6a3ff92976db08bfdf95e083 - + zoommtg pwd= - + zoommtg zc=0 - + zoommtg zc=1 - + msteams: - + wbx: - + C:\Users\ \Downloads\ - + C:\Users\ \Desktop\ - + \awk.exe;\sed.exe listena - -s -n -u -i:http: - /s /n /u /i:http: - assoc - del - expand - md - move - rd - ren - set - setx - bginfo.bgi /popup /nolicprompt;bginfo.bgi -popup -nolicprompt - find.exe - grabff - routerscan - pythonEngine.Execute - sesshijack - file:// - HTML Application host - Manager Profile Installer - Microsoft Application Virtualization Injector - Application Compatibility Database Installer - popd.exe - pushd.exe - subst.exe - doskey.exe - cls.exe - \ - C:\Windows\system32\svchost.exe -k iissvcs - \ - acrobat.exe - acrord32.exe - java.exe - javaw.exe + -s -n -u -i:http: + /s /n /u /i:http: + assoc + del + expand + md + move + rd + ren + set + setx + bginfo.bgi /popup /nolicprompt;bginfo.bgi -popup -nolicprompt + find.exe + grabff + routerscan + pythonEngine.Execute + sesshijack + file:// + HTML Application host + Manager Profile Installer + Microsoft Application Virtualization Injector + Application Compatibility Database Installer + popd.exe + pushd.exe + subst.exe + doskey.exe + cls.exe + \ + C:\Windows\system32\svchost.exe -k iissvcs + \ + acrobat.exe + acrord32.exe + java.exe + javaw.exe - + C:\Windows\system32\svchost.exe - cacls.exe - takeown.exe - /x Macro - + cacls.exe + takeown.exe + /x Macro + \pipe\ > - /noprofile - /sc ONEVENT - \\VBOXSVR - | more - |more - \\tsclient - %PROCESSOR_ARCHITECTURE% - sysnative - AutoIt - Microsoft Filter Loader - more.com - :\Windows\Microsoft.NET\ - acrord32.exe - gpupdate.exe - :\Windows\Microsoft.NET\ - System + /noprofile + /sc ONEVENT + \\VBOXSVR + | more + |more + \\tsclient + %PROCESSOR_ARCHITECTURE% + sysnative + AutoIt + Microsoft Filter Loader + more.com + :\Windows\Microsoft.NET\ + acrord32.exe + gpupdate.exe + :\Windows\Microsoft.NET\ + System @@ -2180,12 +2181,12 @@ - census - researchscan - scanhub - shadow - shodan - + census + researchscan + scanhub + shadow + shodan + 137.184.67.33;206.188.196.77;125.212.220.48;5.180.61.17;47.242.39.92;61.244.94.85;86.48.6.69;86.48.12.64;94.140.8.48;94.140.8.113;103.9.76.208;103.9.76.211;104.244.79.6;112.118.48.186;122.155.174.188;125.212.241.134;185.220.101.182;194.150.167.88;212.119.34.11 137.184.67. httpbin.org @@ -2223,7 +2224,7 @@ - + wscript.exe @@ -2232,8 +2233,8 @@ - at.exe - schtasks.exe + at.exe + schtasks.exe @@ -2296,39 +2297,39 @@ - + \temp\ 127.0.0.1 - + \wwwroot\ - \Windows\addins\ - C:\Windows\repair\ - \htdocs\ - C:\Windows\system32\config\systemprofile\ - C:\Intel\Logs\ - C:\Windows\addins\ - C:\Windows\security\ - C:\Windows\Help\ - $RECYCLE.BIN - C:\Windows\Debug\ - C:\Windows\Fonts\ - C:\PerfLogs\ - :\$Recycle.bin\ - :\Users\Default\ - C:\Users\NetworkService\ - C:\Users\Public\ - C:\Windows\Media\ - \Windows\IME\ - C:\ProgramData + \Windows\addins\ + C:\Windows\repair\ + \htdocs\ + C:\Windows\system32\config\systemprofile\ + C:\Intel\Logs\ + C:\Windows\addins\ + C:\Windows\security\ + C:\Windows\Help\ + $RECYCLE.BIN + C:\Windows\Debug\ + C:\Windows\Fonts\ + C:\PerfLogs\ + :\$Recycle.bin\ + :\Users\Default\ + C:\Users\NetworkService\ + C:\Users\Public\ + C:\Windows\Media\ + \Windows\IME\ + C:\ProgramData - + CSC.exe @@ -2339,24 +2340,24 @@ - infDefaultInstall.exe - SyncAppvPublishingServer.exe + infDefaultInstall.exe + SyncAppvPublishingServer.exe - InstallUtil.exe + InstallUtil.exe - msiexec.exe + msiexec.exe - + regasm.exe;regsvcs.exe - Mavinject.exe + Mavinject.exe - + msbuild.exe @@ -2395,7 +2396,7 @@ - dsquery.exe + dsquery.exe @@ -2408,17 +2409,17 @@ - driverquery.exe + driverquery.exe - nbtstat.exe + nbtstat.exe - net.exe - net1.exe + net.exe + net1.exe - qwinsta.exe - rwinsta.exe + qwinsta.exe + rwinsta.exe @@ -2429,7 +2430,7 @@ - + true 3389 AutomationManager.ScriptRunner64.exe @@ -2457,7 +2458,7 @@ thor64.exe thor.exe - + true 3391 AutomationManager.ScriptRunner64.exe @@ -2485,42 +2486,42 @@ thor64.exe thor.exe - + true 3389 127.0.0.1;0:0:0:0:0:0:0:1 - + true 3389 fe80:0 - + putty.exe;kitty.exe;kitty_portable.exe - + wsmprovhost.exe - + psftp.exe - reg.exe - psshutdown - PsPasswd - psservice - ssh.exe - psexe - tftp.exe - telnet.exe - mstsc.exe - wmic.exe - sc.exe - pskill - dsquery.exe - plink.exe - vnc.exe - vncviewer.exe - vncservice.exe + reg.exe + psshutdown + PsPasswd + psservice + ssh.exe + psexe + tftp.exe + telnet.exe + mstsc.exe + wmic.exe + sc.exe + pskill + dsquery.exe + plink.exe + vnc.exe + vncviewer.exe + vncservice.exe omniinet.exe hpsmhd.exe @@ -2548,11 +2549,11 @@ - + 50050 true - + 25 \Bin\EdgeTransport.exe;Bin\MSExchangeFrontendTransport.exe true @@ -2565,26 +2566,26 @@ - + powershell.exe 0:0:0:0:0:0:0:;127.0.0.1 - mshta.exe - cmd.exe - certutil.exe - certutil.exe - notepad.exe - regsvcs.exe - regsvr32.exe - rundll32.exe + mshta.exe + cmd.exe + certutil.exe + certutil.exe + notepad.exe + regsvcs.exe + regsvr32.exe + rundll32.exe - tor.exe - hiddenservice.net;onion.city;onion.direct;onion.direct;onion.link;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org;onion.to + tor.exe + hiddenservice.net;onion.city;onion.direct;onion.direct;onion.link;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org;onion.to @@ -2593,16 +2594,16 @@ - dns.google;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;doh.opendns.com;.quad9.net;dns.cleanbrowsing.org;dns-family.adguard.com;dns.adguard.com;.233py.com;dnscrypt;dnscrypt-cert.oszx.co;dns.oszx.co;doh.dns.sb;doh.defaultroutes.de;doh.tiarap.org;doh.tiar.app;doh.captnemo.in;.aaflalo.me;doh.appliedprivacy.net;doh.dnswarden.com;commons.host;dns.twnic.tw;ibuki.cgnat.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;.seby.io;rdns.faelix.net;doh.li;.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk;adblock.mydns.network;ibksturm.synology.me;jcdns.fun + dns.google;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;doh.opendns.com;.quad9.net;dns.cleanbrowsing.org;dns-family.adguard.com;dns.adguard.com;.233py.com;dnscrypt;dnscrypt-cert.oszx.co;dns.oszx.co;doh.dns.sb;doh.defaultroutes.de;doh.tiarap.org;doh.tiar.app;doh.captnemo.in;.aaflalo.me;doh.appliedprivacy.net;doh.dnswarden.com;commons.host;dns.twnic.tw;ibuki.cgnat.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;.seby.io;rdns.faelix.net;doh.li;.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk;adblock.mydns.network;ibksturm.synology.me;jcdns.fun - privatlab.com - mega.nz;mega.co.nz - .pcloud.com + privatlab.com + mega.nz;mega.co.nz + .pcloud.com @@ -2615,11 +2616,11 @@ - 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool - + C:\Windows\system32\svchost.exe 3389 22 @@ -2627,24 +2628,24 @@ 5985 false - + C:\Windows\system32\svchost.exe true 135 445 5985 - + System svchost.exe 445 - + System svchost.exe;lsass.exe 389 - + C:\Windows\System32\lsass.exe 389 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 @@ -2652,105 +2653,105 @@ 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 false - + notepad.exe 127.0.0.1 - + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 80 443 true - github - githubusercontent.com - + github + githubusercontent.com + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe 80 true - + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe 443 true - + apache.exe - + java.exe - + w3wp.exe - + \php-cgi.exe;\php.exe - + setup - + tomcat - + unins - + unknown process - + explorer.exe - + inetinfo.exe - netcat.exe;nc.exe;nc64.exe;ncat.exe - procdump - psexe - vnc;vncs;vncv - + netcat.exe;nc.exe;nc64.exe;ncat.exe + procdump + psexe + vnc;vncs;vncv + rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe;advanced_port_scanner.exe;rcpping.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe - 0 - 5985 - 5986 - 1293 - 1701 - 1194 - 3540 - 3389 - 22 - 1080 - 3128 - 8080 - 1723 - 23 - 4500 - 9001 - 9030 - 5900 - 5800 + 0 + 5985 + 5986 + 1293 + 1701 + 1194 + 3540 + 3389 + 22 + 1080 + 3128 + 8080 + 1723 + 23 + 4500 + 9001 + 9030 + 5900 + 5800 - 0 - + 0 + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 443 true - + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe 80 true - 80 - 443 - 636 - 5900 - 443 + 80 + 443 + 636 + 5900 + 443 - afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com + afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com @@ -2886,7 +2887,7 @@ MSExchangeFrontendTransport.exe MSExchangeHMWorker.exe MSExchangeSubmission.exe - \ + \ C:\Program Files (x86)\Kaspersky Lab @@ -2905,18 +2906,18 @@ - + C:\Windows\ \System32\;Syswow64;sysmon.exe;sysmon64.exe - + C:\Windows\system32\ config\systemprofile\ - + C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe - + A:\;B:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;N:\;O:\;P:\;Q:\;R:\;S:\;T:\;U:\;V:\;W:\;X:\;Y:\;Z:\;AA:\;BB:\;CC:\;DD:\;EE:\;FF:\;GG:\;HH:\;II:\;JJ:\;KK:\;LL:\;MM:\;NN:\;OO:\;PP:\;QQ:\;RR:\;SS:\;TT:\;UU:\;VV:\;WW:\;XX:\;YY;ZZ:\ :\PROGRA~ :\Program Files @@ -2930,29 +2931,29 @@ :\$WinREAgent :\inetpub\ - + \ - + C:\Users\ - + C:\ProgramData\ C:\ProgramData\sysmon\sysmon64.exe;C:\ProgramData\sysmon\sysmon.exe - + C:\Program Files;C:\PROGRA~ - + C:\inetpub\ - $RECYCLE.BIN - packetbeat.exe;metricbeat.exe;filebeat.exe;winlogbeat.exe;o365beat.exe;graylog-sidecar.exe;graylog-collector-sidecar.exe;splunkd.exe;splunk.exe;syslogng.exe;syslog-ng.exe;nxlog-processor.exe;snarecore.exe;fluentd;td-agent - C:\Windows\system32\config\systemprofile\ - C:\Windows\sysWOW64\config\systemprofile\ + $RECYCLE.BIN + packetbeat.exe;metricbeat.exe;filebeat.exe;winlogbeat.exe;o365beat.exe;graylog-sidecar.exe;graylog-collector-sidecar.exe;splunkd.exe;splunk.exe;syslogng.exe;syslog-ng.exe;nxlog-processor.exe;snarecore.exe;fluentd;td-agent + C:\Windows\system32\config\systemprofile\ + C:\Windows\sysWOW64\config\systemprofile\ \Temp\ - C:\Users\ + C:\Users\ @@ -2966,25 +2967,25 @@ - + 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - + 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5;c948ae14761095e4d76b55d9de86412258be7afd;c996d7971c49252c582171d9380360f2;ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1;10b30bdee43b3a2ec4aa63375577ade650269d25;d2fd132ab7bbc6bbb87a84f026fa0244 - DumpExt.dll - mimidrv - lsremora - wceaux.dll - npcap - \Temp - :\Users - ChongKim Chan + DumpExt.dll + mimidrv + lsremora + wceaux.dll + npcap + \Temp + :\Users + ChongKim Chan ? Revoked Unavailable Valid - false + false @@ -2998,136 +2999,136 @@ - + msdt.exe sdiageng.dll - + WINWORD.exe;EXCEL.EXE VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wshom.ocx wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - + ntkrnlmp.exe - + \spool\drivers\x64\3\;\spool\drivers\W32X86\3\;\spool\drivers\IA64\3\ spoolsv.exe;printisolationhost.exe Valid Brother Industries;Canon;Sharp;Microsoft Corporation;DYMO;Euro Plus d.o.o;HP Inc;Hewlett-Packard - + C:\Windows\ \Users\Public\;\Desktop\;\Downloads\;\AppData\Local\Temp\;\PerfLogs\;$Recycle;\Fonts\ \Program Files - + EQNEDT32.EXE EQNEDT32.EXE - + ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll C:\Users;\Temp\;\ProgramData\ - + ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll \wscript.exe;\cscript.exe;\powershell.exe;\powershell_ise.exe;\rundll32.exe;\msbuild.exe;\csc.exe - + WINWORD.exe;EXCEL.EXE VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wshom.ocx wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll;fastprox.dll - + WINWORD.exe;EXCEL.EXE VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - + WINWORD.exe;EXCEL.EXE VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - + WINWORD.exe;EXCEL.EXE taskschd.dll - + wscript.exe;cscript.exe taskschd.dll - + wmiprvse.exe taskschd.dll - + powershell.exe msi.dll - + powershell amsi.dll - + powershell amsi.dll - + logoncli.dll C:\Windows\System32\wbem\WmiPrvSE.exe - + WINWORD.exe;EXCEL.EXE clr.dll - + clr.dll;System.Management.ni.dll;Microsoft.Build.Utilities - + wscript.exe;cscript.exe msxml;wshom.ocx - + wscript.exe;cscript.exe winhttp.dll;mswsock.dll;IPHLPAPI.DLL - + installutil.exe CustomMarshalers.dll;CustomMarshalers.ni.dll;System.Management.ni.dll;WMINet_Utils.dll;mswsock.dll - + System.Management.Automation.ni.dll C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ - + System.Management.Automation.dll C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ Lenovo.Vantage.AddinHost;\Microsoft.Sara.exe;C:\Program Files\CONEXANT - + C:\Windows\System32\vaultcli.dll \svchost.exe;\GameBar.exe;C:\Program Files\WindowsApps;\Microsoft\Teams\current\Teams.exe - + \\ - + \Microsoft\Word\Startup\ .wll - + \Microsoft\Excel\Startup\ .xll - + \Microsoft\Addins\ .xla - + tor-lib.dll - + C:\Windows\System32\WinSCard.dll;C:\Windows\System32\cryptdll.dll;C:\Windows\System32\hid.dll;C:\Windows\System32\samlib.dll;C:\Windows\System32\vaultcli.dll - + rundll32.exe vaultcli.dll;wlanapi.dll combase.dll @@ -3141,14 +3142,14 @@ shcore.dll srvcli.dll - + odbc32.dll;winhttp.dll;netapi32.dll;SHLWAPI.dll - + C:\Windows\Explorer.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - + C:\ProgramData\ C:\ProgramData\ .exe @@ -3157,18 +3158,18 @@ C:\ProgramData\Microsoft\Windows Defender\ C:\ProgramData\sysmon\sysmon64.exe - + C:\Users\Default\;C:\Users\Public\ .exe - + C:\Users\Default\;C:\Users\Public\ .dll - + 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - + SHA256=074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 SHA256=45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 SHA256=9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 @@ -3176,23 +3177,23 @@ SHA256=c8c907a67955bcdf07dd11d35f2a23498fb5ffe5c6b5d7f36870cf07da47bff2 SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e - + C:\Windows\System32\svchost.exe false - + Revoked - + Expired - + jscript9.dll mshta.exe scrobj.dll crypt0.dll - + C:\Windows\System32\wlanapi.dll C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe @@ -3213,11 +3214,11 @@ C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_ C:\Windows\explorer.exe - + C:\Windows\Microsoft.NET\assembly\GAC_MSIL false - + C:\Windows\Microsoft.NET\assembly\GAC_MSIL true @@ -3225,15 +3226,15 @@ - + \Microsoft Office\ \mscorlib.ni.dll - + \Microsoft Office\ \sppc.dll - + C:\Windows\System32\svchost.exe true @@ -3277,41 +3278,41 @@ - + 0x001A0000 c:\windows\system32\lsass.exe - + msiexec.exe - + chrome.exe;firefox.exe;edge.exe;browser_broker.exe;iexplore.exe;opera.exe - + 0x001A0000 c:\windows\system32\lsass.exe - + c:\windows\system32\lsass.exe c:\windows\system32\rundll32.exe - + DbgUiRemoteBreakin nacl64.exe - + QueryProcessDebugInformationRemote nacl64.exe - + isdebuggerpresent nacl64.exe - + DebugActiveProcess nacl64.exe - + LoadLibrary C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe @@ -3323,22 +3324,22 @@ C:\Program Files (x86)\ASUS\ROG Live Service\FileOperator.exe C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe - + CreateFileMapping;MapViewOfFile - + LdrLoadDll - + CryptAcquireContextA;CryptDecodeObjectEx;CryptImportPublicKeyInfo;CryptEncrypt;CryptGenKey;CryptDecrypt;CryptStringToBinary;CryptBinaryToString;CryptImportKey - + c:\windows\system32\csrss.exe CrtlRoutine - 0B80 - 0C7C - 0C88 + 0B80 + 0C7C + 0C88 c:\windows\system32\mstsc.exe C:\WINDOWS\SYSTEM32\ntdll.dll @@ -3367,70 +3368,70 @@ - + C:\Windows\System32\SHELL32.dll+9b5bd \LocalBridge.exe - + C:\Windows\System32\wshom.ocx+c8a0;C:\Windows\System32\wshom.ocx+c39d - + C:\Windows\SYSTEM32\framedynos.dll+2cb3e C:\Windows\system32\SgrmBroker.exe;C:\Windows\system32\SecurityHealthService.exe;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Windows\system32\services.exe;C:\Windows\system32\wininit.exe;C:\Windows\system32\sppsvc.exe;C:\Windows\System32\smss.exe;C:\Windows\system32\csrss.exe;C:\Windows\System32\svchost.exe - + C:\Windows\SYSTEM32\framedynos.dll+2b496 - + C:\Windows\SYSTEM32\dbgcore.DLL+6cfb - + C:\Windows\System32\KernelBase.dll+de67e - + ntdll.dll+a0044 - + clr.dll+6c23;clr.dll+6b38 - + C:\Windows\\SYSTEM32\ntdll.dll+;|C:\Windows\System32\KERNELBASE.dll+;|UNKNOWN( ) - + "UNKNOWN(;)|UNKNOWN( ) - + "UNKNOWN 0x1F0FFF;0x1F1FFF;0x143A;0x1410;0x1010;0x1F2FFF;0x1F3FFF;0x1FFFFF - + C:\Program Files;\Microsoft Office\Root\Office \Microsoft Shared\VBA C:\Program Files (x86)\Intuit\ - + C:\Windows\system32\lsass.exe 0x1FFFFF UNKNOWN WmiPerfClass.dll C:\Windows\sysWOW64\wbem\wmiprvse.exe;C:\Windows\system32\wbem\wmiprvse.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe;WmiPerfClass.dll;C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files (x86)\Common Files\Adobe - + C:\Windows\system32\lsass.exe C:\Windows\system32\wsmprovhost.exe - + C:\Windows\system32\lsass.exe 0x1FFFFF python27.dll;_ctypes.pyd;KERNELBASE.dll;ntdll.dll - + C:\Windows\system32\lsass.exe C:\Windows\SYSTEM32\ntdll.dll+4595c|C:\Windows\system32\KERNELBASE.dll+8185 - + C:\Windows\system32\lsass.exe C:\WINDOWS\SYSTEM32\ntdll.dll+ ) @@ -3438,52 +3439,52 @@ wow64.dll;)|C;Exchange.Diagnostics;Microsoft.Exchange C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe;c:\windows\system32\inetsrv\w3wp.exe;MSExchangeHMHost.exe;C:\Windows\sysWOW64\wbem\wmiprvse.exe - + C:\Windows\system32\winlogon.exe 0x1F3FFF C:\Windows\Microsoft.NET;UNKNOWN - + .exe C:\Windows\sysmon64.exe;C:\Windows\sysmon64.exe 0x1C00 - + C:\Windows\system32\lsass.exe 0x1F1FFF UNKNOWN - + C:\Windows\system32\lsass.exe 0x1010 UNKNOWN - + C:\Windows\system32\lsass.exe 0x143A UNKNOWN - + C:\Windows\system32\lsass.exe 0x1fffff dbghelp.dll;dbgcore.dll - + dbghelp.dll;dbgcore.dll C:\Windows\system32\lsass.exe C:\wfx32\ - + powershell.exe C:\Programdata\sysmon\sysmon64.exe;C:\Programdata\sysmon\sysmon.exe;C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe;\dismhost.exe - + getasynckeystate - + cmlua.dll - + System.Management.Automation C:\ProgramData\Microsoft\Windows Defender\platform\ ctiuser.dll @@ -3501,34 +3502,34 @@ C:\Windows\system32\query.exe MsMpEng.exe - + C:\Windows\system32\lsass.exe comsvcs.dll - + VBE7.dll;VBEUI.DLL;VBE7INTL.DLL - + VBE6.dll;VBEUI.DLL;VBE6INTL.DLL - + Office verclsid.exe VBE7.dll;VBEUI.DLL;VBE7INTL.DLL |UNKNOWN( 0x1FFFFF - + C:\Program Files\Microsoft Office\Root\Office C:\Windows\System32\KERNELBASE.dll+76516 - + C:\Windows\System32\SHELL32.dll+ae3b9 C:\WINDOWS\system32\sihost.exe C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub - UNKNOWN - + UNKNOWN + |UNKNOWN( C:\WINDOWS\SYSTEM32\ntdll.dll+ |C:\WINDOWS\System32\KERNELBASE.dll+ @@ -3539,15 +3540,15 @@ \Intel\Driver and Support Assistant\ C:\Windows\Microsoft.NET\Framework\;\ngen.exe - + winword.exe;excel.exe;powerpnt.exe :\Windows\Microsoft.NET\Framework64\v2.;UNKNOWN - + UNKNOWN 0x147a - + C:\Windows\Sysmon64.exe;C:\Windows\Sysmon.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe @@ -3556,21 +3557,21 @@ 0x1400 - 0x0800 + 0x0800 - 0x0810 + 0x0810 - 0x0820 + 0x0820 - 0x810 + 0x810 0x820 - cscript.exe - wscript.exe + cscript.exe + wscript.exe jjs.exe - dump - mimikatz - CorperfmontExt.dll + dump + mimikatz + CorperfmontExt.dll C:\Program Files (x86)\Kaspersky Lab C:\Program Files\Kaspersky Lab @@ -3599,7 +3600,7 @@ :\Windows\system32\sdiagnhost.exe UNKNOWN(00007F - + C:\Windows\SYSTEM32\ntdll.dll C:\Windows\SYSTEM32\win32u.dll C:\Windows\SYSTEM32\wow64win.dll @@ -3612,7 +3613,7 @@ - \TEMP\nessus_ + \TEMP\nessus_ @@ -3640,19 +3641,19 @@ - + solarwinds.businesslayerhost .exe;.dll;.ps1;.mz;.jpg;.png - + C:\WINDOWS\SysWOW64\netsetupsvc.dll - + C:\Windows\SoftwareDistribution - C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_;.exe + C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe .exe - + proj .targets .build @@ -3666,29 +3667,29 @@ - .bat - .btm - .cmd - .com - .cmdline - .bas - .bin - C:\Windows\SysWOW64\Wbem - C:\Windows\System32\Wbem - .ws - .wsc - .wsf - .wsh - .pif + .bat + .btm + .cmd + .com + .cmdline + .bas + .bin + C:\Windows\SysWOW64\Wbem + C:\Windows\System32\Wbem + .ws + .wsc + .wsf + .wsh + .pif - .hta + .hta - IronPython - .py - .pyc - .pyd + IronPython + .py + .pyc + .pyd - + .cdxml .ps1 .ps1xml @@ -3697,37 +3698,38 @@ .psm1 .pssc - + powershell.exe;powershell_ise.exe - - C:\Windows\SysWOW64\WindowsPowerShell - C:\Windows\System32\WindowsPowerShell - c:\Windows\System32\WindowsPowerShell\v1.0\profile - c:\Windows\Syswow64\WindowsPowerShell\v1.0\profile - \UsageLogs\powershell.exe.log - PSReadLine\ConsoleHost_history.txt + \Recent\CustomDestinations\ + + C:\Windows\SysWOW64\WindowsPowerShell + C:\Windows\System32\WindowsPowerShell + c:\Windows\System32\WindowsPowerShell\v1.0\profile + c:\Windows\Syswow64\WindowsPowerShell\v1.0\profile + \UsageLogs\powershell.exe.log + PSReadLine\ConsoleHost_history.txt - .vbs - .oracle_jre_usage\ - .js - .jse - .vb - .vbe - .vbsript + .vbs + .oracle_jre_usage\ + .js + .jse + .vb + .vbe + .vbsript - + Report.wer.tmp \WER\ C:\Windows\system32\wermgr.exe - + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe .exe C:\Users - + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe .dll C:\Users @@ -3740,24 +3742,24 @@ - + !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;=READ=THIS=PLEASE=;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy C:\Users\;\Google\Chrome Beta\User Data\;\IndexedDB\ C:\Program Files\WindowsApps\Microsoft.YourPhone_;C:\Program Files\dotnet\shared\Microsoft.NETCore.App\ - crackmapexec - \Crypto.Cipher._AES.pyd - \Crypto.Cipher._DES.pyd - \Crypto.Hash._SHA256.pyd - \Crypto.Random.OSRNG.winrandom.pyd - \Crypto.Util.strxor.pyd - \crackmapexec.exe.manifest - \greenlet.pyd - BootStrapDLL.dll - C:\windows\temp\wininit.exe - lazycat;powerkatz;mimikatz;mimidrv;mimilove;mimilib;mimikittenz;mimiauth;invoke-mimi - rdpwrap.dll - winspool.drv + crackmapexec + \Crypto.Cipher._AES.pyd + \Crypto.Cipher._DES.pyd + \Crypto.Hash._SHA256.pyd + \Crypto.Random.OSRNG.winrandom.pyd + \Crypto.Util.strxor.pyd + \crackmapexec.exe.manifest + \greenlet.pyd + BootStrapDLL.dll + C:\windows\temp\wininit.exe + lazycat;powerkatz;mimikatz;mimidrv;mimilove;mimilib;mimikittenz;mimiauth;invoke-mimi + rdpwrap.dll + winspool.drv C:\Windows\System32\Wbem C:\Windows\SysWOW64\Wbem @@ -3766,8 +3768,8 @@ - \Programs\Startup\ - \Startup\ + \Programs\Startup\ + \Startup\ @@ -3779,53 +3781,53 @@ - \Word\STARTUP\ - \Microsoft\Templates\ - \Excel\XLSTART\ + \Word\STARTUP\ + \Microsoft\Templates\ + \Excel\XLSTART\ .dotm .XLSB - C:\Windows\Tasks\ + C:\Windows\Tasks\ - + RedirSuiteServiceProxy.aspx - + w3wp.exe .aspx - + w3wp.exe .php - + w3wp.exe .aaa - + \wwwroot\aspnet_client\;\FrontEnd\HttpProxy\owa\auth .aspx;.php;.ashx - + \wwwroot\ \wwwroot\aspnet_client\;jpg - + .asp \wwwroot\ - + .aspx \wwwroot\ - \ecp\auth\ - \oab\auth\ - ClientAccess\Owa\ - \owa\auth\ - httpproxy\rpc\ - ClientAccess\ecp\ - \htdocs\ + \ecp\auth\ + \oab\auth\ + ClientAccess\Owa\ + \owa\auth\ + httpproxy\rpc\ + ClientAccess\ecp\ + \htdocs\ @@ -3839,16 +3841,16 @@ - + .SPL spoolsv.exe;printfilterpipelinesvc.exe;printisolationhost.exe;splwow64.exe;msiexec.exe;poqexec.exe - + spoolsv.exe .exe C\:\Windows\System32\spool\;C\:\Windows\Temp\;C\:\Users\ - + msiexec.exe \Microsoft\Edge\Application elevation_service.exe @@ -3876,10 +3878,10 @@ - \LocalState\rootfs\ + \LocalState\rootfs\ - + C:\PerfLogs\ C:\Temp\ C:\Users\Default\ @@ -3887,13 +3889,13 @@ C:\Windows\Temp\ \AppData\Temp\ - $Recycle.Bin - $Recycle.Bin - + $Recycle.Bin + $Recycle.Bin + C:\Windows\ \config\systemprofile\ - + C:\Windows\ \config\systemprofile\ @@ -3980,7 +3982,7 @@ - + UMWorkerProcess.exe;UMService.exe . .log;.cfg;.txt;cleanup;.HealthCheck;\wp.active;.db @@ -3997,31 +3999,31 @@ - .7z - .7zip - .arj - .s7z - .a - .ace - .ar - .arc - .bin - .cab - .pak - .gz - .img - .iso - .lzm - .lzma - Temp\Rar$ - .rar - RarSFX - .sfx - .sz - .tar - .tar.gz - .xz - .zip + .7z + .7zip + .arj + .s7z + .a + .ace + .ar + .arc + .bin + .cab + .pak + .gz + .img + .iso + .lzm + .lzma + Temp\Rar$ + .rar + RarSFX + .sfx + .sz + .tar + .tar.gz + .xz + .zip @@ -4034,10 +4036,10 @@ - .ost - .eml - .msg - .pst + .ost + .eml + .msg + .pst @@ -4046,7 +4048,7 @@ - + Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք @@ -4054,21 +4056,21 @@ - Teamviewer.exe - rundll32.exe - mstsc.exe - cmd.exe - ipy.exe - WScript.exe - cscript.exe - mshta.exe - python.exe - wmic.exe - + Teamviewer.exe + rundll32.exe + mstsc.exe + cmd.exe + ipy.exe + WScript.exe + cscript.exe + mshta.exe + python.exe + wmic.exe + C:\Users\Default\;C:\Users\Public\ .dll - + C:\Users\Default\;C:\Users\Public\ .exe @@ -4078,10 +4080,10 @@ - HiddenService - torrc - \tor.exe - tor-gencert + HiddenService + torrc + \tor.exe + tor-gencert @@ -4097,27 +4099,27 @@ - rclone - s3browser - grabff.exe - grabff.exe + rclone + s3browser + grabff.exe + grabff.exe - + RESTORE_;_FILES.txt - + DECRYPT_;_FILES.txt - + \run.dat;\task.dat;\storage.dat AppData Symantec BlueJeans - + VBoxRT.dll;VboxC.dll @@ -4131,140 +4133,141 @@ - + Content.IE5;INetCache .exe;.zip;.ps1;.bat;.rar;.dll - + MSForms.exd - + .exe C:\windows\system32\ - + .exe C:\windows\ \system32\ - + .dll;.exe C:\windows\ C:\Users\ - + .dll;.exe C:\Users\ - + \Microsoft\Word\Startup\ .wll - + C:\windows\system32\CodeIntegrity\ - + \Microsoft\Excel\Startup\ .xll - + \Microsoft\Outlook\VbaProject.OTM - + \Microsoft\Addins\ .xla - + .vsto - + .bat C:\Windows\ C:\ProgramData\Lenovo\SystemUpdate\sessionSE\ - + .dll C:\Windows\ - + .sys C:\Windows\ - + .exe C:\Windows\ C:\Windows\System32\;C:\windows\syswow64\ - + .exe C:\Windows\System32\ - + .exe C:\Windows\SysWow64\ - + .theme - + \Packages\oice_ - + VirtualboxVM.exe - notepad++.exe - .lnk:Zone.Identifier - \UsageLogs\cscript.exe.log - \UsageLogs\mshta.exe.log - \UsageLogs\msiexec.exe.log - \UsageLogs\regsvr32.exe.log - \UsageLogs\rundll32.exe.log - \UsageLogs\svchost.exe.log - \UsageLogs\wmic.exe.log - \UsageLogs\wscript.exe.log - \regsvr32.exe.log - \UsageLogs\wsmprovhost.exe.log - .lnk - .url + notepad++.exe + .lnk:Zone.Identifier + \UsageLogs\cscript.exe.log + \UsageLogs\mshta.exe.log + \UsageLogs\msiexec.exe.log + \UsageLogs\regsvr32.exe.log + \UsageLogs\rundll32.exe.log + \UsageLogs\svchost.exe.log + \UsageLogs\wmic.exe.log + \UsageLogs\wscript.exe.log + \regsvr32.exe.log + \UsageLogs\wsmprovhost.exe.log + .lnk + .url - .sys - .inf - C:\Windows\SysWOW64\Drivers - C:\Windows\System32\Drivers - \Drivers\ + .sys + .inf + C:\Windows\SysWOW64\Drivers + C:\Windows\System32\Drivers + \Drivers\ .drv - .xlam - .xlsm - .xla - .xll - .xls - .xlsb - .xlsx - .xlt - .xltm - .xlw - \Microsoft\Templates\ - .eml - .msg - .pptm - .potm - .pptm - .pptm - .sldm - \Microsoft\Office\Recent + .xlam + .xlsm + .xla + .xll + .xls + .xlsb + .xlsx + .xlt + .xltm + .xlw + \Microsoft\Templates\ + .eml + .msg + .pptm + .potm + .pptm + .pptm + .sldm + \Microsoft\Office\Recent oleObject - \Downloads\ - \Content.Outlook\ - .docb - .wbk - .ped - .dot - .dotx - .doc - .docm - .docx - + \Recent\CustomDestinations\ + \Downloads\ + \Content.Outlook\ + .docb + .wbk + .ped + .dot + .dotx + .doc + .docm + .docx + .accdb .accde .accdr @@ -4287,7 +4290,7 @@ .xps - + .pem .crt .ca-bundle @@ -4305,7 +4308,7 @@ .key - + .hlp ACLUI.DLL.UI ACLUI.DLL @@ -4394,63 +4397,63 @@ wts.chm credwiz.exe - ssMUIDLL.dll - aepic.dll - ftllib.dll - userenv.dll - \Terminal Server Client\Cache\ + ssMUIDLL.dll + aepic.dll + ftllib.dll + userenv.dll + \Terminal Server Client\Cache\ C:\Windows\Prefetch - \\tsclient - C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ - \Temp\debug.bin - Temp\7z - C:\Windows\AppPatch\Custom - .chm - .cpl - .mht - \Chrome\User Data\Default\Extensions\ - .crx - .appref-ms - .gadget - .JSE - .exe - .scf - Exchange Server\ClientAccess\Owa\ - \Device\HarddiskVolumeShadowCopy - .zip\ - .FON - .FOT - C:\Windows\System32\GroupPolicy\Machine\Scripts - C:\Windows\System32\GroupPolicy\User\Scripts - .iqy - .ico - .isp - .msc - .manifest - MEMORY.dmp - .msi - .cs - .customDestinations-ms - C:\Windows\Minidump - .PAF - .bmc - .rdp - .rtf - .reg - .SHS - .slk - .SCR - .set - .SettingContent-ms - .SHD - .SPL - .scr - HammerDrillStatus.dll - Microsoft\Windows\WER\ - .ICL - .sdb - .SCT - .SHB + \\tsclient + C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ + \Temp\debug.bin + Temp\7z + C:\Windows\AppPatch\Custom + .chm + .cpl + .mht + \Chrome\User Data\Default\Extensions\ + .crx + .appref-ms + .gadget + .JSE + .exe + .scf + Exchange Server\ClientAccess\Owa\ + \Device\HarddiskVolumeShadowCopy + .zip\ + .FON + .FOT + C:\Windows\System32\GroupPolicy\Machine\Scripts + C:\Windows\System32\GroupPolicy\User\Scripts + .iqy + .ico + .isp + .msc + .manifest + MEMORY.dmp + .msi + .cs + .customDestinations-ms + C:\Windows\Minidump + .PAF + .bmc + .rdp + .rtf + .reg + .SHS + .slk + .SCR + .set + .SettingContent-ms + .SHD + .SPL + .scr + HammerDrillStatus.dll + Microsoft\Windows\WER\ + .ICL + .sdb + .SCT + .SHB Temp\Temp1_ \Microsoft\;CLR_v;\UsageLogs\ @@ -4514,37 +4517,37 @@ DefaultPrinter - MountedDevices - Mountpoints2 - Active Setup\Installed Components - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} + MountedDevices + Mountpoints2 + Active Setup\Installed Components + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} + HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\ LoggedOnUser - LastLoggedOnUser - LastLoggedOnProvider + LastLoggedOnUser + LastLoggedOnProvider - + HKCR\ms-msdt\ - + HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck
DWORD (0x00000001)
 @@ -4554,37 +4557,37 @@ - + SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost \print\ \AzureAttestService\CoInitializeSecurityParam C:\$WINDOWS.~BT\ - + \AccessVBOM C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe - + Security\VBAWarnings C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe - + Security\VBAWarnings C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe - + EXCEL.exe;WINWORD.exe {8BD21D32-EC42-11CE-9E0D-00AA006002F3};{5B9D8FC8-4A71-101B-97A6-00000B65C08B} - + HKCU\di - + HKCU\� - + HKLM\SOFTWARE\Microsoft\AMSI\Providers\ hklm\software\microsoft\windows script\settings\amsienable hkcu\software\microsoft\windows script\settings\amsienable @@ -4592,34 +4595,34 @@ - + Google\Chrome\Extensions update_url SetValue - + ForcePasswordReset - + HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC\CurrVal - + HKLM\SAM\SAM\DOMAINS\Account\Users\ Last Password Change - + HKLM\SAM\SAM\DOMAINS\Account\Users\ Account Expiration - + HKLM\SAM\SAM\DOMAINS\Account\Users\ Last Failed Logon - + HKLM\SAM\SAM\Domains\Builtin\Aliases\00000220\ - + HKLM\SAM\SAM\Domains\Builtin\Aliases\0000022B\ @@ -4630,32 +4633,32 @@ \CurrentVersion\Run\ Add_exclusions_here - \Microsoft\System\Scripts - \Windows\System\Scripts - HKLM\SYSTEM\Setup\CmdLine - + \Microsoft\System\Scripts + \Windows\System\Scripts + HKLM\SYSTEM\Setup\CmdLine + \Start
DWORD (0x00000000)
 - + \Start
DWORD (0x00000001)
 - + \Start
DWORD (0x00000002)
 - + \Start
DWORD (0x00000003)
 - + \Start
DWORD (0x00000004)
 - \ImagePath - \ServiceDll - \ServiceManifest + \ImagePath + \ServiceDll + \ServiceManifest hkcu\software\microsoft\windows nt\currentversion\windows\run\ hkcu\software\microsoft\windows\currentversion\explorer\shell folders\common startup hkcu\software\microsoft\windows\currentversion\explorer\shell folders\startup @@ -4664,12 +4667,12 @@ Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup \Print\Monitors - + @@ -4679,73 +4682,73 @@ $ CreateKey - + HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ $ CreateKey - + HKLM\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} C:\WINDOWS\sysmon64.exe C:\WINDOWS\sysmon.exe C:\Programdata\sysmon\sysmon64.exe - + HKCR\ (Default) \shell\open\command\(Default)
URL:
 - + HKCU\Software\Classes\ (Default) \shell\open\command\(Default)
URL:
 - + HKCR\ \shell\open\command\(Default)
%1
 - + HKCU\Software\Classes\ \shell\open\command\(Default)
%1
 - + \shell\open\command\DelegateExecute - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe - Session Manager\KnownDlls + Session Manager\KnownDlls - + Outlook\Addins - + Word\Addins - + Excel\Addins - + Powerpoint\Addins - + Software\Microsoft\VSTO\Security\Inclusion\ - + Software\Microsoft\VSTO\SolutionMetadata\ @@ -4756,77 +4759,77 @@ - + cmmgr32.exe - HKLU\Software\Microsoft\Command Processor\AutoRun - HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute - HKLM\System\CurrentControlSet\Control\Session Manager\Execute - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell - HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug - HKLM\Software\Microsoft\Command Processor\AutoRun - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup - UserInitMprLogonScript - HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath + HKLU\Software\Microsoft\Command Processor\AutoRun + HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute + HKLM\System\CurrentControlSet\Control\Session Manager\Execute + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug + HKLM\Software\Microsoft\Command Processor\AutoRun + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup + UserInitMprLogonScript + HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath - HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages + HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages - + \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default)
C:\Users\Public\;$Recyclebin;\temp\;\Desktop\;\Downloads\;\Content.Outlook\;\Microsoft\Office\
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
 - + \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default)
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
 - + \ProgID\(Default);\TreatAs\(Default) - + \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ Debugger;ReportingMode;MonitorProcess - + \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ GlobalFlag
DWORD (0x00000200)
 - + \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ MonitorProcess - + \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ ReportingMode
DWORD (0x00000001)
 - + \Microsoft\Windows NT\CurrentVersion\SilentProcessExit CreateKey - + \Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{;}\EDGEMITMP_;.tmp\setup.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe @@ -4838,7 +4841,7 @@ - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree SD Microsoft\Windows\UpdateOrchestrator @@ -4852,52 +4855,52 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Automatic Updates 2.0\SD Microsoft\Windows\UpdateOrchestrator - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree ID - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks Author - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks Path - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks Date - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot - + SetValue \Environment\ - + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
DWORD (0x00000000)
 - + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
DWORD (0x00000000)
 - + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop
DWORD (0x00000000)
 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy - \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe - exefile\shell\runas\command\isolatedCommand + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe + exefile\shell\runas\command\isolatedCommand @@ -4910,26 +4913,26 @@ - \Hidden - + \Hidden + SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\ $
DWORD (0x00000000)
 - + HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Parameters C:\WINDOWS\sysmon64.exe C:\WINDOWS\sysmon.exe C:\Programdata\sysmon\sysmon64.exe - + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel MitigationOptions;MitigationAuditOptions - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options MitigationOptions;MitigationAuditOptions HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmcompute.exe\0\MitigationOptions @@ -4937,135 +4940,135 @@ msiexec.exe TiWorker.exe - + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options MitigationOptions;MitigationAuditOptions C:\Program Files\Microsoft Office 15\root\integration\integrator.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acro - + DisableTaskMgr C:\WINDOWS\system32\svchost.exe C:\windows\SysWOW64\svchost.exe - + HKLM\SYSTEM\CurrentControlSet\ \Instances\;Altitude HKLM\System\CurrentControlSet\Services\CldFlt\Instances\CldFlt\Altitude SetValue - + \Security\Level
DWORD (0x00000001)
 - + \Security\Level
DWORD (0x00000002)
 - + \Security\Level
DWORD (0x00000003)
 - + \Security\Level
DWORD (0x00000004)
 - + \Outlook\Security \Security\Level - \Word\Security - \Excel\Security - \Security\Level1Remove - \HideSCAHealth - HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring - HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride - HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting + \Word\Security + \Excel\Security + \Security\Level1Remove + \HideSCAHealth + HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring + HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride + HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled
DWORD (0x00000000)
 - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled
DWORD (0x00000001)
 - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled - + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\ \ChannelAccess
(A;;0x1;;;SY);(A;;0x5;;;BA);(A;;0x1;;;LA)
C:\Windows\servicing\TrustedInstaller.exe;\TiWorker.exe - + HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging \EnableScriptBlockLogging
DWORD (0x00000000)
 - + HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging \EnableScriptBlockLogging DeleteKey;DeleteValue - + hklm\software\microsoft\windows\currentversion\policies\system\audit \ProcessCreationIncludeCmdLine_Enabled
DWORD (0x00000000)
 - + hklm\software\microsoft\windows\currentversion\policies\system\audit \ProcessCreationIncludeCmdLine_Enabled DeleteKey;DeleteValue - + HKLM\System\CurrentControlSet\Services\Eventlog \CustomSD - + HKLM\System\CurrentControlSet\Services\Eventlog \MaxSize - + globallyopenports - EnableFirewall - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + EnableFirewall + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List - + \Microsoft\.NETFramework\ETWEnabled
DWORD (0x00000000)
 - + \Microsoft\.NETFramework\NGenAssemblyUsageLog - + SetValue \Environment\NGenAssemblyUsageLog - + SetValue \Environment\COMPlus_ETWEnabled @@ -5077,20 +5080,20 @@ \LastKey - + SymbolicLinkValue - + \Software\Microsoft\Windows\CurrentVersion\Explorer \AppData\;\ProgramData\;\Temp\;C:\users - + ‮ - HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg + HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg - + \Software\Policies\Microsoft\SystemCertificates\;\SOFTWARE\Microsoft\EnterpriseCertificates\;HKLM\SOFTWARE\Microsoft\SystemCertificates\;HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ CreateKey C:\WINDOWS\Sysmon64.exe @@ -5107,16 +5110,16 @@ C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe - fDenyTSConnections - Terminal Server\WinStations\RDP-Tcp - RDP-tcp\PortNumber - Control\Terminal Server\fSingleSessionPerUser + fDenyTSConnections + Terminal Server\WinStations\RDP-Tcp + RDP-tcp\PortNumber + Control\Terminal Server\fSingleSessionPerUser - + � - + Й;ќ;Л;я;К @@ -5125,7 +5128,7 @@ - HKLM\HARDWARE\ACPI\DSDT + HKLM\HARDWARE\ACPI\DSDT @@ -5167,17 +5170,17 @@ SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\MAPI Provider SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 User SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP User - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP Password - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName - SecurityPasswordAES - OptionsPasswordAES - SecurityPasswordExported - PermanentPassword + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP Password + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName + SecurityPasswordAES + OptionsPasswordAES + SecurityPasswordExported + PermanentPassword @@ -5250,7 +5253,7 @@ - + HKLM\SOFTWARE\GitForWindows @@ -5275,7 +5278,7 @@ - + HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ DeleteKey @@ -5287,7 +5290,7 @@ - + \Services\VSS\Diag\(Default) @@ -5295,35 +5298,35 @@ - + HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters - + HKLM\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters \LastKey - + \WinStationsDisabled - + \TSServerDrainMode \TypedURLs - + HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\disabledcomponents - + HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage\Bind
Binary Data
 - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards - + services\http\parameters\urlaclinf @@ -5333,236 +5336,236 @@ \File MRU\Item 1 - + HKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHash - HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - HKLM\Software\Microsoft\Windows\CurrentVersion\RunService - HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - CurrentVersion\Windows\Load - CurrentVersion\Windows\Run - CurrentVersion\Winlogon\Shell - CurrentVersion\Winlogon\System - \Software\Microsoft\Windows NT\CurrentVersion\Windows\load - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - SOFTWARE\Microsoft\.NETFramework\ETWEnabled + HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + HKLM\Software\Microsoft\Windows\CurrentVersion\RunService + HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + CurrentVersion\Windows\Load + CurrentVersion\Windows\Run + CurrentVersion\Winlogon\Shell + CurrentVersion\Winlogon\System + \Software\Microsoft\Windows NT\CurrentVersion\Windows\load + \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + SOFTWARE\Microsoft\.NETFramework\ETWEnabled \Group Policy\Scripts - Terminal Server\Wds\rdpwd\StartupPrograms - Winlogon\AlternateShells\AvailableShells - Policies\System\Shell - Windows CE Services\AutoStartOnConnect - Windows CE Services\AutoStartOnDisconnect - PreferenceMACs\Default\extensions.settings - CurrentVersion\URL - \CurrentVersion\Font Drivers - HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown - CurrentVersion\Windows\IconServiceLib - Active Setup\Installed Components - NullSessionShares - NullSessionPipes - PasswordExpiryNotification - SafeBoot\AlternateShell - Desktop\Scrnsave.exe - \DisplayVersion - \ModifyPath - \Microsoft\Windows\CurrentVersion\Uninstall\ - \UninstallString - Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman + Terminal Server\Wds\rdpwd\StartupPrograms + Winlogon\AlternateShells\AvailableShells + Policies\System\Shell + Windows CE Services\AutoStartOnConnect + Windows CE Services\AutoStartOnDisconnect + PreferenceMACs\Default\extensions.settings + CurrentVersion\URL + \CurrentVersion\Font Drivers + HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown + CurrentVersion\Windows\IconServiceLib + Active Setup\Installed Components + NullSessionShares + NullSessionPipes + PasswordExpiryNotification + SafeBoot\AlternateShell + Desktop\Scrnsave.exe + \DisplayVersion + \ModifyPath + \Microsoft\Windows\CurrentVersion\Uninstall\ + \UninstallString + Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman - \Explorer\FileExts\ - \shell\install\command\ + \Explorer\FileExts\ + \shell\install\command\ \ProfileImagePath - \Classes\AllFilesystemObjects\ - \Classes\*\ - \Software\Microsoft\Ctf\LangBarAddin - \ContextMenuHandlers\ - \CurrentVersion\Shell - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers - \Classes\Directory\ - \Classes\Drive\ - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - \Classes\Folder\ - \Hidden - \HideFileExt - \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components - \SOFTWARE\Classes\Protocols\Filter - \SOFTWARE\Classes\Protocols\Handler - \SharedTaskScheduler - \ShowSuperHidden - \ColumnHandlers - \CopyHookHandlers - \ExtShellFolderViews - \PropertySheetHandlers - \ShellServiceObjectDelayLoad - \ShellServiceObjects + \Classes\AllFilesystemObjects\ + \Classes\*\ + \Software\Microsoft\Ctf\LangBarAddin + \ContextMenuHandlers\ + \CurrentVersion\Shell + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers + \Classes\Directory\ + \Classes\Drive\ + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + \Classes\Folder\ + \Hidden + \HideFileExt + \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components + \SOFTWARE\Classes\Protocols\Filter + \SOFTWARE\Classes\Protocols\Handler + \SharedTaskScheduler + \ShowSuperHidden + \ColumnHandlers + \CopyHookHandlers + \ExtShellFolderViews + \PropertySheetHandlers + \ShellServiceObjectDelayLoad + \ShellServiceObjects - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ - HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ + HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand - HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ - \3\1809 - \3\2500 - \3\1206 - \DisableSecuritySettingsCheck - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries - HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ - \ProxyServer - SavedLegacySettings - Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy - EnableConsoleTracing - EnableFileTracing + \3\1809 + \3\2500 + \3\1206 + \DisableSecuritySettingsCheck + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries + HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ + \ProxyServer + SavedLegacySettings + Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy + EnableConsoleTracing + EnableFileTracing - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ - HKLM\SOFTWARE\Microsoft\Netsh - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ + HKLM\SOFTWARE\Microsoft\Netsh + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ - HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - Office Test\ + Office Test\ - \Internet Explorer\Toolbar\ - \Internet Explorer\Extensions\ + \Internet Explorer\Toolbar\ + \Internet Explorer\Extensions\ - \Browser Helper Objects\ - {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ + \Browser Helper Objects\ + {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ - \UrlUpdateInfo - \InstallSource + \UrlUpdateInfo + \InstallSource - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ - TamperProtection - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ + TamperProtection + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff - \Software\Policies\Microsoft\Windows\System\Scripts\Logoff - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon - \Software\Policies\Microsoft\Windows\System\Scripts\Logon - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff + \Software\Policies\Microsoft\Windows\System\Scripts\Logoff + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon + \Software\Policies\Microsoft\Windows\System\Scripts\Logon + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup - Domain - DHCPDefaultGateway - DhcpIPAddress - DhcpNameserver - Dhcpserver - DhcpSubnetMask - Nameserver - \DefaultGateway - PersistentRoutes - }\Category - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - SubnetMask - \Trusted Documents\TrustRecords - Software\Microsoft\VBA\7.1\Common - Software\Microsoft\VBA\7.1\Trusted - \Security\DontTrustInstalledFiles - \Security\Trusted Locations - Security\ProtectedView\DisableInternetFilesInPV - Security\ProtectedView\DisableAttachmentsInPV - Security\ProtectedView\DisableUnsafeLocationsInPV + Domain + DHCPDefaultGateway + DhcpIPAddress + DhcpNameserver + Dhcpserver + DhcpSubnetMask + Nameserver + \DefaultGateway + PersistentRoutes + }\Category + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + SubnetMask + \Trusted Documents\TrustRecords + Software\Microsoft\VBA\7.1\Common + Software\Microsoft\VBA\7.1\Trusted + \Security\DontTrustInstalledFiles + \Security\Trusted Locations + Security\ProtectedView\DisableInternetFilesInPV + Security\ProtectedView\DisableAttachmentsInPV + Security\ProtectedView\DisableUnsafeLocationsInPV Software\WinRAR\ArcHistory WinZip\mru\ Recent File List - Outlook\WebView\Inbox - Outlook\Today\UserDefinedUrl - Outlook\WebView\Calendar + Outlook\WebView\Inbox + Outlook\Today\UserDefinedUrl + Outlook\WebView\Calendar \Place MRU - \LinkDate - \DriverVerVersion - \DriverVersion - \LowerCaseLongPath - \Publisher - Compatibility Assistant\Store\ - \BinProductVersion - Root\InventoryApplicationShortcut\ - Root\InventoryDriverBinary\ - Root\InventoryDeviceContainer\ - + \LinkDate + \DriverVerVersion + \DriverVersion + \LowerCaseLongPath + \Publisher + Compatibility Assistant\Store\ + \BinProductVersion + Root\InventoryApplicationShortcut\ + Root\InventoryDriverBinary\ + Root\InventoryDeviceContainer\ + Root\InventoryApplication\ ProgramID;Name;Version;Publisher;Language;InstallDate;Source;RootDirPath;HiddenArp;UninstallString;RegistryKeyPath;UserSID;sha256 - + Root\InventoryApplicationFile\ ProgramId;FileId;LowerCaseLongPath;Name;OriginalFileName;Publisher;Version;binfileversion;LinkDate;Size;Language;USN;IsPeFile;IsOsComponent;sha256;AppxPackageFullName - + Root\InventoryApplicationAppV\ - + Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations - \Explorer\MountPoints2 - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices - + \Explorer\MountPoints2 + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices + HKLM\System\CurrentControlSet\services\ \DeleteFlag
DWORD (0x00000001)
 - \ConsentStore\bluetooth - \ConsentStore\contacts - \ConsentStore\hunmanInterfaceDevice - \ConsentStore\location - \ConsentStore\microphone - \ConsentStore\usb\ - \ConsentStore\webcam - \ConsentStore\humanInterfaceDevice - LastVisitedMRU - SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit + \ConsentStore\bluetooth + \ConsentStore\contacts + \ConsentStore\hunmanInterfaceDevice + \ConsentStore\location + \ConsentStore\microphone + \ConsentStore\usb\ + \ConsentStore\webcam + \ConsentStore\humanInterfaceDevice + LastVisitedMRU + SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU - HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR - HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ - HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\Microsoft\Cryptography\OID - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID - HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll - Classes\exefile\shell\runas\command\isolatedCommand - \FriendlyName - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ - \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB - HKLM\SOFTWARE\Microsoft\Tracing\ + HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR + HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ + HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\Microsoft\Cryptography\OID + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID + HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll + Classes\exefile\shell\runas\command\isolatedCommand + \FriendlyName + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + HKLM\SOFTWARE\Microsoft\Tracing\ HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}
ndis;rndis
 - HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 + HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 \Software\AppDataLow\Software\Microsoft\
.exe;.dll;powershell;wmic
 - Software\Microsoft\Office test\Special\Perf - \CurrentControlSet\Services\NTDS\LsaDbExtPt - \Services\NTDS\DirectoryServiceExtPt + Software\Microsoft\Office test\Special\Perf + \CurrentControlSet\Services\NTDS\LsaDbExtPt + \Services\NTDS\DirectoryServiceExtPt GoToMyPc\FileTransfer\history GoToMyPc\GuestInvite Filesharing @@ -5570,33 +5573,33 @@ LogIncomingConnections LogOutgoingConnections PermanentPasswordDate - Security_Adminrights - vncviewer\MRU - Autostart_GUI - Meeting_UserName - BuddyLoginName - BuddyLoginTokenID - Always_Online - HKLM\SOFTWARE\Microsoft\CurrentVersion\Policies\System\EnableLinkedConnections - Software\recfg - \Keyboard Layout\Preload\ - \Keyboard Layout\Substitutes\ - HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ - \Client\Enabled - \Server\Enabled + Security_Adminrights + vncviewer\MRU + Autostart_GUI + Meeting_UserName + BuddyLoginName + BuddyLoginTokenID + Always_Online + HKLM\SOFTWARE\Microsoft\CurrentVersion\Policies\System\EnableLinkedConnections + Software\recfg + \Keyboard Layout\Preload\ + \Keyboard Layout\Substitutes\ + HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ + \Client\Enabled + \Server\Enabled Kitty\Sessions - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel PuTTY\Sessions - Terminal Server Client\Servers - WinSCP 2\Sessions - WinSCP 2\Sessions + Terminal Server Client\Servers + WinSCP 2\Sessions + WinSCP 2\Sessions C:\Program Files (x86)\Kaspersky Lab C:\Program Files\Kaspersky Lab @@ -5609,18 +5612,18 @@ - + Content.IE5;INetCache .exe;.zip;.ps1;.bat;.rar;.vbs;.hta - + :Zone.Identifier blob:;about:internet - + 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - + SHA256=074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 SHA256=45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 SHA256=9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 @@ -5628,16 +5631,16 @@ SHA256=c8c907a67955bcdf07dd11d35f2a23498fb5ffe5c6b5d7f36870cf07da47bff2 SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e - + Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf - + IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE - + IMPHASH=19584675D94829987952432E018D5056 - + IMPHASH=330768a4f172e10acb6287b87289d83b @@ -5665,60 +5668,60 @@ - + msagent_;\MSSE-;postex;\status_ - + \atctl;\userpipe;\iehelper;\sdlrpc;\comnap - + \PSEXESVC -stdin -stdout - + RemCom_ stdin;stdout;stderr;communication - + \svcctl - + \ntsvcs ConnectPipe - \lsadump;\cachedump;\wceservicepipe - \9f81f59bc58452127884ce513865ed20 - \46a676ab7f179e511e30dd2dc41bd388 - tssmp_endpoint - \NamePipe_MoreWindows - \WCEServicePipe - \ahexec - \cachedumppipe - \csexec - \e710f28d59aa529d6792ca6ff0ca1b34 - \isapi_dg - \isapi_http - \isapi_http - \lsadump - \lsassw - \paexec - \pcheap_reuse - \gruntsvc - \remcom - \rpchlp_3 - \sdlrpc - \winsession - \adschemerpc - \AnonymousPipe - \bc367 - \bc31a7 - \testPipe + \lsadump;\cachedump;\wceservicepipe + \9f81f59bc58452127884ce513865ed20 + \46a676ab7f179e511e30dd2dc41bd388 + tssmp_endpoint + \NamePipe_MoreWindows + \WCEServicePipe + \ahexec + \cachedumppipe + \csexec + \e710f28d59aa529d6792ca6ff0ca1b34 + \isapi_dg + \isapi_http + \isapi_http + \lsadump + \lsassw + \paexec + \pcheap_reuse + \gruntsvc + \remcom + \rpchlp_3 + \sdlrpc + \winsession + \adschemerpc + \AnonymousPipe + \bc367 + \bc31a7 + \testPipe msf-pipe - \atsvc - \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc - \atctl;\userpipe;\iehelper;\sdlrpc;\comnap - + \atsvc + \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc + \atctl;\userpipe;\iehelper;\sdlrpc;\comnap + \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester;demoagent_ \wkssvc \spoolss @@ -5728,26 +5731,26 @@ \PGMessagePipe \MsFteWds - + ConnectPipe \MICROSOFT##WID\tsql\query - + \Winsock2\CatalogChangeListener- -0, - + \pipe\ CtxSharefilepipe0 - \winreg - Anonymous Pipe + \winreg + Anonymous Pipe @@ -5821,120 +5824,120 @@ - + type: 16;type: 16 powershell.exe - + github powershell.exe - + powershell;cscript.exe;wscript.exe;mshta.exe;bitsadmin.exe;\cmd.exe . - + dropboxapi.com \Dropbox\Client\Dropbox.exe;\Dropbox\bin\Dropbox.exe;\Oracle\Java\ - + 1drv \AppData\Local\Microsoft\OneDrive\OneDrive.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe;\Internet Explorer\iexplore.exe;C:\Windows\System32\AppHostRegistrationVerifier.exe;C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe;C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe;C:\Program Files\Mozilla Firefox\firefox.exe - + .box.com;upload - + mega.nz;mega.co.nz - + privatlab.com - + thedoccloud.com;deftsecurity.com;websitetheme.com;highdatabase.com;incomeupdate.com;zupertech.com;panhardware.com;databasegalore.com;avsvmcloud.com;freescanonline.com - + tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat - + efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet - + .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com - + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.nimpool.io;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool;analytics.blue;estream.to - graph.microsoft.com - dl.dropboxusercontent.com - api.onedrive.com - zoom.us - teamviewer - Screenconnect + graph.microsoft.com + dl.dropboxusercontent.com + api.onedrive.com + zoom.us + teamviewer + Screenconnect census - researchscan - scanhub - shadow - shodan + researchscan + scanhub + shadow + shodan - .download - .kp - .su - .ss - .xn - .sy - .ve - .xxx - .cn - .click - .club - .ir - .ru - .host - .icu - .pw - .website - .ninja - .rocks - .top - .ua - .xyz + .download + .kp + .su + .ss + .xn + .sy + .ve + .xxx + .cn + .click + .club + .ir + .ru + .host + .icu + .pw + .website + .ninja + .rocks + .top + .ua + .xyz - + kuternull.com;rimrun.com;0ffice36o;asushotfix;infestexe;rahasn.webhop.org;rahasn.akamake.net;rahasn.homewealth.biz;winodwsupdates;israirairlines - githubusercontent.com;github.com + githubusercontent.com;github.com - api.ipify.org;whatismyipaddress.com;edns.ip-api.com;checkip.dyndns.org;icanhazip.com;ifconfig.me;ifconfig.co;ipaddress.com;ipecho.net;ident.me;api.ip.sb;www.myexternalip.com;ip.anysrc.net;wtfismyip.com;myexternalip.com;ipecho.net;checkip.amazonaws.com;goo.gl;git.io;bit.ly;ow.ly;ip-api.com + api.ipify.org;whatismyipaddress.com;edns.ip-api.com;checkip.dyndns.org;icanhazip.com;ifconfig.me;ifconfig.co;ipaddress.com;ipecho.net;ident.me;api.ip.sb;www.myexternalip.com;ip.anysrc.net;wtfismyip.com;myexternalip.com;ipecho.net;checkip.amazonaws.com;goo.gl;git.io;bit.ly;ow.ly;ip-api.com - tiny-share.com;paste.ee;pastebin.com + tiny-share.com;paste.ee;pastebin.com - afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com - darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org - adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk - gc._msdcs. - _kerberos._tcp.dc._msdcs. - _kerberos._udp.dc._msdcs. - _ldap._tcp.pdc._msdcs. - wpad - + afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com + darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org + adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk + gc._msdcs. + _kerberos._tcp.dc._msdcs. + _kerberos._udp.dc._msdcs. + _ldap._tcp.pdc._msdcs. + wpad + _ldap. C:\Windows\ unknown process C:\ProgramData\Microsoft\Windows Defender\Platform\;\Windows Defender\MsMpEng.exe;C:\Windows\ System;svchost.exe;services.exe;unknown process;\;; @@ -6208,7 +6211,7 @@ - + .;>;unknown;anonymous C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Symantec\ @@ -6239,19 +6242,19 @@ - + OUTLOOK.exe;WINWORD.exe;EXCEL.EXE;powerpnt.exe;msaccess.exe;mspub.exe;eqnedt32.exe;visio.exe;wordpad.exe;wordview.exe;msohtmed.exe;lync.exe;teams.exe :\Program Files\Microsoft Office\;:\Program Files (x86)\Microsoft Office\ - + w3wp.exe;tomcat;apache;nginx;httpd whitelist_me_here - + powershell.exe;powershell_ise.exe whitelist_me_here - + .pdf.exe .doc.exe .docx.exe @@ -6267,22 +6270,22 @@ .ico.exe .lnk.exe - + psexesvc psexec - + wmiprvse.exe - + C:\Users\Public\ amdsfhdcd.bin intuit - + AcroRd32.exe;notepad.exe;mshta.exe;hh.exe;certutil.exe;certoc.exe;certreq.exe;desktopimgdownldr.exe;esentutl.exe;finger.exe;presentationhost.exe;cscript.exe;wscript.exe;mspaint.exe;RdrCEF.exe - + IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 IMPHASH=3A19059BD7688CB88E70005F18EFC439 IMPHASH=bf6223a49e45d99094406777eb6004ba @@ -6376,13 +6379,13 @@ SHA256=c8c907a67955bcdf07dd11d35f2a23498fb5ffe5c6b5d7f36870cf07da47bff2 SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e - + \DrSDKCaller.exe;C:\Users\Public\all.exe;C:\Users\Public\dump.dll;C:\Users\Public\ad.exe;C:\PerfLogs\gpg-error.exe;C:\PerfLogs\cm.exe;C:\Program Files\Common Files\system\ado\msado32.tlb - + \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll - + certutil.exe certoc.exe CertReq.exe @@ -6393,16 +6396,16 @@ finger.exe presentationhost.exe - + bitsadmin.exe C:\Windows;$WINDOWS.;\SoftwareDistribution\ System TrustedInstaller;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC - + \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll - + C:\PerfLogs\ From 2231a8d79744e8567301f818c878d23417ac51b9 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 3 Oct 2022 17:37:34 -0400 Subject: [PATCH 396/471] Add Missing MITRE Datasources --- sysmonconfig-export.xml | 242 ++++++++++++++++++++-------------------- 1 file changed, 121 insertions(+), 121 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 5bc351b3..3a7c8f0b 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -110,7 +110,7 @@ - + PurpleSharp;xyz123456 PurpleSharp @@ -119,7 +119,7 @@ /serverlevelplugindll - + add;sslcert;http http del sslcert @@ -270,17 +270,17 @@ svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe conhost.exe - + conhost.exe :\Windows\splwow64.exe;:\Windows\System32\WerFault.exe;:\Windows\System32\conhost.exe - + cmd.exe powershell.exe;powershell_ise.exe Get-ItemProperty HKLM:\software\wow6432node\microsoft\windows\currentversion\uninstall\ @@ -299,7 +299,7 @@ powershell.exe;powershell_ise.exe mshta.exe - + wscript.exe;cscript.exe IEX;Net.WebClient;ospp.vbs;powershell;slmgr.vbs;spiceworks_upload @@ -335,7 +335,7 @@ C:\Windows\Temp\hpqhvind.exe;C:\ProgramData\DRM\;Test.exe C:\ProgramData\DRM;wmplayer.exe;C:\ProgramData\DRM\CLR\CLR.EXE - + regedit.exe explorer.exe @@ -344,12 +344,12 @@ explorer.exe --> - + \svchost.exe;\taskhostw.exe;\userinit.exe;\smss.exe;\csrss.exe;\wininit.exe;\winlogon.exe;\lsass.exe;\logonui.exe;\services.exe C:\windows\System32\;C:\windows\syswow64\ \wininit.exe;\winlogon.exe;\services.exe;\dwm.exe;System;\smss.exe;\svchost.exe - + \spoolsv.exe;\PrintIsolationHost.exe C:\Windows\System32\spoolsv.exe;\GPLGS\gswin32c.exe;C:\Windows\System32\spool\drivers\;\bin\gswin64c.exe;C:\PROGRA~2\CUTEPD~1\;C:\Windows\EEFPrinter.exe C:\Windows\system32\spool\DRIVERS @@ -384,7 +384,7 @@ C:\Windows\system32\spool\DRIVERS\ PhotoViewer.dll - + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe C:\Users\ .exe @@ -402,7 +402,7 @@ iexplore.exe vivaldi.exe - + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe C:\ProgramData\ Firefox @@ -445,7 +445,7 @@ FLTLDR.EXE - /dde;-dde + /dde;-dde @@ -672,18 +672,18 @@ route ; ADD - + eventvwr.exe c:\windows\system32\mmc.exe - fodhelper.exe + fodhelper.exe InstallUtil.exe Invoke-PsUaCme BypassUAC PowerUp - computerdefaults.exe - dism.exe - fodhelper.exe + computerdefaults.exe + dism.exe + fodhelper.exe NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC @@ -712,11 +712,11 @@ C:\Windows\System32\ATBroker.exe;Magnify.exe;C:\Windows\System32\osk.exe sethc.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe sdbinst.exe @@ -852,7 +852,7 @@ bash.exe forfiles.exe forfiles.exe - .com + .com -appvscript @@ -928,7 +928,7 @@ C^om^S^pEc;^c^o^m^S^p^E^c^;Wscript.Shell;-ComObject;MsXml2.ServerXmlHttp;Remove.ToString;System.Convert;-UseB;[Byte[];^h^t^t^p;h"t"t"p IwAjACMAd;IyM=;SUVYI;aWV4I;SQBFAFgA;aQBlAHgA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC - WindowStyle Hidden function;WindowStyle Hidden;windowstyle h;windowstyl h;windowsty h;windowst h;windows h;window h;windo h;wind h;win h;wi h;-w h;/w h;win hi;win hid;win hidd;win hidde;win hidden + WindowStyle Hidden function;WindowStyle Hidden;windowstyle h;windowstyl h;windowsty h;windowst h;windows h;window h;windo h;wind h;win h;wi h;-w h;/w h;win hi;win hid;win hidd;win hidde;win hidden ^ TYPE CON > copy CON > @@ -1089,11 +1089,11 @@ - InstallUtil.exe + InstallUtil.exe /logfile=;/LogToConsole=false;/U - InstallUtil.exe + InstallUtil.exe -logfile=;-LogToConsole=false;-U @@ -1126,40 +1126,40 @@ script:http Register-cimprovider - Scriptrunner.exe -appvscript - bginfo - cbd + Scriptrunner.exe -appvscript + bginfo + cbd runscripthelper.exe surfacecheck xwizard RunWizard PresentationHost driver executeinf control.exe /name;control.exe -name Control_RunDLL - SyncAppvPublishingServer.exe - Scriptrunner.exe - ATBroker.exe - Appvlp.exe - InfDefaultInstall.EXE - PresentationHost.exe - RegisterCimProvider2.exe - RegisterCimProvider.exe - ScriptRunner.exe - csi.exe - extexport.exe - msconfig.EXE - rasdlui.exe - tttracer.exe - verclsid.exe - wab.exe + SyncAppvPublishingServer.exe + Scriptrunner.exe + ATBroker.exe + Appvlp.exe + InfDefaultInstall.EXE + PresentationHost.exe + RegisterCimProvider2.exe + RegisterCimProvider.exe + ScriptRunner.exe + csi.exe + extexport.exe + msconfig.EXE + rasdlui.exe + tttracer.exe + verclsid.exe + wab.exe Register-cimprovider.exe - csi.exe - devtoolslauncher.exe LaunchForDeploy - bginfo - devtoolslauncher.exe - wab.exe - wsreset.exe + csi.exe + devtoolslauncher.exe LaunchForDeploy + bginfo + devtoolslauncher.exe + wab.exe + wsreset.exe - cmstp.exe /ni /s;cmstp.exe -ni -s + cmstp.exe /ni /s;cmstp.exe -ni -s cmstp /ni /s;cmstp -ni -s Mavinject.exe @@ -1178,7 +1178,7 @@ regsvr32.exe C:\Users;Public - Microsoft(C) Register Server + Microsoft(C) Register Server SyncAppvPublishingServer.exe control.exe rasautou.exe @@ -1507,11 +1507,11 @@ pathping.exe - + find;385201 select-string;385201 - + find;virus select-string;virus process;Description;virus @@ -1555,9 +1555,9 @@ select-string;sidecar process;Description;sidecar - - fltMC.exe - misc::mflt + + fltMC.exe + misc::mflt AntiVirusProduct root\SecurityCenter2 @@ -1745,7 +1745,7 @@ tftp.exe powershellcustomhost - + -Embedding c:\windows\system32\mmc.exe @@ -2141,7 +2141,7 @@ :\Windows\Microsoft.NET\ System - + @@ -2155,12 +2155,12 @@ - C:\Users - C:\ProgramData - \Temp\ - \tmp\ - \drivers\ - \Download + C:\Users + C:\ProgramData + \Temp\ + \tmp\ + \drivers\ + \Download @@ -2522,8 +2522,8 @@ vnc.exe vncviewer.exe vncservice.exe - omniinet.exe - hpsmhd.exe + omniinet.exe + hpsmhd.exe @@ -3340,8 +3340,8 @@ 0B80 0C7C 0C88 - c:\windows\system32\mstsc.exe - + c:\windows\system32\mstsc.exe + C:\WINDOWS\SYSTEM32\ntdll.dll EtwEventWrite @@ -3565,7 +3565,7 @@ 0x810 - 0x820 + 0x820 cscript.exe wscript.exe jjs.exe @@ -3761,9 +3761,9 @@ rdpwrap.dll winspool.drv - C:\Windows\System32\Wbem - C:\Windows\SysWOW64\Wbem - C:\WINDOWS\system32\wbem\scrcons.exe + C:\Windows\System32\Wbem + C:\Windows\SysWOW64\Wbem + C:\WINDOWS\system32\wbem\scrcons.exe @@ -3784,8 +3784,8 @@ \Word\STARTUP\ \Microsoft\Templates\ \Excel\XLSTART\ - .dotm - .XLSB + .dotm + .XLSB C:\Windows\Tasks\ @@ -3914,15 +3914,15 @@ - .chm + .chm - proj - .sln + proj + .sln @@ -4255,8 +4255,8 @@ .pptm .sldm \Microsoft\Office\Recent - oleObject - \Recent\CustomDestinations\ + oleObject + \Recent\CustomDestinations\ \Downloads\ \Content.Outlook\ .docb @@ -4402,7 +4402,7 @@ ftllib.dll userenv.dll \Terminal Server Client\Cache\ - C:\Windows\Prefetch + C:\Windows\Prefetch \\tsclient C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ \Temp\debug.bin @@ -4454,7 +4454,7 @@ .sdb .SCT .SHB - Temp\Temp1_ + Temp\Temp1_ \Microsoft\;CLR_v;\UsageLogs\ .ade @@ -4512,7 +4512,7 @@ - + \Software\Microsoft\Terminal Server Client DefaultPrinter @@ -4627,8 +4627,8 @@ - SOFTWARE\Microsoft\Wow64\x86\ - + SOFTWARE\Microsoft\Wow64\x86\ + SetValue \CurrentVersion\Run\ Add_exclusions_here @@ -4659,14 +4659,14 @@ \ImagePath \ServiceDll \ServiceManifest - hkcu\software\microsoft\windows nt\currentversion\windows\run\ - hkcu\software\microsoft\windows\currentversion\explorer\shell folders\common startup - hkcu\software\microsoft\windows\currentversion\explorer\shell folders\startup - hklm\software\microsoft\command processor\autorun - hkcu\software\microsoft\windows nt\currentversion\accessibility\ATs\\*(1)\StartExe - Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup + hkcu\software\microsoft\windows nt\currentversion\windows\run\ + hkcu\software\microsoft\windows\currentversion\explorer\shell folders\common startup + hkcu\software\microsoft\windows\currentversion\explorer\shell folders\startup + hklm\software\microsoft\command processor\autorun + hkcu\software\microsoft\windows nt\currentversion\accessibility\ATs\\*(1)\StartExe + Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup - \Print\Monitors + \Print\Monitors - + HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ $ CreateKey @@ -5077,7 +5077,7 @@ - + \LastKey @@ -5304,7 +5304,7 @@ HKLM\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters - + \LastKey @@ -5313,7 +5313,7 @@ \TSServerDrainMode - + \TypedURLs @@ -5329,11 +5329,11 @@ services\http\parameters\urlaclinf - + cRecentFiles\c1\ tDIText - + \File MRU\Item 1 @@ -5378,7 +5378,7 @@ \Explorer\FileExts\ \shell\install\command\ - \ProfileImagePath + \ProfileImagePath \Classes\AllFilesystemObjects\ \Classes\*\ @@ -5435,7 +5435,7 @@ HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ @@ -5487,13 +5487,13 @@ Security\ProtectedView\DisableInternetFilesInPV Security\ProtectedView\DisableAttachmentsInPV Security\ProtectedView\DisableUnsafeLocationsInPV - Software\WinRAR\ArcHistory - WinZip\mru\ - Recent File List + Software\WinRAR\ArcHistory + WinZip\mru\ + Recent File List Outlook\WebView\Inbox Outlook\Today\UserDefinedUrl Outlook\WebView\Calendar - \Place MRU + \Place MRU \LinkDate \DriverVerVersion \DriverVersion @@ -5536,7 +5536,7 @@ \ConsentStore\humanInterfaceDevice LastVisitedMRU SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit - \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU + \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust @@ -5559,20 +5559,20 @@
ndis;rndis
 HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 - + \Software\AppDataLow\Software\Microsoft\
.exe;.dll;powershell;wmic
 Software\Microsoft\Office test\Special\Perf \CurrentControlSet\Services\NTDS\LsaDbExtPt \Services\NTDS\DirectoryServiceExtPt - GoToMyPc\FileTransfer\history - GoToMyPc\GuestInvite - Filesharing - DesktopSharing - LogIncomingConnections - LogOutgoingConnections - PermanentPasswordDate + GoToMyPc\FileTransfer\history + GoToMyPc\GuestInvite + Filesharing + DesktopSharing + LogIncomingConnections + LogOutgoingConnections + PermanentPasswordDate Security_Adminrights vncviewer\MRU Autostart_GUI @@ -5592,11 +5592,11 @@ HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ \Client\Enabled \Server\Enabled - Kitty\Sessions + Kitty\Sessions HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel - PuTTY\Sessions + PuTTY\Sessions Terminal Server Client\Servers WinSCP 2\Sessions WinSCP 2\Sessions @@ -5717,7 +5717,7 @@ \bc367 \bc31a7 \testPipe - msf-pipe + msf-pipe \atsvc \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc \atctl;\userpipe;\iehelper;\sdlrpc;\comnap @@ -5818,7 +5818,7 @@ - Created + Created @@ -5877,7 +5877,7 @@ Screenconnect - census + census researchscan scanhub shadow @@ -5939,7 +5939,7 @@ type: 99 type: 33 --> - System;svchost.exe;services.exe;unknown process;\;; + System;svchost.exe;services.exe;unknown process;\;; @@ -6222,7 +6222,7 @@ - + \BHO\ie_to_edge_stub.exe;\Microsoft\Teams\;\Vivaldi\Application\;Google\Chrome\;Google\Update;BraveSoftware\Brave-Browser\;Edge\Application\;EdgeUpdate\Install\;Program Files\SmartGit\ From 7589df63ea598c966f5e2206eb6477b5d0e85fdc Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 3 Oct 2022 17:58:38 -0400 Subject: [PATCH 397/471] Add Contribution Guidelines text. --- sysmonconfig-export.xml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 3a7c8f0b..5156f305 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -75,6 +75,17 @@ Other Notes: The Rulename field has a hard limit of 255 characters, make the best of the size available, shorten tags and descriptions as needed. Add exclusions in line enclosed within a Compound rule rather than a global exclusion list. + + Contribution Guidelines: + Always submit new rule requests/pull requests in this format where possible, if the rule is highly accurate and should fire off a SIEM Alert replace Desc= with Alert=, + See Risk ratings and levels above for guidance. + Example Rule: + + + + --> + System;svchost.exe;services.exe;unknown process;\;; + --> md5,sha256,imphash From a917402b7bfa120824ab0cbbf845fbe3b1edfeb0 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 3 Oct 2022 18:00:08 -0400 Subject: [PATCH 398/471] Fix Copy/paste after contributor guidelines edit :P --- sysmonconfig-export.xml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 5156f305..04718648 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -82,10 +82,7 @@ Example Rule: - - --> - System;svchost.exe;services.exe;unknown process;\;; - + --> md5,sha256,imphash From c77e3c9ac5a5fd2b0072322bdc971a176bc4aeee Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 09:31:56 -0400 Subject: [PATCH 399/471] Re-enable explorer.exe parentimage logging --- sysmonconfig-export.xml | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 04718648..246f8de1 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -282,12 +282,10 @@ conhost.exe :\Windows\splwow64.exe;:\Windows\System32\WerFault.exe;:\Windows\System32\conhost.exe - cmd.exe powershell.exe;powershell_ise.exe @@ -347,11 +345,6 @@ regedit.exe explorer.exe - \svchost.exe;\taskhostw.exe;\userinit.exe;\smss.exe;\csrss.exe;\wininit.exe;\winlogon.exe;\lsass.exe;\logonui.exe;\services.exe C:\windows\System32\;C:\windows\syswow64\ @@ -2148,6 +2141,9 @@ gpupdate.exe :\Windows\Microsoft.NET\ System + + explorer.exe + @@ -5561,7 +5557,6 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB HKLM\SOFTWARE\Microsoft\Tracing\ - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}
ndis;rndis
From 30302ea5b58176455ec83c125cf4cd6f6789a17d Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 10:06:21 -0400 Subject: [PATCH 400/471] Implement FileBlockShredding Protection for C:\Users, event log directory, Program Files, Program Data directories. Protect Pagefile, MFT and system config directory --- sysmonconfig-export.xml | 56 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 55 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 246f8de1..2705edef 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -84,7 +84,7 @@ --> - + md5,sha256,imphash @@ -6438,5 +6438,59 @@ + + + + + C:\Users + + + C:\Program Files + + + C:\ProgramData + + + C:\$mft + + + C:\Windows\System32\winevt\Logs + + + ntuser.dat + + + Pagefile.sys + + + C:\Windows\System32\config + + + + + + + C:\WINDOWS\system32\wuauclt.exe;C:\$WINDOWS.~BT\Sources\SetupHost.Exe + + + C:\Windows\SoftwareDistribution\;C:\$WINDOWS.~BT\NewOS\ + + + + + + \ No newline at end of file From 2bfaa0553343159b371c61ba53d19ed3f31ee6e8 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 10:18:50 -0400 Subject: [PATCH 401/471] MITRE Tagging and SIEM Alerting of Data Destruction/File Shred protected locations. --- sysmonconfig-export.xml | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 2705edef..80620534 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -6441,39 +6441,45 @@ - + C:\Users - + C:\Program Files - + C:\ProgramData - + C:\$mft - + C:\Windows\System32\winevt\Logs - + ntuser.dat - + Pagefile.sys - + C:\Windows\System32\config + + .db + + + .key + + + $Recycle + - - C:\WINDOWS\system32\wuauclt.exe;C:\$WINDOWS.~BT\Sources\SetupHost.Exe - - C:\Windows\SoftwareDistribution\;C:\$WINDOWS.~BT\NewOS\ + C:\Safe-shred-location - + C:\Users - + C:\Program Files - + C:\ProgramData - + C:\$mft - + C:\Windows\System32\winevt\Logs - + ntuser.dat - + Pagefile.sys - + C:\Windows\System32\config - + .db - + .key - + $Recycle From 3b71ab5953d11e340639c7fc1da63784459fa2b5 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 10:27:22 -0400 Subject: [PATCH 403/471] Fix alert text for $mft file --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index d7d4f30e..44781d40 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -6450,7 +6450,7 @@ C:\ProgramData - + C:\$mft From f10e539390254453f1e5b2ac7192c3befd3c61b0 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 11:41:22 -0400 Subject: [PATCH 404/471] Protect common Office extensions, pdf's, archive files and more. --- sysmonconfig-export.xml | 110 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 106 insertions(+), 4 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 44781d40..4a2e1dbf 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -6462,18 +6462,120 @@ Pagefile.sys - + C:\Windows\System32\config - + .db - + + .asc + .ca-bundle + .cer + .cer + .crl + .crt + .csr + .der + .gpg .key + .p7b + .p7r + .p7s + .p12 + .pem + .pfx + .pgp + .ppk + .sst + .sto + + + .log + ConsoleHost_history.txt - + + .evtx + + $Recycle + + .exe + + + .dll + + + \Content.Outlook\ + \Microsoft\Office\Recent + \Microsoft\Templates\ + \Recent\CustomDestinations\ + oleObject + .accdb + .accde + .accdr + .accdt + .doc + .docb + .docm + .docx + .dot + .dotx + .eml + .mdb + .mde + .msc + .msg + .mst + .ped + .potm + .potx + .ppam + .ppsm + .ppsx + .ppt + .pptm + .pptx + .pub + .sldm + .sldx + .wbk + .xla + .xlam + .xll + .xls + .xlsb + .xlsm + .xlsx + .xlt + .xltm + .xlw + .xps + + + .pdf + + + .zip + .rar + .tar + .tgz + .ace + + + .cdxml + .ps1 + .ps1xml + .psc1 + .psd1 + .psm1 + .pssc + .bat + .com + .hta + .vbs + From 828dc0469a272bafdb65c2fde4c2ec072cc20e82 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 12:02:31 -0400 Subject: [PATCH 405/471] Protect shredding of common Disk images from Virtual infrastructure, veeam, acronis, datto, hyper-v, vmware and more. --- sysmonconfig-export.xml | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 4a2e1dbf..f0ff6787 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -6562,6 +6562,7 @@ .tar .tgz .ace + .7z .cdxml @@ -6576,6 +6577,46 @@ .hta .vbs + + .vmdk + .vhd + .vhdx + .avhd + .vdi + .dvd + .mdf + .dsk + .D01 + .D02 + .vmwarevm + .vmwarevm + .HDS + .WIM + .WIM + .XVA + .IMG + .ISO + .DD + .DISK + .WMT + .LZ01 + .E01 + .EX01 + .L01 + .L01 + .TIB + .HC + .IMD + .IMAGE + .SPARSEIMAGE + .PARTIMG + .PGD + .HDD + .VBK + .VIB + .VIB + .VBM + From 882723149c7a3ab87725f7eb9e1cbdae932a8c49 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 12:04:30 -0400 Subject: [PATCH 406/471] Sort and remove dupes --- sysmonconfig-export.xml | 49 +++++++++++++++++++---------------------- 1 file changed, 23 insertions(+), 26 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f0ff6787..641b93e3 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -6578,44 +6578,41 @@ .vbs - .vmdk - .vhd - .vhdx - .avhd - .vdi - .dvd - .mdf - .dsk .D01 .D02 - .vmwarevm - .vmwarevm - .HDS - .WIM - .WIM - .XVA - .IMG - .ISO .DD .DISK - .WMT - .LZ01 .E01 .EX01 - .L01 - .L01 - .TIB .HC - .IMD + .HDD + .HDS .IMAGE - .SPARSEIMAGE + .IMD + .IMG + .ISO + .L01 + .LZ01 .PARTIMG .PGD - .HDD + .SPARSEIMAGE + .TIB .VBK - .VIB - .VIB .VBM + .VIB + .WIM + .WIM + .WMT + .XVA + .avhd + .dsk + .dvd + .mdf + .vdi + .vhd + .vhdx + .vmdk + .vmwarevm From 3c1457b66fe420984ef6b453d983bf014063ea0a Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 12:28:26 -0400 Subject: [PATCH 407/471] ensure other rules fire before logging user activity launched from explorer. --- sysmonconfig-export.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 641b93e3..b340d201 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -2143,6 +2143,7 @@ System explorer.exe + \regedit.exe;\cmd.exe;terminal;\powershell From 1f07e3005e1d19e4e9ccacc2c64cbcc5c5fe2de8 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 12:48:45 -0400 Subject: [PATCH 408/471] update readme --- README.md | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index e28c6dfd..eacd6572 100644 --- a/README.md +++ b/README.md @@ -3,11 +3,25 @@ The file provided should function as a great starting point for system monitorin       **[sysmonconfig-export.xml](https://github.com/ion-storm/sysmon-config/blob/master/sysmonconfig-export.xml)** -Because virtually every line is commented and sections are marked with explanations, it should also function as a tutorial for Sysmon and a guide to critical monitoring areas in Windows systems. It demonstrates a lot of what I wish I knew when I began with Sysmon in 2014. +Pull requests and issue tickets are welcome, and new additions will be credited in-line or on Git, tag your naame with Author=YourName within the rulename field. -Pull requests and issue tickets are welcome, and new additions will be credited in-line or on Git. +This Sysmon ATT&CK Configuration is designed "Explicitely" to enrich your SIEM for threat intelligence, forensics, UEBA, use cases. You'll want to create a key-value parser for the +rulename field to create field names per event within your SIEM. +Ideally this is best used with an Alerting Repository/Index where the "Alert=" field is marked and a non-alerting visibility index/repository where threat hunting, investigations can be done +that contains added context and story line information of user behavior and activity leading up to an attack. Non-Alerting Visibility rules are tagged with Desc=, and Forensic= and should +are meant to provide contextual information for analysts to build cases and identify what is happening with SIEM enrichments. Some of these non-alerting visibility rules can be graduated +to the Alerting rules or can be used with correlation rules within a SIEM/SOAR/XDR. + +The goal with this configuration is a "Control" configuration that provides ultimate visibility that should be ran in conjunction with an EDR. +As we know, allot of EDR's today provide little contextual information, forensic information that is tagged, categorized, risk rated, some alerts EDR vendors choose to not alert +on due to the differences between each environment and how hard it is to baseline some detections. There is many use cases where EDR's fall short, they are not the greatest at +identifying suspicious activity that may fall short of being labeled as malicious. The goal here is to detect all common user activity that would lead to exfiltration, infiltration, +malware, malicious activity, questionable activity. If a user is poking around the registry, sending data to cloud storage, downloading and executing random attachments and files, +copying files, we want to know. We also want to leave an audit trail by monitoring the registry, artifact locations and provide our forensic analysts as much detail as possible. + +If you have forensic registry keys, file locations, artifacts, behavior detections and anything that may be beneficial here, feel free to put in a pull request. +The goal here is as much visibility as possible, with accurate alerts that are not noisy. -Note: Exact syntax and filtering choices are deliberate to catch appropriate entries and to have as little performance impact as possible. Sysmon's filtering abilities are different than the built-in Windows auditing features, so often a different approach is taken than the normal static listing of every possible important area. This now has an Auto Updater script to update to the latest Sysmon config hourly. This is great for mass deployments without having to manually update thousands of systems. From a0e7dd3c279690147973d125ca1c003e3048d240 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 12:49:19 -0400 Subject: [PATCH 409/471] update readme --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index eacd6572..afa52f64 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ The file provided should function as a great starting point for system monitorin       **[sysmonconfig-export.xml](https://github.com/ion-storm/sysmon-config/blob/master/sysmonconfig-export.xml)** -Pull requests and issue tickets are welcome, and new additions will be credited in-line or on Git, tag your naame with Author=YourName within the rulename field. +Pull requests and issue tickets are welcome, and new additions will be credited in-line or on Git, tag your name with Author=YourName within the rulename field. This Sysmon ATT&CK Configuration is designed "Explicitely" to enrich your SIEM for threat intelligence, forensics, UEBA, use cases. You'll want to create a key-value parser for the rulename field to create field names per event within your SIEM. From 045d80577487af5444c912bb1902b22b288b01f9 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 12:49:48 -0400 Subject: [PATCH 410/471] update readme --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index afa52f64..0bd58cac 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ The file provided should function as a great starting point for system monitorin Pull requests and issue tickets are welcome, and new additions will be credited in-line or on Git, tag your name with Author=YourName within the rulename field. -This Sysmon ATT&CK Configuration is designed "Explicitely" to enrich your SIEM for threat intelligence, forensics, UEBA, use cases. You'll want to create a key-value parser for the +This Sysmon ATT&CK Configuration is designed "Explicitly" to enrich your SIEM for threat intelligence, forensics, UEBA, use cases. You'll want to create a key-value parser for the rulename field to create field names per event within your SIEM. Ideally this is best used with an Alerting Repository/Index where the "Alert=" field is marked and a non-alerting visibility index/repository where threat hunting, investigations can be done that contains added context and story line information of user behavior and activity leading up to an attack. Non-Alerting Visibility rules are tagged with Desc=, and Forensic= and should From 47a9c1eb0bc286a15bd674e4b505bd8a5a7a5edc Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 12:52:55 -0400 Subject: [PATCH 411/471] update readme.. --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 0bd58cac..f41fe5e2 100644 --- a/README.md +++ b/README.md @@ -8,8 +8,8 @@ Pull requests and issue tickets are welcome, and new additions will be credited This Sysmon ATT&CK Configuration is designed "Explicitly" to enrich your SIEM for threat intelligence, forensics, UEBA, use cases. You'll want to create a key-value parser for the rulename field to create field names per event within your SIEM. Ideally this is best used with an Alerting Repository/Index where the "Alert=" field is marked and a non-alerting visibility index/repository where threat hunting, investigations can be done -that contains added context and story line information of user behavior and activity leading up to an attack. Non-Alerting Visibility rules are tagged with Desc=, and Forensic= and should -are meant to provide contextual information for analysts to build cases and identify what is happening with SIEM enrichments. Some of these non-alerting visibility rules can be graduated +that contains added context and story line information of user behavior and activity leading up to an attack. Non-Alerting Visibility rules are tagged with Desc=, and Forensic= and are +meant to provide contextual information for analysts to build cases and identify what is happening with SIEM enrichments. Some of these non-alerting visibility rules can be graduated to the Alerting rules or can be used with correlation rules within a SIEM/SOAR/XDR. The goal with this configuration is a "Control" configuration that provides ultimate visibility that should be ran in conjunction with an EDR. From a47c6a9fd78fa1cb51eb90a57f191d4306ea4e8d Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 15:20:35 -0400 Subject: [PATCH 412/471] Misc Detection additions and improvements --- sysmonconfig-export.xml | 101 +++++++++++++++++++++++++++++++++------- 1 file changed, 85 insertions(+), 16 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b340d201..241dad38 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -379,14 +379,14 @@ - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe - tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe + tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe;msidb.exe .cmd;- C:\Windows\system32\spool\DRIVERS\ PhotoViewer.dll - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe C:\Users\ .exe Zoom Video @@ -551,7 +551,7 @@ cmd.exe" /c cd - ntdsutil;/set {default} recoveryenabled no;telnet ;-dumpcr;putty;bash.exe;pssh;shareenum;sekurlsa;reg save;reg save;psscan;shellexec;vbscript:createobject;/output:clipboard;root\\default;root\\subscription;Wmiclass;WmiCl'+'as'+'s + ntdsutil;/set {default} recoveryenabled no;telnet ;-dumpcr;putty;bash.exe;pssh;shareenum;sekurlsa;reg save;reg save;psscan;shellexec;vbscript:createobject;/output:clipboard;root\\default;root\\subscription;Wmiclass;WmiCl'+'as'+'s;export-mft;ApplicationImpersonation ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy @@ -741,8 +741,8 @@ unknown process - \LocalState\rootfs\ - \LocalState\rootfs\ + \LocalState\rootfs\ + \LocalState\rootfs\ @@ -836,16 +836,17 @@ bash.exe;wsl.exe;ubuntu.exe;kali.exe - -e;/e;-u root;--exec bash;dev/tcp + -e;/e;-u root;--exec bash;dev/tcp;~ -d;~ /d wsl.exe wsl.exe - wslhost.exe - wslhost.exe - ubuntu.exe - ubuntu.exe + wslhost.exe + wslhost.exe + ubuntu.exe + ubuntu.exe kali.exe kali.exe + distro-id;vm-id pcalua.exe pcalua.exe @@ -1781,6 +1782,25 @@ 7z.exe a -mx9 -r0 -p;a -v500m -mx9 -r0 -p + + 7z + 7z + + + winrar + winrar + + + winrar + winrar + + + winzip + winzip + + + Compress-Archive + WindowsAudioDevice-Powershell-Cmdlet SoundRecorder.exe @@ -1800,6 +1820,9 @@ New-MailboxExportRequest + + add-pssnapin;exchange;new-managementroleassignment;applicationimpersonation + screencapture @@ -2196,6 +2219,12 @@ 137.184.67. httpbin.org + + advanced-ip-scanner.com + + + kali.download + shodan @@ -3798,22 +3827,50 @@ RedirSuiteServiceProxy.aspx - + w3wp.exe .aspx - + + w3wp.exe + .asp + + + w3wp.exe + .ashx + + w3wp.exe .php - + w3wp.exe .aaa - + \wwwroot\aspnet_client\;\FrontEnd\HttpProxy\owa\auth .aspx;.php;.ashx + + w3wp.exe + .ps1 + + + w3wp.exe + .bat + + + w3wp.exe + .dll + + + w3wp.exe + .vbs + + + w3wp.exe + .hta + \wwwroot\ \wwwroot\aspnet_client\;jpg @@ -4027,6 +4084,7 @@ .sz .tar .tar.gz + .tgz .xz .zip @@ -4494,6 +4552,11 @@ + + Software\Famatech\advanced_ip_scanner\State + LastRangeUsed + SetValue + @@ -5869,8 +5932,14 @@ .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com + + advanced-ip-scanner.com + + + kali.download + - + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.nimpool.io;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool;analytics.blue;estream.to graph.microsoft.com From e421fec9638d1f62318d7c8a6e3007d62054b390 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 15:44:55 -0400 Subject: [PATCH 413/471] Add some File Shred Exclusions --- sysmonconfig-export.xml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 241dad38..89427239 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -6513,6 +6513,7 @@ C:\Users + C:\Program Files\WindowsApps\ C:\Program Files @@ -6534,6 +6535,7 @@ C:\Windows\System32\config + C:\WINDOWS\system32\consent.exe .db @@ -6560,8 +6562,11 @@ .sst .sto - + .log + C:\Windows\System32\sru\ + + ConsoleHost_history.txt @@ -6688,6 +6693,13 @@ + + C:\WINDOWS\System32\svchost.exe + C:\WINDOWS\System32\services.exe + C:\WINDOWS\system32\consent.exe + C:\Program Files\Google\Drive File Stream\;\GoogleDriveFS.exe + C:\Program Files (x86)\Microsoft\EdgeWebView\Application\;msedgewebview2.exe + C:\Safe-shred-location From 88eaac22bdb07e1a340fefefaf87908219bdeee7 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 16:02:13 -0400 Subject: [PATCH 414/471] Whitelist C:\Windows for now for file shred protection, just to prevent any weirdness. --- sysmonconfig-export.xml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 89427239..41f6e103 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -6694,14 +6694,17 @@ - C:\WINDOWS\System32\svchost.exe - C:\WINDOWS\System32\services.exe - C:\WINDOWS\system32\consent.exe + C:\WINDOWS\ + C:\Program Files\WindowsApps\ + C:\PROGRA~2\Citrix\ICACLI~1\WFICA32.EXE + C:\Program Files;\Microsoft\EdgeWebView\Application\;\msedgewebview2.exe + C:\Program Files;\Citrix\;\WFICA32.EXE C:\Program Files\Google\Drive File Stream\;\GoogleDriveFS.exe C:\Program Files (x86)\Microsoft\EdgeWebView\Application\;msedgewebview2.exe - + C:\Safe-shred-location + .lock C:\$mft From 8a9963d46ca2cecabe0c38b2e3a4589590689a58 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 4 Oct 2022 17:02:27 -0400 Subject: [PATCH 417/471] Target specific folders for powershell file block, as this will block copying of exe files as well \Temp\;\AppData\;C:\Users\Public --- sysmonconfig-export.xml | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 82831c98..cd54d838 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -6315,19 +6315,21 @@ - + OUTLOOK.exe;WINWORD.exe;EXCEL.EXE;powerpnt.exe;msaccess.exe;mspub.exe;eqnedt32.exe;visio.exe;wordpad.exe;wordview.exe;msohtmed.exe;lync.exe;teams.exe :\Program Files\Microsoft Office\;:\Program Files (x86)\Microsoft Office\ - + w3wp.exe;tomcat;apache;nginx;httpd whitelist_me_here - + + powershell.exe;powershell_ise.exe + \Temp\;\AppData\;C:\Users\Public whitelist_me_here - + .pdf.exe .doc.exe .docx.exe @@ -6343,19 +6345,19 @@ .ico.exe .lnk.exe - + psexesvc psexec - + wmiprvse.exe - + C:\Users\Public\ amdsfhdcd.bin intuit - + AcroRd32.exe;notepad.exe;mshta.exe;hh.exe;certutil.exe;certoc.exe;certreq.exe;desktopimgdownldr.exe;esentutl.exe;finger.exe;presentationhost.exe;cscript.exe;wscript.exe;mspaint.exe;RdrCEF.exe @@ -6458,7 +6460,7 @@ \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll - + certutil.exe certoc.exe CertReq.exe @@ -6469,7 +6471,7 @@ finger.exe presentationhost.exe - + bitsadmin.exe C:\Windows;$WINDOWS.;\SoftwareDistribution\ System From 7328ab70bccc259ededb51aa5eb056de84d2c6c0 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 5 Oct 2022 12:01:16 -0400 Subject: [PATCH 418/471] More Amcache Forensic logging added --- sysmonconfig-export.xml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index cd54d838..f32e6a7e 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5570,8 +5570,10 @@ Compatibility Assistant\Store\ \BinProductVersion Root\InventoryApplicationShortcut\ - Root\InventoryDriverBinary\ - Root\InventoryDeviceContainer\ + Root\InventoryDriverBinary + Root\InventoryDriverPackage + Root\InventoryDevicePnp + Root\InventoryDeviceContainer Root\InventoryApplication\ ProgramID;Name;Version;Publisher;Language;InstallDate;Source;RootDirPath;HiddenArp;UninstallString;RegistryKeyPath;UserSID;sha256 From 33d1499615c440922f2de7082c14e46256045e50 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 5 Oct 2022 13:12:34 -0400 Subject: [PATCH 419/471] Add additional Data Exfiltration Rules, change order of web browser rules. --- sysmonconfig-export.xml | 74 ++++++++++++++++++++++++++++------------- 1 file changed, 50 insertions(+), 24 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f32e6a7e..2929a47e 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -2692,22 +2692,38 @@ 127.0.0.1 - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe 80 443 true github githubusercontent.com - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe - 80 - true + + dropboxapi.com + \Dropbox\Client\Dropbox.exe;\Dropbox\bin\Dropbox.exe;\Oracle\Java\ - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe - 443 - true + + 1drv + \AppData\Local\Microsoft\OneDrive\OneDrive.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe;\Internet Explorer\iexplore.exe;C:\Windows\System32\AppHostRegistrationVerifier.exe;C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe;C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe;C:\Program Files\Mozilla Firefox\firefox.exe + + + .box.com;upload + + + mega.nz;mega.co.nz + + + privatlab.com + + + tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat + + + efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet + + + .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com apache.exe @@ -2769,21 +2785,31 @@ 5800 0 + 80 + 443 + 636 + 5900 + 443 + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe + 80 + true + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - 443 + https true \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - 80 + http + true + + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe + 443 true - 80 - 443 - 636 - 5900 - 443 afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com @@ -3723,7 +3749,7 @@ .pyc .pyd - + .cdxml .ps1 .ps1xml @@ -3732,7 +3758,7 @@ .psm1 .pssc - + powershell.exe;powershell_ise.exe \Recent\CustomDestinations\ @@ -3779,7 +3805,7 @@ !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;=READ=THIS=PLEASE=;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy C:\Users\;\Google\Chrome Beta\User Data\;\IndexedDB\ - C:\Program Files\WindowsApps\Microsoft.YourPhone_;C:\Program Files\dotnet\shared\Microsoft.NETCore.App\ + C:\Program Files\WindowsApps\Microsoft.YourPhone_;C:\Program Files\dotnet\shared\Microsoft.NETCore.App\;\Microsoft.NET\assembly\GAC_MSIL crackmapexec \Crypto.Cipher._AES.pyd @@ -5905,21 +5931,21 @@ powershell;cscript.exe;wscript.exe;mshta.exe;bitsadmin.exe;\cmd.exe . - + dropboxapi.com \Dropbox\Client\Dropbox.exe;\Dropbox\bin\Dropbox.exe;\Oracle\Java\ - + 1drv \AppData\Local\Microsoft\OneDrive\OneDrive.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe;\Internet Explorer\iexplore.exe;C:\Windows\System32\AppHostRegistrationVerifier.exe;C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe;C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe;C:\Program Files\Mozilla Firefox\firefox.exe - + .box.com;upload - + mega.nz;mega.co.nz - + privatlab.com From 5777038350416bc866b022647ead70d65d17f82e Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 5 Oct 2022 17:43:52 -0400 Subject: [PATCH 420/471] Add additional Detections, expand qbot detection to detect subprocesses of rundll32/regsvr32.exe that are uncommon. --- sysmonconfig-export.xml | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 2929a47e..204f5839 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -1074,7 +1074,7 @@ \rundll32.exe;\regsvr32.exe - \explorer.exe;\wermgr.exe;\msra.exe + \explorer.exe;\wermgr.exe;\msra.exe;\OneDriveSetup.exe;\mobsync.exe;\xwizard.exe .exe @@ -2705,7 +2705,8 @@ 1drv - \AppData\Local\Microsoft\OneDrive\OneDrive.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe;\Internet Explorer\iexplore.exe;C:\Windows\System32\AppHostRegistrationVerifier.exe;C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe;C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe;C:\Program Files\Mozilla Firefox\firefox.exe + + C:\Program Files\Microsoft OneDrive\OneDrive.exe;\AppData\Local\Microsoft\OneDrive\OneDrive.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe;\Internet Explorer\iexplore.exe;C:\Windows\System32\AppHostRegistrationVerifier.exe;C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe;C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe;C:\Program Files\Mozilla Firefox\firefox.exe .box.com;upload @@ -3274,6 +3275,9 @@ C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_ C:\Windows\explorer.exe + + python + C:\Windows\Microsoft.NET\assembly\GAC_MSIL false @@ -3537,6 +3541,7 @@ powershell.exe C:\Programdata\sysmon\sysmon64.exe;C:\Programdata\sysmon\sysmon.exe;C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe;\dismhost.exe + C:\WINDOWS\SYSTEM32\ntdll.dll+;|C:\WINDOWS\System32\KERNELBASE.dll+;|C:\ProgramData\Microsoft\Windows Defender\Platform\;\MPCLIENT.DLL;\MpOav.dll+;|C:\WINDOWS\SYSTEM32\amsi.dll getasynckeystate @@ -5658,6 +5663,10 @@ \Software\AppDataLow\Software\Microsoft\
.exe;.dll;powershell;wmic
 + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel +
DWORD (0x00000005)
+ Software\Microsoft\Office test\Special\Perf \CurrentControlSet\Services\NTDS\LsaDbExtPt \Services\NTDS\DirectoryServiceExtPt @@ -5688,13 +5697,11 @@ \Client\Enabled \Server\Enabled Kitty\Sessions - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic PuTTY\Sessions Terminal Server Client\Servers WinSCP 2\Sessions - WinSCP 2\Sessions C:\Program Files (x86)\Kaspersky Lab C:\Program Files\Kaspersky Lab From 2888b1bd34c7a948017d9677606f223a4efe7e45 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 5 Oct 2022 18:03:55 -0400 Subject: [PATCH 421/471] Add Windows Defender Exclusion registry path, enable alerting --- sysmonconfig-export.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 204f5839..34be84c6 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5554,6 +5554,9 @@ HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ + \Exclusions\Paths + \Exclusions\Extensions + \Exclusions\Processes TamperProtection HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ From caa8d68baa6dbd054128fe81b40f469f82ec89d8 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 6 Oct 2022 10:47:31 -0400 Subject: [PATCH 422/471] Add additional Service Monitoring capability with Driver detection based on DWORD Information, also add additional detail to be logged for driver tracking/correlation capability. --- sysmonconfig-export.xml | 84 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 84 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 34be84c6..b78af38a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5629,6 +5629,90 @@ \DeleteFlag
DWORD (0x00000001)
 + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000001)
+ + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000002)
+ + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000004)
+ + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000020)
+ + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000020)
+ + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000100)
+ + + HKLM\System\CurrentControlSet\services\ + \Group + + + HKLM\System\CurrentControlSet\services\ + \DependOnService + + + HKLM\System\CurrentControlSet\services\ + \BinaryPathName + + + HKLM\System\CurrentControlSet\services\ + \RequiredPrivileges + + + HKLM\System\CurrentControlSet\services\ + \Owners + + + HKLM\System\CurrentControlSet\services\ + \ObjectName + + + HKLM\System\CurrentControlSet\services\ + \ServiceStartName + + + HKLM\System\CurrentControlSet\services\ + \ErrorControl + + + + HKLM\System\CurrentControlSet\services\ + \DependOnGroup + + + HKLM\System\CurrentControlSet\services\ + \DisplayName + + + HKLM\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder + \List + + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000001)
+ \ConsentStore\bluetooth \ConsentStore\contacts From 084b234313c886faeb044161bb8f9557719e10d6 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 6 Oct 2022 12:12:16 -0400 Subject: [PATCH 423/471] Enable MITRE Tagging for drivers, system services, enable alerting. --- sysmonconfig-export.xml | 62 ++++++++++++++++++++--------------------- 1 file changed, 31 insertions(+), 31 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index b78af38a..e659fcc2 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -4735,27 +4735,27 @@ \Microsoft\System\Scripts \Windows\System\Scripts HKLM\SYSTEM\Setup\CmdLine - + \Start
DWORD (0x00000000)
 - + \Start
DWORD (0x00000001)
 - + \Start
DWORD (0x00000002)
 - + \Start
DWORD (0x00000003)
 - + \Start
DWORD (0x00000004)
 - \ImagePath + \ImagePath \ServiceDll \ServiceManifest hkcu\software\microsoft\windows nt\currentversion\windows\run\ @@ -5597,17 +5597,17 @@ Outlook\WebView\Calendar \Place MRU \LinkDate - \DriverVerVersion - \DriverVersion + \DriverVerVersion + \DriverVersion \LowerCaseLongPath \Publisher Compatibility Assistant\Store\ \BinProductVersion Root\InventoryApplicationShortcut\ - Root\InventoryDriverBinary - Root\InventoryDriverPackage - Root\InventoryDevicePnp - Root\InventoryDeviceContainer + Root\InventoryDriverBinary + Root\InventoryDriverPackage + Root\InventoryDevicePnp + Root\InventoryDeviceContainer Root\InventoryApplication\ ProgramID;Name;Version;Publisher;Language;InstallDate;Source;RootDirPath;HiddenArp;UninstallString;RegistryKeyPath;UserSID;sha256 @@ -5624,70 +5624,70 @@ \Explorer\MountPoints2 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices - + HKLM\System\CurrentControlSet\services\ \DeleteFlag
DWORD (0x00000001)
 - + HKLM\System\CurrentControlSet\services\ \Type
DWORD (0x00000001)
 - + HKLM\System\CurrentControlSet\services\ \Type
DWORD (0x00000002)
 - + HKLM\System\CurrentControlSet\services\ \Type
DWORD (0x00000004)
 - + HKLM\System\CurrentControlSet\services\ \Type
DWORD (0x00000020)
 - + HKLM\System\CurrentControlSet\services\ \Type
DWORD (0x00000020)
 - + HKLM\System\CurrentControlSet\services\ \Type
DWORD (0x00000100)
 - + HKLM\System\CurrentControlSet\services\ \Group - + HKLM\System\CurrentControlSet\services\ \DependOnService - + HKLM\System\CurrentControlSet\services\ \BinaryPathName - + HKLM\System\CurrentControlSet\services\ \RequiredPrivileges - + HKLM\System\CurrentControlSet\services\ \Owners - + HKLM\System\CurrentControlSet\services\ \ObjectName - + HKLM\System\CurrentControlSet\services\ \ServiceStartName - + HKLM\System\CurrentControlSet\services\ \ErrorControl - + HKLM\System\CurrentControlSet\services\ \DependOnGroup - + HKLM\System\CurrentControlSet\services\ \DisplayName - + HKLM\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder \List - + HKLM\System\CurrentControlSet\services\ \Type
DWORD (0x00000001)
From 89e8cd59d518ae4949fe4d220f578ff469b13404 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 6 Oct 2022 12:29:46 -0400 Subject: [PATCH 424/471] Noise reduction in Class Keys for new hardware detections --- sysmonconfig-export.xml | 40 ++++++++++++++++++++++++++++++++-------- 1 file changed, 32 insertions(+), 8 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e659fcc2..d57e04dd 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -4616,17 +4616,41 @@ DefaultPrinter + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974 + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} + SetValue + MountedDevices Mountpoints2 Active Setup\Installed Components - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} - HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} From 7bd07c130b23e1013e7ed38c15bd3e8011b0a2c5 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 7 Oct 2022 09:02:34 -0400 Subject: [PATCH 425/471] MITRE Tagging of hardware additions --- sysmonconfig-export.xml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index d57e04dd..fc881eec 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -4620,36 +4620,36 @@ HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} SetValue - + HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} SetValue - + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} SetValue - + HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} SetValue - + HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974 SetValue - + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} SetValue - + HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} SetValue - + HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} SetValue - MountedDevices - Mountpoints2 + MountedDevices + Mountpoints2 Active Setup\Installed Components From 995be59d850175762e23cbaa6649b2ff6b55ea85 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 7 Oct 2022 09:09:32 -0400 Subject: [PATCH 426/471] AV Exclusions for performance, noise reduction --- sysmonconfig-export.xml | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index fc881eec..34a14b57 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -3303,6 +3303,13 @@ true + + C:\Program Files (x86)\Kaspersky Lab + C:\Program Files\Kaspersky Lab + C:\Program Files (x86)\ESET + C:\Program Files\ESET + C:\ProgramData\Microsoft\Windows Defender\ + Fortinet Lenovo Sophos @@ -3637,12 +3644,6 @@ dump mimikatz CorperfmontExt.dll - - C:\Program Files (x86)\Kaspersky Lab - C:\Program Files\Kaspersky Lab - C:\Program Files (x86)\ESET - C:\Program Files\ESET - @@ -3670,6 +3671,13 @@ C:\Windows\SYSTEM32\win32u.dll C:\Windows\SYSTEM32\wow64win.dll + + C:\Program Files (x86)\Kaspersky Lab + C:\Program Files\Kaspersky Lab + C:\Program Files (x86)\ESET + C:\Program Files\ESET + C:\ProgramData\Microsoft\Windows Defender\ + @@ -6858,6 +6866,13 @@ :\Users\;\AppData\;\D3DSCache .lock + + C:\Program Files (x86)\Kaspersky Lab + C:\Program Files\Kaspersky Lab + C:\Program Files (x86)\ESET + C:\Program Files\ESET + C:\ProgramData\Microsoft\Windows Defender\ + @@ -6483,21 +6516,25 @@ \Temp\;\AppData\;C:\Users\Public whitelist_me_here - - .pdf.exe + + .exe + .7z.exe + .doc.exe .doc.exe .docx.exe - .xls.exe - .xlsx.exe + .ico.exe + .iso.exe + .lnk.exe + .pdf.exe .ppt.exe - .txt.exe + .pptx.exe + .rar.exe .rtf.exe - .iso.exe + .txt.exe + .xls.exe + .xlsx.exe .zip.exe - .rar.exe - .7z.exe - .ico.exe - .lnk.exe + ______.exe psexesvc From e1d603d630e71e6a2bc94a26a0720cb8ca19a79e Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 7 Oct 2022 09:31:07 -0400 Subject: [PATCH 428/471] Move Double Extensions under masquerading --- sysmonconfig-export.xml | 42 ++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index ab44be9f..95cc6c20 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -144,26 +144,6 @@ .SettingContent-ms immersivecontrolpanel - - .exe - .7z.exe - .doc.exe - .doc.exe - .docx.exe - .ico.exe - .iso.exe - .lnk.exe - .pdf.exe - .ppt.exe - .pptx.exe - .rar.exe - .rtf.exe - .txt.exe - .xls.exe - .xlsx.exe - .zip.exe - ______.exe - Hwp.exe gbb.exe @@ -866,7 +846,27 @@ C:\Users\NetworkService\;C:\Users\NetworkService\;HarddiskVolumeShadowCopy;C:\Users\Default\;C:\Users\Public;C:\Users\Guest\;\administrateur\;C:\Windows\Media\;C:\Windows\addins\;tsclient\;\htdocs\;\config\systemprofile\;C:\PerfLogs\;c:\windows\ServiceProfiles\;C:\Intel\Logs\;C:\Windows\repair\;C:\Windows\Help\;$Recycle;C:\Windows\Debug\;C:\Windows\Security\;C:\Windows\Fonts\;\wwwroot\;\Contacts;C:\Windows\vss\ - + + + .exe + .7z.exe + .doc.exe + .doc.exe + .docx.exe + .ico.exe + .iso.exe + .lnk.exe + .pdf.exe + .ppt.exe + .pptx.exe + .rar.exe + .rtf.exe + .txt.exe + .xls.exe + .xlsx.exe + .zip.exe + ______.exe + From 0fd06947cde6e0528ce4b8b80dcab7f395430b09 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 7 Oct 2022 09:43:14 -0400 Subject: [PATCH 429/471] add additional office apps --- sysmonconfig-export.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 95cc6c20..77d3cda0 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -390,7 +390,7 @@ vivaldi.exe - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe C:\ProgramData\ Firefox Microsoft Edge @@ -3811,12 +3811,12 @@ C:\Windows\system32\wermgr.exe - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe .exe C:\Users - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe .dll C:\Users From 1d16037648af970a1da2cc21a1687d9b627f516b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 7 Oct 2022 14:17:24 -0400 Subject: [PATCH 430/471] Some new detections to track spearphishing attachments and more --- sysmonconfig-export.xml | 56 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 52 insertions(+), 4 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 77d3cda0..f7914e02 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -344,9 +344,9 @@ COMSPEC ScriptFile - AppData\Local\Temp\7z - AppData\Local\Temp\Temp1_ - \AppData\Local\Temp\Rar$ + \Temp\7z + \Temp\Temp1_ + \Temp\Rar$ powershell.exe;powershell_ise.exe @@ -371,6 +371,51 @@ C:\Windows\system32\spool\DRIVERS\ PhotoViewer.dll + + outlook.exe + http:;https:;ftp:;mailto:;tel: + .html + + + outlook.exe + http:;https:;ftp:;mailto:;tel: + .html" + + + outlook.exe + http:;https:;ftp:;mailto:;tel: + .html" + + + outlook.exe + .pdf" + + + outlook.exe + .pdf + + + outlook.exe + .iso" + + + outlook.exe + .iso + + + outlook.exe + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe;BrowserAssist.exe;\msedgewebview;\msedge.exe + http:;https:;ftp:;mailto:;tel: + + + outlook.exe + http:;https:;ftp:;mailto:;tel: + \Content.Outlook\;\Downloads\;\Documents\;:\Users\Public\;\Desktop\ + + + outlook.exe + \\ + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe C:\Users\ @@ -389,7 +434,7 @@ iexplore.exe vivaldi.exe - + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe C:\ProgramData\ Firefox @@ -397,6 +442,9 @@ Microsoft Teams Zoom Video + + .zip\ + acrobat.exe;acrord32.exe tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe From ede706773aa1bdbdeeab2c2309733e89fb958dee Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 7 Oct 2022 14:40:58 -0400 Subject: [PATCH 431/471] additional mounted devices detection besides mounted devices keys to ensure logging of iso/img malware --- sysmonconfig-export.xml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f7914e02..813995d9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -344,9 +344,9 @@ COMSPEC ScriptFile - \Temp\7z - \Temp\Temp1_ - \Temp\Rar$ + \Temp\7z + \Temp\Temp1_ + \Temp\Rar$ powershell.exe;powershell_ise.exe @@ -5735,7 +5735,12 @@ Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations - \Explorer\MountPoints2 + + \Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives\Volume + Drive Type +
DWORD (0x00000011)
+ + \Explorer\MountPoints2 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices HKLM\System\CurrentControlSet\services\ From 729b8a9d0c47e0266ac3036b304984e3b39f8824 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 7 Oct 2022 14:48:05 -0400 Subject: [PATCH 432/471] Add alerting in Amcache for virtual DVD-ROM Mount after iso mount for additional telemetry for iso/img malware. --- sysmonconfig-export.xml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 813995d9..bc574d0c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -4737,6 +4737,10 @@ HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} SetValue + + Root\InventoryDevicePnp;prod_virtual_dvd-rom + SetValue + MountedDevices Mountpoints2 Active Setup\Installed Components From 5b57c5cfbf97ce1c2896776e013def96469f441f Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 7 Oct 2022 14:57:38 -0400 Subject: [PATCH 433/471] Add Bitlocker Status Monitoring for System drive with alerting enabled. --- sysmonconfig-export.xml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index bc574d0c..1767a77e 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5499,6 +5499,14 @@ DeleteKey + + SYSTEM\CurrentControlSet\Control\BitlockerStatus\BootStatus +
DWORD (0x00000001)
+ + + SYSTEM\CurrentControlSet\Control\BitlockerStatus\BootStatus +
DWORD (0x00000000)
+ From 7ccb9bd3fa6658152d4d95c7815f46a4f8374952 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 7 Oct 2022 15:02:08 -0400 Subject: [PATCH 434/471] Add Bitlocker Status Monitoring for System drive with alerting enabled. Fix --- sysmonconfig-export.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1767a77e..a50d086a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5500,11 +5500,11 @@ - SYSTEM\CurrentControlSet\Control\BitlockerStatus\BootStatus + HKLM\SYSTEM\CurrentControlSet\Control\BitlockerStatus\BootStatus
DWORD (0x00000001)
 - SYSTEM\CurrentControlSet\Control\BitlockerStatus\BootStatus + HKLM\SYSTEM\CurrentControlSet\Control\BitlockerStatus\BootStatus
DWORD (0x00000000)
 From b7d421aebcc9906be23bff7696428ebc94d56f84 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 7 Oct 2022 15:33:00 -0400 Subject: [PATCH 435/471] Push Vulnerable Driver detections from Nasreddine Bencherchali https://twitter.com/nas_bench/status/1578433581479002112 ref: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_vuln_drivers.yml --- sysmonconfig-export.xml | 483 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 482 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index a50d086a..11cb3215 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -85,7 +85,7 @@ --> - md5,sha256,imphash + md5,sha1,sha256,imphash @@ -3108,6 +3108,487 @@ Unavailable Valid false + + + SHA1=2261198385d62d2117f50f631652eded0ecc71db + SHA1=8db869c0674221a2d3280143cbb0807fac08e0cc + SHA1=27d3ebea7655a72e6e8b95053753a25db944ec0f + SHA1=33cdab3bbc8b3adce4067a1b042778607dce2acd + SHA1=21e6c104fe9731c874fab5c9560c929b2857b918 + SHA1=d979353d04bf65cc92ad3412605bc81edbb75ec2 + SHA1=2f991435a6f58e25c103a657d24ed892b99690b8 + SHA1=f02af84393e9627ba808d4159841854a6601cf80 + SHA1=bb962c9a8dda93e94fef504c4159de881e4706fe + SHA1=b97a8d506be2e7eaa4385f70c009b22adbd071ba + SHA1=92f251358b3fe86fd5e7aa9b17330afa0d64a705 + SHA1=8b6aa5b2bff44766ef7afbe095966a71bc4183fa + SHA1=af6e1f2cfb230907476e8b2d676129b6d6657124 + SHA1=fcde5275ee1913509927ce5f0f85e6681064c9d2 + SHA1=00a442a4305c62cefa8105c0b4c4a9a5f4d1e93b + SHA1=6523b3fd87de39eb5db1332e4523ce99556077dc + SHA1=72966ca845759d239d09da0de7eebe3abe86fee3 + SHA1=57511ef5ff8162a9d793071b5bf7ebe8371759de + SHA1=2d503a2457a787014a1fdd48a2ece2e6cbe98ea7 + SHA1=400f833dcc2ef0a122dd0e0b1ec4ec929340d90e + SHA1=89cd760e8cb19d29ee08c430fb17a5fd4455c741 + SHA1=1d0df45ee3fa758f0470e055915004e6eae54c95 + SHA1=d5fd9fe10405c4f90235e583526164cd0902ed86 + SHA1=c52cef5b9e1d4a78431b7af56a6fdb6aa1bcad65 + SHA1=609fa1efcf61e26d64a5ceb13b044175ab2b3a13 + SHA1=7d7c03e22049a725ace2a9812c72b53a66c2548b + SHA1=f9519d033d75e1ab6b82b2e156eafe9607edbcfb + SHA1=468e2e5505a3d924b14fedee4ddf240d09393776 + SHA1=2e3de9bff43d7712707ef8a0b10f7e4ad8427fd8 + SHA1=c9cbfdd0be7b35751a017ec59ff7237ffdc4df1f + SHA1=078ae07dec258db4376d5a2a05b9b508d68c0123 + SHA1=623cd2abef6c92255f79cbbd3309cb59176771da + SHA1=1f3a9265963b660392c4053329eb9436deeed339 + SHA1=4a235f0b84ff615e2879fa9e0ec0d745fcfdaa5c + SHA1=ace6b9e34e3e2e73fe584f3bbdb4e4ec106e0a7d + SHA1=4268f30b79ce125a81d0d588bef0d4e2ad409bbb + SHA1=c834c4931b074665d56ccab437dfcc326649d612 + SHA1=8f5cd4a56e6e15935491aa40adb1ecad61eafe7c + SHA1=51b60eaa228458dee605430aae1bc26f3fc62325 + SHA1=3270720a066492b046d7180ca6e60602c764cac7 + SHA1=2a6e6bd51c7062ad24c02a4d2c1b5e948908d131 + SHA1=19bd488fe54b011f387e8c5d202a70019a204adf + SHA1=a6fe4f30ca7cb94d74bc6d42cdd09a136056952e + SHA1=ea877092d57373cb466b44e7dbcad4ce9a547344 + SHA1=205c69f078a563f54f4c0da2d02a25e284370251 + SHA1=f9feb60b23ca69072ce42264cd821fe588a186a6 + SHA1=b25170e09c9fb7c0599bfba3cf617187f6a733ac + SHA1=160c96b5e5db8c96b821895582b501e3c2d5d6e7 + SHA1=a2e0b3162cfa336cd4ab40a2acc95abe7dc53843 + SHA1=4e826430a1389032f3fe06e2cc292f643fb0c417 + SHA1=7ab4565ba24268f0adadb03a5506d4eb1dc7c181 + SHA1=dc7b022f8bd149efbcb2204a48dce75c72633526 + SHA1=0307d76750dd98d707c699aee3b626643afb6936 + SHA1=5711c88e9e64e45b8fc4b90ab6f2dd6437dc5a8a + SHA1=6714380bc0b8ab09b9a0d2fa66d1b025b646b946 + SHA1=8626ab1da6bfbdf61bd327eb944b39fd9df33d1d + SHA1=30a224b22592d952fbe2e6ad97eda4a8f2c734e0 + SHA1=c95db1e82619fb16f8eec9a8209b7b0e853a4ebe + SHA1=fe1d909ab38de1389a2a48352fd1c8415fd2eab0 + SHA1=b4d1554ec19504215d27de0758e13c35ddd6db3e + SHA1=5dd2c31c4357a8b76db095364952b3d0e3935e1d + SHA1=ecb4d096a9c58643b02f328d2c7742a38e017cf0 + SHA1=4a705af959af61bad48ef7579f839cb5ebd654d2 + SHA1=d2e6fc9259420f0c9b6b1769be3b1f63eb36dc57 + SHA1=c948ae14761095e4d76b55d9de86412258be7afd + SHA1=ddbe809b731a0962e404a045ab9e65a0b64917ad + SHA1=745bad097052134548fe159f158c04be5616afc2 + SHA1=8d59fd14a445c8f3f0f7991fa6cd717d466b3754 + SHA1=2dfcb799b3c42ecb0472e27c19b24ac7532775ce + SHA1=cc51be79ae56bc97211f6b73cc905c3492da8f9d + SHA1=ac13941f436139b909d105ad55637e1308f49d9a + SHA1=2b0bb408ff0e66bcdf6574f1ca52cbf4015b257b + SHA1=cc0e0440adc058615e31e8a52372abadf658e6b1 + SHA1=5520ac25d81550a255dc16a0bb89d4b275f6f809 + SHA1=6afc6b04cf73dd461e4a4956365f25c1f1162387 + SHA1=4b009e91bae8d27b160dc195f10c095f8a2441e1 + SHA1=6003184788cd3d2fc624ca801df291ccc4e225ee + SHA1=0466e90bf0e83b776ca8716e01d35a8a2e5f96d3 + SHA1=e6305dddd06490d7f87e3b06d09e9d4c1c643af0 + SHA1=89909fa481ff67d7449ee90d24c167b17b0612f1 + SHA1=d7e8aef8c8feb87ce722c0b9abf34a7e6bab6eb4 + SHA1=5e6ddd2b39a3de0016385cbd7aa50e49451e376d + SHA1=976777d39d73034df6b113dfce1aa6e1d00ffcfd + SHA1=9c6749fc6c1127f8788bff70e0ce9062959637c9 + SHA1=53acd4d9e7ba0b1056cf52af0d191f226eddf312 + SHA1=3abb9d0a9d600200ae19c706e570465ef0a15643 + SHA1=27eab595ec403580236e04101172247c4f5d5426 + SHA1=78b9481607ca6f3a80b4515c432ddfe6550b18a8 + SHA1=414cd15d6c991d19fb5be02e3b9fb0e6c5ce731c + SHA1=d9c09dd725bc7bc3c19b4db37866015817a516ef + SHA1=9c256edd10823ca76c0443a330e523027b70522d + SHA1=35829e096a15e559fcbabf3441d99e580ca3b26e + SHA1=b8de3a1aeeda9deea43e3f768071125851c85bd0 + SHA1=054a50293c7b4eea064c91ef59cf120d8100f237 + SHA1=d94f2fb3198e14bfe69b44fb9f00f2551f7248b2 + SHA1=01a578a3a39697c4de8e3dab04dba55a4c35163e + SHA1=14bf0eaa90e012169745b3e30c281a327751e316 + SHA1=f50c6b84dfb8f2d53ba3bce000a55f0a486c0e79 + SHA1=6100eb82a25d64a7a7702e94c2b21333bc15bd08 + SHA1=bf87e32a651bdfd9b9244a8cf24fca0e459eb614 + SHA1=28b1c0b91eb6afd2d26b239c9f93beb053867a1a + SHA1=879fcc6795cebe67718388228e715c470de87dca + SHA1=1f7501e01d84a2297c85cb39880ec4e40ac3fe8a + SHA1=152b6bb9ffd2ffec00cc46f5c6e29362d0e66e67 + SHA1=5f8356ffa8201f338dd2ea979eb47881a6db9f03 + SHA1=a7bd05de737f8ea57857f1e0845a25677df01872 + SHA1=cce9b82f01ec68f450f5fe4312f40d929c6a506e + SHA1=e35a2b009d54e1a0b231d8a276251f64231b66a3 + SHA1=37364cb5f5cefd68e5eca56f95c0ab4aff43afcc + SHA1=d62fa51e520022483bdc5847141658de689c0c29 + SHA1=93aa3bb934b74160446df3a47fa085fd7f3a6be9 + SHA1=ec4cc6de4c779bb1ca1dd32ee3a03f7e8d633a9b + SHA1=35f1ba60ba0da8512a0b1b15ee8e30fe240d77cd + SHA1=3805e4e08ad342d224973ecdade8b00c40ed31be + SHA1=65d8a7c2e867b22d1c14592b020c548dd0665646 + SHA1=c8d87f3cd34c572870e63a696cf771580e6ea81b + SHA1=c4d7fb9db3c3459f7e8c0e3d48c95c7c9c4cff60 + SHA1=d34a7c497c603f3f7fcad546dc4097c2da17c430 + SHA1=1fd7f881ea4a1dbb5c9aeb9e7ad659a85421745b + SHA1=0b8b83f245d94107cb802a285e6529161d9a834d + SHA1=c969f1f73922fd95db1992a5b552fbc488366a40 + SHA1=ac600a2bc06b312d92e649b7b55e3e91e9d63451 + SHA1=da9cea92f996f938f699902482ac5313d5e8b28e + SHA1=33285b2e97a0aeb317166cce91f6733cf9c1ad53 + SHA1=21edff2937eb5cd6f6b0acb7ee5247681f624260 + SHA1=f052dc35b74a1a6246842fbb35eb481577537826 + SHA1=f0c463d29a5914b01e4607889094f1b7d95e7aaf + SHA1=0c26ab1299adcd9a385b541ef1653728270aa23e + SHA1=f36a47edfacd85e0c6d4d22133dd386aee4eec15 + SHA1=460008b1ffd31792a6deadfa6280fb2a30c8a5d2 + SHA1=738b7918d85e5cb4395df9e3f6fc94ddad90e939 + SHA1=43419df1f9a07430a18c5f3b3cc74de621be0f8e + SHA1=558aad879b6a47d94a968f39d0a4e3a3aaef1ef1 + SHA1=7fb52290883a6b69a96d480f2867643396727e83 + + SHA1=f5696fb352a3fbd14fb1a89ad21a71776027f9ab + SHA1=693a2645c28fc3b248fda95179c36c3ac64f6fc2 + SHA1=05c0c49e8bcf11b883d41441ce87a2ee7a3aba1d + SHA1=d25340ae8e92a6d29f599fef426a2bc1b5217299 + SHA1=7c1b25518dee1e30b5a6eaa1ea8e4a3780c24d0c + SHA1=fe10018af723986db50701c8532df5ed98b17c39 + SHA1=bfe55cacc7c56c9f7bd75bdb4b352c0b745d071b + SHA1=a21c84c6bf2e21d69fa06daaf19b4cc34b589347 + SHA1=82ba5513c33e056c3f54152c8555abf555f3e745 + SHA1=d098600152e5ee6a8238d414d2a77a34da8afaaa + SHA1=64e4ac8b9ea2f050933b7ec76a55dd04e97773b4 + SHA1=bbc1e5fd826961d93b76abd161314cb3592c4436 + SHA1=90a76945fd2fa45fab2b7bcfdaf6563595f94891 + SHA1=b03b1996a40bfea72e4584b82f6b845c503a9748 + SHA1=c771ea59f075170e952c393cfd6fc784b265027c + SHA1=cb44c6f0ee51cb4c5836499bc61dd6c1fbdf8aa1 + SHA1=0918277fcdc64a9dc51c04324377b3468fa1269b + SHA1=b09bcc042d60d2f4c0d08284818ed198cededa04 + + SHA1=8dc2097a90eb7e9d6ee31a7c7a95e7a0b2093b89 + SHA1=15df139494d2c40a645fb010908551185c27f3c5 + SHA1=012db3a80faf1f7f727b538cbe5d94064e7159de + SHA1=d04e5db5b6c848a29732bfd52029001f23c3da75 + SHA1=490109fa6739f114651f4199196c5121d1c6bdf2 + SHA1=b4d014b5edd6e19ce0e8395a64faedf49688ecb5 + SHA1=a87d6eac2d70a3fbc04e59412326b28001c179de + SHA1=3f223581409492172a1e875f130f3485b90fbe5f + SHA1=5db61d00a001fd493591dc919f69b14713889fc5 + + SHA1=9923c8f1e565a05b3c738d283cf5c0ed61a0b90f + SHA1=15d1a6a904c8409fb47a82aefa42f8c3c7d8c370 + SHA1=9d07df024ec457168bf0be7e0009619f6ac4f13c + SHA1=9a35ae9a1f95ce4be64adc604c80079173e4a676 + SHA1=c6bd965300f07012d1b651a9b8776028c45b149a + SHA1=e83458c4a6383223759cd8024e60c17be4e7c85f + SHA1=cb3de54667548a5c9abf5d8fa47db4097fcee9f1 + SHA1=9c24dd75e4074041dbe03bf21f050c77d748b8e9 + SHA1=dc55217b6043d819eadebd423ff07704ee103231 + SHA1=e92817a8744ebc4e4fa5383cdce2b2977f01ecd4 + SHA1=dc0e97adb756c0f30b41840a59b85218cbdd198f + SHA1=26c4a7b392d7e7bd7f0a2a758534e45c0d9a56ab + SHA1=d0d39e1061f30946141b6ecfa0957f8cc3ddeb63 + SHA1=c6d349823bbb1f5b44bae91357895dba653c5861 + SHA1=f42f28d164205d9f6dab9317c9fecad54c38d5d2 + SHA1=bbc0b9fd67c8f4cefa3d76fcb29ff3cef996b825 + SHA1=8183a341ba6c3ce1948bf9be49ab5320e0ee324d + SHA1=eb1ecad3d37bb980f908bf1a912415cff32e79e6 + SHA1=eb0d45aa6f537f5b2f90f3ad99013606eafcd162 + SHA1=6053d258096bccb07cb0057d700fe05233ab1fbb + SHA1=29a190727140f40cea9514a6420f5a195e36386b + SHA1=a4b2c56c12799855162ca3b004b4b2078c6ecf77 + SHA1=7667b72471689151e176baeba4e1cd9cd006a09a + SHA1=d7f7594ff084201c0d9fa2f4ef1626635b67bce5 + SHA1=99201c9555e5faf6e8d82da793b148311f8aa4b8 + SHA1=947db58d6f36a8df9fa2a1057f3a7f653ccbc42e + SHA1=6a3d3b9ab3d201cd6b0316a7f9c3fb4d34d0f403 + SHA1=d702d88b12233be9413446c445f22fda4a92a1d9 + SHA1=910cb12aa49e9f35ecc4907e8304adf0dcca8cf1 + SHA1=643383938d5e0d4fd30d302af3e9293a4798e392 + SHA1=c4ed28fdfba7b8a8dfe39e591006f25d39990f07 + + + SHA1=b0032b8d8e6f4bd19a31619ce38d8e010f29a816 + SHA1=db6245578ec57bd767b27ecf8085095e1c8e5a6e + SHA1=166759fd511613414d3213942fe2575b926a6226 + SHA1=02a8b74899591da7b7f49c0450328d39b939d7e4 + SHA1=98ceed786f79288becc08c3b82c57e8d4bfa1bca + SHA1=f6b3577ea4b1a5641ae3421151a26268434c3db8 + SHA1=4de33d03fee52f396a1c788000ca868d56ac30de + SHA1=c6920171fa6dff2c17eb83befb5fd28e8dddf5f0 + SHA1=fbc6d2448739ddec35bb5d6c94b46df4148f648d + SHA1=6b54f8f137778c1391285fee6150dfa58a8120b1 + SHA1=943593e880b4d340f2548548e6e673ef6f61eed3 + SHA1=5ac4d0e2381fc4a8aebe94a0fb6fe5e7558e4dcd + SHA1=e44297a2b750ec1958bef265e2f1ae6fa4323b28 + SHA1=aa2ea973bb248b18973e57339307cfb8d309f687 + SHA1=3a5d176c50f97b71d139767ed795d178623f491d + SHA1=25d812a5ece19ea375178ef9d60415841087726e + SHA1=3795e32592ab6d8074b6f7ad33759c6a39b0df07 + SHA1=fc121ed6fb37e97a004b6faf217435b772dfc4c0 + SHA1=ab2b8602e4baef828b58b995d0889a8e5b8dbd02 + SHA1=cf040040628b58f4a811f98c2690913c1e8e4e3c + SHA1=3296844d22c87dd5eba3aa378a8242b41d59db7a + SHA1=bc47e15537fa7c32dfefd23168d7e1741f8477ed + SHA1=cb22723faa5ae2809476e5c5e9b9a597b26cab9b + SHA1=f3c5e723ae009b336cd2719137b8cd194c9ee51d + SHA1=41f2d0f9863bce8920c207b1ef5d3d32b603edef + SHA1=eb93d2f564fea9b3dc350f386b45de2cd9a3e001 + SHA1=3cd037fbba8aae82c1b111c9f8755349c98bcb3c + SHA1=9401389fba314d1810f83edce33c37e84a78e112 + SHA1=7eb34cc1fcffb4fdb5cb7e97184dd64a65cb9371 + SHA1=16d7ecf09fc98798a6170e4cef2745e0bee3f5c7 + SHA1=fcd615df88645d1f57ff5702bd6758b77efea6d0 + SHA1=f3db629cfe37a73144d5258e64d9dd8b38084cf4 + SHA1=a00e444120449e35641d58e62ed64bb9c9f518d2 + SHA1=38571f14fc014487194d1eecfa80561ee8644e09 + SHA1=4d41248078181c7f61e6e4906aa96bbdea320dc2 + SHA1=3599ea2ac1fa78f423423a4cf90106ea0938dde8 + SHA1=3d6d53b0f1cc908b898610227b9f1b9352137aba + SHA1=4c18754dca481f107f0923fb8ef5e149d128525d + SHA1=8c377ab4eebc5f4d8dd7bb3f90c0187dfdd3349f + SHA1=cde32654a041fedc7b0fa1083f6005b950760062 + SHA1=5fb9421be8a8b08ec395d05e00fd45eb753b593a + SHA1=b480c54391a2a2f917a44f91a5e9e4590648b332 + SHA1=4f7a8e26a97980544be634b26899afbefb0a833c + + SHA256=05F052C64D192CF69A462A5EC16DDA0D43CA5D0245900C9FCB9201685A2E7748 + SHA256=4045AE77859B1DBF13972451972EAAF6F3C97BEA423E9E78F1C2F14330CD47CA + SHA256=6948480954137987A0BE626C24CF594390960242CD75F094CD6AAA5C2E7A54FA + SHA256=8CB62C5D41148DE416014F80BD1FD033FD4D2BD504CB05B90EEB6992A382D58F + SHA256=B1D96233235A62DBB21B8DBE2D1AE333199669F67664B107BFF1AD49B41D9414 + SHA256=7196187FB1EF8D108B380D37B2AF8EFDEB3CA1F6EEFD37B5DC114C609147216D + SHA256=7F375639A0DF7FE51E5518CF87C3F513C55BC117DB47D28DA8C615642EB18BFA + SHA256=42579A759F3F95F20A2C51D5AC2047A2662A2675B3FB9F46C1ED7F23393A0F00 + SHA256=2DA330A2088409EFC351118445A824F11EDBE51CF3D653B298053785097FE40E + SHA256=436CCAB6F62FA2D29827916E054ADE7ACAE485B3DE1D3E5C6C62D3DEBF1480E7 + SHA256=B4D47EA790920A4531E3DF5A4B4B0721B7FEA6B49A35679F0652F1E590422602 + SHA256=DDE6F28B3F7F2ABBEE59D4864435108791631E9CB4CDFB1F178E5AA9859956D8 + SHA256=B48A309EE0960DA3CAAAAF1E794E8C409993AEB3A2B64809F36B97AAC8A1E62A + SHA256=025E7BE9FCEFD6A83F4471BBA0C11F1C11BD5047047D26626DA24EE9A419CDC4 + SHA256=2AA1B08F47FBB1E2BD2E4A492F5D616968E703E1359A921F62B38B8E4662F0C4 + SHA256=ECE0A900EA089E730741499614C0917432246CEB5E11599EE3A1BB679E24FD2C + SHA256=F40435488389B4FB3B945CA21A8325A51E1B5F80F045AB019748D0EC66056A8B + SHA256=2A652DE6B680D5AD92376AD323021850DAB2C653ABF06EDF26120F7714B8E08A + SHA256=950A4C0C772021CEE26011A92194F0E58D61588F77F2873AA0599DFF52A160C9 + SHA256=0AAFA9F47ACF69D46C9542985994FF5321F00842A28DF2396D4A3076776A83CB + SHA256=47F08F7D30D824A8F4BB8A98916401A37C0FD8502DB308ABA91FE3112B892DCC + SHA256=B9A4E40A5D80FEDD1037EAED958F9F9EFED41EB01ADA73D51B5DCD86E27E0CBF + SHA256=5C04C274A708C9A7D993E33BE3EA9E6119DC29527A767410DBAF93996F87369A + SHA256=0040153302B88BEE27EB4F1ECA6855039E1A057370F5E8C615724FA5215BADA3 + SHA256=3326E2D32BBABD69FEB6024809AFC56C7E39241EBE70A53728C77E80995422A5 + SHA256=36B9E31240AB0341873C7092B63E2E0F2CAB2962EBF9B25271C3A1216B7669EB + SHA256=29E0062A017A93B2F2F5207A608A96DF4D554C5DE976BD0276C2590A03BD3E94 + SHA256=45ABDBCD4C0916B7D9FAAF1CD08543A3A5178871074628E0126A6EDA890D26E0 + SHA256=50DB5480D0392A7DD6AB5DF98389DC24D1ED1E9C98C9C35964B19DABCD6DC67F + SHA256=607DC4C75AC7AEF82AE0616A453866B3B358C6CF5C8F9D29E4D37F844306B97C + SHA256=61D6E40601FA368800980801A662A5B3B36E3C23296E8AE1C85726A56EF18CC8 + SHA256=74A846C61ADC53692D3040AFF4C1916F32987AD72B07FE226E9E7DBEFF1036C4 + SHA256=76FB4DEAEE57EF30E56C382C92ABFFE2CF616D08DBECB3368C8EE6B02E59F303 + SHA256=81939E5C12BD627FF268E9887D6FB57E95E6049F28921F3437898757E7F21469 + SHA256=9790A7B9D624B2B18768BB655DDA4A05A9929633CEF0B1521E79E40D7DE0A05B + SHA256=9A1D66036B0868BBB1B2823209FEDEA61A301D5DD245F8E7D390BD31E52D663E + SHA256=AA9AB1195DC866270E984F1BED5E1358D6EF24C515DFDB6C2A92D1E1B94BF608 + SHA256=AF095DE15A16255CA1B2C27DAD365DFF9AC32D2A75E8E288F5A1307680781685 + SHA256=D5586DC1E61796A9AE5E5D1CED397874753056C3DF2EB963A8916287E1929A71 + SHA256=D8459F7D707C635E2C04D6D6D47B63F73BA3F6629702C7A6E0DF0462F6478AE2 + SHA256=E81230217988F3E7EC6F89A06D231EC66039BDBA340FD8EBB2BBB586506E3293 + SHA256=F88EBB633406A086D9CCA6BC8B66A4EA940C5476529F9033A9E0463512A23A57 + SHA256=1C8DFA14888BB58848B4792FB1D8A921976A9463BE8334CFF45CC96F1276049A + SHA256=22418016E980E0A4A2D01CA210A17059916A4208352C1018B0079CCB19AAF86A + SHA256=405472A8F9400A54BB29D03B436CCD58CFD6442FE686F6D2ED4F63F002854659 + SHA256=49F75746EEBE14E5DB11706B3E58ACCC62D4034D2F1C05C681ECEF5D1AD933BA + SHA256=4A3D4DB86F580B1680D6454BAEE1C1A139E2DDE7D55E972BA7C92EC3F555DCE2 + SHA256=4AB41816ABBF14D59E75B7FAD49E2CB1C1FEB27A3CB27402297A2A4793FF9DA7 + SHA256=54841D9F89E195196E65AA881834804FE3678F1CF6B328CAB8703EDD15E3EC57 + SHA256=5EE292B605CD3751A24E5949AAE615D472A3C72688632C3040DC311055B75A92 + SHA256=76B86543CE05540048F954FED37BDDA66360C4A3DDB8328213D5AEF7A960C184 + SHA256=7F190F6E5AB0EDAFD63391506C2360230AF4C2D56C45FC8996A168A1FC12D457 + SHA256=845F1E228DE249FC1DDF8DC28C39D03E8AD328A6277B6502D3932E83B879A65A + SHA256=84BF1D0BCDF175CFE8AEA2973E0373015793D43907410AE97E2071B2C4B8E2D4 + SHA256=8EF0AD86500094E8FA3D9E7D53163AA6FEEF67C09575C169873C494ED66F057F + SHA256=A56C2A2425EB3A4260CC7FC5C8D7BED7A3B4CD2AF256185F24471C668853AEE8 + SHA256=AC3F613D457FC4D44FA27B2E0B1BAA62C09415705EFB5A40A4756DA39B3AC165 + SHA256=B1334A71CC73B3D0C54F62D8011BEC330DFC355A239BF94A121F6E4C86A30A2E + SHA256=B47BE212352D407D0EF7458A7161C66B47C2AEC8391DD101DF11E65728337A6A + SHA256=B9B3878DDC5DFB237D38F8D25067267870AFD67D12A330397A8853209C4D889C + SHA256=DB90E554AD249C2BD888282ECF7D8DA4D1538DD364129A3327B54F8242DD5653 + SHA256=E61A54F6D3869B43C4ECEAC3016DF73DF67CCE03878C5A6167166601C5D3F028 + SHA256=3871E16758A1778907667F78589359734F7F62F9DC953EC558946DCDBE6951E3 + SHA256=DED2927F9A4E64EEFD09D0CABA78E94F309E3A6292841AE81D5528CAB109F95D + SHA256=0296E2CE999E67C76352613A718E11516FE1B0EFC3FFDB8918FC999DD76A73A5 + SHA256=80CBBA9F404DF3E642F22C476664D63D7C229D45D34F5CD0E19C65EB41BECEC3 + SHA256=BB50818A07B0EB1BD317467139B7EB4BAD6CD89053FECDABFEAE111689825955 + SHA256=FF6729518A380BF57F1BC6F1EC0AA7F3012E1618B8D9B0F31A61D299EE2B4339 + SHA256=3A5EC83FE670E5E23AEF3AFA0A7241053F5B6BE5E6CA01766D6B5F9177183C25 + SHA256=61A1BDDDD3C512E681818DEBB5BEE94DB701768FC25E674FCAD46592A3259BD0 + SHA256=07B6D69BAFCFD767F1B63A490A8843C3BB1F8E1BBEA56176109B5743C8F7D357 + SHA256=21CCDD306B5183C00ECFD0475B3152E7D94B921E858E59B68A03E925D1715F21 + SHA256=2D83CCB1AD9839C9F5B3F10B1F856177DF1594C66CBBC7661677D4B462EBF44D + SHA256=F581DECC2888EF27EE1EA85EA23BBB5FB2FE6A554266FF5A1476ACD1D29D53AF + SHA256=F8965FDCE668692C3785AFA3559159F9A18287BC0D53ABB21902895A8ECF221B + SHA256=3D23BDBAF9905259D858DF5BF991EB23D2DC9F4ECDA7F9F77839691ACEF1B8C4 + SHA256=DD4A1253D47DE14EF83F1BC8B40816A86CCF90D1E624C5ADF9203AE9D51D4097 + SHA256=509628B6D16D2428031311D7BD2ADD8D5F5160E9ECC0CD909F1E82BBBB3234D6 + SHA256=525D9B51A80CA0CD4C5889A96F857E73F3A80DA1FFBAE59851E0F51BDFB0B6CD + SHA256=6DE84CAA2CA18673E01B91AF58220C60AECD5CCCF269725EC3C7F226B2167492 + SHA256=09BEDBF7A41E0F8DABE4F41D331DB58373CE15B2E9204540873A1884F38BDDE1 + SHA256=101402D4F5D1AE413DED499C78A5FCBBC7E3BAE9B000D64C1DD64E3C48C37558 + SHA256=131D5490CEB9A5B2324D8E927FEA5BECFC633015661DE2F4C2F2375A3A3B64C6 + SHA256=1DDFE4756F5DB9FB319D6C6DA9C41C588A729D9E7817190B027B38E9C076D219 + SHA256=1E8B0C1966E566A523D652E00F7727D8B0663F1DFDCE3B9A09B9ADFAEF48D8EE + SHA256=2BBE65CBEC3BB069E92233924F7EE1F95FFA16173FCEB932C34F68D862781250 + SHA256=30706F110725199E338E9CC1C940D9A644D19A14F0EB8847712CBA4CACDA67AB + SHA256=3124B0411B8077605DB2A9B7909D8240E0D554496600E2706E531C93C931E1B5 + SHA256=38FA0C663C8689048726666F1C5E019FEAA9DA8278F1DF6FF62DA33961891D2A + SHA256=39CFDE7D401EFCE4F550E0A9461F5FC4D71FA07235E1336E4F0B4882BD76550E + SHA256=3D9E83B189FCF5C3541C62D1F54A0DA0A4E5B62C3243D2989AFC46644056C8E3 + SHA256=3F2FDA9A7A9C57B7138687BBCE49A2E156D6095DDDABB3454EA09737E02C3FA5 + SHA256=47F0CDAA2359A63AD1389EF4A635F1F6EEE1F63BDF6EF177F114BDCDADC2E005 + SHA256=50D5EAA168C077CE5B7F15B3F2C43BD2B86B07B1E926C1B332F8CB13BD2E0793 + SHA256=56A3C9AC137D862A85B4004F043D46542A1B61C6ACB438098A9640469E2D80E7 + SHA256=591BD5E92DFA0117B3DAA29750E73E2DB25BAA717C31217539D30FFB1F7F3A52 + SHA256=5D530E111400785D183057113D70623E17AF32931668AB7C7FC826F0FD4F91A3 + SHA256=6F1FF29E2E710F6D064DC74E8E011331D807C32CC2A622CBE507FD4B4D43F8F4 + SHA256=79E2D37632C417138970B4FEBA91B7E10C2EA251C5EFE3D1FC6FA0190F176B57 + SHA256=85866E8C25D82C1EC91D7A8076C7D073CCCF421CF57D9C83D80D63943A4EDD94 + SHA256=89B0017BC30CC026E32B758C66A1AF88BD54C6A78E11EC2908FF854E00AC46BE + SHA256=9254F012009D55F555418FF85F7D93B184AB7CB0E37AECDFDAB62CFE94DEA96B + SHA256=984A77E5424C6D099051441005F2938AE92B31B5AD8F6521C6B001932862ADD7 + SHA256=98B734DDA78C16EBCAA4AFEB31007926542B63B2F163B2F733FA0D00DBB344D8 + SHA256=99F4994A0E5BD1BF6E3F637D3225C69FF4CD620557E23637533E7F18D7D6CBA1 + SHA256=9C10E2EC4F9EF591415F9A784B93DC9C9CDAFA7C69602C0DC860C5B62222E449 + SHA256=A961F5939088238D76757669A9A81905E33F247C9C635B908DAAC146AE063499 + SHA256=A9706E320179993DADE519A83061477ACE195DAA1B788662825484813001F526 + SHA256=B7A20B5F15E1871B392782C46EBCC897929443D82073EE4DCB3874B6A5976B5D + SHA256=CC586254E9E89E88334ADEE44E332166119307E79C2F18F6C2AB90CE8BA7FC9B + SHA256=CD4A249C3EF65AF285D0F8F30A8A96E83688486AAB515836318A2559757A89BB + SHA256=CF4B5FA853CE809F1924DF3A3AE3C4E191878C4EA5248D8785DC7E51807A512B + SHA256=D0BD1AE72AEB5F3EABF1531A635F990E5EAAE7FDD560342F915F723766C80889 + SHA256=D8B58F6A89A7618558E37AFC360CD772B6731E3BA367F8D58734ECEE2244A530 + SHA256=D92EAB70BCECE4432258C9C9A914483A2267F6AB5CE2630048D3A99E8CB1B482 + SHA256=E005E8D183E853A27AD3BB56F25489F369C11B0D47E3D4095AAD9291B3343BF1 + SHA256=E68D453D333854787F8470C8BAEF3E0D082F26DF5AA19C0493898BCF3401E39A + SHA256=E83908EBA2501A00EF9E74E7D1C8B4FF1279F1CD6051707FD51824F87E4378FA + SHA256=EF86C4E5EE1DBC4F81CD864E8CD2F4A2A85EE4475B9A9AB698A4AE1CC71FBEB0 + SHA256=F088B2BA27DACD5C28F8EE428F1350DCA4BC7C6606309C287C801B2E1DA1A53D + SHA256=FD8669794C67B396C12FC5F08E9C004FDF851A82FAF302846878173E4FBECB03 + SHA256=91314768DA140999E682D2A290D48B78BB25A35525EA12C1B1F9634D14602B2C + SHA256=F0605DDA1DEF240DC7E14EFA73927D6C6D89988C01EA8647B671667B2B167008 + SHA256=6CB51AE871FBD5D07C5AAD6FF8EEA43D34063089528603CA9CEB8B4F52F68DDC + SHA256=DB2A9247177E8CDD50FE9433D066B86FFD2A84301AA6B2EB60F361CFFF077004 + SHA256=7EC93F34EB323823EB199FBF8D06219086D517D0E8F4B9E348D7AFD41EC9FD5D + SHA256=7049F3C939EFE76A5556C2A2C04386DB51DAF61D56B679F4868BB0983C996EBB + SHA256=7877C1B0E7429453B750218CA491C2825DAE684AD9616642EFF7B41715C70ACA + SHA256=159E7C5A12157AF92E0D14A0D3EA116F91C09E21A9831486E6DC592C93C10980 + SHA256=3243AAB18E273A9B9C4280A57AECEF278E10BFFF19ABB260D7A7820E41739099 + SHA256=7CFA5E10DFF8A99A5D544B011F676BC383991274C693E21E3AF40CF6982ADB8C + SHA256=C9B49B52B493B53CD49C12C3FA9553E57C5394555B64E32D1208F5B96A5B8C6E + SHA256=3EC5AD51E6879464DFBCCB9F4ED76C6325056A42548D5994BA869DA9C4C039A8 + SHA256=47EAEBC920CCF99E09FC9924FEB6B19B8A28589F52783327067C9B09754B5E84 + + SHA256=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b + SHA256=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790 + SHA256=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22 + SHA256=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44 + SHA256=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8 + SHA256=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009 + SHA256=39937d239220c1b779d7d55613de2c0a48bd6e12e0214da4c65992b96cf591df + SHA256=7ed26a593524a2a92ffcfb075a42bb4fa4775ffbf83af98525244a4710886ead + SHA256=aa717e9ab4d614497df19f602d289a6eddcdba8027c71bcc807780a219347d16 + SHA256=ff5f6048a3d6f6738b60e911e3876fcbdc9a02ec9862f909345c8a50fd4cc0a7 + SHA256=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 + SHA256=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495 + SHA256=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd + SHA256=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c + SHA256=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427 + + SHA256=952199C28332BC90CFD74530A77EE237967ED32B3C71322559C59F7A42187DC4 + SHA256=9529EFB1837B1005E5E8F477773752078E0A46500C748BC30C9B5084D04082E6 + SHA256=A7B000ABBCC344444A9B00CFADE7AA22AB92CE0CADEC196C30EB1851AE4FA062 + SHA256=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b + SHA256=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece + SHA256=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374 + SHA256=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50 + SHA256=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6 + SHA256=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e + + SHA256=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc + SHA256=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d + SHA256=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65 + SHA256=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347 + SHA256=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9 + SHA256=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219 + SHA256=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8 + SHA256=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813 + SHA256=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a + SHA256=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f + SHA256=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc + SHA256=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de + SHA256=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073 + SHA256=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890 + SHA256=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0 + SHA256=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200 + SHA256=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf + SHA256=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2 + SHA256=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173 + SHA256=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6 + SHA256=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8 + SHA256=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508 + SHA256=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3 + SHA256=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52 + SHA256=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129 + SHA256=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993 + SHA256=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d + SHA256=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd + SHA256=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35 + SHA256=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33 + SHA256=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29 + + + SHA256=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838 + SHA256=3c5bf92c26398695f9ced7ce647a7e9f6ddcc89eea66b45aa3607196a187431b + SHA256=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82 + SHA256=4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7 + SHA256=b205835b818d8a50903cf76936fcf8160060762725bd74a523320cfbd091c038 + SHA256=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89 + SHA256=73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e + SHA256=87e38e7aeaaaa96efe1a74f59fca8371de93544b7af22862eb0e574cec49c7c3 + SHA256=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6 + SHA256=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89 + SHA256=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf + SHA256=1dadd707c55413a16320dc70d2ca7784b94c6658331a753b3424ae696c5d93ea + SHA256=d84e3e250a86227c64a96f6d5ac2b447674ba93d399160850acb2339da43eae5 + SHA256=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a + SHA256=0f726d8ce21c0c9e01ebe6b55913c519ad6086bcaec1a89f8308f3effacd435f + SHA256=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3 + SHA256=0e14a4401011a9f4e444028ac5b1595da34bbbf9af04a00670f15ff839734003 + SHA256=26c86227d3f387897c1efd77dc711eef748eb90be84149cb306e3d4c45cc71c7 + SHA256=42d926cfb3794f9b1e3cb397498696cb687f505e15feb9df11b419c49c9af498 + SHA256=1684e24dae20ab83ab5462aa1ff6473110ec53f52a32cfb8c1fe95a2642c6d22 + SHA256=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4 + SHA256=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c + SHA256=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53 + SHA256=3a364a7a3f6c0f2f925a060e84fb18b16c118125165b5ea6c94363221dc1b6de + SHA256=fda506e2aa85dc41a4cbc23d3ecc71ab34e06f1def736e58862dc449acbc2330 + SHA256=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46 + SHA256=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347 + SHA256=8596ea3952d84eeef8f5dc5b0b83014feb101ec295b2d80910f21508a95aa026 + SHA256=52a90fd1546c068b92add52c29fbb8a87d472a57e609146bbcb34862f9dcec15 + SHA256=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91 + SHA256=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf + SHA256=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c + SHA256=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64 + SHA256=3ed15a390d8dfbd8a8fb99e8367e19bfd1cced0e629dfe43ccdb46c863394b59 + SHA256=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6 + SHA256=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b + SHA256=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9 + SHA256=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351 + SHA256=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5 + SHA256=ff803017d1acafde6149fe7d463aee23b1c4f6f3b97c698c05f3ca6f07e4df6c + SHA256=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b + SHA256=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05 + SHA256=a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433 + From 81679a2c928979423fd709d89616460e286a4079 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 7 Oct 2022 15:54:15 -0400 Subject: [PATCH 436/471] Add Risk Rating to vuln driver loads --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 11cb3215..6506266b 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -3108,7 +3108,7 @@ Unavailable Valid false - + SHA1=2261198385d62d2117f50f631652eded0ecc71db SHA1=8db869c0674221a2d3280143cbb0807fac08e0cc From a99afce0868b51bd5d06bd69a38eab55456a20f2 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Fri, 21 Oct 2022 18:01:04 -0400 Subject: [PATCH 437/471] Removing Blocking from Config due to reports of interference of windows updates. No logs were provided yet to troubleshoot, so splitting out the blocking config. Use blocking config at your own risk --- sysmonconfig-export.xml | 429 -- sysmonconfig-export_blocking.xml | 7049 ++++++++++++++++++++++++++++++ 2 files changed, 7049 insertions(+), 429 deletions(-) create mode 100644 sysmonconfig-export_blocking.xml diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 6506266b..30796a47 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -7045,434 +7045,5 @@ NETWORK SERVICE; LOCAL SERVICE - - - - - OUTLOOK.exe;WINWORD.exe;EXCEL.EXE;powerpnt.exe;msaccess.exe;mspub.exe;eqnedt32.exe;visio.exe;wordpad.exe;wordview.exe;msohtmed.exe;lync.exe;teams.exe - :\Program Files\Microsoft Office\;:\Program Files (x86)\Microsoft Office\ - - - w3wp.exe;tomcat;apache;nginx;httpd - whitelist_me_here - - - - powershell.exe;powershell_ise.exe - \Temp\;\AppData\;C:\Users\Public - whitelist_me_here - - - .exe - .7z.exe - .doc.exe - .doc.exe - .docx.exe - .ico.exe - .iso.exe - .lnk.exe - .pdf.exe - .ppt.exe - .pptx.exe - .rar.exe - .rtf.exe - .txt.exe - .xls.exe - .xlsx.exe - .zip.exe - ______.exe - - - psexesvc - psexec - - - wmiprvse.exe - - - C:\Users\Public\ - amdsfhdcd.bin - intuit - - - AcroRd32.exe;notepad.exe;mshta.exe;hh.exe;certutil.exe;certoc.exe;certreq.exe;desktopimgdownldr.exe;esentutl.exe;finger.exe;presentationhost.exe;cscript.exe;wscript.exe;mspaint.exe;RdrCEF.exe - - - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 - IMPHASH=3A19059BD7688CB88E70005F18EFC439 - IMPHASH=bf6223a49e45d99094406777eb6004ba - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF - IMPHASH=4C1B52A19748428E51B14C278D0F58E3 - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A - IMPHASH=672B13F4A0B6F27D29065123FE882DFC - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 - IMPHASH=D21BBC50DCC169D7B4D0F01962793154 - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC - IMPHASH=6118619783FC175BC7EBECFF0769B46E - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA - IMPHASH=563233BFA169ACC7892451F71AD5850A - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 - IMPHASH=13F08707F759AF6003837A150A371BA1 - IMPHASH=1781F06048A7E58B323F0B9259BE798B - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 - IMPHASH=713C29B396B907ED71A72482759ED757 - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E - IMPHASH=8B114550386E31895DFAB371E741123D - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 - IMPHASH=9D68781980370E00E0BD939EE5E6C141 - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE - IMPHASH=CB567F9498452721D77A451374955F5F - IMPHASH=730073214094CD328547BF1F72289752 - IMPHASH=17B461A082950FC6332228572138B80C - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 - IMPHASH=819B19D53CA6736448F9325A85736792 - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 - IMPHASH=0588081AB0E63BA785938467E1B10CCA - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 - IMPHASH=4DA924CF622D039D58BCE71CDF05D242 - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E - IMPHASH=E6F9D5152DA699934B30DAAB206471F6 - IMPHASH=3AD59991CCF1D67339B319B15A41B35D - IMPHASH=FFDD59E0318B85A3E480874D9796D872 - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 - IMPHASH=0E2216679CA6E1094D63322E3412D650 - IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB - IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 - IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 - IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 - IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F - IMPHASH=767637C23BB42CD5D7397CF58B0BE688 - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC - IMPHASH=7D010C6BB6A3726F327F7E239166D127 - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F - IMPHASH=5834ED4291BDEB928270428EBBAF7604 - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 - IMPHASH=3DE09703C8E79ED2CA3F01074719906B - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F - IMPHASH=E96A73C7BF33A464C510EDE582318BF2 - IMPHASH=32089B8851BBF8BC2D014E9F37288C83 - IMPHASH=09D278F9DE118EF09163C6140255C690 - IMPHASH=03866661686829D806989E2FC5A72606 - IMPHASH=E57401FBDADCD4571FF385AB82BD5D6D - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE - IMPHASH=19584675D94829987952432E018D5056 - IMPHASH=330768A4F172E10ACB6287B87289D83B - SHA256=074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 - SHA256=45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 - SHA256=9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 - SHA256=29b75f0db3006440651c6342dc3c0672210cfb339141c75e12f6c84d990931c3 - SHA256=c8c907a67955bcdf07dd11d35f2a23498fb5ffe5c6b5d7f36870cf07da47bff2 - SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e - - - \DrSDKCaller.exe;C:\Users\Public\all.exe;C:\Users\Public\dump.dll;C:\Users\Public\ad.exe;C:\PerfLogs\gpg-error.exe;C:\PerfLogs\cm.exe;C:\Program Files\Common Files\system\ado\msado32.tlb - - - \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll - - - certutil.exe - certoc.exe - CertReq.exe - - Desktopimgdownldr.exe - esentutl.exe - - finger.exe - presentationhost.exe - - - bitsadmin.exe - C:\Windows;$WINDOWS.;\SoftwareDistribution\ - System - TrustedInstaller;NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC - - - \EntenLoader.exe;\SysmonQuiet.exe;\SharpEvtMute.exe;\EvtMuteHook.dll - - - C:\PerfLogs\ - - - - - - - C:\WINDOWS\system32\wuauclt.exe;C:\$WINDOWS.~BT\Sources\SetupHost.Exe - - - C:\Windows\SoftwareDistribution\;C:\$WINDOWS.~BT\NewOS\ - - - - - - - - - - - C:\Users - C:\Program Files\WindowsApps\;AppData - - - - C:\$mft - - - C:\Windows\System32\winevt\Logs - - - ntuser.dat - - - Pagefile.sys - - - C:\Windows\System32\config - C:\WINDOWS\system32\consent.exe - - - .db - - - .asc - .ca-bundle - .cer - .cer - .crl - .crt - .csr - .der - .gpg - .key - .p7b - .p7r - .p7s - .p12 - .pem - .pfx - .pgp - .ppk - .sst - .sto - - - .log - C:\Windows\System32\sru\ - - - ConsoleHost_history.txt - - - .evtx - - - $Recycle - - - .exe - - - .dll - - - \Content.Outlook\ - \Microsoft\Office\Recent - \Microsoft\Templates\ - \Recent\CustomDestinations\ - oleObject - .accdb - .accde - .accdr - .accdt - .doc - .docb - .docm - .docx - .dot - .dotx - .eml - .mdb - .mde - .msc - .msg - .mst - .ped - .potm - .potx - .ppam - .ppsm - .ppsx - .ppt - .pptm - .pptx - .pub - .sldm - .sldx - .wbk - .xla - .xlam - .xll - .xls - .xlsb - .xlsm - .xlsx - .xlt - .xltm - .xlw - .xps - - - .pdf - - - .zip - .rar - .tar - .tgz - .ace - .7z - - - .cdxml - .ps1 - .ps1xml - .psc1 - .psd1 - .psm1 - .pssc - .bat - .com - .hta - .vbs - - - .D01 - .D02 - .DD - .DISK - .E01 - .EX01 - .HC - .HDD - .HDS - .IMAGE - .IMD - .IMG - .ISO - .L01 - .LZ01 - .PARTIMG - .PGD - .SPARSEIMAGE - .TIB - .VBK - .VBM - .VIB - .WIM - .WIM - .WMT - .XVA - .avhd - .dsk - .dvd - .mdf - .vdi - .vhd - .vhdx - .vmdk - .vmwarevm - - - - - - - C:\WINDOWS\ - C:\Program Files\WindowsApps\ - C:\PROGRA~2\Citrix\ICACLI~1\WFICA32.EXE - C:\Program Files;\Microsoft\EdgeWebView\Application\;\msedgewebview2.exe - C:\Program Files;\Citrix\;\WFICA32.EXE - C:\Program Files\Google\Drive File Stream\;\GoogleDriveFS.exe - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\;msedgewebview2.exe - - - C:\Safe-shred-location - C:\$WINDOWS.~BT\NewOS\ - :\Users\;\AppData\;\D3DSCache - .lock - - - C:\Program Files (x86)\Kaspersky Lab - C:\Program Files\Kaspersky Lab - C:\Program Files (x86)\ESET - C:\Program Files\ESET - C:\ProgramData\Microsoft\Windows Defender\ - - - - - - \ No newline at end of file diff --git a/sysmonconfig-export_blocking.xml b/sysmonconfig-export_blocking.xml new file mode 100644 index 00000000..30796a47 --- /dev/null +++ b/sysmonconfig-export_blocking.xml @@ -0,0 +1,7049 @@ + + + md5,sha1,sha256,imphash + + + + + + + + + TEMP\nessus_;nessus_task_list + TEMP\nessus_;nessus_task_list + + + rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe + advanced_port_scanner.exe;rcpping.exe;nc.exe;nc64.exe;netcat.exe;ncat.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe + Network Scanner;Advanced IP Scanner + + + adfind + adfind + -gcb -sc;/gcb /sc;-f (objectcategory=;/f (objectcategory=;trustdmp + + + + + + + + + + + + + + PurpleSharp;xyz123456 + PurpleSharp + + + + + /serverlevelplugindll + + + add;sslcert;http + + http del sslcert + + + + + + + C:\Users\ + Content.Outlook + + + .SettingContent-ms + immersivecontrolpanel + + + Hwp.exe + gbb.exe + + + + iexplore.exe;chrome.exe;firefox.exe;browser_broker.exe;vivaldi.exe;microsoftedge.exe;microsoftedgecp.exe;brave.exe;vivaldi.exe + tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe + apt-config + + + cmd.exe /c C:\Windows\Setup\Scripts\SetupComplete.cmd;cmd.exe /c C:\Windows\Setup\Scripts\PartnerSetupComplete.cmd + C:\Windows\Setup + C:\Windows\SysWOW64 + C:\Windows\System32 + C:\Windows\WinSxS + + + consent.exe + http + iexplore.exe + SYSTEM + + + + w3wp.exe + \csc.exe;\TranscodingService.exe;\werfault.exe;\appcmd.exe + + + + + w3wp.exe + appcmd.exe + appcmd.exe add module;system.enterpriseservices.internal.publish;\gacutil.exe /I;gacutil.exe -I + + + apache;php-cgi.exe;nginx.exe;httpd.exe;tomcat;php.exe + arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;certutil.exe + + + cmd.exe + ping 127.0.0.1 + c:\windows\system32\inetsrv\ + + + svchost.exe;termsvcs + rdpclip.exe;csrss.exe;wininit.exe + + + dns.exe + werfault.exe;conhost.exe;dnscmd.exe;dns.exe + + + UMWorkerProcess.exe;UMService.exe + perfenabled + + + UMWorkerProcess.exe;UMService.exe + perfenabled + wemgr.exe;werfault.exe + + + \wwwroot\ + + + \Atlassian\Confluence\jre\bin\java.exe + cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin + + + DesktopCentral_Server\jre\bin\java.exe + cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin + + + \jre\bin\java.exe + cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe + + \Atlassian\Confluence\jre\bin\java.exe + + + sqlservr + arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;sh.exe;bash.exe + + + keytool.exe + cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe + + + bash.exe;cmd.exe;powershell.exe;pwsh.exe + id -Gn `;id /Gn `;id -Gn ';id /Gn ' + + + + e=Access&;y=Guest&;&p=;&c=;&k= + + + + + + + + + + + wmic.exe + process;call;create + + + wmic.exe + call set priority;call terminate;product get name;bios, get serialNumber;BIOS GET SERIALNUMBER;onboarddevice get;useraccount where name;useraccount get;path win32_networkadapter where index=;process list;useraccount get /ALL;useraccount list;qfe get description,installedOn /format:csv;process get caption,executablepath,commandline;service get name,displayname,pathname,startmode;share list;win32_share + + + + C:\Users\;$Recycle;\Temp\;\Downloads\ + \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 + conhost.exe + + + svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe + conhost.exe + + + conhost.exe + :\Windows\splwow64.exe;:\Windows\System32\WerFault.exe;:\Windows\System32\conhost.exe + + + \cmd.exe;WindowsTerminal;powershell + explorer.exe + + + cmd.exe + powershell.exe;powershell_ise.exe + Get-ItemProperty HKLM:\software\wow6432node\microsoft\windows\currentversion\uninstall\ + mysql server + select-object displayversion,displayname + + + cscript.exe;wscript.exe + powershell.exe;powershell_ise.exe + + + cscript.exe;wscript.exe + powershell.exe;powershell_ise.exe + + + powershell.exe;powershell_ise.exe + mshta.exe + + + wscript.exe;cscript.exe + IEX;Net.WebClient;ospp.vbs;powershell;slmgr.vbs;spiceworks_upload + + + wscript.exe + .jse + .js + .vba + .vbe + + + \wscript.exe;\cscript.exe + \rundll32.exe;regsvr32.exe + + + \rundll32.exe;regsvr32.exe + .dll;.cpl;.ocx;localserver;enable-speech-input;auto-scan-plugin;enable-media-stream;CastMediaRouteProvider;-eoim;/eoim + setupapi;InstallHinfSection;DefaultInstall;SplunkUniversalForwarder\bin\spl;rundll32.exe "C:\Windows\Installer\MSI + \MSI;.tmp",zzzInvokeManagerCustomActionOutOfProc + + + cscript.exe + .js + .jse + .vba + .vbe + + + mshta vbscript:CreateObject("Wscript.Shell");mshta vbscript:Execute("Execute;mshta vbscript:CreateObject("Wscript.Shell").Run("mshta.exe;javascript:a= + .jpg;.png;.lnk;.xls;.doc;.zip;.sct;.hta + + + C:\Windows\Temp\hpqhvind.exe;C:\ProgramData\DRM\;Test.exe + C:\ProgramData\DRM;wmplayer.exe;C:\ProgramData\DRM\CLR\CLR.EXE + + + regedit.exe + explorer.exe + + + \svchost.exe;\taskhostw.exe;\userinit.exe;\smss.exe;\csrss.exe;\wininit.exe;\winlogon.exe;\lsass.exe;\logonui.exe;\services.exe + C:\windows\System32\;C:\windows\syswow64\ + \wininit.exe;\winlogon.exe;\services.exe;\dwm.exe;System;\smss.exe;\svchost.exe + + + \spoolsv.exe;\PrintIsolationHost.exe + C:\Windows\System32\spoolsv.exe;\GPLGS\gswin32c.exe;C:\Windows\System32\spool\drivers\;\bin\gswin64c.exe;C:\PROGRA~2\CUTEPD~1\;C:\Windows\EEFPrinter.exe + C:\Windows\system32\spool\DRIVERS + Brother Industries;Thomson Reuters + + COMSPEC + ScriptFile + \Temp\7z + \Temp\Temp1_ + \Temp\Rar$ + + + powershell.exe;powershell_ise.exe + C:\users\ + Microsoft VS Code\Code.exe + \Deployment tool extract\setupodt.exe + + Shellcode + + ipy.exe + python.exe + + -agentpath: + -agentlib: + + + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe + tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe;msidb.exe + .cmd;- + C:\Windows\system32\spool\DRIVERS\ + PhotoViewer.dll + + + outlook.exe + http:;https:;ftp:;mailto:;tel: + .html + + + outlook.exe + http:;https:;ftp:;mailto:;tel: + .html" + + + outlook.exe + http:;https:;ftp:;mailto:;tel: + .html" + + + outlook.exe + .pdf" + + + outlook.exe + .pdf + + + outlook.exe + .iso" + + + outlook.exe + .iso + + + outlook.exe + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe;BrowserAssist.exe;\msedgewebview;\msedge.exe + http:;https:;ftp:;mailto:;tel: + + + outlook.exe + http:;https:;ftp:;mailto:;tel: + \Content.Outlook\;\Downloads\;\Documents\;:\Users\Public\;\Desktop\ + + + outlook.exe + \\ + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe + C:\Users\ + .exe + Zoom Video + Firefox + Microsoft Edge + Microsoft Teams + GrammarlyAddInSetupe + Teams.exe + Zoom.exe + browser_broker.exe + chrome.exe + edge.exe + firefox.exe + iexplore.exe + vivaldi.exe + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe + C:\ProgramData\ + Firefox + Microsoft Edge + Microsoft Teams + Zoom Video + + + .zip\ + + + acrobat.exe;acrord32.exe + tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe + + + winword.exe;powerpnt.exe;excel.exe + control.exe + input.dll + + + msdt.exe + msdt.exe + BrowseForFile=;PCWDiagnostic + /af;-af + + + msdt.exe + pcwrun.exe + PCWDiagnostic + + + msdt.exe + /cab;-cab + .diagcab + + + powershell.exe;pwsh.exe;cmd.exe;mshta.exe;cscript.exe;wscript.exe;wsl.exe;rundll32.exe;regsvr32.exe + msdt.exe + + EQNEDT32.EXE + + winword.exe;excel.exe;powerpnt.exe + FLTLDR.EXE + + + /dde;-dde + + + + schtasks.exe + /create;-create;/change;-change + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ + + taskeng.exe + + schtasks.exe + /Run;-run + Sentinel\AutoRepair + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ + + + schtasks.exe + schtasks /TN RtkAudUService64_BG + -change;/change;-delete;/delete;-create;/create + + at.exe + at.exe + + C:\Windows\System32\svchost.exe + netsvcs;-p;-s;Schedule + netsvcs;-p;-s;Schedule + + + + + + net.exe;net1.exe;net2.exe + stop + tvsu_tmp + + + net.exe;net1.exe;net2.exe + start + tvsu_tmp + + + wmiprvse.exe;mmc.exe;explorer.exe;services.exe + &1;cmd.exe;\\127.0.0.1\;/Q /c + + + wmiprvse.exe;mmc.exe;explorer.exe;services.exe + &1;cmd.exe;\\127.0.0.1\;-Q -c + + + schtasks;Create;ONLOGON;TN;Updater;TR;powershell + + + sc.exe + create + \NIC_Emulex_Firmware\;C:\Windows\Temp\ExchangeSetup\ + + + sc.exe + config;binpath + + + cmd.exe;powershell.exe + services.exe + + new-service + psexesvc.exe + + Execute processes remotely + psexe + PsExec Service + PsExec Launched + + + accepteula + + + Execute processes remotely + -s;/s + + psexec.exe + pskill.exe + pskill + + C:\WINDOWS\system32\svchost.exe -k NetworkService -p + + + C:\WINDOWS\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation + + + C:\WINDOWS\System32\svchost.exe -k netprofm -p -s netprofm + + + C:\WINDOWS\system32\svchost.exe;RPCSS + + + C:\WINDOWS\system32\svchost.exe;RPCSS + werfault.exe + + + + && type + > + cmd.exe" /c cd + + + ntdsutil;/set {default} recoveryenabled no;telnet ;-dumpcr;putty;bash.exe;pssh;shareenum;sekurlsa;reg save;reg save;psscan;shellexec;vbscript:createobject;/output:clipboard;root\\default;root\\subscription;Wmiclass;WmiCl'+'as'+'s;export-mft;ApplicationImpersonation + + + ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy + ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy + + --disable-http2 --disable-quic + /Client/Login?id= + JABzA + + 2f40abbb4f78e77745f0e657a19903fc953cc664;478dc5a5f934c62a9246f7d1fc275868f568bc07;37b4496e650b3994312c838435013560b3ca8571;37b4496e650b3994312c838435013560b3ca8571;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;807d86da63f0db1fc746d1f0b05bc357;849a2b0dc80aeca3d175c139efe5221c;86A4CAC227078B9C95C560C8F0370BF0;98908ce6f80ecc48628c8d2bf5b2a50c;a4b42c2c95d1f2ff12171a01c86cd64f;4abe604916c04fe3dd8b9cb3d501d3f;eac3e3ece94bc84e922ec077efb15edd;128CECC59C91C0D0574BC1075FE7CB40;88777aacd5f16599547926a4c9202862;0f49621b06f2cdaac8850c6e9581a594;17a36ac3e31f3a18936552aff2c80249;322cb39bc049aa69136925137906d855;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;3d129263f6a48647f103a04446fb0c2f;37cd353621b0f4fc6981b50071c94f01;1b60021baedc3f9201bcdb40e9b87f62;71345b139166482acaa568ac8816c7bc;5E022694C0DBD1FBBC263D608E577949;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc5733c013378fa418d13773f5bfe6f1;c579341f86f7e962719c7113943bb6e4;d326e629a90e78825645963b35e53a6a;5E022694C0DBD1FBBC263D608E577949;53841a0c6a3ff92976db08bfdf95e083;dc7e564809d6c2a2f3457c3c9b91f22b;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b;FE2CA1BE3BDA2A757036A89E54CC02DB;FE2CA1BE3BDA2A757036A89E54CC02DB + + 22d142f11cf2a30ea4953e1fffb0fa7e;2317d65da4639f4246de200650a70753;27612cb03c89158225ca201721ea1aad;412956675fbc3f8c51f438c1abc100eb;daf2da52475fd8981b19ec3c321a983c;490a140093b5870a47edc29f33542fd2;51a7068640af42c3a7c1b94f1c11ab9d;533340c54bd25256873b3dca34d7f74e;684eca6b62d69ce899a3ec3bb04d0a5b;69a19abf5ba56ee07cdd3425b07cf8bf;6cfd131fef548fcd60fbcdb59317df8e;72dc98449b45a7f1ccdef27d51e31e91;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;80c37e062aa4c94697f287352acf2e9d;815f1f8a7bc1e6f94cb5c416e381a110;a43d3b31575846fa4c3992b4143a06da;08e82dc7bae524884b7dc2134942aadb;7bcd736a2394fc49f3e27b3987cce640;57314359df11ffdf476f809671ec0275;b72737b464e50aa3664321e8e001ff32;ce8ce92fb6565181572dce00d69c24f8;5985087678414143d33ffc6e8863b887;84730a6e426fbd3cf6b821c59674c8a0;d5377dc1821c935302c065ad8432c0d2;d8f1356bebda9e77f480a6a60eab36bb;92f8e3f0f1f7cc49fad797a62a169acd;9003cfaac523e94d5479dc6a10575e60;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;c1e7850da5604e081b9647b58248d7e8;99828721ac1a0e32e4582c3f615d6e57;f559c87b4a14a4be1bd84df6553aaf56;b9c208ea8115232bfd9ec2c62f32d6b8;061089d8cb0ca58e660ce2e433a689b3;0e9afd3a870906ebf34a0b66d8b07435;9c115e9a81d25f9d88e7aaa4313d9a8f;520ee02668a1c7b7c262708e12b1ba6b;7bfba2c69bed6b160261bdbf2b826401;77a745b07d9c453650dd7f683b02b3ed;3a771efb7ba2cd0df247ab570e1408b2;0969b2b399a8d4cd2d751824d0d842b4;fc53f2cd780cd3a01a4299b8445f8511;4e39620afca6f60bb30e031ddc5a4330;bfe3f6a79cad5b9c642bb56f8037c43b;3dfebce4703f30eed713d795b90538b5;9793afcea43110610757bd3b800de517;36db24006e2b492cafb75f2663f241b2;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;649ef1dd4a5411d3afcf108d57ff87af;320b2f1d9551b5d1df4fb19bd9ab253a;3d75c72144d873b3c1c4977fbafe9184;b9cf4301b7b186a75e82a04e87b30fe4;b4e67706103c3b8ee148394ebee3f268;7bfbd72441e1f2ed48fbc0f33be00f24;cdb303f61a47720c7a8c5086e6b2a743;2a6f7ec77ab6bd4297e7b15ae06e2e61;8403a28e0bffa9cc085e7b662d0d5412;3ffd2915d285ad748202469d4a04e1f5;04078ef95a70a04e95bda06cc7bec3fa;235d427f94630575a4ea4bff180ecf5d;8035a8a143765551ca7db4bc5efb5dfd;cacaa3bf3b2801956318251db5e90f3c;1aadf739782afcae6d1c3e4d1f315cbd;c3e255888211d74cc6e3fb66b69bbffb;d9e9f22988d43d73d79db6ee178d70a4;16ab79fb2fd92db0b1f38bedb2f02ed8;8da15a97eaf69ff7ee184fc446f19cf1;ffc7305cb24c1955f9625e525d58aeee;c0e72eb4c9f897410c795c1b360090ef;9ad6fa6fdedb2df8055b3d30bd6f64f1;44619a88a6cff63523163c6a4cf375dd;a571660c9cf1696a2f4689b2007a12c7;81229c1e272218eeda14892fa8425883;0ac48cfa2ff8351365e99c1d26e082ad;afcdf79be1557326c854b6e20cb900a7 + a53a02b997935fd8eedcb5f7abab9b9f + e96a73c7bf33a464c510ede582318bf2 + serialfunc.exe + + e PAA;en PAA;enc PAA;enco PAA;encode PAA;encoded PAA;encodedco PAA;encodedcom PAA;encodedcomm PAA;encodedcomma PAA;encodedcomman PAA;encodedcommand PAA;e IAA;en IAA;enc IAA;enco IAA;encode IAA;encoded IAA;encodedco IAA;encodedcom IAA;encodedcomm IAA;encodedcomma IAA;encodedcomman IAA;encodedcommand IAA;e JAB;en JAB;enc JAB;enco JAB;encode JAB;encoded JAB;encodedco JAB;encodedcom JAB;encodedcomm JAB;encodedcomma JAB;encodedcomman JAB;encodedcommand JAB;e cwBFAFQA;en cwBFAFQA;enc cwBFAFQA;enco cwBFAFQA;encode cwBFAFQA;encoded cwBFAFQA;encodedco cwBFAFQA;encodedcom cwBFAFQA;encodedcomm cwBFAFQA;encodedcomma cwBFAFQA;encodedcomman cwBFAFQA;encodedcommand cwBFAFQA;e SQBFAF;en SQBFAF;enc SQBFAF;enco SQBFAF;encode SQBFAF;encoded SQBFAF;encodedco SQBFAF;encodedcom SQBFAF;encodedcomm SQBFAF;encodedcomma SQBFAF;encodedcomman SQBFAF;encodedcommand SQBFAF;e UwBFAFQA;en UwBFAFQA;enc UwBFAFQA;enco UwBFAFQA;encode UwBFAFQA;encoded UwBFAFQA;encodedco UwBFAFQA;encodedcom UwBFAFQA;encodedcomm UwBFAFQA;encodedcomma UwBFAFQA;encodedcomman UwBFAFQA;encodedcommand UwBFAFQA;e IABpAE4AdgBPAEsAZQAt;en IABpAE4AdgBPAEsAZQAt;enc IABpAE4AdgBPAEsAZQAt;enco IABpAE4AdgBPAEsAZQAt;encode IABpAE4AdgBPAEsAZQAt;encoded IABpAE4AdgBPAEsAZQAt;encodedco IABpAE4AdgBPAEsAZQAt;encodedcom IABpAE4AdgBPAEsAZQAt;encodedcomm IABpAE4AdgBPAEsAZQAt;encodedcomma IABpAE4AdgBPAEsAZQAt;encodedcomman IABpAE4AdgBPAEsAZQAt;encodedcommand IABpAE4AdgBPAEsAZQAt;e SQBmACgAJAB;en SQBmACgAJAB;enc SQBmACgAJAB;enco SQBmACgAJAB;encode SQBmACgAJAB;encoded SQBmACgAJAB;encodedco SQBmACgAJAB;encodedcom SQBmACgAJAB;encodedcomm SQBmACgAJAB;encodedcomma SQBmACgAJAB;encodedcomman SQBmACgAJAB;encodedcommand SQBmACgAJAB;e J;en J;enc J;enco J;encode J;encoded J;encodedco J;encodedcom J;encodedcomm J;encodedcomma J;encodedcomman J;encodedcommand J;e SUVY;en SUVY;enc SUVY;enco SUVY;encode SUVY;encoded SUVY;encodedco SUVY;encodedcom SUVY;encodedcomm SUVY;encodedcomma SUVY;encodedcomman SUVY;encodedcommand SUVY;e aWV4;en aWV4;enc aWV4;enco aWV4;encode aWV4;encoded aWV4;encodedco aWV4;encodedcom aWV4;encodedcomm aWV4;encodedcomma aWV4;encodedcomman aWV4;encodedcommand aWV4;e dmFy;en dmFy;enc dmFy;enco dmFy;encode dmFy;encoded dmFy;encodedco dmFy;encodedcom dmFy;encodedcomm dmFy;encodedcomma dmFy;encodedcomman dmFy;encodedcommand dmFy;e dgBhA;en dgBhA;enc dgBhA;enco dgBhA;encode dgBhA;encoded dgBhA;encodedco dgBhA;encodedcom dgBhA;encodedcomm dgBhA;encodedcomma dgBhA;encodedcomman dgBhA;encodedcommand dgBhA;e R2V0;en R2V0;enc R2V0;enco R2V0;encode R2V0;encoded R2V0;encodedco R2V0;encodedcom R2V0;encodedcomm R2V0;encodedcomma R2V0;encodedcomman R2V0;encodedcommand R2V0;e IAAgAH;en IAAgAH;enc IAAgAH;enco IAAgAH;encode IAAgAH;encoded IAAgAH;encodedco IAAgAH;encodedcom IAAgAH;encodedcomm IAAgAH;encodedcomma IAAgAH;encodedcomman IAAgAH;encodedcommand IAAgAH;e TVq;en TVq;enc TVq;enco TVq;encode TVq;encoded TVq;encodedco TVq;encodedcom TVq;encodedcomm TVq;encodedcomma TVq;encodedcomman TVq;encodedcommand TVq;e aQBIA;en aQBIA;enc aQBIA;enco aQBIA;encode aQBIA;encoded aQBIA;encodedco aQBIA;encodedcom aQBIA;encodedcomm aQBIA;encodedcomma aQBIA;encodedcomman aQBIA;encodedcommand aQBIA;e UEs;en UEs;enc UEs;enco UEs;encode UEs;encoded UEs;encodedco UEs;encodedcom UEs;encodedcomm UEs;encodedcomma UEs;encodedcomman UEs;encodedcommand UEs;e H4s;en H4s;enc H4s;enco H4s;encode H4s;encoded H4s;encodedco H4s;encodedcom H4s;encodedcomm H4s;encodedcomma H4s;encodedcomman H4s;encodedcommand H4s;e dXNpbm;en dXNpbm;enc dXNpbm;enco dXNpbm;encode dXNpbm;encoded dXNpbm;encodedco dXNpbm;encodedcom dXNpbm;encodedcomm dXNpbm;encodedcomma dXNpbm;encodedcomman dXNpbm;encodedcommand dXNpbm;e cwBhA;en cwBhA;enc cwBhA;enco cwBhA;encode cwBhA;encoded cwBhA;encodedco cwBhA;encodedcom cwBhA;encodedcomm cwBhA;encodedcomma cwBhA;encodedcomman cwBhA;encodedcommand cwBhA;JABzA + + + FromBase64String + JAB;SUVY;aWV4;dmFy;dgBhA;R2V0;SQBFAF;TVq;aQBIA;UEs;H4s;dXNpbm;cwBhA + + + /v Word experienced;/v Excel experienced;-v Word experienced;-v Excel experienced + + + JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ;QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA;kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA;IgAoACcAKgAnACkAOwAkA;IAKAAnACoAJwApADsAJA;iACgAJwAqACcAKQA7ACQA + + + e^;^en^;^nc + + + ^ + + + ..\;\.. + + + \cmd.exe /c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe /c del "C:\Users\*\Desktop\*.exe;\cmd.exe -c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe -c del "C:\Users\*\Desktop\*.exe + + ping.exe -n 6 127.0.0.1 &ping.exe /n 6 127.0.0.1 & type + System.Net.Networkinformation.ping + + mofcomp.exe + + + + + net.exe;net1.exe;net2.exe + user;group;localgroup + remove;delete;active;del + tvsu_tmp + + + + + + + + + net.exe;net1.exe;net2.exe + user + add + tvsu_tmp + + dsmod.exe + dsadd.exe + + + + WerFault.exe + -s;/s + + + + + + + + + + + + + + + cmd.exe + echo;\pipe\;> + + + cmd.exe + /c;copy;dll;\\;admin$ + + + rundll32.exe + ,;StartW + + + rundll32.exe + ,;update;appdata;temp;/i: + + + rundll32.exe + ,;update;appdata;temp;-i: + + + dllhost.exe + {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} + + + dllhost.exe + {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} + + + + winlogon.exe;services.exe;lsass.exe;csrss.exe;wininit.exe;spoolsv.exe;searchindexer.exe + powershell.exe;pwsh.exe;cmd.exe + AUTHORI;AUTORI + route ; ADD + + + + eventvwr.exe + c:\windows\system32\mmc.exe + + fodhelper.exe + InstallUtil.exe + Invoke-PsUaCme + BypassUAC + PowerUp + computerdefaults.exe + dism.exe + fodhelper.exe + + + NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC + NT AUTHORITY\SYSTEM;СИСТЕМА;NT-AUTORITÄT\SYSTEM;AUTORITE NT\SYSTEM + + c:\windows\system32\svchost.exe -k netsvcs -s Appinfo + runas.exe + + + + + + + + Cmd.Exe + winlogon.exe + utilman.exe + + + Cmd.Exe + winlogon.exe + sethc.exe + + + utilman.exe + C:\Windows\System32\ATBroker.exe;Magnify.exe;C:\Windows\System32\osk.exe + + sethc.exe + osk.exe + Magnify.exe + DisplaySwitch.exe + Narrator.exe + AtBroker.exe + + sdbinst.exe + + + dwm.exe + + + cmd.exe + 7zFM.exe + ;/c;-c + + + cmd.exe + elevation_service.exe + System + + + + + + + + unknown process + \LocalState\rootfs\ + \LocalState\rootfs\ + + + + + + + + + + + auditpol + /set;-set;/restore;-restore;/clear;-clear;/remove;-remove;/resourceSACL;-resourceSACL + + + + + + + +s;+h + attrib.exe + + + Hidden;Attributes + powershell.exe + + + + + Sysinternals Sysmon + /u;/c;-u;-c + C:\ProgramdData\sysmon\ + + + MpCmdRun.exe + Add-MpPreference;RemoveDefinitions;DisableIOAVProtection + + + + IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE + + + IMPHASH=19584675D94829987952432E018D5056 + + + IMPHASH=330768a4f172e10acb6287b87289d83b + + + PsKill.exe + + Set-MpPreference;Add-MpPreference;Remove-MpPreference;MpCmdRun.exe + RemoveDefinitions;RemoveDynamicSignature;DisableIOAVProtection;DisableRealTimeMonitoring;DisableBehaviorMonitoring;DisableBlockAtFirstSeen;DisableIOAVProtection;DisablePrivacyMode;DisableScriptScanning;DisableRealtimeMonitoring;DisableScanningNetworkFiles;DisableScanningMappedNetworkDrivesForFullScan;DisableRestorePoint;DisableRemovableDriveScanning;SignatureDisableUpdateOnStartupWithoutEngine;DisableIntrusionPreventionSystem;DisableScanOnRealtimeEnable;DisableArchiveScanning;DisableIntrusionPreventionSystem;DisableScriptScanning;DisableOnAccessProtection;ExclusionExtension;ExclusionPath;ExclusionProcess;ThreatDefaultAction;TamperProtection + + interface ipv6 set + interface ipv4 set + taskkill.exe + + firewall delete + firewall add + firewall set opmode disable + Core Networking - Router Solicitation + netsh advfirewall firewall + + + wevtutil.exe + cl + wevtutil im + wevtutil.exe im + ClickToRun + + + fltMC.exe + detach;unload + + + appcmd.exe + DontLog;True + iisetup.exe + + + set;NGenAssemblyUsageLog + New-ItemProperty;NGenAssemblyUsageLog + reg;add;dword;NGenAssemblyUsageLog + $env;NGenAssemblyUsageLog + + + set;COMPlus_ETWEnabled + New-ItemProperty;COMPlus_ETWEnabled + reg;add;dword;COMPlus_ETWEnabled + $env;COMPlus_ETWEnabled + + + + bash.exe;wsl.exe;ubuntu.exe;kali.exe + -e;/e;-u root;--exec bash;dev/tcp;~ -d;~ /d + + wsl.exe + wsl.exe + wslhost.exe + wslhost.exe + ubuntu.exe + ubuntu.exe + kali.exe + kali.exe + distro-id;vm-id + + pcalua.exe + pcalua.exe + bash.exe + bash.exe + forfiles.exe + forfiles.exe + .com + -appvscript + + + + C:\Users\NetworkService\;C:\Users\NetworkService\;HarddiskVolumeShadowCopy;C:\Users\Default\;C:\Users\Public;C:\Users\Guest\;\administrateur\;C:\Windows\Media\;C:\Windows\addins\;tsclient\;\htdocs\;\config\systemprofile\;C:\PerfLogs\;c:\windows\ServiceProfiles\;C:\Intel\Logs\;C:\Windows\repair\;C:\Windows\Help\;$Recycle;C:\Windows\Debug\;C:\Windows\Security\;C:\Windows\Fonts\;\wwwroot\;\Contacts;C:\Windows\vss\ + + + .exe + .7z.exe + .doc.exe + .doc.exe + .docx.exe + .ico.exe + .iso.exe + .lnk.exe + .pdf.exe + .ppt.exe + .pptx.exe + .rar.exe + .rtf.exe + .txt.exe + .xls.exe + .xlsx.exe + .zip.exe + ______.exe + + + + + reg add hkcu\software\classes\ + reg.exe add hkcu\software\classes\ + C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry + + regedit.exe + : + + + reg.exe + delete + + + regedit.exe + /d;-d + + + HKCU:;HKLM + remove-item + + + HKCU:;HKLM + set-item;new-item + + + + + + chcp.exe + 936 + 1256 + 864 + 1258 + 855 + 866 + + + powershell.exe + -e ;-en;-enc;-enco;-encod;-encode;-encoded;-encodedc;-encodedco;-encodedcom;-encodedcomm;-encodedcomma;-encodedcomman;-encodedcommand;/e ;/en;/enc;/enco;/encod;/encode;/encoded;/encodedc;/encodedco;/encodedcom;/encodedcomm;/encodedcomma;/encodedcomman;/encodedcommand + + + powershell.exe + -w h;-wi h;-win h;-wind h;-windo h;-window h;-windows h;-windowst h;-windowsty h;-windowstyl h;-windowstyle h;/w h;/wi h;/win h;/wind h;/windo h;/window h;/windows h;/windowst h;/windowsty h;/windowstyl h;/windowstyle h + + + powershell.exe + -ex;/ex + bypass + + + powershell.exe + -noni;/noni + Import-Module FileServerResourceManager + C:\Program Files\LogicMonitor + + + powershell.exe + hextobin;iex;io.filestream;system.text;base64;system.io;io.file;IMAGE_SUBSYSTEM_WINDOWS_GUI;IMAGE_NT_OPTIONAL_HDR32;IMAGE_NT_OPTIONAL_HDR64;DllCharacteristicsType;GetDelegateForFunctionPointer;WriteProcessMemory;ReadProcessMemory;ImpersonateSelf;AdjustTokenPrivileges;NtCreateThreadEx;CreateRemoteThread;io.seek;iwr;-bxor;invoke-expression;remove.to.string;shellcode;System.Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;unicode;-useb;msxml2.serverxmlhttp;wscript.shell;-comobject;frombase64;io.compression;system.convert;io.streamreader;io.memorystream;compression.gzipstream;text.encoding;executioncontext;text.enc;convertto-securestring;runtime.interop;verbosepreference;[[string]]::join + + + powershell.exe + SUVYI;aWV4I;SQBFAFgA;aQBlA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC;UwB0AGE + + + C^om^S^pEc;^c^o^m^S^p^E^c^;Wscript.Shell;-ComObject;MsXml2.ServerXmlHttp;Remove.ToString;System.Convert;-UseB;[Byte[];^h^t^t^p;h"t"t"p + + IwAjACMAd;IyM=;SUVYI;aWV4I;SQBFAFgA;aQBlAHgA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC + WindowStyle Hidden function;WindowStyle Hidden;windowstyle h;windowstyl h;windowsty h;windowst h;windows h;window h;windo h;wind h;win h;wi h;-w h;/w h;win hi;win hid;win hidd;win hidde;win hidden + ^ + TYPE CON > + copy CON > + + FromBase64String;action=create keyvalue=;VerbosePreference.ToString;SecureString;CSharpCodeProvider;runtime.interopservices.marshal;system.globalization.numberstyles;system.reflection.assembly;hextobin;VerbosePreference.ToString;system.text.encoding;io.filestream;io.filestream;io.seekorigin;text.encoding;unicode.getstring;FromBase64;[Convert]::;System.IO.File]::ReadAllText;|iex + ngen.exe;install + + + + certutil + decode;encode + + + ping.exe + 0x + + + + csc.exe + \AppData\;\Windows\Temp\ + + + csc.exe + wscript.exe + cscript.exe + mshta.exe + + + mofcomp.exe + .mof + C:\WINDOWS\Installer\MSI + MsMpEng.exe + aspnet_regiis.exe + msiexec.exe + + + csc.exe + out:;target:library + + Microsoft.Workflow.Compiler.exe + + + + + autochk.exe + \smss.exe;\fontdrvhost.exe;\dwm.exe + + + \consent.exe;\Runtimebroker.exe;\TiWorker.exe + \svchost.exe + - + + + \consent.exe;\Runtimebroker.exe;\TiWorker.exe + svchost.exe + - + + + SearchProtocolHost.exe + \SearchIndexer.exe;\dllhost.exe + - + + + dllhost.exe + \services.exe;\svchost.exe + - + + + smss.exe + \smss.exe + System + - + + + csrss.exe + - + \smss.exe;svchost.exe + + + wininit.exe + - + \smss.exe + + + winlogon.exe + \smss.exe + + + \lsass.exe;LsaIso.exe + \wininit.exe + + + LogonUI.exe + \wininit.exe;\winlogon.exe + + + services.exe + \wininit.exe + + + svchost.exe + - + \MsMpEng.exe;\services.exe + + + spoolsv.exe + \services.exe + + + taskhost.exe + \services.exe;\svchost.exe + + + userinit.exe + \dwm.exe;\winlogon.exe + + + \wmiprvse.exe;\wsmprovhost.exe;\winrshost.exe + - + \svchost.exe + + + \SearchProtocolHost.exe;\taskhost.exe;\csrss.exe + \werfault.exe;\wermgr.exe;\WerFaultSecure.exe + + + autochk.exe + \chkdsk.exe;\doskey.exe;\WerFault.exe + + + smss.exe + \autochk.exe;\smss.exe;\csrss.exe;\wininit.exe;\winlogon.exe;\setupcl.exe;\WerFault.exe + + + wermgr.exe + \WerFaultSecure.exe;\wermgr.exe;\WerFault.exe + + + wermgr.exe + wermgr.exe + + + \rundll32.exe;\regsvr32.exe + \explorer.exe;\wermgr.exe;\msra.exe;\OneDriveSetup.exe;\mobsync.exe;\xwizard.exe + .exe + + + conhost.exe + \mscorsvw.exe;\wermgr.exe;\WerFault.exe;\WerFaultSecure.exe + + + System.Management.Automation + "C:\Windows\Microsoft.NET\Framework\;\ngen.exe;install + + + + + + + + InstallUtil.exe + /logfile=;/LogToConsole=false;/U + + + InstallUtil.exe + -logfile=;-LogToConsole=false;-U + + + Mavinject.exe;mavinject64.exe + INJECTRUNNING + + + CMSTP.exe + /ni;/s + + + CMSTP.exe + /ns;/s + + + CMSTP.exe + -ni;-s + + + CMSTP.exe + -ns;-s + + + rundll32.exe;shell32.dll;_RunDLL + C:\Windows\ImmersiveControlPanel\SystemSettings.exe + + + odbcconf.exe + /S /A {REGSVR;-S -A {REGSVR + + script:http + Register-cimprovider + Scriptrunner.exe -appvscript + bginfo + cbd + runscripthelper.exe surfacecheck + xwizard RunWizard + PresentationHost + driver executeinf + control.exe /name;control.exe -name + Control_RunDLL + SyncAppvPublishingServer.exe + Scriptrunner.exe + ATBroker.exe + Appvlp.exe + InfDefaultInstall.EXE + PresentationHost.exe + RegisterCimProvider2.exe + RegisterCimProvider.exe + ScriptRunner.exe + csi.exe + extexport.exe + msconfig.EXE + rasdlui.exe + tttracer.exe + verclsid.exe + wab.exe + Register-cimprovider.exe + csi.exe + devtoolslauncher.exe LaunchForDeploy + bginfo + devtoolslauncher.exe + wab.exe + wsreset.exe + + cmstp.exe /ni /s;cmstp.exe -ni -s + cmstp /ni /s;cmstp -ni -s + + Mavinject.exe + INJECTRUNNING + + + rundll32.exe + DllRegisterServer + xapauthenticodesip.dll + + + regsvr32.exe + C:\Users;Appdata;Temp + + + regsvr32.exe + C:\Users;Public + + Microsoft(C) Register Server + SyncAppvPublishingServer.exe + control.exe + rasautou.exe + control.exe /name;control.exe -name + Control_RunDLL + + + msiexec.exe + /y;-y + C:\Windows\SysWOW64\DartSock.dll + C:\Windows\SysWOW64\ImageViewer2.OCX + C:\Windows\SysWOW64\SysTray.ocx + C:\Windows\SysWOW64\tdbg6.ocx + C:\Windows\SysWOW64\tdbg7.ocx + C:\Windows\SysWOW64\tdbg7.ocx + C:\Windows\SysWOW64\todg7.ocx + C:\Windows\SysWOW64\todgub7.dll + C:\Windows\SysWOW64\xarraydb.ocx + + + msiexec.exe + /i;-i + http + + + + RUNDLL32.EXE + ,;# + C:\Windows\resources\themes\Aero\AeroLite.msstyles + uxtheme.dll + ImageView_Fullscreen + EDGEHTML.dll + PhotoViewer.dll + \AppData\Local\WebEx\WebEx\ + + + RUNDLL32.EXE + -sta;/sta + + + RUNDLL32.EXE + -localserver;/localserver + + + RUNDLL32.EXE + shell32.dll;OpenAs_RunDLL + + + RUNDLL32.EXE + powershell + + + RUNDLL32.EXE + url.dll;OpenURL + + + RUNDLL32.EXE + url.dll;FileProtocolHandler + + + RUNDLL32.EXE + zipfldr.dll;RouteTheCall + + + RUNDLL32.EXE + Shell32.dll;Control_RunDLL + + + RUNDLL32.EXE + javascript: + + + RUNDLL32.EXE + RegisterXLL + + + rundll32.exe + C:\Users;Public + rdpinit.exe + rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe + + + rundll32.exe + C:\Users;Appdata;Temp + ImageView_ + rdpinit.exe + rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe + + advpack.dll;LaunchINFSection + ieadvpack.dll;LaunchINFSection + syssetup.dll;SetupInfObjectInstallAction + setupapi.dll;InstallHinfSection + InstallHinfSection + infDefaultInstall.exe + rundll32.exe "C:\Windows\twain_64.dll" + shdocvw.dll;OpenURL + advpack.dll;RegisterOCX + Zipfldr.dll;RouteTheCall + url.dll;FileProtocolHandler + url.dll;FileProtocolHandler + OpenURLA;file: + OpenURL;file: + + + mshta.exe + cmd.exe;powershell.exe;wscript.exe;cscript.exe;sh.exe;bash.exe;reg.exe;regsvr32.exe;bitsadmin + + + mshta.exe + + RunHTMLApplication + mshtml + vbscript:CreateObject + + odbcconf.exe + + + manage-bde.wsf + + + + + powershell.exe;powershell_ise.exe + msbuild.exe + + + msbuild.exe + regasm.exe + + + msbuild.exe + userinit.exe + + + msbuild.exe + .xml + + + regasm.exe + \conhost.exe + + + msbuild.exe + .lnk + + .csproj + + + + + + + msxsl.exe + msxsl.exe + + + + + + + + + /stext + keylog + keyscan_ + Get-Keystrokes + /scomma + + + + + + sniff + C:\Program Files\Adobe\ + + + tcpdump.exe;tcpdump.c;tshark.exe;tshark.c;windump.exe;windump.c;wireshark.c;wireshark.exe + windump;tshark;tcpdump;windump;wireshark + netsh;trace;start;capture=yes + + + + vssadmin.exe + create;shadow + + + wmic.exe + shadowcopy;call;create + + + wmic.exe + call;create;esentutl;vss + + + win32_shadowcopy;create;clientaccessible + + + mklink;GLOBALROOT;Shadow + + + copy;NTDS\ntds.dit + + + ntdsutil.exe + + + copy;System32\config\SYSTEM + + + reg;save;HKLM + + + mimikatz;mimidrv;mimilove;mimilib;sekurlsa;lsadump;dumpcreds;privilege::;token::;logonpasswords;mimikittenz;mimiauth;::;kerberos::;misc::skeleton;privilege::debug;dpapi::cred;vault::cred;lsadump;misc::;Krbtgt;TOKEN::;invoke-mimi + + + cmdkey + + rpcping.exe + nltest.exe + + -ma lsass.exe;Do-Exfiltration;Powersploit;GPPPassword;gpprefdecrypt;gsecdump;hashdump;laZagne;ntds.dit;ppldump;pwdump;pwdumpx;secretsdump;/listcreds:;-listcreds: + + VaultCloseVault + VaultEnumerateItem + VaultFree + VaultGetItem + VaultOpenVault + Vaultcmd + vaultcli.dll + select * from moz_login + Invoke-WinEnum + System.Net.CredentialCache + create shadow + wlan;export;profile;key=clear + dcsync + HKCU /f password;HKCU -f password + HKLM /f password;HKLM -f password + nltest.exe + ProcDump.exe + ProcDump + + + asktgt;asktgs + createnetonly /program:;createnetonly -program: + dump /service:krbtgt;dump -service:krbtgt + harvest /interval:;harvest -interval: + renew /ticket:;renew -ticket: + asreproast + impersonateuser: + kerberoast + ptt /ticket: + klist.exe + hh.exe + + + + appcmd.exe + list;text;password + + + + quser.exe + + net.exe;net1.exe;net2.exe + group;localgroup; user + /domain + SUService + \users + tvsu_tmp + + + net.exe;net1.exe;net2.exe + group;localgroup; user + /domain + SUService + \users + tvsu_tmp + + + sharphound;bloodhound;azurehound;CollectionMethod;encryptzip;randomizefilenames;dumpcomputerstatus + sharphound;bloodhound + sharphound;bloodhound + sharphound;bloodhound + sharphound;bloodhound + sharphound;bloodhound + sharphound;bloodhound + + dscl . list /Groups;dscl . list -Groups + dscl . list /Users;dscl . list -Users + dsquery.exe + query.exe + + + + + + + + + + + tree.com + + + auditpol + /get;-get;/list;-list;/backup;-backup + + gpresult.exe + get-gpo;get-gpresult;get-gpreg + + + + + + + + tasklist.exe + qprocess.exe + + reg query + reg.exe query + driverquery.exe + + + tracert.exe + pathping.exe + + + + find;385201 + select-string;385201 + + + find;virus + select-string;virus + process;Description;virus + find;cb + select-string;cb + process;Description;cb + find;defender + select-string;defender + process;Description;defender + find;crowdstrike + select-string;crowdstrike + process;Description;crowdstrike + find;sentinel + select-string;sentinel + process;Description;sentinel + find;nessusd + select-string;nessusd + process;Description;nessusd + find;td-agent + select-string;td-agent + process;Description;td-agent + find;cbagentd + select-string;cbagentd + process;Description;cbagentd + find;sysmon + select-string;sysmon + process;Description;sysmon + find;winlogbeat + select-string;winlogbeat + process;Description;winlogbeat + find;winlogbeat + select-string;winlogbeat + process;Description;winlogbeat + find;csfalcon + select-string;csfalcon + process;Description;csfalcon + find;splunk + select-string;splunk + process;Description;splunk + find;sidecar + select-string;sidecar + process;Description;sidecar + + + fltMC.exe + misc::mflt + + AntiVirusProduct + root\SecurityCenter2 + + sysinfo.exe + systeminfo + + + + netsh.exe + get;list;show + + + netsh.exe + get;list;show + + ipconfig.exe + + netstat.exe + arp -a + arp.exe -a + arp -a + + + whoami.exe;whoami1.exe + + + wmic.exe + get;useraccount + + + netsh.exe + add;set + encryption;dohtemplate + + + netsh.exe + add;del;set + + + nbtstat + nessus + + + route.exe + print + + + route.exe + ADD;DEL;CHANGE;-f + + qwinsta.exe + rwinsta.exe + + + + + + + + Microsoft Office\root\Office + Microsoft Office\root\Office + automation;Embedding + + + admin$ + davclnt.dll + WebClientGroup + + + + + + + /shadow;-shadow + noConsentPrompt + + + tscon.exe + dest:rdp-tcp: + + + powershell.exe + WmiPrvSE.exe + + + WmiPrvSE.exe + \Users\ + + + NetworkDetective + WmiPrvSE.exe + + + sc.exe + tenable + WmiPrvSE.exe + + + cmd.exe + WmiPrvSE.exe + do_vbsUpload;Spiceworks + + + regsvr32.exe + WmiPrvSE.exe + + + cmd.exe + WmiPrvSE.exe + + + powershell.exe + WmiPrvSE.exe + + + dsa.msc + + + virtmgmt.msc + + + wmiprvse.exe + CompMgmtLauncher.exe + DismHost.exe + Microsoft.NET\Framework + NetEvtFwdr.exe + ServerManager.exe + WerFault.exe + chcp.com + g2mupdate.exe + slack.exe + + + wsmprovhost.exe + cmd.exe + sh.exe + bash.exe + wsl.exe + powershell.exe + powershell_ise.exe + schtasks.exe + at.exe + certutil.exe + mshta.exe + whoami.exe + ping.exe + ping.exe + bitsadmin.exe + + winrm.cmd + winrs.exe + winrshost.exe + waitfor.exe + wsmprovhost.exe + winrshost.exe + wsmprovhost.exe + + wmiprvse.exe + mshta.exe + + + ssh.exe;putty.exe;kitty.exe;kitty_portable.exe + + PuTTY suite + + sftp;psftp + + + rundll32.exe + + + rundll32.exe + ..\;, + + + rundll32.exe + ,StartW + + psshutdown + psservice + PsPasswd + mstsc.exe + telnet.exe + tftp.exe + powershellcustomhost + + + -Embedding + c:\windows\system32\mmc.exe + + --execm;atexec + {4991d34b-80a1-4291-83b6-3328366b9097} + {00020812-0000-0000-C000-000000000046} + {40AEEAB6-8FDA-41e3-9A5F-8350D4CFCA91} + {7e0423cd-1119-0928-900c-e6d4a52a0715} + {0006F04A-0000-0000-C000-000000000046} + {048EB43E-2059-422F-95E0-557DA96038AF} + {13709620-C279-11CE-A49E-444553540000} + {c08afd90-f2a1-11d1-8455-00a0c91f3880} + 9BA05972-F6A8-11CF-A442-00A0C90A8F39 + {00021A20-0000-0000-C000-000000000046} + {72C24DD5-D70A-438B-8A42-98424B88AFB8} + {00020906-0000-0000-C000-000000000046} + {cc5bbec3-db4a-4bed-828d-08d78ee3e1ed} + {1b7cd997-e5ff-4932-a7a6-2a9e636da385} + {16d51579-a30b-4c8b-a276-0ff4dc41e755} + rundll32.exe -sta;rundll32.exe /sta;rundll32 -sta;rundll32 /sta + shell32.dll;SHCreateLocalServerRunDll + -k DcomLaunch;/k DcomLaunch + + + + + + + + + + 7z.exe + a -mx9 -r0 -p;a -v500m -mx9 -r0 -p + + + 7z + 7z + + + winrar + winrar + + + winrar + winrar + + + winzip + winzip + + + Compress-Archive + + + WindowsAudioDevice-Powershell-Cmdlet + SoundRecorder.exe + + + + clip.exe + get-clipboard + + + + + + + + + + New-MailboxExportRequest + + + add-pssnapin;exchange;new-managementroleassignment;applicationimpersonation + + + + screencapture + system.drawing.Imaging + system.drawing.bitmap + system.windows.forms.screen + + + + + + + odHRwczovL;aHR0cDovL;h0dHA6Ly;odHRwOi8v;aHR0cHM6Ly;h0dHBzOi8v + ie_to_edge_stub.exe;chrome.exe;firefox.exe;iexplore.exe;brave.exe;vivaldi.exe;msedge.exe;webex;teams.exe;goto opener.exe;lynx.exe;\Webex\webexAppLauncherLatest.exe;\WebEx\webexAppLauncher.exe;\WebEx\Applications\webexAppLauncher.exe;WebEx\webex.exe + wbx:;/SITE_TOKEN=;msteams:;PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSI + msedgeupdate.dll + + + VFZvQUFBQ;RWb0FBQU;UVm9BQUFB;VFZxQUFBR;RWcUFBQU;UVnFBQUFF;VFZwUUFBS;RWcFFBQU;UVnBRQUFJ;VFZxUUFBT;RWcVFBQU;UVnFRQUFN;VFZwVEFRR;RWcFRBUU;UVnBUQVFF + + + powershell.exe + AAAAYInlM;OiCAAAAYInlM;OiJAAAAYInlM;RwBlAHQAL;WwBOAGUAdAAuAFM;W05ldC5TZXJ2aWNl + + + Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք + + + + + + + + certutil.exe + urlcache;split;f + + + DownloadFile;DownloadString;Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;Invoke-Expression;Invoke-WebRequest + powershell.exe;cmd.exe + + + bitsadmin.exe + CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME + util;setieproxy;localsystem;AUTODETECT + + + BITS administration utility + CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME + + + \curl.exe;\wget.exe;\www.exe + + + \curl.exe;\wget.exe;\www.exe + + + certutil + split;f + + + certutil + verifyctl;URL + + + C:\Perflogs\;C:\Users\Public\;C:\root\ + + + C:\Perflogs\;C:\Users\Public\;C:\root\ + + start-bitstransfer + expand \\ + expand.exe \\ + ieexec http + ieexec.exe http + powercat + esentutl /y \\;esentutl -y \\ + esentutl.exe /y \\;esentutl.exe -y \\ + extrac32 \\ + extrac32.exe \\ + + + + + + portproxy + tor.exe + + TeamViewer_Desktop.exe + + psexec + + + + + + + winscp.exe;winscp.com;scp.exe;pscp + + + + bitch.exe;bitch.bat;bitch_lasagna.exe;Admin Cracker.exe;BulletsPassView.exe;ChromePass.exe;Dialupass.exe;LSASecretsView.exe;OpenedFilesView.exe;OperaPassView.exe;PasswordFox.exe;ProduKey.exe;RouterPassView.exe;USBDeview.exe;USBStealer.exe;VNCPassView.exe;WebBrowserPassView.exe;WirelessKeyView.exe;WirelessKeyView.exe;empv.exe;netpass.exe;pspv.exe;usbdll.exe;rdpv.exe;WirelessKeyView.exe;lasagna.exe;all -vvv >>;rsync -r + + + CredsLeaker;Windows.Security.Credentials.UI.CredentialPicker;function Leaker;function Await + + + .exe -url https://;dll,Run https://;Invoke-Merlin;-m SimpleHTTPServer;/m SimpleHTTPServer + + + + + -q=txt;/q=txt + nslookup.exe + + + rclone + Rsync for cloud storage + rclone + rclone + \rclone + + + s3browser + s3browser + s3browser + s3browser + + + add-ftp;.UploadFile( + ftp.exe + + + rundll32.exe + davclnt.dll;DavSetCookie + + + + + + + + + + + + bcdedit.exe + safeboot + + + bootcfg.exe + safeboot + + + -startvm;vrun.exe -vm + + + + + vssadmin.exe + delete;resize + + + wmic.exe + shadowcopy;delete + + + wbadmin.exe + SYSTEMSTATEBACKUP;delete + + + wmic.exe + wmic shadowstorage SET MaxSpace= + + + wmic.exe + cleareventlog;call disable;nteventlog where filename + + + diskpart.exe + format;clean;delete;remove + + + manage-bde.exe + changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw + + + manage-bde.wsf + changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw + + format + format + bootstatuspolicy ignoreallfailures + recoveryenabled No + Win32_Shadowcopy + sdelete + delete catalog + wbadmin delete catalog + erase + -nw -exec= + -p -nw + shred + diskshadow + + del ; /f + del ; -f + rmdir ; /s ; /q + rmdir ; -s ; -q + rd ; /s ; /q + rd ; -s ; -q + + + usn deletejournal + + + + + fsutil.exe + deletejournal + usn + + + + + + + + + AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz + + + ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool + CPU miner;GPU miner;Lime Miner;XMRig CPU miner; miner + + + b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 + + 87AECF008D87EC86EC8B00A2394B3E6C + FB3F0D0DE8B80EA8CFAB2A025EC6B833 + F4067FBF7FFF6945D0BB485B727B39AA + 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee + e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f + d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b + 53841a0c6a3ff92976db08bfdf95e083 + + + zoommtg + pwd= + + + zoommtg + zc=0 + + + zoommtg + zc=1 + + + msteams: + + + wbx: + + + C:\Users\ + \Downloads\ + + + C:\Users\ + \Desktop\ + + + \awk.exe;\sed.exe + + + C:\Users\Public\;$Recyclebin;\Desktop\;\Content.Outlook\ + + + C:\Users\Public\;$Recyclebin;\Desktop\;\Content.Outlook\;\Downloads\ + .html;.hta;.iso;.js;.bat;.cmd;.cmdline;.vbs;.vb;.vbe;.reg;.com + + listena + -s -n -u -i:http: + /s /n /u /i:http: + assoc + del + expand + md + move + rd + ren + set + setx + bginfo.bgi /popup /nolicprompt;bginfo.bgi -popup -nolicprompt + find.exe + grabff + routerscan + pythonEngine.Execute + sesshijack + file:// + HTML Application host + Manager Profile Installer + Microsoft Application Virtualization Injector + Application Compatibility Database Installer + popd.exe + pushd.exe + subst.exe + doskey.exe + cls.exe + \ + C:\Windows\system32\svchost.exe -k iissvcs + \ + acrobat.exe + acrord32.exe + java.exe + javaw.exe + + + + + C:\Windows\system32\svchost.exe + + cacls.exe + takeown.exe + /x Macro + + \pipe\ + > + + /noprofile + /sc ONEVENT + \\VBOXSVR + | more + |more + \\tsclient + %PROCESSOR_ARCHITECTURE% + sysnative + AutoIt + Microsoft Filter Loader + more.com + :\Windows\Microsoft.NET\ + acrord32.exe + gpupdate.exe + :\Windows\Microsoft.NET\ + System + + explorer.exe + \regedit.exe;\cmd.exe;terminal;\powershell + + + + + + + + + C:\Windows\System32\WerFault.exe + C:\Windows\System32\wbem\WmiPrvSE.exe + + + + + + + C:\Users + C:\ProgramData + \Temp\ + \tmp\ + \drivers\ + \Download + + + + + C:\Windows\system32\backgroundTaskHost.exe + TrustedInstaller.exe + OneDrive.exe + vivaldi.exe + chrome.exe + C:\WINDOWS\system32\backgroundTaskHost.exe + setup + AppData\Local\Microsoft\Teams\current\Teams.exe + \AppData\Local\Microsoft\Edge SxS\Application\msedge.exe + + + + + + + + census + researchscan + scanhub + shadow + shodan + + 137.184.67.33;206.188.196.77;125.212.220.48;5.180.61.17;47.242.39.92;61.244.94.85;86.48.6.69;86.48.12.64;94.140.8.48;94.140.8.113;103.9.76.208;103.9.76.211;104.244.79.6;112.118.48.186;122.155.174.188;125.212.241.134;185.220.101.182;194.150.167.88;212.119.34.11 + 137.184.67. + httpbin.org + + + advanced-ip-scanner.com + + + kali.download + + shodan + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + wscript.exe + + + + + + + + at.exe + schtasks.exe + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \temp\ + 127.0.0.1 + + + \wwwroot\ + + \Windows\addins\ + C:\Windows\repair\ + \htdocs\ + C:\Windows\system32\config\systemprofile\ + C:\Intel\Logs\ + C:\Windows\addins\ + C:\Windows\security\ + C:\Windows\Help\ + $RECYCLE.BIN + C:\Windows\Debug\ + C:\Windows\Fonts\ + C:\PerfLogs\ + :\$Recycle.bin\ + :\Users\Default\ + C:\Users\NetworkService\ + C:\Users\Public\ + C:\Windows\Media\ + \Windows\IME\ + C:\ProgramData + + + + + + + + CSC.exe + + + + + + + + + + infDefaultInstall.exe + SyncAppvPublishingServer.exe + + + InstallUtil.exe + + msiexec.exe + + + regasm.exe;regsvcs.exe + + + Mavinject.exe + + + + + + msbuild.exe + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + dsquery.exe + + + + + + + + + + + + + driverquery.exe + + + + nbtstat.exe + + net.exe + net1.exe + + qwinsta.exe + rwinsta.exe + + + + + + + + + + + + true + 3389 + AutomationManager.ScriptRunner64.exe + C:\Program Files (x86)\VMware\VMware Remote Console\vmrc.exe + C:\Program Files\VMware\VMware Remote Console\vmrc.exe + C:\Program Files\WindowsApps\Microsoft.RemoteDesktop_ + CtxLicUsageRecorder.exe + FSAssessment.exe + FSDiscovery.exe + MobaRTE.exe + RDCMan.exe + RSSensor.exe + RTS2App.exe + RTSApp.exe + RemoteDesktopManager64.exe + RemoteDesktopManager.exe + RemoteDesktopManagerFree.exe + Terminals.exe + chrome.exe + mRemote.exe + mRemoteNG.exe + mstsc.exe + spiceworks-finder.exe + svchost.exe + thor64.exe + thor.exe + + + true + 3391 + AutomationManager.ScriptRunner64.exe + C:\Program Files (x86)\VMware\VMware Remote Console\vmrc.exe + C:\Program Files\VMware\VMware Remote Console\vmrc.exe + C:\Program Files\WindowsApps\Microsoft.RemoteDesktop_ + CtxLicUsageRecorder.exe + FSAssessment.exe + FSDiscovery.exe + MobaRTE.exe + RDCMan.exe + RSSensor.exe + RTS2App.exe + RTSApp.exe + RemoteDesktopManager64.exe + RemoteDesktopManager.exe + RemoteDesktopManagerFree.exe + Terminals.exe + chrome.exe + mRemote.exe + mRemoteNG.exe + mstsc.exe + spiceworks-finder.exe + svchost.exe + thor64.exe + thor.exe + + + true + 3389 + 127.0.0.1;0:0:0:0:0:0:0:1 + + + true + 3389 + fe80:0 + + + putty.exe;kitty.exe;kitty_portable.exe + + + wsmprovhost.exe + + + psftp.exe + + reg.exe + psshutdown + PsPasswd + psservice + ssh.exe + psexe + tftp.exe + telnet.exe + mstsc.exe + wmic.exe + sc.exe + pskill + dsquery.exe + plink.exe + vnc.exe + vncviewer.exe + vncservice.exe + omniinet.exe + hpsmhd.exe + + + + + + + + + + + + + + + + + + + + + + + + + + + 50050 + true + + + 25 + \Bin\EdgeTransport.exe;Bin\MSExchangeFrontendTransport.exe + true + + + + + + + + + + + powershell.exe + 0:0:0:0:0:0:0:;127.0.0.1 + + mshta.exe + cmd.exe + certutil.exe + certutil.exe + notepad.exe + regsvcs.exe + regsvr32.exe + rundll32.exe + + + + + + + tor.exe + hiddenservice.net;onion.city;onion.direct;onion.direct;onion.link;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org;onion.to + + + + + + + + + dns.google;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;doh.opendns.com;.quad9.net;dns.cleanbrowsing.org;dns-family.adguard.com;dns.adguard.com;.233py.com;dnscrypt;dnscrypt-cert.oszx.co;dns.oszx.co;doh.dns.sb;doh.defaultroutes.de;doh.tiarap.org;doh.tiar.app;doh.captnemo.in;.aaflalo.me;doh.appliedprivacy.net;doh.dnswarden.com;commons.host;dns.twnic.tw;ibuki.cgnat.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;.seby.io;rdns.faelix.net;doh.li;.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk;adblock.mydns.network;ibksturm.synology.me;jcdns.fun + + + + + + + privatlab.com + mega.nz;mega.co.nz + .pcloud.com + + + + + + + + + + + + + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool + + + + + C:\Windows\system32\svchost.exe + 3389 + 22 + 21 + 5985 + false + + + C:\Windows\system32\svchost.exe + true + 135 + 445 + 5985 + + + System + svchost.exe + 445 + + + System + svchost.exe;lsass.exe + 389 + + + C:\Windows\System32\lsass.exe + 389 + 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 + EXCH + 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 + false + + + notepad.exe + 127.0.0.1 + + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe + 80 + 443 + true + + github + githubusercontent.com + + dropboxapi.com + \Dropbox\Client\Dropbox.exe;\Dropbox\bin\Dropbox.exe;\Oracle\Java\ + + + 1drv + + C:\Program Files\Microsoft OneDrive\OneDrive.exe;\AppData\Local\Microsoft\OneDrive\OneDrive.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe;\Internet Explorer\iexplore.exe;C:\Windows\System32\AppHostRegistrationVerifier.exe;C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe;C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe;C:\Program Files\Mozilla Firefox\firefox.exe + + + .box.com;upload + + + mega.nz;mega.co.nz + + + privatlab.com + + + tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat + + + efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet + + + .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com + + + apache.exe + + + java.exe + + + w3wp.exe + + + \php-cgi.exe;\php.exe + + + setup + + + tomcat + + + unins + + + unknown process + + + explorer.exe + + + inetinfo.exe + + + netcat.exe;nc.exe;nc64.exe;ncat.exe + procdump + psexe + vnc;vncs;vncv + + rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe;advanced_port_scanner.exe;rcpping.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe + + + 0 + 5985 + 5986 + 1293 + 1701 + 1194 + 3540 + 3389 + 22 + 1080 + 3128 + 8080 + 1723 + 23 + 4500 + 9001 + 9030 + 5900 + 5800 + + 0 + 80 + 443 + 636 + 5900 + 443 + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe + 80 + true + + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + https + true + + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + http + true + + + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe + 443 + true + + + afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com + + + + + udp + + System;svchost.exe;oracle.exe;apache.exe;java.exe;php-cgi.exe;w3wp.exe;httpd;ServerManager.exe;unknown process;sql;wscript;cscript;schtasks;at.exe;reg.exe;C:\Windows\System32\find.exe + 127.0.0.1;0:0:0:0:0:0:0:1 + 127.0.0.1;0:0:0:0:0:0:0:1 + + + + C:\Windows\System32\lsass.exe + 88 + + + epmap + llmnr + microsoft-ds + netbios-dgm + ntp + ssdp + epmap + llmnr + microsoft-ds + netbios-dgm + ntp + ssdp + + 53 + 67 + 68 + 1434 + 1812 + 3544 + 3702 + 5228 + 5353 + 5357 + 5989 + 6007 + 49154 + 49209 + 52176 + 59241 + 53 + 67 + 68 + 1812 + 3702 + 6007 + 49154 + 49209 + 50646 + 52176 + 59241 + + .bing.com + .cloudapp.net + .lync.com + .microsoft.com + .outlook.com + .search.msn.com + .wns.windows.com + aps.windows.com + arc.msn.com.nsatc.net + arc.msn.com + atson.telemetry.microsoft.com + au.download.windowsupdate.com + b.akamaiedge.net + bingforbusiness.com + client-office365-tas.msedge.net + config.edge.skype.com + csp.digicert.com + ctldl.windowsupdate.com + cy2.licensing.md.mp.microsoft.com.akadns.net + cy2.settings.data.microsoft.com.akadns.net + displaycatalog.mp.microsoft.com + download.windowsupdate.com + e-msedge.net + e3.delivery.dsp.mp.microsoft.com.nsatc.net + emdl.ws.microsoft.com + ettings-win.data.microsoft.com + fe2.update.microsoft.com + fe3.delivery.dsp.mp.microsoft.com.nsatc.net + fe3.delivery.mp.microsoft.com + g.akamaiedge.net + g.live.com + g.msn.com.nsatc.net + geo-prod.do.dsp.mp.microsoft.com + geo-prod.dodsp.mp.microsoft.com.nsatc.net + ile-service.weather.microsoft.com + ip5.afdorigin-prod-am02.afdogw.com + ipv4.login.msa.akadns6.net + licensing.mp.microsoft.com + m3p.wns.notify.windows.com.akadns.net + microsoft.com.akadns.net + microsoft.com.nsatc.net + microsoft.com + modern.watson.data.microsoft.com.akadns.net + msedge.net + msn.com.nsatc.net + msn.com + ocation-inference-westus.cloudapp.net + ocos-office365-s2s.msedge.net + ocsp.digicert.com + odern.watson.data.microsoft.com.akadns.net + oneclient.sfx.ms + pv4.login.msa.akadns6.net + query.prod.cms.rt.microsoft.com + ris.api.iris.microsoft.com.akadns.net + ris.api.iris.microsoft.com + s-msedge.net + settings.data.microsoft.com + sfe.trafficshaping.dsp.mp.microsoft.com + sls.update.microsoft.com + storecatalogrevocation.storequality.microsoft.com + storeedgefd.dsx.mp.microsoft.com + telecommand.telemetry.microsoft.com.akadns.net + tile-service.weather.microsoft.com + tlu.dl.delivery.mp.microsoft.com + tsfe.trafficshaping.dsp.mp.microsoft.com + vip5.afdorigin-prod-am02.afdogw.com + vip5.afdorigin-prod-ch02.afdogw.com + virtualearth.net + windows.net + windowsupdate.com + y2.displaycatalog.md.mp.microsoft.com.akadns.net + y2.licensing.md.mp.microsoft.com.akadns.net + y2.settings.data.microsoft.com.akadns.net + EdgeTransport.exe + MSExchangeDelivery.exe + MSExchangeFrontendTransport.exe + MSExchangeHMWorker.exe + MSExchangeSubmission.exe + \ + + + C:\Program Files (x86)\Kaspersky Lab + C:\Program Files\Kaspersky Lab + C:\Program Files (x86)\ESET + C:\Program Files\ESET + + + + + + + + + + + + + + C:\Windows\ + \System32\;Syswow64;sysmon.exe;sysmon64.exe + + + C:\Windows\system32\ + config\systemprofile\ + + + C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe + + + A:\;B:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;N:\;O:\;P:\;Q:\;R:\;S:\;T:\;U:\;V:\;W:\;X:\;Y:\;Z:\;AA:\;BB:\;CC:\;DD:\;EE:\;FF:\;GG:\;HH:\;II:\;JJ:\;KK:\;LL:\;MM:\;NN:\;OO:\;PP:\;QQ:\;RR:\;SS:\;TT:\;UU:\;VV:\;WW:\;XX:\;YY;ZZ:\ + :\PROGRA~ + :\Program Files + :\Program Files + :\Program Files + :\ProgramData\ + :\Users\ + :\Windows\ + :\inetpub\ + :\$SysReset + :\$WinREAgent + :\inetpub\ + + + \ + + + C:\Users\ + + + C:\ProgramData\ + C:\ProgramData\sysmon\sysmon64.exe;C:\ProgramData\sysmon\sysmon.exe + + + C:\Program Files;C:\PROGRA~ + + + C:\inetpub\ + + + $RECYCLE.BIN + packetbeat.exe;metricbeat.exe;filebeat.exe;winlogbeat.exe;o365beat.exe;graylog-sidecar.exe;graylog-collector-sidecar.exe;splunkd.exe;splunk.exe;syslogng.exe;syslog-ng.exe;nxlog-processor.exe;snarecore.exe;fluentd;td-agent + C:\Windows\system32\config\systemprofile\ + C:\Windows\sysWOW64\config\systemprofile\ + \Temp\ + C:\Users\ + + + + + Microsoft\Teams\current\Teams.exe + \git.exe + Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe + C:\ProgramData\Lenovo\ImController\ + + + + + + + 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e + + + 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5;c948ae14761095e4d76b55d9de86412258be7afd;c996d7971c49252c582171d9380360f2;ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1;10b30bdee43b3a2ec4aa63375577ade650269d25;d2fd132ab7bbc6bbb87a84f026fa0244 + + DumpExt.dll + mimidrv + lsremora + wceaux.dll + npcap + \Temp + :\Users + ChongKim Chan + ? + Revoked + Unavailable + Valid + false + + + SHA1=2261198385d62d2117f50f631652eded0ecc71db + SHA1=8db869c0674221a2d3280143cbb0807fac08e0cc + SHA1=27d3ebea7655a72e6e8b95053753a25db944ec0f + SHA1=33cdab3bbc8b3adce4067a1b042778607dce2acd + SHA1=21e6c104fe9731c874fab5c9560c929b2857b918 + SHA1=d979353d04bf65cc92ad3412605bc81edbb75ec2 + SHA1=2f991435a6f58e25c103a657d24ed892b99690b8 + SHA1=f02af84393e9627ba808d4159841854a6601cf80 + SHA1=bb962c9a8dda93e94fef504c4159de881e4706fe + SHA1=b97a8d506be2e7eaa4385f70c009b22adbd071ba + SHA1=92f251358b3fe86fd5e7aa9b17330afa0d64a705 + SHA1=8b6aa5b2bff44766ef7afbe095966a71bc4183fa + SHA1=af6e1f2cfb230907476e8b2d676129b6d6657124 + SHA1=fcde5275ee1913509927ce5f0f85e6681064c9d2 + SHA1=00a442a4305c62cefa8105c0b4c4a9a5f4d1e93b + SHA1=6523b3fd87de39eb5db1332e4523ce99556077dc + SHA1=72966ca845759d239d09da0de7eebe3abe86fee3 + SHA1=57511ef5ff8162a9d793071b5bf7ebe8371759de + SHA1=2d503a2457a787014a1fdd48a2ece2e6cbe98ea7 + SHA1=400f833dcc2ef0a122dd0e0b1ec4ec929340d90e + SHA1=89cd760e8cb19d29ee08c430fb17a5fd4455c741 + SHA1=1d0df45ee3fa758f0470e055915004e6eae54c95 + SHA1=d5fd9fe10405c4f90235e583526164cd0902ed86 + SHA1=c52cef5b9e1d4a78431b7af56a6fdb6aa1bcad65 + SHA1=609fa1efcf61e26d64a5ceb13b044175ab2b3a13 + SHA1=7d7c03e22049a725ace2a9812c72b53a66c2548b + SHA1=f9519d033d75e1ab6b82b2e156eafe9607edbcfb + SHA1=468e2e5505a3d924b14fedee4ddf240d09393776 + SHA1=2e3de9bff43d7712707ef8a0b10f7e4ad8427fd8 + SHA1=c9cbfdd0be7b35751a017ec59ff7237ffdc4df1f + SHA1=078ae07dec258db4376d5a2a05b9b508d68c0123 + SHA1=623cd2abef6c92255f79cbbd3309cb59176771da + SHA1=1f3a9265963b660392c4053329eb9436deeed339 + SHA1=4a235f0b84ff615e2879fa9e0ec0d745fcfdaa5c + SHA1=ace6b9e34e3e2e73fe584f3bbdb4e4ec106e0a7d + SHA1=4268f30b79ce125a81d0d588bef0d4e2ad409bbb + SHA1=c834c4931b074665d56ccab437dfcc326649d612 + SHA1=8f5cd4a56e6e15935491aa40adb1ecad61eafe7c + SHA1=51b60eaa228458dee605430aae1bc26f3fc62325 + SHA1=3270720a066492b046d7180ca6e60602c764cac7 + SHA1=2a6e6bd51c7062ad24c02a4d2c1b5e948908d131 + SHA1=19bd488fe54b011f387e8c5d202a70019a204adf + SHA1=a6fe4f30ca7cb94d74bc6d42cdd09a136056952e + SHA1=ea877092d57373cb466b44e7dbcad4ce9a547344 + SHA1=205c69f078a563f54f4c0da2d02a25e284370251 + SHA1=f9feb60b23ca69072ce42264cd821fe588a186a6 + SHA1=b25170e09c9fb7c0599bfba3cf617187f6a733ac + SHA1=160c96b5e5db8c96b821895582b501e3c2d5d6e7 + SHA1=a2e0b3162cfa336cd4ab40a2acc95abe7dc53843 + SHA1=4e826430a1389032f3fe06e2cc292f643fb0c417 + SHA1=7ab4565ba24268f0adadb03a5506d4eb1dc7c181 + SHA1=dc7b022f8bd149efbcb2204a48dce75c72633526 + SHA1=0307d76750dd98d707c699aee3b626643afb6936 + SHA1=5711c88e9e64e45b8fc4b90ab6f2dd6437dc5a8a + SHA1=6714380bc0b8ab09b9a0d2fa66d1b025b646b946 + SHA1=8626ab1da6bfbdf61bd327eb944b39fd9df33d1d + SHA1=30a224b22592d952fbe2e6ad97eda4a8f2c734e0 + SHA1=c95db1e82619fb16f8eec9a8209b7b0e853a4ebe + SHA1=fe1d909ab38de1389a2a48352fd1c8415fd2eab0 + SHA1=b4d1554ec19504215d27de0758e13c35ddd6db3e + SHA1=5dd2c31c4357a8b76db095364952b3d0e3935e1d + SHA1=ecb4d096a9c58643b02f328d2c7742a38e017cf0 + SHA1=4a705af959af61bad48ef7579f839cb5ebd654d2 + SHA1=d2e6fc9259420f0c9b6b1769be3b1f63eb36dc57 + SHA1=c948ae14761095e4d76b55d9de86412258be7afd + SHA1=ddbe809b731a0962e404a045ab9e65a0b64917ad + SHA1=745bad097052134548fe159f158c04be5616afc2 + SHA1=8d59fd14a445c8f3f0f7991fa6cd717d466b3754 + SHA1=2dfcb799b3c42ecb0472e27c19b24ac7532775ce + SHA1=cc51be79ae56bc97211f6b73cc905c3492da8f9d + SHA1=ac13941f436139b909d105ad55637e1308f49d9a + SHA1=2b0bb408ff0e66bcdf6574f1ca52cbf4015b257b + SHA1=cc0e0440adc058615e31e8a52372abadf658e6b1 + SHA1=5520ac25d81550a255dc16a0bb89d4b275f6f809 + SHA1=6afc6b04cf73dd461e4a4956365f25c1f1162387 + SHA1=4b009e91bae8d27b160dc195f10c095f8a2441e1 + SHA1=6003184788cd3d2fc624ca801df291ccc4e225ee + SHA1=0466e90bf0e83b776ca8716e01d35a8a2e5f96d3 + SHA1=e6305dddd06490d7f87e3b06d09e9d4c1c643af0 + SHA1=89909fa481ff67d7449ee90d24c167b17b0612f1 + SHA1=d7e8aef8c8feb87ce722c0b9abf34a7e6bab6eb4 + SHA1=5e6ddd2b39a3de0016385cbd7aa50e49451e376d + SHA1=976777d39d73034df6b113dfce1aa6e1d00ffcfd + SHA1=9c6749fc6c1127f8788bff70e0ce9062959637c9 + SHA1=53acd4d9e7ba0b1056cf52af0d191f226eddf312 + SHA1=3abb9d0a9d600200ae19c706e570465ef0a15643 + SHA1=27eab595ec403580236e04101172247c4f5d5426 + SHA1=78b9481607ca6f3a80b4515c432ddfe6550b18a8 + SHA1=414cd15d6c991d19fb5be02e3b9fb0e6c5ce731c + SHA1=d9c09dd725bc7bc3c19b4db37866015817a516ef + SHA1=9c256edd10823ca76c0443a330e523027b70522d + SHA1=35829e096a15e559fcbabf3441d99e580ca3b26e + SHA1=b8de3a1aeeda9deea43e3f768071125851c85bd0 + SHA1=054a50293c7b4eea064c91ef59cf120d8100f237 + SHA1=d94f2fb3198e14bfe69b44fb9f00f2551f7248b2 + SHA1=01a578a3a39697c4de8e3dab04dba55a4c35163e + SHA1=14bf0eaa90e012169745b3e30c281a327751e316 + SHA1=f50c6b84dfb8f2d53ba3bce000a55f0a486c0e79 + SHA1=6100eb82a25d64a7a7702e94c2b21333bc15bd08 + SHA1=bf87e32a651bdfd9b9244a8cf24fca0e459eb614 + SHA1=28b1c0b91eb6afd2d26b239c9f93beb053867a1a + SHA1=879fcc6795cebe67718388228e715c470de87dca + SHA1=1f7501e01d84a2297c85cb39880ec4e40ac3fe8a + SHA1=152b6bb9ffd2ffec00cc46f5c6e29362d0e66e67 + SHA1=5f8356ffa8201f338dd2ea979eb47881a6db9f03 + SHA1=a7bd05de737f8ea57857f1e0845a25677df01872 + SHA1=cce9b82f01ec68f450f5fe4312f40d929c6a506e + SHA1=e35a2b009d54e1a0b231d8a276251f64231b66a3 + SHA1=37364cb5f5cefd68e5eca56f95c0ab4aff43afcc + SHA1=d62fa51e520022483bdc5847141658de689c0c29 + SHA1=93aa3bb934b74160446df3a47fa085fd7f3a6be9 + SHA1=ec4cc6de4c779bb1ca1dd32ee3a03f7e8d633a9b + SHA1=35f1ba60ba0da8512a0b1b15ee8e30fe240d77cd + SHA1=3805e4e08ad342d224973ecdade8b00c40ed31be + SHA1=65d8a7c2e867b22d1c14592b020c548dd0665646 + SHA1=c8d87f3cd34c572870e63a696cf771580e6ea81b + SHA1=c4d7fb9db3c3459f7e8c0e3d48c95c7c9c4cff60 + SHA1=d34a7c497c603f3f7fcad546dc4097c2da17c430 + SHA1=1fd7f881ea4a1dbb5c9aeb9e7ad659a85421745b + SHA1=0b8b83f245d94107cb802a285e6529161d9a834d + SHA1=c969f1f73922fd95db1992a5b552fbc488366a40 + SHA1=ac600a2bc06b312d92e649b7b55e3e91e9d63451 + SHA1=da9cea92f996f938f699902482ac5313d5e8b28e + SHA1=33285b2e97a0aeb317166cce91f6733cf9c1ad53 + SHA1=21edff2937eb5cd6f6b0acb7ee5247681f624260 + SHA1=f052dc35b74a1a6246842fbb35eb481577537826 + SHA1=f0c463d29a5914b01e4607889094f1b7d95e7aaf + SHA1=0c26ab1299adcd9a385b541ef1653728270aa23e + SHA1=f36a47edfacd85e0c6d4d22133dd386aee4eec15 + SHA1=460008b1ffd31792a6deadfa6280fb2a30c8a5d2 + SHA1=738b7918d85e5cb4395df9e3f6fc94ddad90e939 + SHA1=43419df1f9a07430a18c5f3b3cc74de621be0f8e + SHA1=558aad879b6a47d94a968f39d0a4e3a3aaef1ef1 + SHA1=7fb52290883a6b69a96d480f2867643396727e83 + + SHA1=f5696fb352a3fbd14fb1a89ad21a71776027f9ab + SHA1=693a2645c28fc3b248fda95179c36c3ac64f6fc2 + SHA1=05c0c49e8bcf11b883d41441ce87a2ee7a3aba1d + SHA1=d25340ae8e92a6d29f599fef426a2bc1b5217299 + SHA1=7c1b25518dee1e30b5a6eaa1ea8e4a3780c24d0c + SHA1=fe10018af723986db50701c8532df5ed98b17c39 + SHA1=bfe55cacc7c56c9f7bd75bdb4b352c0b745d071b + SHA1=a21c84c6bf2e21d69fa06daaf19b4cc34b589347 + SHA1=82ba5513c33e056c3f54152c8555abf555f3e745 + SHA1=d098600152e5ee6a8238d414d2a77a34da8afaaa + SHA1=64e4ac8b9ea2f050933b7ec76a55dd04e97773b4 + SHA1=bbc1e5fd826961d93b76abd161314cb3592c4436 + SHA1=90a76945fd2fa45fab2b7bcfdaf6563595f94891 + SHA1=b03b1996a40bfea72e4584b82f6b845c503a9748 + SHA1=c771ea59f075170e952c393cfd6fc784b265027c + SHA1=cb44c6f0ee51cb4c5836499bc61dd6c1fbdf8aa1 + SHA1=0918277fcdc64a9dc51c04324377b3468fa1269b + SHA1=b09bcc042d60d2f4c0d08284818ed198cededa04 + + SHA1=8dc2097a90eb7e9d6ee31a7c7a95e7a0b2093b89 + SHA1=15df139494d2c40a645fb010908551185c27f3c5 + SHA1=012db3a80faf1f7f727b538cbe5d94064e7159de + SHA1=d04e5db5b6c848a29732bfd52029001f23c3da75 + SHA1=490109fa6739f114651f4199196c5121d1c6bdf2 + SHA1=b4d014b5edd6e19ce0e8395a64faedf49688ecb5 + SHA1=a87d6eac2d70a3fbc04e59412326b28001c179de + SHA1=3f223581409492172a1e875f130f3485b90fbe5f + SHA1=5db61d00a001fd493591dc919f69b14713889fc5 + + SHA1=9923c8f1e565a05b3c738d283cf5c0ed61a0b90f + SHA1=15d1a6a904c8409fb47a82aefa42f8c3c7d8c370 + SHA1=9d07df024ec457168bf0be7e0009619f6ac4f13c + SHA1=9a35ae9a1f95ce4be64adc604c80079173e4a676 + SHA1=c6bd965300f07012d1b651a9b8776028c45b149a + SHA1=e83458c4a6383223759cd8024e60c17be4e7c85f + SHA1=cb3de54667548a5c9abf5d8fa47db4097fcee9f1 + SHA1=9c24dd75e4074041dbe03bf21f050c77d748b8e9 + SHA1=dc55217b6043d819eadebd423ff07704ee103231 + SHA1=e92817a8744ebc4e4fa5383cdce2b2977f01ecd4 + SHA1=dc0e97adb756c0f30b41840a59b85218cbdd198f + SHA1=26c4a7b392d7e7bd7f0a2a758534e45c0d9a56ab + SHA1=d0d39e1061f30946141b6ecfa0957f8cc3ddeb63 + SHA1=c6d349823bbb1f5b44bae91357895dba653c5861 + SHA1=f42f28d164205d9f6dab9317c9fecad54c38d5d2 + SHA1=bbc0b9fd67c8f4cefa3d76fcb29ff3cef996b825 + SHA1=8183a341ba6c3ce1948bf9be49ab5320e0ee324d + SHA1=eb1ecad3d37bb980f908bf1a912415cff32e79e6 + SHA1=eb0d45aa6f537f5b2f90f3ad99013606eafcd162 + SHA1=6053d258096bccb07cb0057d700fe05233ab1fbb + SHA1=29a190727140f40cea9514a6420f5a195e36386b + SHA1=a4b2c56c12799855162ca3b004b4b2078c6ecf77 + SHA1=7667b72471689151e176baeba4e1cd9cd006a09a + SHA1=d7f7594ff084201c0d9fa2f4ef1626635b67bce5 + SHA1=99201c9555e5faf6e8d82da793b148311f8aa4b8 + SHA1=947db58d6f36a8df9fa2a1057f3a7f653ccbc42e + SHA1=6a3d3b9ab3d201cd6b0316a7f9c3fb4d34d0f403 + SHA1=d702d88b12233be9413446c445f22fda4a92a1d9 + SHA1=910cb12aa49e9f35ecc4907e8304adf0dcca8cf1 + SHA1=643383938d5e0d4fd30d302af3e9293a4798e392 + SHA1=c4ed28fdfba7b8a8dfe39e591006f25d39990f07 + + + SHA1=b0032b8d8e6f4bd19a31619ce38d8e010f29a816 + SHA1=db6245578ec57bd767b27ecf8085095e1c8e5a6e + SHA1=166759fd511613414d3213942fe2575b926a6226 + SHA1=02a8b74899591da7b7f49c0450328d39b939d7e4 + SHA1=98ceed786f79288becc08c3b82c57e8d4bfa1bca + SHA1=f6b3577ea4b1a5641ae3421151a26268434c3db8 + SHA1=4de33d03fee52f396a1c788000ca868d56ac30de + SHA1=c6920171fa6dff2c17eb83befb5fd28e8dddf5f0 + SHA1=fbc6d2448739ddec35bb5d6c94b46df4148f648d + SHA1=6b54f8f137778c1391285fee6150dfa58a8120b1 + SHA1=943593e880b4d340f2548548e6e673ef6f61eed3 + SHA1=5ac4d0e2381fc4a8aebe94a0fb6fe5e7558e4dcd + SHA1=e44297a2b750ec1958bef265e2f1ae6fa4323b28 + SHA1=aa2ea973bb248b18973e57339307cfb8d309f687 + SHA1=3a5d176c50f97b71d139767ed795d178623f491d + SHA1=25d812a5ece19ea375178ef9d60415841087726e + SHA1=3795e32592ab6d8074b6f7ad33759c6a39b0df07 + SHA1=fc121ed6fb37e97a004b6faf217435b772dfc4c0 + SHA1=ab2b8602e4baef828b58b995d0889a8e5b8dbd02 + SHA1=cf040040628b58f4a811f98c2690913c1e8e4e3c + SHA1=3296844d22c87dd5eba3aa378a8242b41d59db7a + SHA1=bc47e15537fa7c32dfefd23168d7e1741f8477ed + SHA1=cb22723faa5ae2809476e5c5e9b9a597b26cab9b + SHA1=f3c5e723ae009b336cd2719137b8cd194c9ee51d + SHA1=41f2d0f9863bce8920c207b1ef5d3d32b603edef + SHA1=eb93d2f564fea9b3dc350f386b45de2cd9a3e001 + SHA1=3cd037fbba8aae82c1b111c9f8755349c98bcb3c + SHA1=9401389fba314d1810f83edce33c37e84a78e112 + SHA1=7eb34cc1fcffb4fdb5cb7e97184dd64a65cb9371 + SHA1=16d7ecf09fc98798a6170e4cef2745e0bee3f5c7 + SHA1=fcd615df88645d1f57ff5702bd6758b77efea6d0 + SHA1=f3db629cfe37a73144d5258e64d9dd8b38084cf4 + SHA1=a00e444120449e35641d58e62ed64bb9c9f518d2 + SHA1=38571f14fc014487194d1eecfa80561ee8644e09 + SHA1=4d41248078181c7f61e6e4906aa96bbdea320dc2 + SHA1=3599ea2ac1fa78f423423a4cf90106ea0938dde8 + SHA1=3d6d53b0f1cc908b898610227b9f1b9352137aba + SHA1=4c18754dca481f107f0923fb8ef5e149d128525d + SHA1=8c377ab4eebc5f4d8dd7bb3f90c0187dfdd3349f + SHA1=cde32654a041fedc7b0fa1083f6005b950760062 + SHA1=5fb9421be8a8b08ec395d05e00fd45eb753b593a + SHA1=b480c54391a2a2f917a44f91a5e9e4590648b332 + SHA1=4f7a8e26a97980544be634b26899afbefb0a833c + + SHA256=05F052C64D192CF69A462A5EC16DDA0D43CA5D0245900C9FCB9201685A2E7748 + SHA256=4045AE77859B1DBF13972451972EAAF6F3C97BEA423E9E78F1C2F14330CD47CA + SHA256=6948480954137987A0BE626C24CF594390960242CD75F094CD6AAA5C2E7A54FA + SHA256=8CB62C5D41148DE416014F80BD1FD033FD4D2BD504CB05B90EEB6992A382D58F + SHA256=B1D96233235A62DBB21B8DBE2D1AE333199669F67664B107BFF1AD49B41D9414 + SHA256=7196187FB1EF8D108B380D37B2AF8EFDEB3CA1F6EEFD37B5DC114C609147216D + SHA256=7F375639A0DF7FE51E5518CF87C3F513C55BC117DB47D28DA8C615642EB18BFA + SHA256=42579A759F3F95F20A2C51D5AC2047A2662A2675B3FB9F46C1ED7F23393A0F00 + SHA256=2DA330A2088409EFC351118445A824F11EDBE51CF3D653B298053785097FE40E + SHA256=436CCAB6F62FA2D29827916E054ADE7ACAE485B3DE1D3E5C6C62D3DEBF1480E7 + SHA256=B4D47EA790920A4531E3DF5A4B4B0721B7FEA6B49A35679F0652F1E590422602 + SHA256=DDE6F28B3F7F2ABBEE59D4864435108791631E9CB4CDFB1F178E5AA9859956D8 + SHA256=B48A309EE0960DA3CAAAAF1E794E8C409993AEB3A2B64809F36B97AAC8A1E62A + SHA256=025E7BE9FCEFD6A83F4471BBA0C11F1C11BD5047047D26626DA24EE9A419CDC4 + SHA256=2AA1B08F47FBB1E2BD2E4A492F5D616968E703E1359A921F62B38B8E4662F0C4 + SHA256=ECE0A900EA089E730741499614C0917432246CEB5E11599EE3A1BB679E24FD2C + SHA256=F40435488389B4FB3B945CA21A8325A51E1B5F80F045AB019748D0EC66056A8B + SHA256=2A652DE6B680D5AD92376AD323021850DAB2C653ABF06EDF26120F7714B8E08A + SHA256=950A4C0C772021CEE26011A92194F0E58D61588F77F2873AA0599DFF52A160C9 + SHA256=0AAFA9F47ACF69D46C9542985994FF5321F00842A28DF2396D4A3076776A83CB + SHA256=47F08F7D30D824A8F4BB8A98916401A37C0FD8502DB308ABA91FE3112B892DCC + SHA256=B9A4E40A5D80FEDD1037EAED958F9F9EFED41EB01ADA73D51B5DCD86E27E0CBF + SHA256=5C04C274A708C9A7D993E33BE3EA9E6119DC29527A767410DBAF93996F87369A + SHA256=0040153302B88BEE27EB4F1ECA6855039E1A057370F5E8C615724FA5215BADA3 + SHA256=3326E2D32BBABD69FEB6024809AFC56C7E39241EBE70A53728C77E80995422A5 + SHA256=36B9E31240AB0341873C7092B63E2E0F2CAB2962EBF9B25271C3A1216B7669EB + SHA256=29E0062A017A93B2F2F5207A608A96DF4D554C5DE976BD0276C2590A03BD3E94 + SHA256=45ABDBCD4C0916B7D9FAAF1CD08543A3A5178871074628E0126A6EDA890D26E0 + SHA256=50DB5480D0392A7DD6AB5DF98389DC24D1ED1E9C98C9C35964B19DABCD6DC67F + SHA256=607DC4C75AC7AEF82AE0616A453866B3B358C6CF5C8F9D29E4D37F844306B97C + SHA256=61D6E40601FA368800980801A662A5B3B36E3C23296E8AE1C85726A56EF18CC8 + SHA256=74A846C61ADC53692D3040AFF4C1916F32987AD72B07FE226E9E7DBEFF1036C4 + SHA256=76FB4DEAEE57EF30E56C382C92ABFFE2CF616D08DBECB3368C8EE6B02E59F303 + SHA256=81939E5C12BD627FF268E9887D6FB57E95E6049F28921F3437898757E7F21469 + SHA256=9790A7B9D624B2B18768BB655DDA4A05A9929633CEF0B1521E79E40D7DE0A05B + SHA256=9A1D66036B0868BBB1B2823209FEDEA61A301D5DD245F8E7D390BD31E52D663E + SHA256=AA9AB1195DC866270E984F1BED5E1358D6EF24C515DFDB6C2A92D1E1B94BF608 + SHA256=AF095DE15A16255CA1B2C27DAD365DFF9AC32D2A75E8E288F5A1307680781685 + SHA256=D5586DC1E61796A9AE5E5D1CED397874753056C3DF2EB963A8916287E1929A71 + SHA256=D8459F7D707C635E2C04D6D6D47B63F73BA3F6629702C7A6E0DF0462F6478AE2 + SHA256=E81230217988F3E7EC6F89A06D231EC66039BDBA340FD8EBB2BBB586506E3293 + SHA256=F88EBB633406A086D9CCA6BC8B66A4EA940C5476529F9033A9E0463512A23A57 + SHA256=1C8DFA14888BB58848B4792FB1D8A921976A9463BE8334CFF45CC96F1276049A + SHA256=22418016E980E0A4A2D01CA210A17059916A4208352C1018B0079CCB19AAF86A + SHA256=405472A8F9400A54BB29D03B436CCD58CFD6442FE686F6D2ED4F63F002854659 + SHA256=49F75746EEBE14E5DB11706B3E58ACCC62D4034D2F1C05C681ECEF5D1AD933BA + SHA256=4A3D4DB86F580B1680D6454BAEE1C1A139E2DDE7D55E972BA7C92EC3F555DCE2 + SHA256=4AB41816ABBF14D59E75B7FAD49E2CB1C1FEB27A3CB27402297A2A4793FF9DA7 + SHA256=54841D9F89E195196E65AA881834804FE3678F1CF6B328CAB8703EDD15E3EC57 + SHA256=5EE292B605CD3751A24E5949AAE615D472A3C72688632C3040DC311055B75A92 + SHA256=76B86543CE05540048F954FED37BDDA66360C4A3DDB8328213D5AEF7A960C184 + SHA256=7F190F6E5AB0EDAFD63391506C2360230AF4C2D56C45FC8996A168A1FC12D457 + SHA256=845F1E228DE249FC1DDF8DC28C39D03E8AD328A6277B6502D3932E83B879A65A + SHA256=84BF1D0BCDF175CFE8AEA2973E0373015793D43907410AE97E2071B2C4B8E2D4 + SHA256=8EF0AD86500094E8FA3D9E7D53163AA6FEEF67C09575C169873C494ED66F057F + SHA256=A56C2A2425EB3A4260CC7FC5C8D7BED7A3B4CD2AF256185F24471C668853AEE8 + SHA256=AC3F613D457FC4D44FA27B2E0B1BAA62C09415705EFB5A40A4756DA39B3AC165 + SHA256=B1334A71CC73B3D0C54F62D8011BEC330DFC355A239BF94A121F6E4C86A30A2E + SHA256=B47BE212352D407D0EF7458A7161C66B47C2AEC8391DD101DF11E65728337A6A + SHA256=B9B3878DDC5DFB237D38F8D25067267870AFD67D12A330397A8853209C4D889C + SHA256=DB90E554AD249C2BD888282ECF7D8DA4D1538DD364129A3327B54F8242DD5653 + SHA256=E61A54F6D3869B43C4ECEAC3016DF73DF67CCE03878C5A6167166601C5D3F028 + SHA256=3871E16758A1778907667F78589359734F7F62F9DC953EC558946DCDBE6951E3 + SHA256=DED2927F9A4E64EEFD09D0CABA78E94F309E3A6292841AE81D5528CAB109F95D + SHA256=0296E2CE999E67C76352613A718E11516FE1B0EFC3FFDB8918FC999DD76A73A5 + SHA256=80CBBA9F404DF3E642F22C476664D63D7C229D45D34F5CD0E19C65EB41BECEC3 + SHA256=BB50818A07B0EB1BD317467139B7EB4BAD6CD89053FECDABFEAE111689825955 + SHA256=FF6729518A380BF57F1BC6F1EC0AA7F3012E1618B8D9B0F31A61D299EE2B4339 + SHA256=3A5EC83FE670E5E23AEF3AFA0A7241053F5B6BE5E6CA01766D6B5F9177183C25 + SHA256=61A1BDDDD3C512E681818DEBB5BEE94DB701768FC25E674FCAD46592A3259BD0 + SHA256=07B6D69BAFCFD767F1B63A490A8843C3BB1F8E1BBEA56176109B5743C8F7D357 + SHA256=21CCDD306B5183C00ECFD0475B3152E7D94B921E858E59B68A03E925D1715F21 + SHA256=2D83CCB1AD9839C9F5B3F10B1F856177DF1594C66CBBC7661677D4B462EBF44D + SHA256=F581DECC2888EF27EE1EA85EA23BBB5FB2FE6A554266FF5A1476ACD1D29D53AF + SHA256=F8965FDCE668692C3785AFA3559159F9A18287BC0D53ABB21902895A8ECF221B + SHA256=3D23BDBAF9905259D858DF5BF991EB23D2DC9F4ECDA7F9F77839691ACEF1B8C4 + SHA256=DD4A1253D47DE14EF83F1BC8B40816A86CCF90D1E624C5ADF9203AE9D51D4097 + SHA256=509628B6D16D2428031311D7BD2ADD8D5F5160E9ECC0CD909F1E82BBBB3234D6 + SHA256=525D9B51A80CA0CD4C5889A96F857E73F3A80DA1FFBAE59851E0F51BDFB0B6CD + SHA256=6DE84CAA2CA18673E01B91AF58220C60AECD5CCCF269725EC3C7F226B2167492 + SHA256=09BEDBF7A41E0F8DABE4F41D331DB58373CE15B2E9204540873A1884F38BDDE1 + SHA256=101402D4F5D1AE413DED499C78A5FCBBC7E3BAE9B000D64C1DD64E3C48C37558 + SHA256=131D5490CEB9A5B2324D8E927FEA5BECFC633015661DE2F4C2F2375A3A3B64C6 + SHA256=1DDFE4756F5DB9FB319D6C6DA9C41C588A729D9E7817190B027B38E9C076D219 + SHA256=1E8B0C1966E566A523D652E00F7727D8B0663F1DFDCE3B9A09B9ADFAEF48D8EE + SHA256=2BBE65CBEC3BB069E92233924F7EE1F95FFA16173FCEB932C34F68D862781250 + SHA256=30706F110725199E338E9CC1C940D9A644D19A14F0EB8847712CBA4CACDA67AB + SHA256=3124B0411B8077605DB2A9B7909D8240E0D554496600E2706E531C93C931E1B5 + SHA256=38FA0C663C8689048726666F1C5E019FEAA9DA8278F1DF6FF62DA33961891D2A + SHA256=39CFDE7D401EFCE4F550E0A9461F5FC4D71FA07235E1336E4F0B4882BD76550E + SHA256=3D9E83B189FCF5C3541C62D1F54A0DA0A4E5B62C3243D2989AFC46644056C8E3 + SHA256=3F2FDA9A7A9C57B7138687BBCE49A2E156D6095DDDABB3454EA09737E02C3FA5 + SHA256=47F0CDAA2359A63AD1389EF4A635F1F6EEE1F63BDF6EF177F114BDCDADC2E005 + SHA256=50D5EAA168C077CE5B7F15B3F2C43BD2B86B07B1E926C1B332F8CB13BD2E0793 + SHA256=56A3C9AC137D862A85B4004F043D46542A1B61C6ACB438098A9640469E2D80E7 + SHA256=591BD5E92DFA0117B3DAA29750E73E2DB25BAA717C31217539D30FFB1F7F3A52 + SHA256=5D530E111400785D183057113D70623E17AF32931668AB7C7FC826F0FD4F91A3 + SHA256=6F1FF29E2E710F6D064DC74E8E011331D807C32CC2A622CBE507FD4B4D43F8F4 + SHA256=79E2D37632C417138970B4FEBA91B7E10C2EA251C5EFE3D1FC6FA0190F176B57 + SHA256=85866E8C25D82C1EC91D7A8076C7D073CCCF421CF57D9C83D80D63943A4EDD94 + SHA256=89B0017BC30CC026E32B758C66A1AF88BD54C6A78E11EC2908FF854E00AC46BE + SHA256=9254F012009D55F555418FF85F7D93B184AB7CB0E37AECDFDAB62CFE94DEA96B + SHA256=984A77E5424C6D099051441005F2938AE92B31B5AD8F6521C6B001932862ADD7 + SHA256=98B734DDA78C16EBCAA4AFEB31007926542B63B2F163B2F733FA0D00DBB344D8 + SHA256=99F4994A0E5BD1BF6E3F637D3225C69FF4CD620557E23637533E7F18D7D6CBA1 + SHA256=9C10E2EC4F9EF591415F9A784B93DC9C9CDAFA7C69602C0DC860C5B62222E449 + SHA256=A961F5939088238D76757669A9A81905E33F247C9C635B908DAAC146AE063499 + SHA256=A9706E320179993DADE519A83061477ACE195DAA1B788662825484813001F526 + SHA256=B7A20B5F15E1871B392782C46EBCC897929443D82073EE4DCB3874B6A5976B5D + SHA256=CC586254E9E89E88334ADEE44E332166119307E79C2F18F6C2AB90CE8BA7FC9B + SHA256=CD4A249C3EF65AF285D0F8F30A8A96E83688486AAB515836318A2559757A89BB + SHA256=CF4B5FA853CE809F1924DF3A3AE3C4E191878C4EA5248D8785DC7E51807A512B + SHA256=D0BD1AE72AEB5F3EABF1531A635F990E5EAAE7FDD560342F915F723766C80889 + SHA256=D8B58F6A89A7618558E37AFC360CD772B6731E3BA367F8D58734ECEE2244A530 + SHA256=D92EAB70BCECE4432258C9C9A914483A2267F6AB5CE2630048D3A99E8CB1B482 + SHA256=E005E8D183E853A27AD3BB56F25489F369C11B0D47E3D4095AAD9291B3343BF1 + SHA256=E68D453D333854787F8470C8BAEF3E0D082F26DF5AA19C0493898BCF3401E39A + SHA256=E83908EBA2501A00EF9E74E7D1C8B4FF1279F1CD6051707FD51824F87E4378FA + SHA256=EF86C4E5EE1DBC4F81CD864E8CD2F4A2A85EE4475B9A9AB698A4AE1CC71FBEB0 + SHA256=F088B2BA27DACD5C28F8EE428F1350DCA4BC7C6606309C287C801B2E1DA1A53D + SHA256=FD8669794C67B396C12FC5F08E9C004FDF851A82FAF302846878173E4FBECB03 + SHA256=91314768DA140999E682D2A290D48B78BB25A35525EA12C1B1F9634D14602B2C + SHA256=F0605DDA1DEF240DC7E14EFA73927D6C6D89988C01EA8647B671667B2B167008 + SHA256=6CB51AE871FBD5D07C5AAD6FF8EEA43D34063089528603CA9CEB8B4F52F68DDC + SHA256=DB2A9247177E8CDD50FE9433D066B86FFD2A84301AA6B2EB60F361CFFF077004 + SHA256=7EC93F34EB323823EB199FBF8D06219086D517D0E8F4B9E348D7AFD41EC9FD5D + SHA256=7049F3C939EFE76A5556C2A2C04386DB51DAF61D56B679F4868BB0983C996EBB + SHA256=7877C1B0E7429453B750218CA491C2825DAE684AD9616642EFF7B41715C70ACA + SHA256=159E7C5A12157AF92E0D14A0D3EA116F91C09E21A9831486E6DC592C93C10980 + SHA256=3243AAB18E273A9B9C4280A57AECEF278E10BFFF19ABB260D7A7820E41739099 + SHA256=7CFA5E10DFF8A99A5D544B011F676BC383991274C693E21E3AF40CF6982ADB8C + SHA256=C9B49B52B493B53CD49C12C3FA9553E57C5394555B64E32D1208F5B96A5B8C6E + SHA256=3EC5AD51E6879464DFBCCB9F4ED76C6325056A42548D5994BA869DA9C4C039A8 + SHA256=47EAEBC920CCF99E09FC9924FEB6B19B8A28589F52783327067C9B09754B5E84 + + SHA256=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b + SHA256=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790 + SHA256=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22 + SHA256=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44 + SHA256=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8 + SHA256=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009 + SHA256=39937d239220c1b779d7d55613de2c0a48bd6e12e0214da4c65992b96cf591df + SHA256=7ed26a593524a2a92ffcfb075a42bb4fa4775ffbf83af98525244a4710886ead + SHA256=aa717e9ab4d614497df19f602d289a6eddcdba8027c71bcc807780a219347d16 + SHA256=ff5f6048a3d6f6738b60e911e3876fcbdc9a02ec9862f909345c8a50fd4cc0a7 + SHA256=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 + SHA256=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495 + SHA256=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd + SHA256=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c + SHA256=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427 + + SHA256=952199C28332BC90CFD74530A77EE237967ED32B3C71322559C59F7A42187DC4 + SHA256=9529EFB1837B1005E5E8F477773752078E0A46500C748BC30C9B5084D04082E6 + SHA256=A7B000ABBCC344444A9B00CFADE7AA22AB92CE0CADEC196C30EB1851AE4FA062 + SHA256=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b + SHA256=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece + SHA256=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374 + SHA256=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50 + SHA256=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6 + SHA256=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e + + SHA256=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc + SHA256=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d + SHA256=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65 + SHA256=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347 + SHA256=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9 + SHA256=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219 + SHA256=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8 + SHA256=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813 + SHA256=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a + SHA256=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f + SHA256=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc + SHA256=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de + SHA256=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073 + SHA256=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890 + SHA256=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0 + SHA256=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200 + SHA256=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf + SHA256=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2 + SHA256=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173 + SHA256=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6 + SHA256=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8 + SHA256=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508 + SHA256=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3 + SHA256=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52 + SHA256=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129 + SHA256=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993 + SHA256=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d + SHA256=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd + SHA256=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35 + SHA256=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33 + SHA256=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29 + + + SHA256=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838 + SHA256=3c5bf92c26398695f9ced7ce647a7e9f6ddcc89eea66b45aa3607196a187431b + SHA256=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82 + SHA256=4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7 + SHA256=b205835b818d8a50903cf76936fcf8160060762725bd74a523320cfbd091c038 + SHA256=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89 + SHA256=73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e + SHA256=87e38e7aeaaaa96efe1a74f59fca8371de93544b7af22862eb0e574cec49c7c3 + SHA256=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6 + SHA256=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89 + SHA256=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf + SHA256=1dadd707c55413a16320dc70d2ca7784b94c6658331a753b3424ae696c5d93ea + SHA256=d84e3e250a86227c64a96f6d5ac2b447674ba93d399160850acb2339da43eae5 + SHA256=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a + SHA256=0f726d8ce21c0c9e01ebe6b55913c519ad6086bcaec1a89f8308f3effacd435f + SHA256=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3 + SHA256=0e14a4401011a9f4e444028ac5b1595da34bbbf9af04a00670f15ff839734003 + SHA256=26c86227d3f387897c1efd77dc711eef748eb90be84149cb306e3d4c45cc71c7 + SHA256=42d926cfb3794f9b1e3cb397498696cb687f505e15feb9df11b419c49c9af498 + SHA256=1684e24dae20ab83ab5462aa1ff6473110ec53f52a32cfb8c1fe95a2642c6d22 + SHA256=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4 + SHA256=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c + SHA256=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53 + SHA256=3a364a7a3f6c0f2f925a060e84fb18b16c118125165b5ea6c94363221dc1b6de + SHA256=fda506e2aa85dc41a4cbc23d3ecc71ab34e06f1def736e58862dc449acbc2330 + SHA256=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46 + SHA256=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347 + SHA256=8596ea3952d84eeef8f5dc5b0b83014feb101ec295b2d80910f21508a95aa026 + SHA256=52a90fd1546c068b92add52c29fbb8a87d472a57e609146bbcb34862f9dcec15 + SHA256=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91 + SHA256=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf + SHA256=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c + SHA256=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64 + SHA256=3ed15a390d8dfbd8a8fb99e8367e19bfd1cced0e629dfe43ccdb46c863394b59 + SHA256=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6 + SHA256=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b + SHA256=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9 + SHA256=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351 + SHA256=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5 + SHA256=ff803017d1acafde6149fe7d463aee23b1c4f6f3b97c698c05f3ca6f07e4df6c + SHA256=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b + SHA256=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05 + SHA256=a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433 + + + + + + + + + + + + + + + msdt.exe + sdiageng.dll + + + WINWORD.exe;EXCEL.EXE + VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wshom.ocx + wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll + + + ntkrnlmp.exe + + + \spool\drivers\x64\3\;\spool\drivers\W32X86\3\;\spool\drivers\IA64\3\ + spoolsv.exe;printisolationhost.exe + Valid + Brother Industries;Canon;Sharp;Microsoft Corporation;DYMO;Euro Plus d.o.o;HP Inc;Hewlett-Packard + + + C:\Windows\ + \Users\Public\;\Desktop\;\Downloads\;\AppData\Local\Temp\;\PerfLogs\;$Recycle;\Fonts\ + \Program Files + + + EQNEDT32.EXE + EQNEDT32.EXE + + + ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll + C:\Users;\Temp\;\ProgramData\ + + + ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll + \wscript.exe;\cscript.exe;\powershell.exe;\powershell_ise.exe;\rundll32.exe;\msbuild.exe;\csc.exe + + + WINWORD.exe;EXCEL.EXE + VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wshom.ocx + wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll;fastprox.dll + + + WINWORD.exe;EXCEL.EXE + VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll + + + WINWORD.exe;EXCEL.EXE + VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll + + + WINWORD.exe;EXCEL.EXE + taskschd.dll + + + wscript.exe;cscript.exe + taskschd.dll + + + wmiprvse.exe + taskschd.dll + + + powershell.exe + msi.dll + + + powershell + amsi.dll + + + powershell + amsi.dll + + + logoncli.dll + C:\Windows\System32\wbem\WmiPrvSE.exe + + + WINWORD.exe;EXCEL.EXE + clr.dll + + + clr.dll;System.Management.ni.dll;Microsoft.Build.Utilities + + + wscript.exe;cscript.exe + msxml;wshom.ocx + + + wscript.exe;cscript.exe + winhttp.dll;mswsock.dll;IPHLPAPI.DLL + + + installutil.exe + CustomMarshalers.dll;CustomMarshalers.ni.dll;System.Management.ni.dll;WMINet_Utils.dll;mswsock.dll + + + System.Management.Automation.ni.dll + C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ + + + System.Management.Automation.dll + C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ + Lenovo.Vantage.AddinHost;\Microsoft.Sara.exe;C:\Program Files\CONEXANT + + + C:\Windows\System32\vaultcli.dll + \svchost.exe;\GameBar.exe;C:\Program Files\WindowsApps;\Microsoft\Teams\current\Teams.exe + + + \\ + + + \Microsoft\Word\Startup\ + .wll + + + \Microsoft\Excel\Startup\ + .xll + + + \Microsoft\Addins\ + .xla + + + tor-lib.dll + + + C:\Windows\System32\WinSCard.dll;C:\Windows\System32\cryptdll.dll;C:\Windows\System32\hid.dll;C:\Windows\System32\samlib.dll;C:\Windows\System32\vaultcli.dll + + + rundll32.exe + vaultcli.dll;wlanapi.dll + combase.dll + cryptdll.dll + imm32.dll + logoncli.dll + netapi32.dll + ntasn1.dll + ntdsapi.dll + samlib.dll + shcore.dll + srvcli.dll + + + odbc32.dll;winhttp.dll;netapi32.dll;SHLWAPI.dll + + + C:\Windows\Explorer.EXE + C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe + + + C:\ProgramData\ + C:\ProgramData\ + .exe + Adobe + C:\ProgramData\Lenovo\ + C:\ProgramData\Microsoft\Windows Defender\ + C:\ProgramData\sysmon\sysmon64.exe + + + C:\Users\Default\;C:\Users\Public\ + .exe + + + C:\Users\Default\;C:\Users\Public\ + .dll + + + 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e + + + SHA256=074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 + SHA256=45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 + SHA256=9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 + SHA256=29b75f0db3006440651c6342dc3c0672210cfb339141c75e12f6c84d990931c3 + SHA256=c8c907a67955bcdf07dd11d35f2a23498fb5ffe5c6b5d7f36870cf07da47bff2 + SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e + + + C:\Windows\System32\svchost.exe + false + + + Revoked + + + Expired + + + jscript9.dll + mshta.exe + + scrobj.dll + crypt0.dll + + C:\Windows\System32\wlanapi.dll + C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe + C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe + C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience + C:\Windows\ImmersiveControlPanel\SystemSettings.exe + C:\Windows\ImmersiveControlPanel\SystemSettings.exe + C:\Windows\System32\AppHostRegistrationVerifier.exe + C:\Windows\System32\CompatTelRunner.exe + C:\Windows\System32\DeviceCensus.exe + C:\Windows\System32\DriverStore\FileRepository\ + C:\Windows\System32\LogonUI.exe + C:\Windows\System32\MoNotificationUx.exe + C:\Windows\System32\SystemSettingsBroker.exe + C:\Windows\System32\dxgiadaptercache.exe + C:\Windows\System32\netsh.exe + C:\Windows\System32\wlanext.exe + C:\Windows\UUS\amd64\MoUsoCoreWorker.exe + C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_ + C:\Windows\explorer.exe + + + python + + + C:\Windows\Microsoft.NET\assembly\GAC_MSIL + false + + + C:\Windows\Microsoft.NET\assembly\GAC_MSIL + true + + + + + + + \Microsoft Office\ + \mscorlib.ni.dll + + + \Microsoft Office\ + \sppc.dll + + + C:\Windows\System32\svchost.exe + true + + + + C:\Program Files (x86)\Kaspersky Lab + C:\Program Files\Kaspersky Lab + C:\Program Files (x86)\ESET + C:\Program Files\ESET + C:\ProgramData\Microsoft\Windows Defender\ + + Fortinet + Lenovo + Sophos + mscorsvw.exe + C:\Program Files (x86)\Microsoft Office\root\Office15\officebackgroundtaskhandler.exe + C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe + C:\Program Files\Microsoft Office\root\Office15\officebackgroundtaskhandler.exe + C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe + C:\Windows\SysWOW64\SearchProtocolHost.exe + C:\Windows\System32\InstallAgentUserBroker.exe + C:\Windows\System32\RuntimeBroker.exe + C:\Windows\System32\SearchIndexer.exe + C:\Windows\System32\SettingSyncHost.exe + C:\Windows\System32\backgroundTaskHost.exe + C:\Windows\System32\sppsvc.exe + C:\Windows\System32\taskhost.exe + C:\Windows\System32\taskhostw.exe + C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe + C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe + HxTsr.exe + SearchUI.exe + C:\Program Files (x86)\Common Files\BIExcelFunctions1.1\32bit\Sage. + C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Pfx. + C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Adist64.dll + C:\Program Files (x86)\Microsoft Office\Office15\Library\Analysis\ANALYS32.XLL + C:\Program Files (x86)\Microsoft Office\Office16\Library\Analysis\ANALYS32.XLL + C:\Program Files\Microsoft Office\Office15\Library\Analysis\ANALYS32.XLL + C:\Program Files\Microsoft Office\Office16\Library\Analysis\ANALYS32.XLL + C:\Windows\SysWOW64\sppc.dll + Microsoft.Office.Interop.VisOcx.dll + Microsoft.Office.Interop.Word.dll + Microsoft.Vbe.Interop.dll + OFFICE.DLL + + + + + + + + 0x001A0000 + c:\windows\system32\lsass.exe + + + msiexec.exe + + + chrome.exe;firefox.exe;edge.exe;browser_broker.exe;iexplore.exe;opera.exe + + + 0x001A0000 + c:\windows\system32\lsass.exe + + + c:\windows\system32\lsass.exe + c:\windows\system32\rundll32.exe + + + DbgUiRemoteBreakin + nacl64.exe + + + QueryProcessDebugInformationRemote + nacl64.exe + + + isdebuggerpresent + nacl64.exe + + + DebugActiveProcess + nacl64.exe + + + LoadLibrary + C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe + C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe + C:\Windows\ImmersiveControlPanel\SystemSettings.exe + C:\Windows\System32\DriverStore\FileRepository\ + C:\Windows\System32\igfxEM.exe + C:\Windows\System32\igfxHK.exe + Enterprise\Common7\IDE\devenv.exe + C:\Program Files (x86)\ASUS\ROG Live Service\FileOperator.exe + C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe + + + CreateFileMapping;MapViewOfFile + + + LdrLoadDll + + + CryptAcquireContextA;CryptDecodeObjectEx;CryptImportPublicKeyInfo;CryptEncrypt;CryptGenKey;CryptDecrypt;CryptStringToBinary;CryptBinaryToString;CryptImportKey + + + c:\windows\system32\csrss.exe + CrtlRoutine + + 0B80 + 0C7C + 0C88 + c:\windows\system32\mstsc.exe + + C:\WINDOWS\SYSTEM32\ntdll.dll + EtwEventWrite + + + + + + + C:\Windows\SysWOW64\wbem\WmiPrvSE.exe + C:\Windows\system32\audiodg.exe + C:\Windows\system32\services.exe + C:\Windows\system32\svchost.exe + C:\Windows\system32\wbem\WmiPrvSE.exe + C:\Windows\system32\wininit.exe + C:\Windows\system32\winlogon.exe + + + + + + + + + + + + + C:\Windows\System32\SHELL32.dll+9b5bd + \LocalBridge.exe + + + C:\Windows\System32\wshom.ocx+c8a0;C:\Windows\System32\wshom.ocx+c39d + + + C:\Windows\SYSTEM32\framedynos.dll+2cb3e + C:\Windows\system32\SgrmBroker.exe;C:\Windows\system32\SecurityHealthService.exe;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Windows\system32\services.exe;C:\Windows\system32\wininit.exe;C:\Windows\system32\sppsvc.exe;C:\Windows\System32\smss.exe;C:\Windows\system32\csrss.exe;C:\Windows\System32\svchost.exe + + + C:\Windows\SYSTEM32\framedynos.dll+2b496 + + + C:\Windows\SYSTEM32\dbgcore.DLL+6cfb + + + C:\Windows\System32\KernelBase.dll+de67e + + + ntdll.dll+a0044 + + + clr.dll+6c23;clr.dll+6b38 + + + C:\Windows\\SYSTEM32\ntdll.dll+;|C:\Windows\System32\KERNELBASE.dll+;|UNKNOWN( + ) + + + "UNKNOWN(;)|UNKNOWN( + ) + + + "UNKNOWN + 0x1F0FFF;0x1F1FFF;0x143A;0x1410;0x1010;0x1F2FFF;0x1F3FFF;0x1FFFFF + + + C:\Program Files;\Microsoft Office\Root\Office + \Microsoft Shared\VBA + C:\Program Files (x86)\Intuit\ + + + C:\Windows\system32\lsass.exe + 0x1FFFFF + UNKNOWN + WmiPerfClass.dll + C:\Windows\sysWOW64\wbem\wmiprvse.exe;C:\Windows\system32\wbem\wmiprvse.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe;WmiPerfClass.dll;C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files (x86)\Common Files\Adobe + + + C:\Windows\system32\lsass.exe + C:\Windows\system32\wsmprovhost.exe + + + C:\Windows\system32\lsass.exe + 0x1FFFFF + python27.dll;_ctypes.pyd;KERNELBASE.dll;ntdll.dll + + + C:\Windows\system32\lsass.exe + C:\Windows\SYSTEM32\ntdll.dll+4595c|C:\Windows\system32\KERNELBASE.dll+8185 + + + C:\Windows\system32\lsass.exe + C:\WINDOWS\SYSTEM32\ntdll.dll+ + ) + |C:\WINDOWS\System32\KERNELBASE.dll+;|UNKNOWN( + wow64.dll;)|C;Exchange.Diagnostics;Microsoft.Exchange + C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe;c:\windows\system32\inetsrv\w3wp.exe;MSExchangeHMHost.exe;C:\Windows\sysWOW64\wbem\wmiprvse.exe + + + C:\Windows\system32\winlogon.exe + 0x1F3FFF + C:\Windows\Microsoft.NET;UNKNOWN + + + .exe + C:\Windows\sysmon64.exe;C:\Windows\sysmon64.exe + 0x1C00 + + + C:\Windows\system32\lsass.exe + 0x1F1FFF + UNKNOWN + + + C:\Windows\system32\lsass.exe + 0x1010 + UNKNOWN + + + C:\Windows\system32\lsass.exe + 0x143A + UNKNOWN + + + C:\Windows\system32\lsass.exe + 0x1fffff + dbghelp.dll;dbgcore.dll + + + dbghelp.dll;dbgcore.dll + C:\Windows\system32\lsass.exe + C:\wfx32\ + + + powershell.exe + C:\Programdata\sysmon\sysmon64.exe;C:\Programdata\sysmon\sysmon.exe;C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe;\dismhost.exe + C:\WINDOWS\SYSTEM32\ntdll.dll+;|C:\WINDOWS\System32\KERNELBASE.dll+;|C:\ProgramData\Microsoft\Windows Defender\Platform\;\MPCLIENT.DLL;\MpOav.dll+;|C:\WINDOWS\SYSTEM32\amsi.dll + + + getasynckeystate + + + cmlua.dll + + + System.Management.Automation + C:\ProgramData\Microsoft\Windows Defender\platform\ + ctiuser.dll + C:\Program Files\Citrix\ConfigSync\ConfigSyncRun.exe + C:\Program Files\Microsoft\Exchange Server\V14\bin\ExSetupUI.exe + C:\Program Files\Microsoft\Exchange Server\V15\bin\ExSetupUI.exe + C:\Program Files\Microsoft\Exchange Server\V16\bin\ExSetupUI.exe + C:\Windows\SysWOW64\sdiagnhost.exe + C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe + C:\Windows\Temp\ExchangeSetup\ExSetupUI.exe + C:\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe + C:\Program Files\Microsoft Azure Active Directory Connect\AzureADConnect.exe + C:\Windows\system32\HOSTNAME.EXE + C:\Windows\system32\ROUTE.exe + C:\Windows\system32\query.exe + MsMpEng.exe + + + C:\Windows\system32\lsass.exe + comsvcs.dll + + + VBE7.dll;VBEUI.DLL;VBE7INTL.DLL + + + VBE6.dll;VBEUI.DLL;VBE6INTL.DLL + + + Office + verclsid.exe + VBE7.dll;VBEUI.DLL;VBE7INTL.DLL + |UNKNOWN( + 0x1FFFFF + + + C:\Program Files\Microsoft Office\Root\Office + C:\Windows\System32\KERNELBASE.dll+76516 + + + C:\Windows\System32\SHELL32.dll+ae3b9 + C:\WINDOWS\system32\sihost.exe + C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub + + UNKNOWN + + |UNKNOWN( + C:\WINDOWS\SYSTEM32\ntdll.dll+ + |C:\WINDOWS\System32\KERNELBASE.dll+ + ) + 0x1028;0x1fffff + C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git;\Intel\Driver and Support Assistant\DSAService.exe + C:\Windows\Microsoft.NET\Framework\;\NGenTask.exe + \Intel\Driver and Support Assistant\ + C:\Windows\Microsoft.NET\Framework\;\ngen.exe + + + winword.exe;excel.exe;powerpnt.exe + :\Windows\Microsoft.NET\Framework64\v2.;UNKNOWN + + + UNKNOWN + 0x147a + + + C:\Windows\Sysmon64.exe;C:\Windows\Sysmon.exe + C:\WINDOWS\system32\wbem\wmiprvse.exe + C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe + C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe + C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe;C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe;C:\Program Files (x86)\Google\Update\GoogleUpdate.exe + 0x1400 + + + 0x0800 + + 0x0810 + + 0x0820 + + 0x810 + + 0x820 + cscript.exe + wscript.exe + jjs.exe + dump + mimikatz + CorperfmontExt.dll + + + + + + wmiprvse.exe + lsass.exe + + + lsass.exe + winlogon.exe + + + + lsass.exe + C:\Windows\system32\w32tm.exe;C:\Windows\System32\ping.exe;C:\Windows\System32\net.exe;C:\Windows\System32\net1.exe;C:\Windows\SYSTEM32\HOSTNAME.EXE;C:\Programdata\sysmon\sysmon.exe;C:\Programdata\sysmon\sysmon64.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\Program Files (x86)\BeAnywhere Support Express\;C:\Program Files (x86)\CheckPoint\;C:\Program Files (x86)\Common Files\Intuit\QuickBooks\;C:\Program Files (x86)\Fortinet\;C:\Program Files (x86)\Trend Micro\;C:\Program Files\Adobe\Adobe Creative Cloud Experience\;C:\Program Files\CheckPoint\;C:\Program Files\Fortinet\;C:\Program Files\Realtek;C:\Program Files\Trend Micro\;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Program Files (x86)\Lenovo\;snmpd.exe;taskmgr;:\Windows\System32\smss.exe;:\Windows\system32\wininit.exe;\Bin\FMS.exe; \EMET_GUI.exe;\EMET_Service.exe;\Google\Update\GoogleUpdate.exe;\RAAGTAPP.EXE;\controls\cef\ConnectWise.exe;C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe;C:\Program Files\Hewlett-Packard\AMS\service\hpqams.exe;C:\Program Files\Intel\SUR\WILLAMETTE\ESRV\esrv_svc.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\WINDOWS\system32\WerFault.exe;C:\WINDOWS\system32\taskkill.exe;C:\Windows\SysWOW64\WerFault.exe;C:\Windows\System32\snmp.exe;C:\Windows\system32\msiexec.exe;C:\Windows\system32\spoolsv.exe;C:\Windows\system32\svchost.exe + + + :\Windows\system32\sppsvc.exe + :\Windows\system32\sdiagnhost.exe + + UNKNOWN(00007F + + C:\Windows\SYSTEM32\ntdll.dll + C:\Windows\SYSTEM32\win32u.dll + C:\Windows\SYSTEM32\wow64win.dll + + + C:\Program Files (x86)\Kaspersky Lab + C:\Program Files\Kaspersky Lab + C:\Program Files (x86)\ESET + C:\Program Files\ESET + C:\ProgramData\Microsoft\Windows Defender\ + + + + + + + + + + \TEMP\nessus_ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + solarwinds.businesslayerhost + .exe;.dll;.ps1;.mz;.jpg;.png + + + C:\WINDOWS\SysWOW64\netsetupsvc.dll + + + C:\Windows\SoftwareDistribution + C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe + .exe + + + proj + .targets + .build + .props + .tasks + .sln + .cs + + + + + + + .bat + .btm + .cmd + .com + .cmdline + .bas + .bin + C:\Windows\SysWOW64\Wbem + C:\Windows\System32\Wbem + .ws + .wsc + .wsf + .wsh + .pif + + .hta + + IronPython + .py + .pyc + .pyd + + + .cdxml + .ps1 + .ps1xml + .psc1 + .psd1 + .psm1 + .pssc + + + powershell.exe;powershell_ise.exe + \Recent\CustomDestinations\ + + C:\Windows\SysWOW64\WindowsPowerShell + C:\Windows\System32\WindowsPowerShell + c:\Windows\System32\WindowsPowerShell\v1.0\profile + c:\Windows\Syswow64\WindowsPowerShell\v1.0\profile + \UsageLogs\powershell.exe.log + PSReadLine\ConsoleHost_history.txt + + .vbs + .oracle_jre_usage\ + .js + .jse + .vb + .vbe + .vbsript + + + + + Report.wer.tmp + \WER\ + C:\Windows\system32\wermgr.exe + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe + .exe + C:\Users + + + winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe + .dll + C:\Users + + + + + + + + + + + !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;=READ=THIS=PLEASE=;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy + C:\Users\;\Google\Chrome Beta\User Data\;\IndexedDB\ + C:\Program Files\WindowsApps\Microsoft.YourPhone_;C:\Program Files\dotnet\shared\Microsoft.NETCore.App\;\Microsoft.NET\assembly\GAC_MSIL + + crackmapexec + \Crypto.Cipher._AES.pyd + \Crypto.Cipher._DES.pyd + \Crypto.Hash._SHA256.pyd + \Crypto.Random.OSRNG.winrandom.pyd + \Crypto.Util.strxor.pyd + \crackmapexec.exe.manifest + \greenlet.pyd + BootStrapDLL.dll + C:\windows\temp\wininit.exe + lazycat;powerkatz;mimikatz;mimidrv;mimilove;mimilib;mimikittenz;mimiauth;invoke-mimi + rdpwrap.dll + winspool.drv + + C:\Windows\System32\Wbem + C:\Windows\SysWOW64\Wbem + C:\WINDOWS\system32\wbem\scrcons.exe + + + + + \Programs\Startup\ + \Startup\ + + + + + + + + + + + + \Word\STARTUP\ + \Microsoft\Templates\ + \Excel\XLSTART\ + .dotm + .XLSB + + + C:\Windows\Tasks\ + + + RedirSuiteServiceProxy.aspx + + + w3wp.exe + .aspx + + + w3wp.exe + .asp + + + w3wp.exe + .ashx + + + w3wp.exe + .php + + + w3wp.exe + .aaa + + + \wwwroot\aspnet_client\;\FrontEnd\HttpProxy\owa\auth + .aspx;.php;.ashx + + + w3wp.exe + .ps1 + + + w3wp.exe + .bat + + + w3wp.exe + .dll + + + w3wp.exe + .vbs + + + w3wp.exe + .hta + + + \wwwroot\ + \wwwroot\aspnet_client\;jpg + + + .asp + \wwwroot\ + + + .aspx + \wwwroot\ + + \ecp\auth\ + \oab\auth\ + ClientAccess\Owa\ + \owa\auth\ + httpproxy\rpc\ + ClientAccess\ecp\ + \htdocs\ + + + + + + + + + + + + + + + .SPL + spoolsv.exe;printfilterpipelinesvc.exe;printisolationhost.exe;splwow64.exe;msiexec.exe;poqexec.exe + + + spoolsv.exe + .exe + C\:\Windows\System32\spool\;C\:\Windows\Temp\;C\:\Users\ + + + msiexec.exe + \Microsoft\Edge\Application + elevation_service.exe + + + + + + + + + + + + + + + + + + + + + + + + + \LocalState\rootfs\ + + + + C:\PerfLogs\ + C:\Temp\ + C:\Users\Default\ + C:\Users\Public\ + C:\Windows\Temp\ + \AppData\Temp\ + + $Recycle.Bin + $Recycle.Bin + + C:\Windows\ + \config\systemprofile\ + + + C:\Windows\ + \config\systemprofile\ + + + .exe + .7z.exe + .doc.exe + .doc.exe + .docx.exe + .ico.exe + .iso.exe + .lnk.exe + .pdf.exe + .ppt.exe + .pptx.exe + .rar.exe + .rtf.exe + .txt.exe + .xls.exe + .xlsx.exe + .zip.exe + ______.exe + + + + + + + + + + + + + + + + + .chm + + + + + + + proj + .sln + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + UMWorkerProcess.exe;UMService.exe + . + .log;.cfg;.txt;cleanup;.HealthCheck;\wp.active;.db + + + + + + + + + + + + + + .7z + .7zip + .arj + .s7z + .a + .ace + .ar + .arc + .bin + .cab + .pak + .gz + .img + .iso + .lzm + .lzma + Temp\Rar$ + .rar + RarSFX + .sfx + .sz + .tar + .tar.gz + .tgz + .xz + .zip + + + + + + + + + + + + + .ost + .eml + .msg + .pst + + + + + + + + + + Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք + + + + + + + Teamviewer.exe + rundll32.exe + mstsc.exe + cmd.exe + ipy.exe + WScript.exe + cscript.exe + mshta.exe + python.exe + wmic.exe + + C:\Users\Default\;C:\Users\Public\ + .dll + + + C:\Users\Default\;C:\Users\Public\ + .exe + + + + + + + + HiddenService + torrc + \tor.exe + tor-gencert + + + + + + + + + + + + + + + + rclone + s3browser + grabff.exe + grabff.exe + + + + + + RESTORE_;_FILES.txt + + + DECRYPT_;_FILES.txt + + + \run.dat;\task.dat;\storage.dat + AppData + Symantec + BlueJeans + + + VBoxRT.dll;VboxC.dll + + + + + + + + + + + + + + Content.IE5;INetCache + .exe;.zip;.ps1;.bat;.rar;.dll + + + MSForms.exd + + + .exe + C:\windows\system32\ + + + .exe + C:\windows\ + \system32\ + + + .dll;.exe + C:\windows\ + C:\Users\ + + + .dll;.exe + C:\Users\ + + + \Microsoft\Word\Startup\ + .wll + + + C:\windows\system32\CodeIntegrity\ + + + \Microsoft\Excel\Startup\ + .xll + + + \Microsoft\Outlook\VbaProject.OTM + + + \Microsoft\Addins\ + .xla + + + .vsto + + + .bat + C:\Windows\ + C:\ProgramData\Lenovo\SystemUpdate\sessionSE\ + + + .dll + C:\Windows\ + + + .sys + C:\Windows\ + + + .exe + C:\Windows\ + C:\Windows\System32\;C:\windows\syswow64\ + + + .exe + C:\Windows\System32\ + + + .exe + C:\Windows\SysWow64\ + + + .theme + + + \Packages\oice_ + + + VirtualboxVM.exe + + notepad++.exe + .lnk:Zone.Identifier + \UsageLogs\cscript.exe.log + \UsageLogs\mshta.exe.log + \UsageLogs\msiexec.exe.log + \UsageLogs\regsvr32.exe.log + \UsageLogs\rundll32.exe.log + \UsageLogs\svchost.exe.log + \UsageLogs\wmic.exe.log + \UsageLogs\wscript.exe.log + \regsvr32.exe.log + \UsageLogs\wsmprovhost.exe.log + .lnk + .url + + .sys + .inf + C:\Windows\SysWOW64\Drivers + C:\Windows\System32\Drivers + \Drivers\ + .drv + + .xlam + .xlsm + .xla + .xll + .xls + .xlsb + .xlsx + .xlt + .xltm + .xlw + \Microsoft\Templates\ + .eml + .msg + .pptm + .potm + .pptm + .pptm + .sldm + \Microsoft\Office\Recent + oleObject + \Recent\CustomDestinations\ + \Downloads\ + \Content.Outlook\ + .docb + .wbk + .ped + .dot + .dotx + .doc + .docm + .docx + + .accdb + .accde + .accdr + .accdt + .mdb + .mde + .msc + .mst + .potx + .ppam + .ppsm + .ppsx + .ppt + .pptm + .pptx + .pub + .sldm + .sldx + .xls + .xps + + + + .pem + .crt + .ca-bundle + .cer + .csr + .der + .p7b + .p7r + .p7s + .pfx + .sto + .p12 + .crl + .sst + .key + + + + .hlp + ACLUI.DLL.UI + ACLUI.DLL + AFLogVw.exe + AShld.exe + AShldRes.DLL.asr + AShldRes.DLL + AhnI2.dll + CamMute.exe + CommFunc.dll + CommFunc.jax + DESqmWrapper.dll + DESqmWrapper.wrapper + FSPMAPI.dll.fsp + FSPMAPI.dll + Gadget.exe + LoLTWLauncher.exe + Mc.exe + McUtil.dll.ping + McUtil.dll.url + McUtil.dll + MpSvc.dll + MsMpEng.exe + NtUserEx.dat + NtUserEx.dat + NtUserEx.dll + NtUserEx.dll + NvSmart.exe + NvSmartMax.dll + NvSmartMax.dll + NvSmartMaxapp.dll + OInfo11.ISO + OInfo11.ocx + OInfoP11.exe + OleView.exe + OleView.exe + POETWLauncher.exe + RasTls.dll.config + RasTls.dll.msc + RasTls.dll + RasTls.exe + RunHelp.exe + Sidebar.dll.doc + Sidebar.dll + Ushata.dll + Ushata.exe + Ushata.fox + VeetlePlayer.exe + boot.ldr + chrome_frame_helper.dll.rom + chrome_frame_helper.dll + chrome_frame_helper.exe + dvcemumanager.exe + fsguidll.exe + fslapi.dll.gui + fslapi.dll + fsstm.exe + hccutils.dll.res + hccutils.dll + hha.dll.bak + hha.dll + hhc.exe + hkcmd.exe + iviewers.dll + jli.dll + libvlc.dll + mPclient.dll + mcf.ep + mcf.exe + mcupdui.exe + mcut.exe + mcutil.dll.bbc + mcvsmap.exe + msi.dll.dat + msi.dll + msseces.asm + msseces.exe + mtcReport.ktc + rc.dll + rc.exe + rc.hlp + sep_NE.exe + sep_NE.slf + tplcdclr.exe + winmm.dll + wts.chm + credwiz.exe + + ssMUIDLL.dll + aepic.dll + ftllib.dll + userenv.dll + \Terminal Server Client\Cache\ + C:\Windows\Prefetch + \\tsclient + C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ + \Temp\debug.bin + Temp\7z + C:\Windows\AppPatch\Custom + .chm + .cpl + .mht + \Chrome\User Data\Default\Extensions\ + .crx + .appref-ms + .gadget + .JSE + .exe + .scf + Exchange Server\ClientAccess\Owa\ + \Device\HarddiskVolumeShadowCopy + .zip\ + .FON + .FOT + C:\Windows\System32\GroupPolicy\Machine\Scripts + C:\Windows\System32\GroupPolicy\User\Scripts + .iqy + .ico + .isp + .msc + .manifest + MEMORY.dmp + .msi + .cs + .customDestinations-ms + C:\Windows\Minidump + .PAF + .bmc + .rdp + .rtf + .reg + .SHS + .slk + .SCR + .set + .SettingContent-ms + .SHD + .SPL + .scr + HammerDrillStatus.dll + Microsoft\Windows\WER\ + .ICL + .sdb + .SCT + .SHB + Temp\Temp1_ + + \Microsoft\;CLR_v;\UsageLogs\ + .ade + .adp + .application + .appref-ms + .asc + .bmf + .cer + .dmp + .gpg + .htm + .html + .json + .jsp + .key + .mof + .ocx + .p7b + .p12 + .pem + .pfx + .pgp + .php + .ppk + .war + .xml + + + + + + + + + Software\Famatech\advanced_ip_scanner\State + LastRangeUsed + SetValue + + + + + + + + + + + + + + + + + + + + + + + + + + \Software\Microsoft\Terminal Server Client + DefaultPrinter + + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974 + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} + SetValue + + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} + SetValue + + + Root\InventoryDevicePnp;prod_virtual_dvd-rom + SetValue + + MountedDevices + Mountpoints2 + Active Setup\Installed Components + + + + + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\ + LoggedOnUser + + LastLoggedOnUser + LastLoggedOnProvider + + + + + + + HKCR\ms-msdt\ + + + HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck +
DWORD (0x00000001)
+ + + + + + + + + SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost + \print\ + \AzureAttestService\CoInitializeSecurityParam + C:\$WINDOWS.~BT\ + + + + \AccessVBOM + C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe + + + Security\VBAWarnings + C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe + + + Security\VBAWarnings + C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe + + + EXCEL.exe;WINWORD.exe + {8BD21D32-EC42-11CE-9E0D-00AA006002F3};{5B9D8FC8-4A71-101B-97A6-00000B65C08B} + + + + HKCU\di + + + HKCU\� + + + HKLM\SOFTWARE\Microsoft\AMSI\Providers\ + hklm\software\microsoft\windows script\settings\amsienable + hkcu\software\microsoft\windows script\settings\amsienable + + + + + + Google\Chrome\Extensions + update_url + SetValue + + + + ForcePasswordReset + + + HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC\CurrVal + + + HKLM\SAM\SAM\DOMAINS\Account\Users\ + Last Password Change + + + HKLM\SAM\SAM\DOMAINS\Account\Users\ + Account Expiration + + + HKLM\SAM\SAM\DOMAINS\Account\Users\ + Last Failed Logon + + + HKLM\SAM\SAM\Domains\Builtin\Aliases\00000220\ + + + HKLM\SAM\SAM\Domains\Builtin\Aliases\0000022B\ + + + + SOFTWARE\Microsoft\Wow64\x86\ + + SetValue + \CurrentVersion\Run\ + Add_exclusions_here + + \Microsoft\System\Scripts + \Windows\System\Scripts + HKLM\SYSTEM\Setup\CmdLine + + \Start +
DWORD (0x00000000)
+ + + \Start +
DWORD (0x00000001)
+ + + \Start +
DWORD (0x00000002)
+ + + \Start +
DWORD (0x00000003)
+ + + \Start +
DWORD (0x00000004)
+ + \ImagePath + \ServiceDll + \ServiceManifest + hkcu\software\microsoft\windows nt\currentversion\windows\run\ + hkcu\software\microsoft\windows\currentversion\explorer\shell folders\common startup + hkcu\software\microsoft\windows\currentversion\explorer\shell folders\startup + hklm\software\microsoft\command processor\autorun + hkcu\software\microsoft\windows nt\currentversion\accessibility\ATs\\*(1)\StartExe + Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup + + \Print\Monitors + + + + + + + HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ + $ + CreateKey + + + HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ + $ + CreateKey + + + + HKLM\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} + C:\WINDOWS\sysmon64.exe + C:\WINDOWS\sysmon.exe + C:\Programdata\sysmon\sysmon64.exe + + + + HKCR\ + (Default) + \shell\open\command\(Default) +
URL:
+ + + HKCU\Software\Classes\ + (Default) + \shell\open\command\(Default) +
URL:
+ + + HKCR\ + \shell\open\command\(Default) +
%1
+ + + HKCU\Software\Classes\ + \shell\open\command\(Default) +
%1
+ + + \shell\open\command\DelegateExecute + + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe + + + + Session Manager\KnownDlls + + + + + Outlook\Addins + + + Word\Addins + + + Excel\Addins + + + Powerpoint\Addins + + + Software\Microsoft\VSTO\Security\Inclusion\ + + + Software\Microsoft\VSTO\SolutionMetadata\ + + + + + + + + + + + cmmgr32.exe + + + + HKLU\Software\Microsoft\Command Processor\AutoRun + HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute + HKLM\System\CurrentControlSet\Control\Session Manager\Execute + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug + HKLM\Software\Microsoft\Command Processor\AutoRun + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup + UserInitMprLogonScript + HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath + + HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages + + + + + + + + \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default) +
C:\Users\Public\;$Recyclebin;\temp\;\Desktop\;\Downloads\;\Content.Outlook\;\Microsoft\Office\
+
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
+ + + \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default) +
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
+ + + \ProgID\(Default);\TreatAs\(Default) + + + + \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ + Debugger;ReportingMode;MonitorProcess + + + \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ + GlobalFlag +
DWORD (0x00000200)
+ + + \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ + MonitorProcess + + + \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ + ReportingMode +
DWORD (0x00000001)
+ + + \Microsoft\Windows NT\CurrentVersion\SilentProcessExit + CreateKey + + + \Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules\ + C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{;}\EDGEMITMP_;.tmp\setup.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe + C:\Program Files\Microsoft Office\root\integration\integrator.exe + C:\Program Files\Google\Chrome Beta\Application\;\Installer\setup.exe + C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\;\OfficeClickToRun.exe + + + + + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree + SD + Microsoft\Windows\UpdateOrchestrator + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OneDrive Per-Machine Standalone Update Task\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Feature Updates\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Feature Updates Logon\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Performance Monitor\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\SnapshotCleanupTask\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office ClickToRun Service Monitor\SD + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Automatic Updates 2.0\SD + Microsoft\Windows\UpdateOrchestrator + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree + ID + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks + Author + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks + Path + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks + Date + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot + + + + + + SetValue + \Environment\ + + + + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA +
DWORD (0x00000000)
+ + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin +
DWORD (0x00000000)
+ + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop +
DWORD (0x00000000)
+ + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe + exefile\shell\runas\command\isolatedCommand + + + + + + + + + + + + + \Hidden + + SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\ + $ +
DWORD (0x00000000)
+ + + + + HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Parameters + C:\WINDOWS\sysmon64.exe + C:\WINDOWS\sysmon.exe + C:\Programdata\sysmon\sysmon64.exe + + + + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel + MitigationOptions;MitigationAuditOptions + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options + MitigationOptions;MitigationAuditOptions + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmcompute.exe\0\MitigationOptions + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmwp.exe\0\MitigationOptions + msiexec.exe + TiWorker.exe + + + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options + MitigationOptions;MitigationAuditOptions + C:\Program Files\Microsoft Office 15\root\integration\integrator.exe + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acro + + + + DisableTaskMgr + C:\WINDOWS\system32\svchost.exe + C:\windows\SysWOW64\svchost.exe + + + HKLM\SYSTEM\CurrentControlSet\ + \Instances\;Altitude + HKLM\System\CurrentControlSet\Services\CldFlt\Instances\CldFlt\Altitude + SetValue + + + + \Security\Level +
DWORD (0x00000001)
+ + + \Security\Level +
DWORD (0x00000002)
+ + + \Security\Level +
DWORD (0x00000003)
+ + + \Security\Level +
DWORD (0x00000004)
+ + + \Outlook\Security + + \Security\Level + + \Word\Security + \Excel\Security + \Security\Level1Remove + \HideSCAHealth + HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring + HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify + HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride + HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ + \Enabled +
DWORD (0x00000000)
+ + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ + \Enabled +
DWORD (0x00000001)
+ + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ + \Enabled + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\ + \ChannelAccess +
(A;;0x1;;;SY);(A;;0x5;;;BA);(A;;0x1;;;LA)
+ C:\Windows\servicing\TrustedInstaller.exe;\TiWorker.exe + + + HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging + \EnableScriptBlockLogging +
DWORD (0x00000000)
+ + + HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging + \EnableScriptBlockLogging + DeleteKey;DeleteValue + + + hklm\software\microsoft\windows\currentversion\policies\system\audit + \ProcessCreationIncludeCmdLine_Enabled +
DWORD (0x00000000)
+ + + hklm\software\microsoft\windows\currentversion\policies\system\audit + \ProcessCreationIncludeCmdLine_Enabled + DeleteKey;DeleteValue + + + HKLM\System\CurrentControlSet\Services\Eventlog + \CustomSD + + + HKLM\System\CurrentControlSet\Services\Eventlog + \MaxSize + + + + globallyopenports + + EnableFirewall + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + + + + \Microsoft\.NETFramework\ETWEnabled +
DWORD (0x00000000)
+ + + \Microsoft\.NETFramework\NGenAssemblyUsageLog + + + SetValue + \Environment\NGenAssemblyUsageLog + + + SetValue + \Environment\COMPlus_ETWEnabled + + + + + + + + \LastKey + + + SymbolicLinkValue + + + \Software\Microsoft\Windows\CurrentVersion\Explorer + \AppData\;\ProgramData\;\Temp\;C:\users + + + ‮ + + HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg + + + + \Software\Policies\Microsoft\SystemCertificates\;\SOFTWARE\Microsoft\EnterpriseCertificates\;HKLM\SOFTWARE\Microsoft\SystemCertificates\;HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ + CreateKey + C:\WINDOWS\Sysmon64.exe + C:\WINDOWS\Sysmon.exe + C:\WINDOWS\system32\certsrv.exe + C:\WINDOWS\system32\CompatTelRunner.exe + C:\WINDOWS\system32\svchost.exe + C:\Windows\SysWOW64\SearchProtocolHost.exe + C:\Windows\system32\SearchProtocolHost.exe + C:\Windows\system32\taskhost.exe + C:\windows\SysWOW64\svchost.exe + C:\WINDOWS\System32\DriverStore\FileRepository\asus + C:\ProgramData\Microsoft\Windows Defender\Platform\ + C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe + C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe + + fDenyTSConnections + Terminal Server\WinStations\RDP-Tcp + RDP-tcp\PortNumber + Control\Terminal Server\fSingleSessionPerUser + + + + � + + + Й;ќ;Л;я;К + + + + + + + + HKLM\HARDWARE\ACPI\DSDT + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Account Name + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Display Name + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Email + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP User + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP User + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\MAPI Provider + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 User + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP User + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 Password + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP Password + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName + SecurityPasswordAES + OptionsPasswordAES + SecurityPasswordExported + PermanentPassword + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + HKLM\SOFTWARE\GitForWindows + + + + + + + + + + + + + + + + + + + + + + + + + HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ + DeleteKey + + + + HKLM\SYSTEM\CurrentControlSet\Control\BitlockerStatus\BootStatus +
DWORD (0x00000001)
+ + + HKLM\SYSTEM\CurrentControlSet\Control\BitlockerStatus\BootStatus +
DWORD (0x00000000)
+ + + + + + + + + + \Services\VSS\Diag\(Default) + + + + + + + + HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters + + + HKLM\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters + + + \LastKey + + + \WinStationsDisabled + + + \TSServerDrainMode + + + \TypedURLs + + + HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\disabledcomponents + + + HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage\Bind +
Binary Data
+ + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards + + + services\http\parameters\urlaclinf + + + cRecentFiles\c1\ + tDIText + + + \File MRU\Item 1 + + + HKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHash + + + HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + HKLM\Software\Microsoft\Windows\CurrentVersion\RunService + HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + CurrentVersion\Windows\Load + CurrentVersion\Windows\Run + CurrentVersion\Winlogon\Shell + CurrentVersion\Winlogon\System + \Software\Microsoft\Windows NT\CurrentVersion\Windows\load + \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + SOFTWARE\Microsoft\.NETFramework\ETWEnabled + \Group Policy\Scripts + Terminal Server\Wds\rdpwd\StartupPrograms + Winlogon\AlternateShells\AvailableShells + Policies\System\Shell + Windows CE Services\AutoStartOnConnect + Windows CE Services\AutoStartOnDisconnect + PreferenceMACs\Default\extensions.settings + CurrentVersion\URL + \CurrentVersion\Font Drivers + HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown + CurrentVersion\Windows\IconServiceLib + Active Setup\Installed Components + NullSessionShares + NullSessionPipes + PasswordExpiryNotification + SafeBoot\AlternateShell + Desktop\Scrnsave.exe + \DisplayVersion + \ModifyPath + \Microsoft\Windows\CurrentVersion\Uninstall\ + \UninstallString + Terminal Server\WinStations\RDP-Tcp\InitialProgram + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman + + \Explorer\FileExts\ + \shell\install\command\ + \ProfileImagePath + + \Classes\AllFilesystemObjects\ + \Classes\*\ + \Software\Microsoft\Ctf\LangBarAddin + \ContextMenuHandlers\ + \CurrentVersion\Shell + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers + \Classes\Directory\ + \Classes\Drive\ + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + \Classes\Folder\ + \Hidden + \HideFileExt + \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components + \SOFTWARE\Classes\Protocols\Filter + \SOFTWARE\Classes\Protocols\Handler + \SharedTaskScheduler + \ShowSuperHidden + \ColumnHandlers + \CopyHookHandlers + \ExtShellFolderViews + \PropertySheetHandlers + \ShellServiceObjectDelayLoad + \ShellServiceObjects + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ + HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand + + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + + \3\1809 + \3\2500 + \3\1206 + \DisableSecuritySettingsCheck + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries + HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ + \ProxyServer + SavedLegacySettings + Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy + EnableConsoleTracing + EnableFileTracing + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ + HKLM\SOFTWARE\Microsoft\Netsh + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ + + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + + + Office Test\ + + \Internet Explorer\Toolbar\ + \Internet Explorer\Extensions\ + + \Browser Helper Objects\ + {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ + + \UrlUpdateInfo + \InstallSource + + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ + \Exclusions\Paths + \Exclusions\Extensions + \Exclusions\Processes + TamperProtection + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff + \Software\Policies\Microsoft\Windows\System\Scripts\Logoff + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon + \Software\Policies\Microsoft\Windows\System\Scripts\Logon + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup + + Domain + DHCPDefaultGateway + DhcpIPAddress + DhcpNameserver + Dhcpserver + DhcpSubnetMask + Nameserver + \DefaultGateway + PersistentRoutes + }\Category + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + SubnetMask + \Trusted Documents\TrustRecords + Software\Microsoft\VBA\7.1\Common + Software\Microsoft\VBA\7.1\Trusted + \Security\DontTrustInstalledFiles + \Security\Trusted Locations + Security\ProtectedView\DisableInternetFilesInPV + Security\ProtectedView\DisableAttachmentsInPV + Security\ProtectedView\DisableUnsafeLocationsInPV + Software\WinRAR\ArcHistory + WinZip\mru\ + Recent File List + Outlook\WebView\Inbox + Outlook\Today\UserDefinedUrl + Outlook\WebView\Calendar + \Place MRU + \LinkDate + \DriverVerVersion + \DriverVersion + \LowerCaseLongPath + \Publisher + Compatibility Assistant\Store\ + \BinProductVersion + Root\InventoryApplicationShortcut\ + Root\InventoryDriverBinary + Root\InventoryDriverPackage + Root\InventoryDevicePnp + Root\InventoryDeviceContainer + + Root\InventoryApplication\ + ProgramID;Name;Version;Publisher;Language;InstallDate;Source;RootDirPath;HiddenArp;UninstallString;RegistryKeyPath;UserSID;sha256 + + + Root\InventoryApplicationFile\ + ProgramId;FileId;LowerCaseLongPath;Name;OriginalFileName;Publisher;Version;binfileversion;LinkDate;Size;Language;USN;IsPeFile;IsOsComponent;sha256;AppxPackageFullName + + + Root\InventoryApplicationAppV\ + + + Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations + + + \Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives\Volume + Drive Type +
DWORD (0x00000011)
+ + \Explorer\MountPoints2 + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices + + HKLM\System\CurrentControlSet\services\ + \DeleteFlag +
DWORD (0x00000001)
+ + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000001)
+ + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000002)
+ + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000004)
+ + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000020)
+ + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000020)
+ + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000100)
+ + + HKLM\System\CurrentControlSet\services\ + \Group + + + HKLM\System\CurrentControlSet\services\ + \DependOnService + + + HKLM\System\CurrentControlSet\services\ + \BinaryPathName + + + HKLM\System\CurrentControlSet\services\ + \RequiredPrivileges + + + HKLM\System\CurrentControlSet\services\ + \Owners + + + HKLM\System\CurrentControlSet\services\ + \ObjectName + + + HKLM\System\CurrentControlSet\services\ + \ServiceStartName + + + HKLM\System\CurrentControlSet\services\ + \ErrorControl + + + + HKLM\System\CurrentControlSet\services\ + \DependOnGroup + + + HKLM\System\CurrentControlSet\services\ + \DisplayName + + + HKLM\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder + \List + + + HKLM\System\CurrentControlSet\services\ + \Type +
DWORD (0x00000001)
+ + + \ConsentStore\bluetooth + \ConsentStore\contacts + \ConsentStore\hunmanInterfaceDevice + \ConsentStore\location + \ConsentStore\microphone + \ConsentStore\usb\ + \ConsentStore\webcam + \ConsentStore\humanInterfaceDevice + LastVisitedMRU + SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit + \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU + HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR + HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ + HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust + HKLM\SOFTWARE\Microsoft\Cryptography\OID + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID + HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll + Classes\exefile\shell\runas\command\isolatedCommand + \FriendlyName + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + HKLM\SOFTWARE\Microsoft\Tracing\ + + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318} +
ndis;rndis
+ + HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 + + \Software\AppDataLow\Software\Microsoft\ +
.exe;.dll;powershell;wmic
+ + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel +
DWORD (0x00000005)
+ + Software\Microsoft\Office test\Special\Perf + \CurrentControlSet\Services\NTDS\LsaDbExtPt + \Services\NTDS\DirectoryServiceExtPt + GoToMyPc\FileTransfer\history + GoToMyPc\GuestInvite + Filesharing + DesktopSharing + LogIncomingConnections + LogOutgoingConnections + PermanentPasswordDate + Security_Adminrights + vncviewer\MRU + Autostart_GUI + Meeting_UserName + BuddyLoginName + BuddyLoginTokenID + Always_Online + HKLM\SOFTWARE\Microsoft\CurrentVersion\Policies\System\EnableLinkedConnections + Software\recfg + \Keyboard Layout\Preload\ + \Keyboard Layout\Substitutes\ + HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ + \Client\Enabled + \Server\Enabled + Kitty\Sessions + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic + PuTTY\Sessions + Terminal Server Client\Servers + WinSCP 2\Sessions + + C:\Program Files (x86)\Kaspersky Lab + C:\Program Files\Kaspersky Lab + C:\Program Files (x86)\ESET + C:\Program Files\ESET + + + + + + + + + Content.IE5;INetCache + .exe;.zip;.ps1;.bat;.rar;.vbs;.hta + + + :Zone.Identifier + blob:;about:internet + + + 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e + + + SHA256=074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 + SHA256=45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 + SHA256=9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 + SHA256=29b75f0db3006440651c6342dc3c0672210cfb339141c75e12f6c84d990931c3 + SHA256=c8c907a67955bcdf07dd11d35f2a23498fb5ffe5c6b5d7f36870cf07da47bff2 + SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e + + + Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf + + + IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE + + + IMPHASH=19584675D94829987952432E018D5056 + + + IMPHASH=330768a4f172e10acb6287b87289d83b + + + + + + IMPHASH=00000000000000000000000000000000 + AppData\Local\Microsoft\Windows\AppCache\ + \Microsoft\Windows\INetCache\ + \Microsoft\Windows\Temporary Internet Files\Content.IE5 + \Mozilla\Firefox\Profiles\ + .default\prefs-1.js + Microsoft\Windows\Start Menu\Programs\Startup + + + + + + + + + + + + + + + + msagent_;\MSSE-;postex;\status_ + + + \atctl;\userpipe;\iehelper;\sdlrpc;\comnap + + + \PSEXESVC + -stdin + -stdout + + + RemCom_ + stdin;stdout;stderr;communication + + + \svcctl + + + \ntsvcs + ConnectPipe + + \lsadump;\cachedump;\wceservicepipe + \9f81f59bc58452127884ce513865ed20 + \46a676ab7f179e511e30dd2dc41bd388 + tssmp_endpoint + \NamePipe_MoreWindows + \WCEServicePipe + \ahexec + \cachedumppipe + \csexec + \e710f28d59aa529d6792ca6ff0ca1b34 + \isapi_dg + \isapi_http + \isapi_http + \lsadump + \lsassw + \paexec + \pcheap_reuse + \gruntsvc + \remcom + \rpchlp_3 + \sdlrpc + \winsession + \adschemerpc + \AnonymousPipe + \bc367 + \bc31a7 + \testPipe + msf-pipe + \atsvc + \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc + \atctl;\userpipe;\iehelper;\sdlrpc;\comnap + + \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester;demoagent_ + \wkssvc + \spoolss + \scerpc + \ntsvcs + \SearchTextHarvester + \PGMessagePipe + \MsFteWds + + + ConnectPipe + \MICROSOFT##WID\tsql\query + + + \Winsock2\CatalogChangeListener- + -0, + + + \pipe\ + CtxSharefilepipe0 + + + \winreg + Anonymous Pipe + + + + + + + ConnectPipe + + + + + lsass + \SQLLocal\RTCLOCAL + \spoolss + C:\Windows\system32\wbem\wmiprvse.exe + C:\Windows\System32\LxRun.exe + C:\Windows\System32\SearchIndexer.exe + C:\Windows\System32\smss.exe + C:\Windows\System32\spoolsv.exe + C:\Windows\System32\wininit.exe + C:\Windows\system32\DFSRs.exe + C:\Windows\SystemApps\Microsoft.Windows + + C:\Windows\Microsoft.NET\Framework + ngen.exe + + + C:\Windows\SystemApps\ShellExperienceHost_ + ShellExperienceHost.exe + + C:\Windows\system32\SearchProtocolHost.exe + \System + ProtectedPrefix\LocalService\FTHPIPE + + Exchange Server + + C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\BIN\OWSTIMER.EXE + C:\Windows\syswow64\snmp.exe + c:\windows\system32\inetsrv\w3wp.exe + \M.E.C.Core.WinRMDataCommunicator.NamedPipe. + + C:\Windows\system32\dns.exe + + \sql\query + C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe + \TDLN- + vmware- + \InitShutdown + \MsFteWds + \W32TIME_ALT + \WiFiNetworkManagerTask + \Winsock2CatelogChangeListener + \browser + \epmapper + \eventlog + \scerpc + \wkssvc + \ntapvsrq + Anonymous Pipe + + + + + + + + + + Created + + + + + + + type: 16;type: 16 + powershell.exe + + + github + powershell.exe + + + powershell;cscript.exe;wscript.exe;mshta.exe;bitsadmin.exe;\cmd.exe + . + + + dropboxapi.com + \Dropbox\Client\Dropbox.exe;\Dropbox\bin\Dropbox.exe;\Oracle\Java\ + + + 1drv + \AppData\Local\Microsoft\OneDrive\OneDrive.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe;\Internet Explorer\iexplore.exe;C:\Windows\System32\AppHostRegistrationVerifier.exe;C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe;C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe;C:\Program Files\Mozilla Firefox\firefox.exe + + + .box.com;upload + + + mega.nz;mega.co.nz + + + privatlab.com + + + thedoccloud.com;deftsecurity.com;websitetheme.com;highdatabase.com;incomeupdate.com;zupertech.com;panhardware.com;databasegalore.com;avsvmcloud.com;freescanonline.com + + + tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat + + + efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet + + + .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com + + + advanced-ip-scanner.com + + + kali.download + + + + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.nimpool.io;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool;analytics.blue;estream.to + + graph.microsoft.com + dl.dropboxusercontent.com + api.onedrive.com + zoom.us + teamviewer + Screenconnect + + + census + researchscan + scanhub + shadow + shodan + + .download + .kp + .su + .ss + .xn + .sy + .ve + .xxx + .cn + .click + .club + .ir + .ru + .host + .icu + .pw + .website + .ninja + .rocks + .top + .ua + .xyz + + + kuternull.com;rimrun.com;0ffice36o;asushotfix;infestexe;rahasn.webhop.org;rahasn.akamake.net;rahasn.homewealth.biz;winodwsupdates;israirairlines + + githubusercontent.com;github.com + + api.ipify.org;whatismyipaddress.com;edns.ip-api.com;checkip.dyndns.org;icanhazip.com;ifconfig.me;ifconfig.co;ipaddress.com;ipecho.net;ident.me;api.ip.sb;www.myexternalip.com;ip.anysrc.net;wtfismyip.com;myexternalip.com;ipecho.net;checkip.amazonaws.com;goo.gl;git.io;bit.ly;ow.ly;ip-api.com + + tiny-share.com;paste.ee;pastebin.com + + afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com + darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org + adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk + gc._msdcs. + _kerberos._tcp.dc._msdcs. + _kerberos._udp.dc._msdcs. + _ldap._tcp.pdc._msdcs. + wpad + + _ldap. + C:\Windows\ + unknown process + C:\ProgramData\Microsoft\Windows Defender\Platform\;\Windows Defender\MsMpEng.exe;C:\Windows\ + + + System;svchost.exe;services.exe;unknown process;\;; + + + + + + C:\Program Files (x86)\Admin Arsenal\ + C:\Program Files (x86)\CheckPoint\ + C:\Program Files (x86)\Fortinet\ + C:\Program Files (x86)\OpenDNS\OpenDNS Connector + C:\Program Files (x86)\Razer\Razer Services\ + C:\Program Files (x86)\Trend Micro\ + C:\Program Files (x86)\VMware + C:\Program Files (x86)\Veeam\ + C:\Program Files\CheckPoint\ + C:\Program Files\Trend Micro\ + Slack.exe + ConnectWise.exe + git-remote-https.exe + C:\Program Files (x86)\Enpass\Enpass.exe + C:\Program Files (x86)\Fiserv\Vision\VisionGUI.NET.exe + C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe + C:\Program Files (x86)\Lenovo\System Update\Tvsukernel.exe + C:\Program Files\VMware\vCenter Server\jre\bin\java.exe + C:\Program Files\VMware\vCenter Server\python\python.exe + C:\Windows\SysWOW64\SearchProtocolHost.exe + C:\Windows\System32\dsregcmd.exe + C:\Windows\sysmon64.exe + C:\Windows\sysmon.exe + brave-sync.s3.dualstack. + .salesforceliveagent.com + ads-serve.brave.com + + .msftncsi.com + ..localmachine + + -pushp.svc.ms + .b-msedge.net + .bing.com + .hotmail.com + .live.com + .live.net + .microsoft.com + .microsoftonline.com + .microsoftstore.com + .ms-acdc.office.com + .msedge.net + .msn.com + .msocdn.com + .s-microsoft.com + .skype.com + .skype.net + .windows.com + .windows.net.nsatc.net + .windowsupdate.com + .xboxlive.com + login.windows.net + + .activedirectory.windowsazure.com + .msauth.net + .msftauth.net + .opinsights.azure.com + management.azure.com + outlook.office365.com + portal.azure.com + + .mozaws.net + .mozilla.com + .mozilla.net + .mozilla.org + .spotify.com + .spotify.map.fastly.net + googleapis.com + clients1.google.com + clients2.google.com + clients3.google.com + clients4.google.com + clients5.google.com + clients6.google.com + cloudsearch.googleapis.com + id.google.com + safebrowsing.googleapis.com + www.googleapis.com + + .akadns.net + .netflix.com + .typekit.net + aspnetcdn.com + ajax.googleapis.com + cdnjs.cloudflare.com + cdnjs.cloudflare.com + fonts.googleapis.com + + .steamcontent.com + + .disqus.com + .fontawesome.com + disqus.com + + .1rx.io + .2mdn.net + .adadvisor.net + .adap.tv + .addthis.com + .adform.net + .adnxs.com + .adroll.com + .adrta.com + .adsafeprotected.com + .adsrvr.org + .advertising.com + .amazon-adsystem.com + .amazon-adsystem.com + .analytics.yahoo.com + .aol.com + .betrad.com + .bidswitch.net + .casalemedia.com + .chartbeat.net + .cnn.com + .convertro.com + .criteo.com + .criteo.net + .crwdcntrl.net + .demdex.net + .domdex.com + .dotomi.com + .doubleclick.net + .doubleverify.com + .emxdgt.com + .exelator.com + .google-analytics.com + .googleadservices.com + .googlesyndication.com + .googletagmanager.com + .googlevideo.com + .gstatic.com + .gvt1.com + .gvt2.com + .ib-ibi.com + .jivox.com + .mathtag.com + .moatads.com + .moatpixel.com + .mookie1.com + .myvisualiq.net + .netmng.com + .nexac.com + .nexac.com + .openx.net + .optimizely.com + .outbrain.com + .pardot.com + .phx.gbl + .pinterest.com + .pubmatic.com + .quantcount.com + .quantserve.com + .revsci.net + .rfihub.net + .rlcdn.com + .rubiconproject.com + .scdn.co + .scorecardresearch.com + .serving-sys.com + .sharethrough.com + .simpli.fi + .sitescout.com + .smartadserver.com + .snapads.com + .spotxchange.com + .taboola.com + .taboola.map.fastly.net + .tapad.com + .tidaltv.com + .trafficmanager.net + .tremorhub.com + .tribalfusion.com + .turn.com + .twimg.com + .tynt.com + .w55c.net + .ytimg.com + .zorosrv.com + ads.yahoo.com + 1rx.io + adservice.google.com + ampcid.google.com + clientservices.googleapis.com + d29x207vrinatv.cloudfront.net + googleadapis.l.google.com + imasdk.googleapis.com + l.google.com + ml314.com + mtalk.google.com + update.googleapis.com + www.googletagservices.com + + .pscp.tv + + adsniper.ru + cdnvideo.ru + chat.minergate.com + cwsa.minergate.com + forum.minergate.com + leadlab.click + mc.yandex.ru + pool.ntp.org + vmg.host + yandex.ru + .adobe.com + .autodesk.com + .avast.com + .avcdn.net + .cdn.bitdefender.net + .digicert.com + .eset.com + .globalsign.com + .globalsign.net + .intuit.com + .java.com + .macromedia.com + .oracle.com + .quickbooks.com + .usertrust.com + amazontrust.com + ocsp.identrust.com + pki.goog + ads.playground.xyz + citrixupdates.cloud.com + forticlient.fortinet.net + mft10.onbaseonline.com + msocsp.com + ocsp.comodoca.com + ocsp.cybertrust.ne.jp + ocsp.entrust.net + ocsp.entrust.net + ocsp.godaddy.com + ocsp.int-x3.letsencrypt.org + ocsp.intel.com + ocsp.msocsp.com + ocsp.quovadisglobal.com + ocsp.quovadisoffshore.com + ocsp.sectigo.com + ocsp.starfieldtech.com + ocsp.thawte.com + ocsp.trustwave.com + ocsp.verisign.com + pki-goog.l.google.com + pki.intel.com + scrootca1.ocsp.secomtrust.net + scrootca2.ocsp.secomtrust.net + stats.anchor.host + status.rapidssl.com + status.thawte.com + ts-ocsp.ws.symantec.com + upgrade.bitdefender.com + + + + + + + + + + + + + + + + + .;>;unknown;anonymous + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + C:\Program Files (x86)\Symantec\ + C:\Program Files\Google\Chrome\Application\chrome.exe + C:\Program Files\Symantec\ + + + + + + + \BHO\ie_to_edge_stub.exe;\Microsoft\Teams\;\Vivaldi\Application\;Google\Chrome\;Google\Update;BraveSoftware\Brave-Browser\;Edge\Application\;EdgeUpdate\Install\;Program Files\SmartGit\ + + + + + + + + + + + \appdata\local\google\chrome\user data\swreporter\;software_reporter_tool.exe + C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + NETWORK SERVICE; LOCAL SERVICE + + + + \ No newline at end of file From f93cc992d3281039b2f88041737997266af23db3 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 27 Jun 2023 16:53:25 -0400 Subject: [PATCH 438/471] Updates from @NerbalOne --- sysmonconfig-export.xml | 5076 +++++++++++++++++++++++++++++---------- 1 file changed, 3828 insertions(+), 1248 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 30796a47..f37910c1 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -4,15 +4,16 @@ _\ \/ // (_- _/_ _/ /__/ ,< /___/\_, /___/_/_/_/\___/_//_/ /_/ |_/_/ /_/ |_____/ \___/_/|_| /___/ - author: ionstorm - project: https://github.com/ion-storm/sysmon-config - license: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text. - Methodology: Detect the Most Techniques per Data source in MITRE ATT&CK. - Provide Visibility into Forensic Artifact Events for UEBA. - Detect Exploitation events with wide CVE Coverage. - Risk Scoring of CVE, UEBA, Forensic, MITRE ATT&CK Events. + Author: ionstorm + Contributors: NerbalOne + Project: https://github.com/ion-storm/sysmon-config + License: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text. + Methodology: Detect the most Techniques per data source in MITRE ATT&CK. + Provide visibility into forensic artifact events for UEBA. + Detect exploitation events with wide CVE coverage. + Risk scoring of CVE, UEBA, Forensic, MITRE ATT&CK events. - Primary Tags: + PRIMARY TAGS: Attack: Mitre ATT&CK Identifier Technique: Mitre ATT&CK Technique Tactic: Mitre ATT&CK Tactic @@ -28,7 +29,7 @@ FP: False Positive Rate Author: Author of rule - Additional Tag Details: + ADDITIONAL TAG DETAILS: Rapid Response Tags: (for EDR/XDR/SIEM Response & Automation) kp=y Kill process with child processes kpp=y Kill Parent Processes & all Child Processes @@ -125,12 +126,16 @@ - /serverlevelplugindll + + /serverlevelplugindll + add;sslcert;http - http del sslcert + + http del sslcert + @@ -153,6 +158,7 @@ iexplore.exe;chrome.exe;firefox.exe;browser_broker.exe;vivaldi.exe;microsoftedge.exe;microsoftedgecp.exe;brave.exe;vivaldi.exe tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe apt-config + SentinelBrowserNativeHost.exe cmd.exe /c C:\Windows\Setup\Scripts\SetupComplete.cmd;cmd.exe /c C:\Windows\Setup\Scripts\PartnerSetupComplete.cmd @@ -259,6 +265,7 @@ C:\Users\;$Recycle;\Temp\;\Downloads\ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 conhost.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\Msp.Ecosystem.Discovery.exe;TCIntegratorCommHelper.exe svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe @@ -342,11 +349,21 @@ C:\Windows\system32\spool\DRIVERS Brother Industries;Thomson Reuters - COMSPEC - ScriptFile - \Temp\7z - \Temp\Temp1_ - \Temp\Rar$ + + COMSPEC + + + ScriptFile + + + \Temp\7z + + + \Temp\Temp1_ + + + \Temp\Rar$ + powershell.exe;powershell_ise.exe @@ -354,13 +371,23 @@ Microsoft VS Code\Code.exe \Deployment tool extract\setupodt.exe - Shellcode + + Shellcode + - ipy.exe - python.exe + + ipy.exe + + + python.exe + - -agentpath: - -agentlib: + + -agentpath: + + + -agentlib: + @@ -474,21 +501,31 @@ powershell.exe;pwsh.exe;cmd.exe;mshta.exe;cscript.exe;wscript.exe;wsl.exe;rundll32.exe;regsvr32.exe msdt.exe - EQNEDT32.EXE + + EQNEDT32.EXE + winword.exe;excel.exe;powerpnt.exe FLTLDR.EXE - /dde;-dde + + /dde;-dde + schtasks.exe /create;-create;/change;-change C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ + C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe + Sentinel\AutoRepair + Update_Sysmon_Rules + + + taskeng.exe + 6.3.9600.20773 (winblue_ltsb_escrow.221219-1740) - taskeng.exe schtasks.exe /Run;-run @@ -498,10 +535,14 @@ schtasks.exe schtasks /TN RtkAudUService64_BG - -change;/change;-delete;/delete;-create;/create + -change;/change;-delete;/delete;-create;/create;Update_Sysmon_Rules + + + at.exe + + + at.exe - at.exe - at.exe C:\Windows\System32\svchost.exe netsvcs;-p;-s;Schedule @@ -539,13 +580,18 @@ sc.exe config;binpath + Ecosystem.AgentSetup.tmp cmd.exe;powershell.exe services.exe - new-service - psexesvc.exe + + new-service + + + psexesvc.exe + Execute processes remotely psexe @@ -559,9 +605,15 @@ Execute processes remotely -s;/s - psexec.exe - pskill.exe - pskill + + psexec.exe + + + pskill.exe + + + pskill + C:\WINDOWS\system32\svchost.exe -k NetworkService -p @@ -586,21 +638,36 @@ ntdsutil;/set {default} recoveryenabled no;telnet ;-dumpcr;putty;bash.exe;pssh;shareenum;sekurlsa;reg save;reg save;psscan;shellexec;vbscript:createobject;/output:clipboard;root\\default;root\\subscription;Wmiclass;WmiCl'+'as'+'s;export-mft;ApplicationImpersonation + C:\Program Files (x86)\mRemoteNG\PuTTYNG.exe ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy - --disable-http2 --disable-quic - /Client/Login?id= - JABzA + + --disable-http2 --disable-quic + + + /Client/Login?id= + + + JABzA + 2f40abbb4f78e77745f0e657a19903fc953cc664;478dc5a5f934c62a9246f7d1fc275868f568bc07;37b4496e650b3994312c838435013560b3ca8571;37b4496e650b3994312c838435013560b3ca8571;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;807d86da63f0db1fc746d1f0b05bc357;849a2b0dc80aeca3d175c139efe5221c;86A4CAC227078B9C95C560C8F0370BF0;98908ce6f80ecc48628c8d2bf5b2a50c;a4b42c2c95d1f2ff12171a01c86cd64f;4abe604916c04fe3dd8b9cb3d501d3f;eac3e3ece94bc84e922ec077efb15edd;128CECC59C91C0D0574BC1075FE7CB40;88777aacd5f16599547926a4c9202862;0f49621b06f2cdaac8850c6e9581a594;17a36ac3e31f3a18936552aff2c80249;322cb39bc049aa69136925137906d855;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;3d129263f6a48647f103a04446fb0c2f;37cd353621b0f4fc6981b50071c94f01;1b60021baedc3f9201bcdb40e9b87f62;71345b139166482acaa568ac8816c7bc;5E022694C0DBD1FBBC263D608E577949;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc5733c013378fa418d13773f5bfe6f1;c579341f86f7e962719c7113943bb6e4;d326e629a90e78825645963b35e53a6a;5E022694C0DBD1FBBC263D608E577949;53841a0c6a3ff92976db08bfdf95e083;dc7e564809d6c2a2f3457c3c9b91f22b;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b;FE2CA1BE3BDA2A757036A89E54CC02DB;FE2CA1BE3BDA2A757036A89E54CC02DB - 22d142f11cf2a30ea4953e1fffb0fa7e;2317d65da4639f4246de200650a70753;27612cb03c89158225ca201721ea1aad;412956675fbc3f8c51f438c1abc100eb;daf2da52475fd8981b19ec3c321a983c;490a140093b5870a47edc29f33542fd2;51a7068640af42c3a7c1b94f1c11ab9d;533340c54bd25256873b3dca34d7f74e;684eca6b62d69ce899a3ec3bb04d0a5b;69a19abf5ba56ee07cdd3425b07cf8bf;6cfd131fef548fcd60fbcdb59317df8e;72dc98449b45a7f1ccdef27d51e31e91;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;80c37e062aa4c94697f287352acf2e9d;815f1f8a7bc1e6f94cb5c416e381a110;a43d3b31575846fa4c3992b4143a06da;08e82dc7bae524884b7dc2134942aadb;7bcd736a2394fc49f3e27b3987cce640;57314359df11ffdf476f809671ec0275;b72737b464e50aa3664321e8e001ff32;ce8ce92fb6565181572dce00d69c24f8;5985087678414143d33ffc6e8863b887;84730a6e426fbd3cf6b821c59674c8a0;d5377dc1821c935302c065ad8432c0d2;d8f1356bebda9e77f480a6a60eab36bb;92f8e3f0f1f7cc49fad797a62a169acd;9003cfaac523e94d5479dc6a10575e60;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;c1e7850da5604e081b9647b58248d7e8;99828721ac1a0e32e4582c3f615d6e57;f559c87b4a14a4be1bd84df6553aaf56;b9c208ea8115232bfd9ec2c62f32d6b8;061089d8cb0ca58e660ce2e433a689b3;0e9afd3a870906ebf34a0b66d8b07435;9c115e9a81d25f9d88e7aaa4313d9a8f;520ee02668a1c7b7c262708e12b1ba6b;7bfba2c69bed6b160261bdbf2b826401;77a745b07d9c453650dd7f683b02b3ed;3a771efb7ba2cd0df247ab570e1408b2;0969b2b399a8d4cd2d751824d0d842b4;fc53f2cd780cd3a01a4299b8445f8511;4e39620afca6f60bb30e031ddc5a4330;bfe3f6a79cad5b9c642bb56f8037c43b;3dfebce4703f30eed713d795b90538b5;9793afcea43110610757bd3b800de517;36db24006e2b492cafb75f2663f241b2;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;649ef1dd4a5411d3afcf108d57ff87af;320b2f1d9551b5d1df4fb19bd9ab253a;3d75c72144d873b3c1c4977fbafe9184;b9cf4301b7b186a75e82a04e87b30fe4;b4e67706103c3b8ee148394ebee3f268;7bfbd72441e1f2ed48fbc0f33be00f24;cdb303f61a47720c7a8c5086e6b2a743;2a6f7ec77ab6bd4297e7b15ae06e2e61;8403a28e0bffa9cc085e7b662d0d5412;3ffd2915d285ad748202469d4a04e1f5;04078ef95a70a04e95bda06cc7bec3fa;235d427f94630575a4ea4bff180ecf5d;8035a8a143765551ca7db4bc5efb5dfd;cacaa3bf3b2801956318251db5e90f3c;1aadf739782afcae6d1c3e4d1f315cbd;c3e255888211d74cc6e3fb66b69bbffb;d9e9f22988d43d73d79db6ee178d70a4;16ab79fb2fd92db0b1f38bedb2f02ed8;8da15a97eaf69ff7ee184fc446f19cf1;ffc7305cb24c1955f9625e525d58aeee;c0e72eb4c9f897410c795c1b360090ef;9ad6fa6fdedb2df8055b3d30bd6f64f1;44619a88a6cff63523163c6a4cf375dd;a571660c9cf1696a2f4689b2007a12c7;81229c1e272218eeda14892fa8425883;0ac48cfa2ff8351365e99c1d26e082ad;afcdf79be1557326c854b6e20cb900a7 - a53a02b997935fd8eedcb5f7abab9b9f - e96a73c7bf33a464c510ede582318bf2 - serialfunc.exe + + 22d142f11cf2a30ea4953e1fffb0fa7e;2317d65da4639f4246de200650a70753;27612cb03c89158225ca201721ea1aad;412956675fbc3f8c51f438c1abc100eb;daf2da52475fd8981b19ec3c321a983c;490a140093b5870a47edc29f33542fd2;51a7068640af42c3a7c1b94f1c11ab9d;533340c54bd25256873b3dca34d7f74e;684eca6b62d69ce899a3ec3bb04d0a5b;69a19abf5ba56ee07cdd3425b07cf8bf;6cfd131fef548fcd60fbcdb59317df8e;72dc98449b45a7f1ccdef27d51e31e91;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;80c37e062aa4c94697f287352acf2e9d;815f1f8a7bc1e6f94cb5c416e381a110;a43d3b31575846fa4c3992b4143a06da;08e82dc7bae524884b7dc2134942aadb;7bcd736a2394fc49f3e27b3987cce640;57314359df11ffdf476f809671ec0275;b72737b464e50aa3664321e8e001ff32;ce8ce92fb6565181572dce00d69c24f8;5985087678414143d33ffc6e8863b887;84730a6e426fbd3cf6b821c59674c8a0;d5377dc1821c935302c065ad8432c0d2;d8f1356bebda9e77f480a6a60eab36bb;92f8e3f0f1f7cc49fad797a62a169acd;9003cfaac523e94d5479dc6a10575e60;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;c1e7850da5604e081b9647b58248d7e8;99828721ac1a0e32e4582c3f615d6e57;f559c87b4a14a4be1bd84df6553aaf56;b9c208ea8115232bfd9ec2c62f32d6b8;061089d8cb0ca58e660ce2e433a689b3;0e9afd3a870906ebf34a0b66d8b07435;9c115e9a81d25f9d88e7aaa4313d9a8f;520ee02668a1c7b7c262708e12b1ba6b;7bfba2c69bed6b160261bdbf2b826401;77a745b07d9c453650dd7f683b02b3ed;3a771efb7ba2cd0df247ab570e1408b2;0969b2b399a8d4cd2d751824d0d842b4;fc53f2cd780cd3a01a4299b8445f8511;4e39620afca6f60bb30e031ddc5a4330;bfe3f6a79cad5b9c642bb56f8037c43b;3dfebce4703f30eed713d795b90538b5;9793afcea43110610757bd3b800de517;36db24006e2b492cafb75f2663f241b2;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;649ef1dd4a5411d3afcf108d57ff87af;320b2f1d9551b5d1df4fb19bd9ab253a;3d75c72144d873b3c1c4977fbafe9184;b9cf4301b7b186a75e82a04e87b30fe4;b4e67706103c3b8ee148394ebee3f268;7bfbd72441e1f2ed48fbc0f33be00f24;cdb303f61a47720c7a8c5086e6b2a743;2a6f7ec77ab6bd4297e7b15ae06e2e61;8403a28e0bffa9cc085e7b662d0d5412;3ffd2915d285ad748202469d4a04e1f5;04078ef95a70a04e95bda06cc7bec3fa;235d427f94630575a4ea4bff180ecf5d;8035a8a143765551ca7db4bc5efb5dfd;cacaa3bf3b2801956318251db5e90f3c;1aadf739782afcae6d1c3e4d1f315cbd;c3e255888211d74cc6e3fb66b69bbffb;d9e9f22988d43d73d79db6ee178d70a4;16ab79fb2fd92db0b1f38bedb2f02ed8;8da15a97eaf69ff7ee184fc446f19cf1;ffc7305cb24c1955f9625e525d58aeee;c0e72eb4c9f897410c795c1b360090ef;9ad6fa6fdedb2df8055b3d30bd6f64f1;44619a88a6cff63523163c6a4cf375dd;a571660c9cf1696a2f4689b2007a12c7;81229c1e272218eeda14892fa8425883;0ac48cfa2ff8351365e99c1d26e082ad;afcdf79be1557326c854b6e20cb900a7 + + + a53a02b997935fd8eedcb5f7abab9b9f + + + e96a73c7bf33a464c510ede582318bf2 + + + serialfunc.exe + e PAA;en PAA;enc PAA;enco PAA;encode PAA;encoded PAA;encodedco PAA;encodedcom PAA;encodedcomm PAA;encodedcomma PAA;encodedcomman PAA;encodedcommand PAA;e IAA;en IAA;enc IAA;enco IAA;encode IAA;encoded IAA;encodedco IAA;encodedcom IAA;encodedcomm IAA;encodedcomma IAA;encodedcomman IAA;encodedcommand IAA;e JAB;en JAB;enc JAB;enco JAB;encode JAB;encoded JAB;encodedco JAB;encodedcom JAB;encodedcomm JAB;encodedcomma JAB;encodedcomman JAB;encodedcommand JAB;e cwBFAFQA;en cwBFAFQA;enc cwBFAFQA;enco cwBFAFQA;encode cwBFAFQA;encoded cwBFAFQA;encodedco cwBFAFQA;encodedcom cwBFAFQA;encodedcomm cwBFAFQA;encodedcomma cwBFAFQA;encodedcomman cwBFAFQA;encodedcommand cwBFAFQA;e SQBFAF;en SQBFAF;enc SQBFAF;enco SQBFAF;encode SQBFAF;encoded SQBFAF;encodedco SQBFAF;encodedcom SQBFAF;encodedcomm SQBFAF;encodedcomma SQBFAF;encodedcomman SQBFAF;encodedcommand SQBFAF;e UwBFAFQA;en UwBFAFQA;enc UwBFAFQA;enco UwBFAFQA;encode UwBFAFQA;encoded UwBFAFQA;encodedco UwBFAFQA;encodedcom UwBFAFQA;encodedcomm UwBFAFQA;encodedcomma UwBFAFQA;encodedcomman UwBFAFQA;encodedcommand UwBFAFQA;e IABpAE4AdgBPAEsAZQAt;en IABpAE4AdgBPAEsAZQAt;enc IABpAE4AdgBPAEsAZQAt;enco IABpAE4AdgBPAEsAZQAt;encode IABpAE4AdgBPAEsAZQAt;encoded IABpAE4AdgBPAEsAZQAt;encodedco IABpAE4AdgBPAEsAZQAt;encodedcom IABpAE4AdgBPAEsAZQAt;encodedcomm IABpAE4AdgBPAEsAZQAt;encodedcomma IABpAE4AdgBPAEsAZQAt;encodedcomman IABpAE4AdgBPAEsAZQAt;encodedcommand IABpAE4AdgBPAEsAZQAt;e SQBmACgAJAB;en SQBmACgAJAB;enc SQBmACgAJAB;enco SQBmACgAJAB;encode SQBmACgAJAB;encoded SQBmACgAJAB;encodedco SQBmACgAJAB;encodedcom SQBmACgAJAB;encodedcomm SQBmACgAJAB;encodedcomma SQBmACgAJAB;encodedcomman SQBmACgAJAB;encodedcommand SQBmACgAJAB;e J;en J;enc J;enco J;encode J;encoded J;encodedco J;encodedcom J;encodedcomm J;encodedcomma J;encodedcomman J;encodedcommand J;e SUVY;en SUVY;enc SUVY;enco SUVY;encode SUVY;encoded SUVY;encodedco SUVY;encodedcom SUVY;encodedcomm SUVY;encodedcomma SUVY;encodedcomman SUVY;encodedcommand SUVY;e aWV4;en aWV4;enc aWV4;enco aWV4;encode aWV4;encoded aWV4;encodedco aWV4;encodedcom aWV4;encodedcomm aWV4;encodedcomma aWV4;encodedcomman aWV4;encodedcommand aWV4;e dmFy;en dmFy;enc dmFy;enco dmFy;encode dmFy;encoded dmFy;encodedco dmFy;encodedcom dmFy;encodedcomm dmFy;encodedcomma dmFy;encodedcomman dmFy;encodedcommand dmFy;e dgBhA;en dgBhA;enc dgBhA;enco dgBhA;encode dgBhA;encoded dgBhA;encodedco dgBhA;encodedcom dgBhA;encodedcomm dgBhA;encodedcomma dgBhA;encodedcomman dgBhA;encodedcommand dgBhA;e R2V0;en R2V0;enc R2V0;enco R2V0;encode R2V0;encoded R2V0;encodedco R2V0;encodedcom R2V0;encodedcomm R2V0;encodedcomma R2V0;encodedcomman R2V0;encodedcommand R2V0;e IAAgAH;en IAAgAH;enc IAAgAH;enco IAAgAH;encode IAAgAH;encoded IAAgAH;encodedco IAAgAH;encodedcom IAAgAH;encodedcomm IAAgAH;encodedcomma IAAgAH;encodedcomman IAAgAH;encodedcommand IAAgAH;e TVq;en TVq;enc TVq;enco TVq;encode TVq;encoded TVq;encodedco TVq;encodedcom TVq;encodedcomm TVq;encodedcomma TVq;encodedcomman TVq;encodedcommand TVq;e aQBIA;en aQBIA;enc aQBIA;enco aQBIA;encode aQBIA;encoded aQBIA;encodedco aQBIA;encodedcom aQBIA;encodedcomm aQBIA;encodedcomma aQBIA;encodedcomman aQBIA;encodedcommand aQBIA;e UEs;en UEs;enc UEs;enco UEs;encode UEs;encoded UEs;encodedco UEs;encodedcom UEs;encodedcomm UEs;encodedcomma UEs;encodedcomman UEs;encodedcommand UEs;e H4s;en H4s;enc H4s;enco H4s;encode H4s;encoded H4s;encodedco H4s;encodedcom H4s;encodedcomm H4s;encodedcomma H4s;encodedcomman H4s;encodedcommand H4s;e dXNpbm;en dXNpbm;enc dXNpbm;enco dXNpbm;encode dXNpbm;encoded dXNpbm;encodedco dXNpbm;encodedcom dXNpbm;encodedcomm dXNpbm;encodedcomma dXNpbm;encodedcomman dXNpbm;encodedcommand dXNpbm;e cwBhA;en cwBhA;enc cwBhA;enco cwBhA;encode cwBhA;encoded cwBhA;encodedco cwBhA;encodedcom cwBhA;encodedcomm cwBhA;encodedcomma cwBhA;encodedcomman cwBhA;encodedcommand cwBhA;JABzA @@ -626,11 +693,17 @@ \cmd.exe /c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe /c del "C:\Users\*\Desktop\*.exe;\cmd.exe -c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe -c del "C:\Users\*\Desktop\*.exe - ping.exe -n 6 127.0.0.1 &ping.exe /n 6 127.0.0.1 & type - System.Net.Networkinformation.ping + + ping.exe -n 6 127.0.0.1 &ping.exe /n 6 127.0.0.1 & type + + + System.Net.Networkinformation.ping + - mofcomp.exe - + + mofcomp.exe + + @@ -651,8 +724,12 @@ add tvsu_tmp - dsmod.exe - dsadd.exe + + dsmod.exe + + + dsadd.exe + @@ -669,7 +746,7 @@ - + cmd.exe @@ -711,21 +788,41 @@ eventvwr.exe c:\windows\system32\mmc.exe - fodhelper.exe - InstallUtil.exe - Invoke-PsUaCme - BypassUAC - PowerUp - computerdefaults.exe - dism.exe - fodhelper.exe + + fodhelper.exe + + + InstallUtil.exe + + + Invoke-PsUaCme + + + BypassUAC + + + PowerUp + + + computerdefaults.exe + + + dism.exe + + + fodhelper.exe + NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC NT AUTHORITY\SYSTEM;СИСТЕМА;NT-AUTORITÄT\SYSTEM;AUTORITE NT\SYSTEM - c:\windows\system32\svchost.exe -k netsvcs -s Appinfo - runas.exe + + c:\windows\system32\svchost.exe -k netsvcs -s Appinfo + + + runas.exe + @@ -746,14 +843,28 @@ utilman.exe C:\Windows\System32\ATBroker.exe;Magnify.exe;C:\Windows\System32\osk.exe - sethc.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe + + sethc.exe + + + osk.exe + + + Magnify.exe + + + DisplaySwitch.exe + + + Narrator.exe + + + AtBroker.exe + - sdbinst.exe + + sdbinst.exe + dwm.exe @@ -772,11 +883,17 @@ - + - unknown process - \LocalState\rootfs\ - \LocalState\rootfs\ + + unknown process + + + \LocalState\rootfs\ + + + \LocalState\rootfs\ + @@ -804,7 +921,7 @@ - + Sysinternals Sysmon /u;/c;-u;-c C:\ProgramdData\sysmon\ @@ -824,20 +941,38 @@ IMPHASH=330768a4f172e10acb6287b87289d83b - PsKill.exe + + PsKill.exe + Set-MpPreference;Add-MpPreference;Remove-MpPreference;MpCmdRun.exe RemoveDefinitions;RemoveDynamicSignature;DisableIOAVProtection;DisableRealTimeMonitoring;DisableBehaviorMonitoring;DisableBlockAtFirstSeen;DisableIOAVProtection;DisablePrivacyMode;DisableScriptScanning;DisableRealtimeMonitoring;DisableScanningNetworkFiles;DisableScanningMappedNetworkDrivesForFullScan;DisableRestorePoint;DisableRemovableDriveScanning;SignatureDisableUpdateOnStartupWithoutEngine;DisableIntrusionPreventionSystem;DisableScanOnRealtimeEnable;DisableArchiveScanning;DisableIntrusionPreventionSystem;DisableScriptScanning;DisableOnAccessProtection;ExclusionExtension;ExclusionPath;ExclusionProcess;ThreatDefaultAction;TamperProtection - interface ipv6 set - interface ipv4 set - taskkill.exe + + interface ipv6 set + + + interface ipv4 set + + + taskkill.exe + - firewall delete - firewall add - firewall set opmode disable - Core Networking - Router Solicitation - netsh advfirewall firewall + + firewall delete + + + firewall add + + + firewall set opmode disable + + + Core Networking - Router Solicitation + + + netsh advfirewall firewall + wevtutil.exe @@ -872,25 +1007,46 @@ bash.exe;wsl.exe;ubuntu.exe;kali.exe -e;/e;-u root;--exec bash;dev/tcp;~ -d;~ /d - wsl.exe - wsl.exe - wslhost.exe - wslhost.exe - ubuntu.exe - ubuntu.exe - kali.exe - kali.exe - distro-id;vm-id - - pcalua.exe - pcalua.exe - bash.exe - bash.exe - forfiles.exe - forfiles.exe - .com - -appvscript - + + wsl.exe + wsl.exe + + + wslhost.exe + + + wslhost.exe + ntsirlemes_deadpool + + + ubuntu.exe + ubuntu.exe + + + kali.exe + kali.exe + + + distro-id;vm-id + + + pcalua.exe + pcalua.exe + + + bash.exe + bash.exe + + + forfiles.exe + forfiles.exe + + + .com + + + -appvscript + C:\Users\NetworkService\;C:\Users\NetworkService\;HarddiskVolumeShadowCopy;C:\Users\Default\;C:\Users\Public;C:\Users\Guest\;\administrateur\;C:\Windows\Media\;C:\Windows\addins\;tsclient\;\htdocs\;\config\systemprofile\;C:\PerfLogs\;c:\windows\ServiceProfiles\;C:\Intel\Logs\;C:\Windows\repair\;C:\Windows\Help\;$Recycle;C:\Windows\Debug\;C:\Windows\Security\;C:\Windows\Fonts\;\wwwroot\;\Contacts;C:\Windows\vss\ @@ -918,9 +1074,15 @@ - reg add hkcu\software\classes\ - reg.exe add hkcu\software\classes\ - C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry + + reg add hkcu\software\classes\ + + + reg.exe add hkcu\software\classes\ + + + C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry + regedit.exe : @@ -965,6 +1127,8 @@ powershell.exe -ex;/ex bypass + C:\Programdata\Sysmon\SysmonUpdateConfig.ps1 + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe powershell.exe @@ -983,16 +1147,25 @@ C^om^S^pEc;^c^o^m^S^p^E^c^;Wscript.Shell;-ComObject;MsXml2.ServerXmlHttp;Remove.ToString;System.Convert;-UseB;[Byte[];^h^t^t^p;h"t"t"p - IwAjACMAd;IyM=;SUVYI;aWV4I;SQBFAFgA;aQBlAHgA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC - WindowStyle Hidden function;WindowStyle Hidden;windowstyle h;windowstyl h;windowsty h;windowst h;windows h;window h;windo h;wind h;win h;wi h;-w h;/w h;win hi;win hid;win hidd;win hidde;win hidden - ^ - TYPE CON > - copy CON > + + IwAjACMAd;IyM=;SUVYI;aWV4I;SQBFAFgA;aQBlAHgA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC + + + WindowStyle Hidden function;WindowStyle Hidden;windowstyle h;windowstyl h;windowsty h;windowst h;windows h;window h;windo h;wind h;win h;wi h;-w h;/w h;win hi;win hid;win hidd;win hidde;win hidden + + + ^ + + + TYPE CON > + + + copy CON > + FromBase64String;action=create keyvalue=;VerbosePreference.ToString;SecureString;CSharpCodeProvider;runtime.interopservices.marshal;system.globalization.numberstyles;system.reflection.assembly;hextobin;VerbosePreference.ToString;system.text.encoding;io.filestream;io.filestream;io.seekorigin;text.encoding;unicode.getstring;FromBase64;[Convert]::;System.IO.File]::ReadAllText;|iex ngen.exe;install - certutil decode;encode @@ -1024,7 +1197,9 @@ csc.exe out:;target:library - Microsoft.Workflow.Compiler.exe + + Microsoft.Workflow.Compiler.exe + @@ -1108,7 +1283,7 @@ \SearchProtocolHost.exe;\taskhost.exe;\csrss.exe - \werfault.exe;\wermgr.exe;\WerFaultSecure.exe + \werfault.exe;\wermgr.exe;\WerFaultSecure.exe;\NGenTask.exe autochk.exe @@ -1175,51 +1350,128 @@ rundll32.exe;shell32.dll;_RunDLL C:\Windows\ImmersiveControlPanel\SystemSettings.exe + C:\Windows\System32\appwiz.cpl odbcconf.exe /S /A {REGSVR;-S -A {REGSVR - script:http - Register-cimprovider - Scriptrunner.exe -appvscript - bginfo - cbd - runscripthelper.exe surfacecheck - xwizard RunWizard - PresentationHost - driver executeinf - control.exe /name;control.exe -name - Control_RunDLL - SyncAppvPublishingServer.exe - Scriptrunner.exe - ATBroker.exe - Appvlp.exe - InfDefaultInstall.EXE - PresentationHost.exe - RegisterCimProvider2.exe - RegisterCimProvider.exe - ScriptRunner.exe - csi.exe - extexport.exe - msconfig.EXE - rasdlui.exe - tttracer.exe - verclsid.exe - wab.exe - Register-cimprovider.exe - csi.exe - devtoolslauncher.exe LaunchForDeploy - bginfo - devtoolslauncher.exe - wab.exe - wsreset.exe + + script:http + + + Register-cimprovider + + + Scriptrunner.exe -appvscript + + + bginfo + + + cbd + + + runscripthelper.exe surfacecheck + + + xwizard RunWizard + + + PresentationHost + + + driver executeinf + + + control.exe /name;control.exe -name + + + Control_RunDLL + + + SyncAppvPublishingServer.exe + + + Scriptrunner.exe + + + ATBroker.exe + + + Appvlp.exe + + + InfDefaultInstall.EXE + + + PresentationHost.exe + + + RegisterCimProvider2.exe + + + RegisterCimProvider.exe + + + ScriptRunner.exe + + + csi.exe + + + extexport.exe + + + msconfig.EXE + + + rasdlui.exe + + + tttracer.exe + + + verclsid.exe + + + wab.exe + + + Register-cimprovider.exe + + + csi.exe + + + devtoolslauncher.exe LaunchForDeploy + + + bginfo + + + devtoolslauncher.exe + + + wab.exe + + + wsreset.exe + - cmstp.exe /ni /s;cmstp.exe -ni -s - cmstp /ni /s;cmstp -ni -s + + cmstp.exe /ni /s;cmstp.exe -ni -s + + + cmstp /ni /s;cmstp -ni -s + - Mavinject.exe - INJECTRUNNING + + Mavinject.exe + + + INJECTRUNNING + rundll32.exe @@ -1234,12 +1486,24 @@ regsvr32.exe C:\Users;Public - Microsoft(C) Register Server - SyncAppvPublishingServer.exe - control.exe - rasautou.exe - control.exe /name;control.exe -name - Control_RunDLL + + Microsoft(C) Register Server + + + SyncAppvPublishingServer.exe + + + control.exe + + + rasautou.exe + + + control.exe /name;control.exe -name + + + Control_RunDLL + msiexec.exe @@ -1323,20 +1587,48 @@ rdpinit.exe rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe - advpack.dll;LaunchINFSection - ieadvpack.dll;LaunchINFSection - syssetup.dll;SetupInfObjectInstallAction - setupapi.dll;InstallHinfSection - InstallHinfSection - infDefaultInstall.exe - rundll32.exe "C:\Windows\twain_64.dll" - shdocvw.dll;OpenURL - advpack.dll;RegisterOCX - Zipfldr.dll;RouteTheCall - url.dll;FileProtocolHandler - url.dll;FileProtocolHandler - OpenURLA;file: - OpenURL;file: + + advpack.dll;LaunchINFSection + + + ieadvpack.dll;LaunchINFSection + + + syssetup.dll;SetupInfObjectInstallAction + + + setupapi.dll;InstallHinfSection + + + InstallHinfSection + + + infDefaultInstall.exe + + + rundll32.exe "C:\Windows\twain_64.dll" + + + shdocvw.dll;OpenURL + + + advpack.dll;RegisterOCX + + + Zipfldr.dll;RouteTheCall + + + url.dll;FileProtocolHandler + + + url.dll;FileProtocolHandler + + + OpenURLA;file: + + + OpenURL;file: + mshta.exe @@ -1345,14 +1637,23 @@ mshta.exe - RunHTMLApplication - mshtml - vbscript:CreateObject + + RunHTMLApplication + + + mshtml + + + vbscript:CreateObject + - odbcconf.exe - + + odbcconf.exe + - manage-bde.wsf + + manage-bde.wsf + @@ -1380,15 +1681,22 @@ msbuild.exe .lnk - .csproj + + .csproj + - msxsl.exe - msxsl.exe + + msxsl.exe + + + msxsl.exe + + @@ -1397,11 +1705,21 @@ - /stext - keylog - keyscan_ - Get-Keystrokes - /scomma + + /stext + + + keylog + + + keyscan_ + + + Get-Keystrokes + + + /scomma + @@ -1452,51 +1770,116 @@ cmdkey - rpcping.exe - nltest.exe + + rpcping.exe + + + nltest.exe + -ma lsass.exe;Do-Exfiltration;Powersploit;GPPPassword;gpprefdecrypt;gsecdump;hashdump;laZagne;ntds.dit;ppldump;pwdump;pwdumpx;secretsdump;/listcreds:;-listcreds: - VaultCloseVault - VaultEnumerateItem - VaultFree - VaultGetItem - VaultOpenVault - Vaultcmd - vaultcli.dll - select * from moz_login - Invoke-WinEnum - System.Net.CredentialCache - create shadow - wlan;export;profile;key=clear - dcsync - HKCU /f password;HKCU -f password - HKLM /f password;HKLM -f password - nltest.exe - ProcDump.exe - ProcDump + + VaultCloseVault + + + VaultEnumerateItem + + + VaultFree + + + VaultGetItem + + + VaultOpenVault + + + Vaultcmd + + + vaultcli.dll + + + select * from moz_login + + + Invoke-WinEnum + + + System.Net.CredentialCache + + + create shadow + + + wlan;export;profile;key=clear + + + dcsync + + + HKCU /f password;HKCU -f password + + + HKLM /f password;HKLM -f password + + + nltest.exe + + + ProcDump.exe + + + ProcDump + - asktgt;asktgs - createnetonly /program:;createnetonly -program: - dump /service:krbtgt;dump -service:krbtgt - harvest /interval:;harvest -interval: - renew /ticket:;renew -ticket: - asreproast - impersonateuser: - kerberoast - ptt /ticket: - klist.exe - hh.exe + + asktgt;asktgs + + + createnetonly /program:;createnetonly -program: + + + dump /service:krbtgt;dump -service:krbtgt + + + harvest /interval:;harvest -interval: + + + renew /ticket:;renew -ticket: + + + asreproast + + + impersonateuser: + + + kerberoast + + + ptt /ticket: + + + klist.exe + + + hh.exe + appcmd.exe list;text;password + - quser.exe + + quser.exe + net.exe;net1.exe;net2.exe group;localgroup; user @@ -1522,10 +1905,18 @@ sharphound;bloodhound sharphound;bloodhound - dscl . list /Groups;dscl . list -Groups - dscl . list /Users;dscl . list -Users - dsquery.exe - query.exe + + dscl . list /Groups;dscl . list -Groups + + + dscl . list /Users;dscl . list -Users + + + dsquery.exe + + + query.exe + @@ -1536,14 +1927,20 @@ - tree.com + + tree.com + auditpol /get;-get;/list;-list;/backup;-backup - gpresult.exe - get-gpo;get-gpresult;get-gpreg + + gpresult.exe + + + get-gpo;get-gpresult;get-gpreg + @@ -1551,16 +1948,29 @@ - tasklist.exe - qprocess.exe + + tasklist.exe + + + qprocess.exe + - reg query - reg.exe query - driverquery.exe - + + reg query + + + reg.exe query + + + driverquery.exe + - tracert.exe - pathping.exe + + tracert.exe + + + pathping.exe + @@ -1610,16 +2020,30 @@ find;sidecar select-string;sidecar process;Description;sidecar + find;nxlog + select-string;nxlog + process;Description;nxlog + find;lpagent + select-string;lpagent + process;Description;lpagent fltMC.exe misc::mflt - AntiVirusProduct - root\SecurityCenter2 + + AntiVirusProduct + + + root\SecurityCenter2 + - sysinfo.exe - systeminfo + + sysinfo.exe + + + systeminfo + @@ -1630,12 +2054,22 @@ netsh.exe get;list;show - ipconfig.exe + + ipconfig.exe + - netstat.exe - arp -a - arp.exe -a - arp -a + + netstat.exe + + + arp -a + + + arp.exe -a + + + arp -a + whoami.exe;whoami1.exe @@ -1665,9 +2099,12 @@ route.exe ADD;DEL;CHANGE;-f - qwinsta.exe - rwinsta.exe - + + qwinsta.exe + + + rwinsta.exe + @@ -1688,8 +2125,12 @@ - /shadow;-shadow - noConsentPrompt + + /shadow;-shadow + + + noConsentPrompt + tscon.exe @@ -1764,13 +2205,27 @@ ping.exe bitsadmin.exe - winrm.cmd - winrs.exe - winrshost.exe - waitfor.exe - wsmprovhost.exe - winrshost.exe - wsmprovhost.exe + + winrm.cmd + + + winrs.exe + + + winrshost.exe + + + waitfor.exe + + + wsmprovhost.exe + + + winrshost.exe + + + wsmprovhost.exe + wmiprvse.exe mshta.exe @@ -1778,7 +2233,9 @@ ssh.exe;putty.exe;kitty.exe;kitty_portable.exe - PuTTY suite + + PuTTY suite + sftp;psftp @@ -1793,38 +2250,90 @@ rundll32.exe ,StartW - psshutdown - psservice - PsPasswd - mstsc.exe - telnet.exe - tftp.exe - powershellcustomhost - - - -Embedding - c:\windows\system32\mmc.exe + + psshutdown - --execm;atexec - {4991d34b-80a1-4291-83b6-3328366b9097} - {00020812-0000-0000-C000-000000000046} - {40AEEAB6-8FDA-41e3-9A5F-8350D4CFCA91} - {7e0423cd-1119-0928-900c-e6d4a52a0715} - {0006F04A-0000-0000-C000-000000000046} - {048EB43E-2059-422F-95E0-557DA96038AF} - {13709620-C279-11CE-A49E-444553540000} - {c08afd90-f2a1-11d1-8455-00a0c91f3880} - 9BA05972-F6A8-11CF-A442-00A0C90A8F39 - {00021A20-0000-0000-C000-000000000046} - {72C24DD5-D70A-438B-8A42-98424B88AFB8} - {00020906-0000-0000-C000-000000000046} - {cc5bbec3-db4a-4bed-828d-08d78ee3e1ed} - {1b7cd997-e5ff-4932-a7a6-2a9e636da385} - {16d51579-a30b-4c8b-a276-0ff4dc41e755} - rundll32.exe -sta;rundll32.exe /sta;rundll32 -sta;rundll32 /sta - shell32.dll;SHCreateLocalServerRunDll - -k DcomLaunch;/k DcomLaunch - + + psservice + + + PsPasswd + + + mstsc.exe + + + telnet.exe + + + tftp.exe + + + powershellcustomhost + + + + -Embedding + c:\windows\system32\mmc.exe + + + --execm;atexec + + + {4991d34b-80a1-4291-83b6-3328366b9097} + + + {00020812-0000-0000-C000-000000000046} + + + {40AEEAB6-8FDA-41e3-9A5F-8350D4CFCA91} + + + {7e0423cd-1119-0928-900c-e6d4a52a0715} + + + {0006F04A-0000-0000-C000-000000000046} + + + {048EB43E-2059-422F-95E0-557DA96038AF} + + + {13709620-C279-11CE-A49E-444553540000} + + + {c08afd90-f2a1-11d1-8455-00a0c91f3880} + + + 9BA05972-F6A8-11CF-A442-00A0C90A8F39 + + + {00021A20-0000-0000-C000-000000000046} + + + {72C24DD5-D70A-438B-8A42-98424B88AFB8} + + + {00020906-0000-0000-C000-000000000046} + + + {cc5bbec3-db4a-4bed-828d-08d78ee3e1ed} + + + {1b7cd997-e5ff-4932-a7a6-2a9e636da385} + + + {16d51579-a30b-4c8b-a276-0ff4dc41e755} + + + rundll32.exe -sta;rundll32.exe /sta;rundll32 -sta;rundll32 /sta + + + shell32.dll;SHCreateLocalServerRunDll + + + -k DcomLaunch;/k DcomLaunch + + @@ -1856,13 +2365,21 @@ Compress-Archive - WindowsAudioDevice-Powershell-Cmdlet - SoundRecorder.exe + + WindowsAudioDevice-Powershell-Cmdlet + + + SoundRecorder.exe + - clip.exe - get-clipboard + + clip.exe + + + get-clipboard + @@ -1879,10 +2396,18 @@ - screencapture - system.drawing.Imaging - system.drawing.bitmap - system.windows.forms.screen + + screencapture + + + system.drawing.Imaging + + + system.drawing.bitmap + + + system.windows.forms.screen + @@ -1890,9 +2415,10 @@ odHRwczovL;aHR0cDovL;h0dHA6Ly;odHRwOi8v;aHR0cHM6Ly;h0dHBzOi8v - ie_to_edge_stub.exe;chrome.exe;firefox.exe;iexplore.exe;brave.exe;vivaldi.exe;msedge.exe;webex;teams.exe;goto opener.exe;lynx.exe;\Webex\webexAppLauncherLatest.exe;\WebEx\webexAppLauncher.exe;\WebEx\Applications\webexAppLauncher.exe;WebEx\webex.exe - wbx:;/SITE_TOKEN=;msteams:;PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSI + ie_to_edge_stub.exe;chrome.exe;firefox.exe;iexplore.exe;brave.exe;vivaldi.exe;msedge.exe;webex;teams.exe;goto opener.exe;lynx.exe;\Webex\webexAppLauncherLatest.exe;\WebEx\webexAppLauncher.exe;\WebEx\Applications\webexAppLauncher.exe;WebEx\webex.exe;C:\PROGRA~2\BEANYW~1\GETSUP~1\TCIntegratorCommHelper.exe + wbx:;/SITE_TOKEN=;msteams:;PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSI;NCentralRDLdr.exe msedgeupdate.dll + C:\Program Files (x86)\BeAnywhere Support Express\GetSupportService_N-Central\BASupSrvc.exe;NCentralRDLdr.exe VFZvQUFBQ;RWb0FBQU;UVm9BQUFB;VFZxQUFBR;RWcUFBQU;UVnFBQUFF;VFZwUUFBS;RWcFFBQU;UVnBRQUFJ;VFZxUUFBT;RWcVFBQU;UVnFRQUFN;VFZwVEFRR;RWcFRBUU;UVnBUQVFF @@ -1946,25 +2472,51 @@ C:\Perflogs\;C:\Users\Public\;C:\root\ - start-bitstransfer - expand \\ - expand.exe \\ - ieexec http - ieexec.exe http - powercat - esentutl /y \\;esentutl -y \\ - esentutl.exe /y \\;esentutl.exe -y \\ - extrac32 \\ - extrac32.exe \\ + + start-bitstransfer + + + expand \\ + + + expand.exe \\ + + + ieexec http + + + ieexec.exe http + + + powercat + + + esentutl /y \\;esentutl -y \\ + + + esentutl.exe /y \\;esentutl.exe -y \\ + + + extrac32 \\ + + + extrac32.exe \\ + - portproxy - tor.exe + + portproxy + + + tor.exe + - TeamViewer_Desktop.exe + + TeamViewer_Desktop.exe + psexec @@ -2016,7 +2568,6 @@ - @@ -2066,19 +2617,42 @@ manage-bde.wsf changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw - format - format - bootstatuspolicy ignoreallfailures - recoveryenabled No - Win32_Shadowcopy - sdelete - delete catalog - wbadmin delete catalog - erase - -nw -exec= - -p -nw - shred - diskshadow + + format + + + bootstatuspolicy ignoreallfailures + + + recoveryenabled No + + + Win32_Shadowcopy + + + sdelete + + + delete catalog + + + wbadmin delete catalog + + + erase + + + -nw -exec= + + + -p -nw + + + shred + + + diskshadow + del ; /f del ; -f @@ -2088,7 +2662,9 @@ rd ; -s ; -q - usn deletejournal + + usn deletejournal + @@ -2104,7 +2680,9 @@ - AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz + + AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz + ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool @@ -2113,13 +2691,27 @@ b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 - 87AECF008D87EC86EC8B00A2394B3E6C - FB3F0D0DE8B80EA8CFAB2A025EC6B833 - F4067FBF7FFF6945D0BB485B727B39AA - 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee - e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f - d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b - 53841a0c6a3ff92976db08bfdf95e083 + + 87AECF008D87EC86EC8B00A2394B3E6C + + + FB3F0D0DE8B80EA8CFAB2A025EC6B833 + + + F4067FBF7FFF6945D0BB485B727B39AA + + + 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee + + + e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f + + + d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b + + + 53841a0c6a3ff92976db08bfdf95e083 + zoommtg @@ -2157,41 +2749,112 @@ C:\Users\Public\;$Recyclebin;\Desktop\;\Content.Outlook\;\Downloads\ .html;.hta;.iso;.js;.bat;.cmd;.cmdline;.vbs;.vb;.vbe;.reg;.com - listena - -s -n -u -i:http: - /s /n /u /i:http: - assoc - del - expand - md - move - rd - ren - set - setx - bginfo.bgi /popup /nolicprompt;bginfo.bgi -popup -nolicprompt - find.exe - grabff - routerscan - pythonEngine.Execute - sesshijack - file:// - HTML Application host - Manager Profile Installer - Microsoft Application Virtualization Injector - Application Compatibility Database Installer - popd.exe - pushd.exe - subst.exe - doskey.exe - cls.exe - \ - C:\Windows\system32\svchost.exe -k iissvcs - \ - acrobat.exe - acrord32.exe - java.exe - javaw.exe + + -s -n -u -i:http: + + + /s /n /u /i:http: + + + listena + + + assoc + + + del + + + expand + + + md + + + move + + + rd + + + ren + + + set + + + setx + + + bginfo.bgi /popup /nolicprompt;bginfo.bgi -popup -nolicprompt + + + find.exe + + + grabff + + + routerscan + + + pythonEngine.Execute + + + sesshijack + + + file:// + + + HTML Application host + + + Manager Profile Installer + + + Microsoft Application Virtualization Injector + + + Application Compatibility Database Installer + + + popd.exe + + + pushd.exe + + + subst.exe + + + doskey.exe + + + cls.exe + + + \ + + + C:\Windows\system32\svchost.exe -k iissvcs + + + \ + + + acrobat.exe + + + acrord32.exe + + + java.exe + C:\ProgramData\Cavelo\jre\bin\java.exe + + + javaw.exe + - census - researchscan - scanhub - shadow - shodan + + census + + + researchscan + + + scanhub + + + shadow + + + shodan + 137.184.67.33;206.188.196.77;125.212.220.48;5.180.61.17;47.242.39.92;61.244.94.85;86.48.6.69;86.48.12.64;94.140.8.48;94.140.8.113;103.9.76.208;103.9.76.211;104.244.79.6;112.118.48.186;122.155.174.188;125.212.241.134;185.220.101.182;194.150.167.88;212.119.34.11 137.184.67. @@ -2286,7 +2997,6 @@ kali.download - shodan @@ -2328,8 +3038,12 @@ - at.exe - schtasks.exe + + at.exe + + + schtasks.exe + @@ -2399,25 +3113,63 @@ \wwwroot\ - \Windows\addins\ - C:\Windows\repair\ - \htdocs\ - C:\Windows\system32\config\systemprofile\ - C:\Intel\Logs\ - C:\Windows\addins\ - C:\Windows\security\ - C:\Windows\Help\ - $RECYCLE.BIN - C:\Windows\Debug\ - C:\Windows\Fonts\ - C:\PerfLogs\ - :\$Recycle.bin\ - :\Users\Default\ - C:\Users\NetworkService\ - C:\Users\Public\ - C:\Windows\Media\ - \Windows\IME\ - C:\ProgramData + + \Windows\addins\ + + + C:\Windows\repair\ + + + \htdocs\ + + + C:\Windows\system32\config\systemprofile\ + + + C:\Intel\Logs\ + + + C:\Windows\addins\ + + + C:\Windows\security\ + + + C:\Windows\Help\ + + + $RECYCLE.BIN + + + C:\Windows\Debug\ + + + C:\Windows\Fonts\ + + + C:\PerfLogs\ + + + :\$Recycle.bin\ + + + :\Users\Default\ + + + C:\Users\NetworkService\ + + + C:\Users\Public\ + + + C:\Windows\Media\ + + + \Windows\IME\ + + + C:\ProgramData + @@ -2435,19 +3187,29 @@ - infDefaultInstall.exe - SyncAppvPublishingServer.exe + + infDefaultInstall.exe + + + SyncAppvPublishingServer.exe + - InstallUtil.exe + + InstallUtil.exe + - msiexec.exe + + msiexec.exe + regasm.exe;regsvcs.exe - Mavinject.exe + + Mavinject.exe + @@ -2491,7 +3253,9 @@ - dsquery.exe + + dsquery.exe + @@ -2504,17 +3268,29 @@ - driverquery.exe + + driverquery.exe + - nbtstat.exe + + nbtstat.exe + - net.exe - net1.exe + + net.exe + + + net1.exe + - qwinsta.exe - rwinsta.exe + + qwinsta.exe + + + rwinsta.exe + @@ -2552,6 +3328,9 @@ svchost.exe thor64.exe thor.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe + C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe + SentinelRanger.exe true @@ -2585,6 +3364,7 @@ true 3389 127.0.0.1;0:0:0:0:0:0:0:1 + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe true @@ -2600,25 +3380,63 @@ psftp.exe - reg.exe - psshutdown - PsPasswd - psservice - ssh.exe - psexe - tftp.exe - telnet.exe - mstsc.exe - wmic.exe - sc.exe - pskill - dsquery.exe - plink.exe - vnc.exe - vncviewer.exe - vncservice.exe - omniinet.exe - hpsmhd.exe + + reg.exe + + + psshutdown + + + PsPasswd + + + psservice + + + ssh.exe + + + psexe + + + tftp.exe + + + telnet.exe + + + mstsc.exe + + + wmic.exe + + + sc.exe + + + pskill + + + dsquery.exe + + + plink.exe + + + vnc.exe + + + vncviewer.exe + + + vncservice.exe + + + omniinet.exe + + + hpsmhd.exe + @@ -2665,22 +3483,42 @@ powershell.exe 0:0:0:0:0:0:0:;127.0.0.1 - mshta.exe - cmd.exe - certutil.exe - certutil.exe - notepad.exe - regsvcs.exe - regsvr32.exe - rundll32.exe + + mshta.exe + + + cmd.exe + + + certutil.exe + + + bitsadmin.exe + + + notepad.exe + + + regsvcs.exe + + + regsvr32.exe + + + rundll32.exe + - tor.exe - hiddenservice.net;onion.city;onion.direct;onion.direct;onion.link;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org;onion.to + + tor.exe + + + hiddenservice.net;onion.city;onion.direct;onion.direct;onion.link;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org;onion.to + @@ -2689,16 +3527,25 @@ - dns.google;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;doh.opendns.com;.quad9.net;dns.cleanbrowsing.org;dns-family.adguard.com;dns.adguard.com;.233py.com;dnscrypt;dnscrypt-cert.oszx.co;dns.oszx.co;doh.dns.sb;doh.defaultroutes.de;doh.tiarap.org;doh.tiar.app;doh.captnemo.in;.aaflalo.me;doh.appliedprivacy.net;doh.dnswarden.com;commons.host;dns.twnic.tw;ibuki.cgnat.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;.seby.io;rdns.faelix.net;doh.li;.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk;adblock.mydns.network;ibksturm.synology.me;jcdns.fun + + dns.google;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;doh.opendns.com;.quad9.net;dns.cleanbrowsing.org;dns-family.adguard.com;dns.adguard.com;.233py.com;dnscrypt;dnscrypt-cert.oszx.co;dns.oszx.co;doh.dns.sb;doh.defaultroutes.de;doh.tiarap.org;doh.tiar.app;doh.captnemo.in;.aaflalo.me;doh.appliedprivacy.net;doh.dnswarden.com;commons.host;dns.twnic.tw;ibuki.cgnat.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;.seby.io;rdns.faelix.net;doh.li;.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk;adblock.mydns.network;ibksturm.synology.me;jcdns.fun + - privatlab.com - mega.nz;mega.co.nz - .pcloud.com + + privatlab.com + + + mega.nz;mega.co.nz + + + .pcloud.com + + @@ -2711,7 +3558,9 @@ - 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool + + 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool + @@ -2758,8 +3607,12 @@ 443 true - github - githubusercontent.com + + github + + + githubusercontent.com + dropboxapi.com \Dropbox\Client\Dropbox.exe;\Dropbox\bin\Dropbox.exe;\Oracle\Java\ @@ -2778,10 +3631,10 @@ privatlab.com - + tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat - + efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet @@ -2818,52 +3671,110 @@ inetinfo.exe - netcat.exe;nc.exe;nc64.exe;ncat.exe - procdump - psexe - vnc;vncs;vncv + + netcat.exe;nc.exe;nc64.exe;ncat.exe + + + procdump + + + psexe + + + vnc;vncs;vncv + rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe;advanced_port_scanner.exe;rcpping.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe - 0 - 5985 - 5986 - 1293 - 1701 - 1194 - 3540 - 3389 - 22 - 1080 - 3128 - 8080 - 1723 - 23 - 4500 - 9001 - 9030 - 5900 - 5800 + + 0 + + + 5985 + + + 5986 + + + 1293 + + + 1701 + + + 1194 + + + 3540 + + + 3389 + + + 22 + + + 1080 + + + 3128 + + + 8080 + + + 1723 + + + 23 + + + 4500 + + + 9001 + + + 9030 + + + 5900 + + + 5800 + - 0 - 80 - 443 - 636 - 5900 - 443 + + 0 + + + 80 + + + 443 + + + 636 + + + 5900 + + + 443 + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe 80 true - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;C:\Program Files\Cavelo\Cavelo Agent\cavelo_windows_amd64.exe;C:\PROGRA~2\BEANYW~1\GETSUP~1\TCIntegratorCommHelper.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe;C:\Program Files (x86)\BeAnywhere Support Express\GetSupportService_N-Central\BASupSrvc.exe https true - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe + \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe http true @@ -2873,7 +3784,9 @@ true - afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com + + afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com + @@ -3016,6 +3929,7 @@ C:\Program Files\Kaspersky Lab C:\Program Files (x86)\ESET C:\Program Files\ESET + C:\Program Files\SentinelOne @@ -3061,27 +3975,41 @@ C:\ProgramData\ - C:\ProgramData\sysmon\sysmon64.exe;C:\ProgramData\sysmon\sysmon.exe + C:\ProgramData\sysmon\sysmon64.exe;C:\ProgramData\sysmon\sysmon.exe;C:\ProgramData\Cavelo\jre\bin\java.exe C:\Program Files;C:\PROGRA~ + C:\Program Files\SentinelOne\ + C:\Program Files (x86)\N-Able Technologies\AutomationManagerEngine\2.70.0.4\AutomationManager.ScriptRunner64.exe;C:\PROGRA~2\BEANYW~1\GETSUP~1\TCIntegratorCommHelper.exe;C:\Program Files\Cavelo\Cavelo Agent\osqueryi.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\NASafeExec.exe C:\inetpub\ - $RECYCLE.BIN - packetbeat.exe;metricbeat.exe;filebeat.exe;winlogbeat.exe;o365beat.exe;graylog-sidecar.exe;graylog-collector-sidecar.exe;splunkd.exe;splunk.exe;syslogng.exe;syslog-ng.exe;nxlog-processor.exe;snarecore.exe;fluentd;td-agent - C:\Windows\system32\config\systemprofile\ - C:\Windows\sysWOW64\config\systemprofile\ - \Temp\ - C:\Users\ - - - - - Microsoft\Teams\current\Teams.exe - \git.exe + + $RECYCLE.BIN + + + packetbeat.exe;metricbeat.exe;filebeat.exe;winlogbeat.exe;o365beat.exe;graylog-sidecar.exe;graylog-collector-sidecar.exe;splunkd.exe;splunk.exe;syslogng.exe;syslog-ng.exe;nxlog-processor.exe;snarecore.exe;fluentd;td-agent;lpagent.exe + + + C:\Windows\system32\config\systemprofile\ + + + C:\Windows\sysWOW64\config\systemprofile\ + + + \Temp\ + + + C:\Users\ + + + + + + Microsoft\Teams\current\Teams.exe + \git.exe Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\ProgramData\Lenovo\ImController\ @@ -3095,19 +4023,45 @@ 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5;c948ae14761095e4d76b55d9de86412258be7afd;c996d7971c49252c582171d9380360f2;ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1;10b30bdee43b3a2ec4aa63375577ade650269d25;d2fd132ab7bbc6bbb87a84f026fa0244 - DumpExt.dll - mimidrv - lsremora - wceaux.dll - npcap - \Temp - :\Users - ChongKim Chan - ? - Revoked - Unavailable - Valid - false + + DumpExt.dll + + + mimidrv + + + lsremora + + + wceaux.dll + + + npcap + + + \Temp + + + :\Users + + + ChongKim Chan + + + ? + + + Revoked + + + Unavailable + + + Valid + + + false + SHA1=2261198385d62d2117f50f631652eded0ecc71db @@ -3632,10 +4586,13 @@ ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll C:\Users;\Temp\;\ProgramData\ + ConnectWise.exe + \MSP Anywhere for N-central\Viewer\tkcuploader.exe ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll \wscript.exe;\cscript.exe;\powershell.exe;\powershell_ise.exe;\rundll32.exe;\msbuild.exe;\csc.exe + 6.3.9600.20566 (winblue_ltsb_escrow.220812-1741) WINWORD.exe;EXCEL.EXE @@ -3673,6 +4630,7 @@ powershell amsi.dll + C:\Program Files (x86)\N-Able Technologies\AutomationManagerEngine\2.70.0.4\AutomationManager.ScriptRunner64.exe;C:\Program Files\Cavelo\Cavelo Agent\osqueryi.exe;C:\Program Files (x86)\Duo Device Health\Duo Device Health.exe logoncli.dll @@ -3705,6 +4663,7 @@ System.Management.Automation.dll C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ Lenovo.Vantage.AddinHost;\Microsoft.Sara.exe;C:\Program Files\CONEXANT + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe;C:\Program Files (x86)\N-able Technologies\AutomationManagerAgent\AutomationManager.AgentService.exe C:\Windows\System32\vaultcli.dll @@ -3730,6 +4689,7 @@ C:\Windows\System32\WinSCard.dll;C:\Windows\System32\cryptdll.dll;C:\Windows\System32\hid.dll;C:\Windows\System32\samlib.dll;C:\Windows\System32\vaultcli.dll + C:\Program Files\Cavelo\Cavelo Agent\osqueryi.exe;C:\Program Files\Veeam\Backup and Replication\Console\veeam.backup.shell.exe rundll32.exe @@ -3757,9 +4717,10 @@ C:\ProgramData\ .exe Adobe - C:\ProgramData\Lenovo\ + C:\ProgramData\Lenovo\;C:\ProgramData\Cavelo\jre\bin\java.exe C:\ProgramData\Microsoft\Windows Defender\ C:\ProgramData\sysmon\sysmon64.exe + C:\ProgramData\sysmon\sysmon.exe C:\Users\Default\;C:\Users\Public\ @@ -3827,6 +4788,7 @@ C:\Windows\Microsoft.NET\assembly\GAC_MSIL true + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe;C:\Program Files (x86)\N-able Technologies\AutomationManagerAgent\AutomationManager.AgentService.exe;C:\Program Files (x86)\Duo Device Health\Duo Device Health.exe @@ -3950,10 +4912,18 @@ c:\windows\system32\csrss.exe CrtlRoutine - 0B80 - 0C7C - 0C88 - c:\windows\system32\mstsc.exe + + 0B80 + + + 0C7C + + + 0C88 + + + c:\windows\system32\mstsc.exe + C:\WINDOWS\SYSTEM32\ntdll.dll EtwEventWrite @@ -4056,6 +5026,7 @@ C:\Windows\system32\winlogon.exe 0x1F3FFF C:\Windows\Microsoft.NET;UNKNOWN + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe .exe @@ -4102,6 +5073,7 @@ System.Management.Automation C:\ProgramData\Microsoft\Windows Defender\platform\ ctiuser.dll + AutomationManager.ScriptRunner64.exe C:\Program Files\Citrix\ConfigSync\ConfigSyncRun.exe C:\Program Files\Microsoft\Exchange Server\V14\bin\ExSetupUI.exe C:\Program Files\Microsoft\Exchange Server\V15\bin\ExSetupUI.exe @@ -4142,14 +5114,17 @@ C:\WINDOWS\system32\sihost.exe C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub - UNKNOWN + + UNKNOWN + |UNKNOWN( C:\WINDOWS\SYSTEM32\ntdll.dll+ |C:\WINDOWS\System32\KERNELBASE.dll+ ) + C:\Program Files\SentinelOne\ 0x1028;0x1fffff - C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git;\Intel\Driver and Support Assistant\DSAService.exe + C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git;\Intel\Driver and Support Assistant\DSAService.exe;C:\Program Files (x86)\N-able Technologies\AutomationManagerAgent\;C:\Program Files (x86)\MspPlatform\RequestHandlerAgent\RequestHandlerAgent.exe;C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe;C:\ProgramData\Cavelo\jre\bin\java.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe;C:\Program Files\Cavelo\Cavelo Agent\parser.exe C:\Windows\Microsoft.NET\Framework\;\NGenTask.exe \Intel\Driver and Support Assistant\ C:\Windows\Microsoft.NET\Framework\;\ngen.exe @@ -4169,23 +5144,46 @@ C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe;C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe;C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 0x1400 + C:\Program Files\SentinelOne\ - 0x0800 + + 0x0800 + - 0x0810 + + 0x0810 + - 0x0820 + + 0x0820 + - 0x810 + + 0x810 + - 0x820 - cscript.exe - wscript.exe - jjs.exe - dump - mimikatz - CorperfmontExt.dll + + 0x820 + + + cscript.exe + + + wscript.exe + + + jjs.exe + + + dump + + + mimikatz + + + CorperfmontExt.dll + @@ -4228,7 +5226,9 @@ - \TEMP\nessus_ + + \TEMP\nessus_ + @@ -4265,7 +5265,7 @@ C:\Windows\SoftwareDistribution - C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe + C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch .exe @@ -4282,55 +5282,133 @@ - .bat - .btm - .cmd - .com - .cmdline - .bas - .bin - C:\Windows\SysWOW64\Wbem - C:\Windows\System32\Wbem - .ws - .wsc - .wsf - .wsh - .pif + + .bat + + + .btm + + + .cmd + + + .com + + + .cmdline + + + .bas + + + .bin + + + C:\Windows\SysWOW64\Wbem + + + C:\Windows\System32\Wbem + + + .ws + + + .wsc + + + .wsf + + + .wsh + + + .pif + - .hta + + .hta + - IronPython - .py - .pyc - .pyd + + IronPython + + + .py + + + .pyc + + + .pyd + - + .cdxml + + .ps1 + C:\Program Files (x86)\N-Able Technologies\AutomationManagerEngine\2.70.0.4\AutomationManager.ScriptRunner64.exe + + .ps1xml + + .psc1 + + .psd1 + + .psm1 + AutomationManager.ScriptRunner64.exe + + .pssc powershell.exe;powershell_ise.exe \Recent\CustomDestinations\ - C:\Windows\SysWOW64\WindowsPowerShell - C:\Windows\System32\WindowsPowerShell - c:\Windows\System32\WindowsPowerShell\v1.0\profile - c:\Windows\Syswow64\WindowsPowerShell\v1.0\profile - \UsageLogs\powershell.exe.log - PSReadLine\ConsoleHost_history.txt + + C:\Windows\SysWOW64\WindowsPowerShell + + + C:\Windows\System32\WindowsPowerShell + + + c:\Windows\System32\WindowsPowerShell\v1.0\profile + + + c:\Windows\Syswow64\WindowsPowerShell\v1.0\profile + + + \UsageLogs\powershell.exe.log + + + PSReadLine\ConsoleHost_history.txt + - .vbs - .oracle_jre_usage\ - .js - .jse - .vb - .vbe - .vbsript + + .vbs + + + .oracle_jre_usage\ + + + .js + + + .jse + + + .vb + + + .vbe + + + .vbsript + @@ -4362,29 +5440,66 @@ C:\Users\;\Google\Chrome Beta\User Data\;\IndexedDB\ C:\Program Files\WindowsApps\Microsoft.YourPhone_;C:\Program Files\dotnet\shared\Microsoft.NETCore.App\;\Microsoft.NET\assembly\GAC_MSIL - crackmapexec - \Crypto.Cipher._AES.pyd - \Crypto.Cipher._DES.pyd - \Crypto.Hash._SHA256.pyd - \Crypto.Random.OSRNG.winrandom.pyd - \Crypto.Util.strxor.pyd - \crackmapexec.exe.manifest - \greenlet.pyd - BootStrapDLL.dll - C:\windows\temp\wininit.exe - lazycat;powerkatz;mimikatz;mimidrv;mimilove;mimilib;mimikittenz;mimiauth;invoke-mimi - rdpwrap.dll - winspool.drv + + crackmapexec + + + \Crypto.Cipher._AES.pyd + + + \Crypto.Cipher._DES.pyd + + + \Crypto.Hash._SHA256.pyd + + + \Crypto.Random.OSRNG.winrandom.pyd + + + \Crypto.Util.strxor.pyd + + + \crackmapexec.exe.manifest + + + \greenlet.pyd + + + BootStrapDLL.dll + + + C:\windows\temp\wininit.exe + + + lazycat;powerkatz;mimikatz;mimidrv;mimilove;mimilib;mimikittenz;mimiauth;invoke-mimi + + + rdpwrap.dll + + + winspool.drv + - C:\Windows\System32\Wbem - C:\Windows\SysWOW64\Wbem - C:\WINDOWS\system32\wbem\scrcons.exe + + C:\Windows\System32\Wbem + + + C:\Windows\SysWOW64\Wbem + + + C:\WINDOWS\system32\wbem\scrcons.exe + + - \Programs\Startup\ - \Startup\ + + \Programs\Startup\ + + + \Startup\ + @@ -4396,14 +5511,26 @@ - \Word\STARTUP\ - \Microsoft\Templates\ - \Excel\XLSTART\ - .dotm - .XLSB + + \Word\STARTUP\ + + + \Microsoft\Templates\ + + + \Excel\XLSTART\ + + + .dotm + + + .XLSB + - C:\Windows\Tasks\ + + C:\Windows\Tasks\ + RedirSuiteServiceProxy.aspx @@ -4464,13 +5591,27 @@ .aspx \wwwroot\ - \ecp\auth\ - \oab\auth\ - ClientAccess\Owa\ - \owa\auth\ - httpproxy\rpc\ - ClientAccess\ecp\ - \htdocs\ + + \ecp\auth\ + + + \oab\auth\ + + + ClientAccess\Owa\ + + + \owa\auth\ + + + httpproxy\rpc\ + + + ClientAccess\ecp\ + + + \htdocs\ + @@ -4521,19 +5662,36 @@ - \LocalState\rootfs\ - + + \LocalState\rootfs\ + - - C:\PerfLogs\ - C:\Temp\ - C:\Users\Default\ - C:\Users\Public\ - C:\Windows\Temp\ + + C:\PerfLogs\ + + + C:\Temp\ + + + C:\Users\Default\ + + + C:\Users\Public\ + + + C:\Windows\Temp\ + C:\Program Files\SentinelOne\ + C:\Program Files\Cavelo\Cavelo Agent\osqueryi.exe;C:\Program Files\Cavelo\Cavelo Agent\parser.exe;C:\Program Files\Cavelo\Cavelo Agent\tesseract\tesseract.exe;AutomationManager.ScriptRunner64.exe + + \AppData\Temp\ - $Recycle.Bin - $Recycle.Bin + + $Recycle.Bin + + + $Recycle.Bin + C:\Windows\ \config\systemprofile\ @@ -4542,24 +5700,58 @@ C:\Windows\ \config\systemprofile\ - + .exe + + .7z.exe + + .doc.exe + + .doc.exe + + .docx.exe + + .ico.exe + + .iso.exe + + .lnk.exe + + .pdf.exe + + .ppt.exe + + .pptx.exe + + .rar.exe + + .rtf.exe + + .txt.exe + + .xls.exe + + .xlsx.exe + + .zip.exe + + ______.exe @@ -4577,15 +5769,21 @@ - .chm + + .chm + - proj - .sln + + proj + + + .sln + @@ -4662,32 +5860,84 @@ - .7z - .7zip - .arj - .s7z - .a - .ace - .ar - .arc - .bin - .cab - .pak - .gz - .img - .iso - .lzm - .lzma - Temp\Rar$ - .rar - RarSFX - .sfx - .sz - .tar - .tar.gz - .tgz - .xz - .zip + + .7z + + + .7zip + + + .arj + + + .s7z + + + .a + + + .ace + + + .ar + + + .arc + + + .bin + + + .cab + + + .pak + + + .gz + + + .img + + + .iso + + + .lzm + + + .lzma + + + Temp\Rar$ + + + .rar + + + RarSFX + + + .sfx + + + .sz + + + .tar + + + .tar.gz + + + .tgz + + + .xz + + + .zip + @@ -4700,10 +5950,18 @@ - .ost - .eml - .msg - .pst + + .ost + + + .eml + + + .msg + + + .pst + @@ -4720,16 +5978,36 @@ - Teamviewer.exe - rundll32.exe - mstsc.exe - cmd.exe - ipy.exe - WScript.exe - cscript.exe - mshta.exe - python.exe - wmic.exe + + Teamviewer.exe + + + rundll32.exe + + + mstsc.exe + + + cmd.exe + + + ipy.exe + + + WScript.exe + + + cscript.exe + + + mshta.exe + + + python.exe + + + wmic.exe + C:\Users\Default\;C:\Users\Public\ .dll @@ -4743,17 +6021,24 @@ - - HiddenService - torrc - \tor.exe - tor-gencert + + + HiddenService + + + torrc + + + \tor.exe + + + tor-gencert + - @@ -4763,10 +6048,19 @@ - rclone - s3browser - grabff.exe - grabff.exe + + rclone + + + s3browser + + + grabff.exe + + + grabff.exe + + @@ -4817,10 +6111,13 @@ .dll;.exe C:\windows\ C:\Users\ + C:\Program Files\WindowsApps\ + C:\Program Files (x86)\MspPlatform\FileCacheServiceAgent\FileCacheServiceAgent.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe .dll;.exe C:\Users\ + C:\Users\*\AppData\Local\Microsoft\Teams\Update.exe \Microsoft\Word\Startup\ @@ -4878,274 +6175,779 @@ VirtualboxVM.exe - notepad++.exe - .lnk:Zone.Identifier - \UsageLogs\cscript.exe.log - \UsageLogs\mshta.exe.log - \UsageLogs\msiexec.exe.log - \UsageLogs\regsvr32.exe.log - \UsageLogs\rundll32.exe.log - \UsageLogs\svchost.exe.log - \UsageLogs\wmic.exe.log - \UsageLogs\wscript.exe.log - \regsvr32.exe.log - \UsageLogs\wsmprovhost.exe.log - .lnk - .url + + notepad++.exe + + + .lnk:Zone.Identifier + + + \UsageLogs\cscript.exe.log + + + \UsageLogs\mshta.exe.log + + + \UsageLogs\msiexec.exe.log + + + \UsageLogs\regsvr32.exe.log + + + \UsageLogs\rundll32.exe.log + + + \UsageLogs\svchost.exe.log + + + \UsageLogs\wmic.exe.log + + + \UsageLogs\wscript.exe.log + + + \regsvr32.exe.log + + + \UsageLogs\wsmprovhost.exe.log + + + .lnk + + + .url + - .sys - .inf - C:\Windows\SysWOW64\Drivers - C:\Windows\System32\Drivers - \Drivers\ - .drv + + .sys + + + .inf + + + C:\Windows\SysWOW64\Drivers + + + C:\Windows\System32\Drivers + + + \Drivers\ + + + .drv + - .xlam - .xlsm - .xla - .xll - .xls - .xlsb - .xlsx - .xlt - .xltm - .xlw - \Microsoft\Templates\ - .eml - .msg - .pptm - .potm - .pptm - .pptm - .sldm - \Microsoft\Office\Recent - oleObject - \Recent\CustomDestinations\ - \Downloads\ - \Content.Outlook\ - .docb - .wbk - .ped - .dot - .dotx - .doc - .docm - .docx - - .accdb - .accde - .accdr - .accdt - .mdb - .mde - .msc - .mst - .potx - .ppam - .ppsm - .ppsx - .ppt - .pptm - .pptx - .pub - .sldm - .sldx + + .xlam + + + .xlsm + + + .xla + + + .xll + + .xls - .xps - - - .pem - .crt - .ca-bundle - .cer - .csr - .der - .p7b + + .xlsb + + + .xlsx + + + .xlt + + + .xltm + + + .xlw + + + \Microsoft\Templates\ + + + .eml + + + .msg + + + .potm + + + .pptm + + + .sldm + + + \Microsoft\Office\Recent + + + oleObject + + + \Recent\CustomDestinations\ + + + \Downloads\ + + + \Content.Outlook\ + + + .docb + + + .wbk + + + .ped + + + .dot + + + .dotx + + + .doc + + + .docm + + + .docx + + + .accdb + + + .accde + + + .accdr + + + .accdt + + + .mdb + + + .mde + + + .msc + + + .mst + + + .potx + + + .ppam + + + .ppsm + + + .ppsx + + + .ppt + + + .pptm + + + .pptx + + + .pub + + + .sldm + + + .sldx + + + .xls + + + .xps + + + + .pem + + + .crt + + + .ca-bundle + + + .cer + + + .csr + + + .der + + + .p7b + + .p7r + + .p7s + + .pfx + + .sto + + .p12 + + .crl + + .sst + SentinelAgent.exe + + .key - + .hlp + + ACLUI.DLL.UI + + ACLUI.DLL + + AFLogVw.exe + + AShld.exe + + AShldRes.DLL.asr + + AShldRes.DLL + + AhnI2.dll + + CamMute.exe + + CommFunc.dll + + CommFunc.jax + + DESqmWrapper.dll + + DESqmWrapper.wrapper + + FSPMAPI.dll.fsp + + FSPMAPI.dll + + Gadget.exe + + LoLTWLauncher.exe + + Mc.exe + + McUtil.dll.ping + + McUtil.dll.url + + McUtil.dll + + MpSvc.dll + + MsMpEng.exe + + NtUserEx.dat + + NtUserEx.dat + + NtUserEx.dll + + NtUserEx.dll + + NvSmart.exe + + NvSmartMax.dll + + NvSmartMax.dll + + NvSmartMaxapp.dll + + OInfo11.ISO + + OInfo11.ocx + + OInfoP11.exe + + OleView.exe + + OleView.exe + + POETWLauncher.exe + + RasTls.dll.config + + RasTls.dll.msc + + RasTls.dll + + RasTls.exe + + RunHelp.exe + + Sidebar.dll.doc + + Sidebar.dll + + Ushata.dll + + Ushata.exe + + Ushata.fox + + VeetlePlayer.exe + + boot.ldr + + chrome_frame_helper.dll.rom + + chrome_frame_helper.dll + + chrome_frame_helper.exe + + dvcemumanager.exe + + fsguidll.exe + + fslapi.dll.gui + + fslapi.dll + + fsstm.exe + + hccutils.dll.res + + hccutils.dll + + hha.dll.bak + + hha.dll + + hhc.exe + + hkcmd.exe + + iviewers.dll + + jli.dll + + libvlc.dll + + mPclient.dll + + mcf.ep + + mcf.exe + + mcupdui.exe + + mcut.exe + + mcutil.dll.bbc + + mcvsmap.exe + + msi.dll.dat + + msi.dll + + msseces.asm + + msseces.exe + + mtcReport.ktc + + rc.dll + + rc.exe + + rc.hlp + + sep_NE.exe + + sep_NE.slf + + tplcdclr.exe + + winmm.dll + + wts.chm + + credwiz.exe - ssMUIDLL.dll - aepic.dll - ftllib.dll - userenv.dll - \Terminal Server Client\Cache\ - C:\Windows\Prefetch - \\tsclient - C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ - \Temp\debug.bin - Temp\7z - C:\Windows\AppPatch\Custom - .chm - .cpl - .mht - \Chrome\User Data\Default\Extensions\ - .crx - .appref-ms - .gadget - .JSE - .exe - .scf - Exchange Server\ClientAccess\Owa\ - \Device\HarddiskVolumeShadowCopy - .zip\ - .FON - .FOT - C:\Windows\System32\GroupPolicy\Machine\Scripts - C:\Windows\System32\GroupPolicy\User\Scripts - .iqy - .ico - .isp - .msc - .manifest - MEMORY.dmp - .msi - .cs - .customDestinations-ms - C:\Windows\Minidump - .PAF - .bmc - .rdp - .rtf - .reg - .SHS - .slk - .SCR - .set - .SettingContent-ms - .SHD - .SPL - .scr - HammerDrillStatus.dll - Microsoft\Windows\WER\ - .ICL - .sdb - .SCT - .SHB - Temp\Temp1_ + + ssMUIDLL.dll + + + aepic.dll + + + ftllib.dll + + + userenv.dll + + + \Terminal Server Client\Cache\ + + + C:\Windows\Prefetch + + + \\tsclient + + + C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ + + + \Temp\debug.bin + + + Temp\7z + + + C:\Windows\AppPatch\Custom + + + .chm + + + .cpl + + + .mht + + + \Chrome\User Data\Default\Extensions\ + + + .crx + + + .appref-ms + + + .gadget + + + .JSE + + + .exe + + + .scf + + + Exchange Server\ClientAccess\Owa\ + + + \Device\HarddiskVolumeShadowCopy + + + .zip\ + + + .FON + + + .FOT + + + C:\Windows\System32\GroupPolicy\Machine\Scripts + + + C:\Windows\System32\GroupPolicy\User\Scripts + + + .iqy + + + .ico + + + .isp + + + .msc + + + .manifest + + + MEMORY.dmp + + + .msi + + + .cs + + + .customDestinations-ms + + + C:\Windows\Minidump + + + .PAF + + + .bmc + + + .rdp + + + .rtf + + + .reg + + + .SHS + + + .slk + + + .SCR + + + .set + + + .SettingContent-ms + + + .SHD + + + .SPL + + + .scr + + + HammerDrillStatus.dll + + + Microsoft\Windows\WER\ + + + .ICL + + + .sdb + + + .SCT + + + .SHB + + + Temp\Temp1_ + - \Microsoft\;CLR_v;\UsageLogs\ - .ade - .adp - .application - .appref-ms - .asc - .bmf - .cer - .dmp - .gpg - .htm - .html - .json - .jsp - .key - .mof - .ocx - .p7b - .p12 - .pem - .pfx - .pgp - .php - .ppk - .war - .xml + + \Microsoft\;CLR_v;\UsageLogs\ + + + .ade + + + .adp + + + .application + + + .appref-ms + + + .asc + + + .bmf + + + .cer + + + .dmp + + + .gpg + + + .htm + + + .html + + + .json + SentinelRanger.exe + + + .jsp + + + .key + + + .mof + + + .ocx + + + .p7b + + + .p12 + + + .pem + + + .pfx + + + .pgp + + + .php + + + .ppk + + + .war + + + .xml + C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\NableUpdateService.exe;C:\Program Files (x86)\N-able Technologies\Reactive\bin\NableReactiveManagement.exe;C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe;C:\Program Files (x86)\MspPlatform\FileCacheServiceAgent\FileCacheServiceAgent.exe;AutomationManager.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe + @@ -5153,7 +6955,7 @@ - + Software\Famatech\advanced_ip_scanner\State LastRangeUsed SetValue @@ -5198,7 +7000,7 @@ HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} SetValue - + HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} SetValue @@ -5206,15 +7008,15 @@ HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974 SetValue - + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} SetValue - + HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} SetValue - + HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} SetValue @@ -5222,9 +7024,15 @@ Root\InventoryDevicePnp;prod_virtual_dvd-rom SetValue - MountedDevices - Mountpoints2 - Active Setup\Installed Components + + MountedDevices + + + Mountpoints2 + + + Active Setup\Installed Components + @@ -5234,8 +7042,13 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\ LoggedOnUser - LastLoggedOnUser - LastLoggedOnProvider + + LastLoggedOnUser + + + LastLoggedOnProvider + + @@ -5324,15 +7137,23 @@ - SOFTWARE\Microsoft\Wow64\x86\ + + SOFTWARE\Microsoft\Wow64\x86\ + SetValue \CurrentVersion\Run\ - Add_exclusions_here + C:\Program Files\Microsoft OneDrive\Update\OneDriveSetup.exe;\AppData\Local\Microsoft\Teams\current\Teams.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe + + + \Microsoft\System\Scripts + + + \Windows\System\Scripts + + + HKLM\SYSTEM\Setup\CmdLine - \Microsoft\System\Scripts - \Windows\System\Scripts - HKLM\SYSTEM\Setup\CmdLine \Start
DWORD (0x00000000)
@@ -5353,17 +7174,37 @@ \Start
DWORD (0x00000004)
 - \ImagePath - \ServiceDll - \ServiceManifest - hkcu\software\microsoft\windows nt\currentversion\windows\run\ - hkcu\software\microsoft\windows\currentversion\explorer\shell folders\common startup - hkcu\software\microsoft\windows\currentversion\explorer\shell folders\startup - hklm\software\microsoft\command processor\autorun - hkcu\software\microsoft\windows nt\currentversion\accessibility\ATs\\*(1)\StartExe - Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup + + \ImagePath + + + \ServiceDll + + + \ServiceManifest + + + hkcu\software\microsoft\windows nt\currentversion\windows\run\ + + + hkcu\software\microsoft\windows\currentversion\explorer\shell folders\common startup + + + hkcu\software\microsoft\windows\currentversion\explorer\shell folders\startup + + + hklm\software\microsoft\command processor\autorun + + + hkcu\software\microsoft\windows nt\currentversion\accessibility\ATs\\*(1)\StartExe + + + Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup + - \Print\Monitors + + \Print\Monitors + - Session Manager\KnownDlls + + Session Manager\KnownDlls + @@ -5461,30 +7304,73 @@ - HKLU\Software\Microsoft\Command Processor\AutoRun - HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute - HKLM\System\CurrentControlSet\Control\Session Manager\Execute - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell - HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug - HKLM\Software\Microsoft\Command Processor\AutoRun - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup - UserInitMprLogonScript - HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath + + HKLU\Software\Microsoft\Command Processor\AutoRun + + + HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute + + + HKLM\System\CurrentControlSet\Control\Session Manager\Execute + + + HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun + + + HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon + + + HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell + + + HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug + + + HKLM\Software\Microsoft\Command Processor\AutoRun + + + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute + + + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup + + + UserInitMprLogonScript + + + HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath + - HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages + + HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages + + + HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages + + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages + + + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages + + + HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages + + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages + @@ -5594,10 +7480,16 @@ HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop
DWORD (0x00000000)
+ + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy + + + \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe + + + exefile\shell\runas\command\isolatedCommand - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy - \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe - exefile\shell\runas\command\isolatedCommand @@ -5610,7 +7502,9 @@ - \Hidden + + \Hidden + SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\ $ @@ -5623,6 +7517,8 @@ C:\WINDOWS\sysmon64.exe C:\WINDOWS\sysmon.exe C:\Programdata\sysmon\sysmon64.exe + C:\Programdata\sysmon\sysmon.exe + C:\Windows\TEMP\sysmon.exe @@ -5676,27 +7572,67 @@ \Outlook\Security \Security\Level + + + \Word\Security + + + \Excel\Security + + + \Security\Level1Remove + + + \HideSCAHealth + + + HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify + + + HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify + + + HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring + + + HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify + + + HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify + + + HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride + + + HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency + + + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange + + + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection + + + HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange + + + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware + + + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring + + + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection + + + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting - \Word\Security - \Excel\Security - \Security\Level1Remove - \HideSCAHealth - HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring - HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride - HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ @@ -5722,6 +7658,7 @@ HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging \EnableScriptBlockLogging
DWORD (0x00000000)
+ C:\Program Files (x86)\N-able Technologies\AutomationManagerAgent\AutomationManager.AgentService.exe HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging @@ -5750,9 +7687,12 @@ globallyopenports - EnableFirewall - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List - + + EnableFirewall + + + HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List + \Microsoft\.NETFramework\ETWEnabled @@ -5787,8 +7727,9 @@ ‮ - HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg - + + HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg + \Software\Policies\Microsoft\SystemCertificates\;\SOFTWARE\Microsoft\EnterpriseCertificates\;HKLM\SOFTWARE\Microsoft\SystemCertificates\;HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ @@ -5807,10 +7748,18 @@ C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe - fDenyTSConnections - Terminal Server\WinStations\RDP-Tcp - RDP-tcp\PortNumber - Control\Terminal Server\fSingleSessionPerUser + + fDenyTSConnections + + + Terminal Server\WinStations\RDP-Tcp + + + RDP-tcp\PortNumber + + + Control\Terminal Server\fSingleSessionPerUser + @@ -5825,7 +7774,9 @@ - HKLM\HARDWARE\ACPI\DSDT + + HKLM\HARDWARE\ACPI\DSDT + @@ -5859,25 +7810,64 @@ - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Account Name - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Display Name - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Email - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP User - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP User - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\MAPI Provider - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 User - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP User - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP Password - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName - SecurityPasswordAES - OptionsPasswordAES - SecurityPasswordExported - PermanentPassword + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Account Name + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Display Name + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Email + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP User + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP User + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\MAPI Provider + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 User + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP User + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP Password + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP Password + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 Password + + + SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP Password + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName + + + SecurityPasswordAES + + + OptionsPasswordAES + + + SecurityPasswordExported + + + PermanentPassword + + @@ -5916,7 +7906,6 @@ - @@ -5963,7 +7952,6 @@ - @@ -5973,6 +7961,7 @@ + @@ -6018,202 +8007,504 @@ \TSServerDrainMode - - \TypedURLs + + \TypedURLs + + + HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\disabledcomponents + + + HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage\Bind +
Binary Data
+ + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards + + + services\http\parameters\urlaclinf + + + cRecentFiles\c1\ + tDIText + + + \File MRU\Item 1 + + + HKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHash + + + + HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 + + + HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + + + HKLM\Software\Microsoft\Windows\CurrentVersion\RunService + + + HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + + + CurrentVersion\Windows\Load + + + CurrentVersion\Windows\Run + + + CurrentVersion\Winlogon\Shell + + + CurrentVersion\Winlogon\System + + + \Software\Microsoft\Windows NT\CurrentVersion\Windows\load + + + \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run + + + \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce + + + SOFTWARE\Microsoft\.NETFramework\ETWEnabled + + + \Group Policy\Scripts + + + Terminal Server\Wds\rdpwd\StartupPrograms + + + Winlogon\AlternateShells\AvailableShells + + + Policies\System\Shell + + + Windows CE Services\AutoStartOnConnect + + + Windows CE Services\AutoStartOnDisconnect + + + + CurrentVersion\URL + + + \CurrentVersion\Font Drivers + + + HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown + + + CurrentVersion\Windows\IconServiceLib + + + Active Setup\Installed Components + + + NullSessionShares + + + NullSessionPipes + + + PasswordExpiryNotification + + + SafeBoot\AlternateShell + + + Desktop\Scrnsave.exe + + + \DisplayVersion + + + \ModifyPath + + + \Microsoft\Windows\CurrentVersion\Uninstall\ + + + \UninstallString + + + Terminal Server\WinStations\RDP-Tcp\InitialProgram + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman + + + + \Explorer\FileExts\ + + + \shell\install\command\ + + + \ProfileImagePath + + + + \Classes\AllFilesystemObjects\ + + + \Classes\*\ + + + \Software\Microsoft\Ctf\LangBarAddin + + + \ContextMenuHandlers\ + + + \CurrentVersion\Shell + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers + + + \Classes\Directory\ + + + \Classes\Drive\ + + + HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks + + + \Classes\Folder\ + + + \Hidden + + + \HideFileExt + + + \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components + + + \SOFTWARE\Classes\Protocols\Filter + + + \SOFTWARE\Classes\Protocols\Handler + + + \SharedTaskScheduler - - HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\disabledcomponents + + \ShowSuperHidden - - HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage\Bind -
Binary Data
+ + \ColumnHandlers - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards + + \CopyHookHandlers - - services\http\parameters\urlaclinf + + \ExtShellFolderViews - - cRecentFiles\c1\ - tDIText + + \PropertySheetHandlers - - \File MRU\Item 1 + + \ShellServiceObjectDelayLoad - - HKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHash + + \ShellServiceObjects - - HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - HKLM\Software\Microsoft\Windows\CurrentVersion\RunService - HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - CurrentVersion\Windows\Load - CurrentVersion\Windows\Run - CurrentVersion\Winlogon\Shell - CurrentVersion\Winlogon\System - \Software\Microsoft\Windows NT\CurrentVersion\Windows\load - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - SOFTWARE\Microsoft\.NETFramework\ETWEnabled - \Group Policy\Scripts - Terminal Server\Wds\rdpwd\StartupPrograms - Winlogon\AlternateShells\AvailableShells - Policies\System\Shell - Windows CE Services\AutoStartOnConnect - Windows CE Services\AutoStartOnDisconnect - PreferenceMACs\Default\extensions.settings - CurrentVersion\URL - \CurrentVersion\Font Drivers - HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown - CurrentVersion\Windows\IconServiceLib - Active Setup\Installed Components - NullSessionShares - NullSessionPipes - PasswordExpiryNotification - SafeBoot\AlternateShell - Desktop\Scrnsave.exe - \DisplayVersion - \ModifyPath - \Microsoft\Windows\CurrentVersion\Uninstall\ - \UninstallString - Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman - - \Explorer\FileExts\ - \shell\install\command\ - \ProfileImagePath - - \Classes\AllFilesystemObjects\ - \Classes\*\ - \Software\Microsoft\Ctf\LangBarAddin - \ContextMenuHandlers\ - \CurrentVersion\Shell - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers - \Classes\Directory\ - \Classes\Drive\ - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - \Classes\Folder\ - \Hidden - \HideFileExt - \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components - \SOFTWARE\Classes\Protocols\Filter - \SOFTWARE\Classes\Protocols\Handler - \SharedTaskScheduler - \ShowSuperHidden - \ColumnHandlers - \CopyHookHandlers - \ExtShellFolderViews - \PropertySheetHandlers - \ShellServiceObjectDelayLoad - \ShellServiceObjects - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ - HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ + + + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ + + + HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand + - HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + + HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram + - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ + - \3\1809 - \3\2500 - \3\1206 - \DisableSecuritySettingsCheck - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries - HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ - \ProxyServer - SavedLegacySettings - Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy - EnableConsoleTracing - EnableFileTracing + + \3\1809 + + + \3\2500 + + + \3\1206 + + + \DisableSecuritySettingsCheck + + + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 + + + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 + + + HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries + + + HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ + + + \ProxyServer + + + SavedLegacySettings + + + Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy + + + EnableConsoleTracing + + + EnableFileTracing + - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ - HKLM\SOFTWARE\Microsoft\Netsh - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters + + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ + + + HKLM\SOFTWARE\Microsoft\Netsh + + + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ + - HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + + + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ + - Office Test\ + + Office Test\ + - \Internet Explorer\Toolbar\ - \Internet Explorer\Extensions\ + + \Internet Explorer\Toolbar\ + + + \Internet Explorer\Extensions\ + - \Browser Helper Objects\ - {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ + + \Browser Helper Objects\ + + + {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ + - \UrlUpdateInfo - \InstallSource + + \UrlUpdateInfo + + + \InstallSource + - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ - \Exclusions\Paths - \Exclusions\Extensions - \Exclusions\Processes - TamperProtection - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + + HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + + + HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ + + + \Exclusions\Paths + + + \Exclusions\Extensions + + + \Exclusions\Processes + + + TamperProtection + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff - \Software\Policies\Microsoft\Windows\System\Scripts\Logoff - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon - \Software\Policies\Microsoft\Windows\System\Scripts\Logon - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup + + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff + + + \Software\Policies\Microsoft\Windows\System\Scripts\Logoff + + + \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon + + + \Software\Policies\Microsoft\Windows\System\Scripts\Logon + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown + + + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup + + + HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup + - Domain - DHCPDefaultGateway - DhcpIPAddress - DhcpNameserver - Dhcpserver - DhcpSubnetMask - Nameserver - \DefaultGateway - PersistentRoutes - }\Category - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - SubnetMask - \Trusted Documents\TrustRecords - Software\Microsoft\VBA\7.1\Common - Software\Microsoft\VBA\7.1\Trusted - \Security\DontTrustInstalledFiles - \Security\Trusted Locations - Security\ProtectedView\DisableInternetFilesInPV - Security\ProtectedView\DisableAttachmentsInPV - Security\ProtectedView\DisableUnsafeLocationsInPV - Software\WinRAR\ArcHistory - WinZip\mru\ - Recent File List - Outlook\WebView\Inbox - Outlook\Today\UserDefinedUrl - Outlook\WebView\Calendar - \Place MRU - \LinkDate - \DriverVerVersion - \DriverVersion - \LowerCaseLongPath - \Publisher - Compatibility Assistant\Store\ - \BinProductVersion - Root\InventoryApplicationShortcut\ - Root\InventoryDriverBinary - Root\InventoryDriverPackage - Root\InventoryDevicePnp - Root\InventoryDeviceContainer + + Domain + + + DHCPDefaultGateway + + + DhcpIPAddress + + + DhcpNameserver + + + Dhcpserver + + + DhcpSubnetMask + + + Nameserver + + + \DefaultGateway + + + PersistentRoutes + + + }\Category + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles + + + SubnetMask + + + \Trusted Documents\TrustRecords + + + Software\Microsoft\VBA\7.1\Common + + + Software\Microsoft\VBA\7.1\Trusted + + + \Security\DontTrustInstalledFiles + + + \Security\Trusted Locations + + + Security\ProtectedView\DisableInternetFilesInPV + + + Security\ProtectedView\DisableAttachmentsInPV + + + Security\ProtectedView\DisableUnsafeLocationsInPV + + + Software\WinRAR\ArcHistory + + + WinZip\mru\ + + + Recent File List + + + Outlook\WebView\Inbox + + + Outlook\Today\UserDefinedUrl + + + Outlook\WebView\Calendar + + + \Place MRU + + + \LinkDate + + + \DriverVerVersion + + + \DriverVersion + + + \LowerCaseLongPath + + + \Publisher + + + Compatibility Assistant\Store\ + + + \BinProductVersion + + + Root\InventoryApplicationShortcut\ + + + Root\InventoryDriverBinary + + + Root\InventoryDriverPackage + + + Root\InventoryDevicePnp + + + Root\InventoryDeviceContainer + Root\InventoryApplication\ ProgramID;Name;Version;Publisher;Language;InstallDate;Source;RootDirPath;HiddenArp;UninstallString;RegistryKeyPath;UserSID;sha256 @@ -6221,6 +8512,7 @@ Root\InventoryApplicationFile\ ProgramId;FileId;LowerCaseLongPath;Name;OriginalFileName;Publisher;Version;binfileversion;LinkDate;Size;Language;USN;IsPeFile;IsOsComponent;sha256;AppxPackageFullName + pingsender.exe Root\InventoryApplicationAppV\ @@ -6233,8 +8525,12 @@ Drive Type
DWORD (0x00000011)
 - \Explorer\MountPoints2 - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices + + \Explorer\MountPoints2 + + + HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices + HKLM\System\CurrentControlSet\services\ \DeleteFlag @@ -6325,38 +8621,94 @@
DWORD (0x00000001)
 - \ConsentStore\bluetooth - \ConsentStore\contacts - \ConsentStore\hunmanInterfaceDevice - \ConsentStore\location - \ConsentStore\microphone - \ConsentStore\usb\ - \ConsentStore\webcam - \ConsentStore\humanInterfaceDevice - LastVisitedMRU - SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit - \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU - HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR - HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ - HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\Microsoft\Cryptography\OID - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID - HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll - Classes\exefile\shell\runas\command\isolatedCommand - \FriendlyName - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ - \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB - HKLM\SOFTWARE\Microsoft\Tracing\ + + \ConsentStore\bluetooth + + + \ConsentStore\contacts + + + \ConsentStore\hunmanInterfaceDevice + + + \ConsentStore\location + + + \ConsentStore\microphone + + + \ConsentStore\usb\ + + + \ConsentStore\webcam + + + \ConsentStore\humanInterfaceDevice + + + LastVisitedMRU + + + SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit + + + \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU + + + HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR + + + HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ + + + HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust + + + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust + + + HKLM\SOFTWARE\Microsoft\Cryptography\OID + + + HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID + + + HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll + + + Classes\exefile\shell\runas\command\isolatedCommand + + + \FriendlyName + + + HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ + + + \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad + + + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB + + + HKLM\SOFTWARE\Microsoft\Tracing\ + HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}
ndis;rndis
 - HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 + + HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 + \Software\AppDataLow\Software\Microsoft\
.exe;.dll;powershell;wmic
@@ -6365,42 +8717,112 @@ HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel
DWORD (0x00000005)
 - Software\Microsoft\Office test\Special\Perf - \CurrentControlSet\Services\NTDS\LsaDbExtPt - \Services\NTDS\DirectoryServiceExtPt - GoToMyPc\FileTransfer\history - GoToMyPc\GuestInvite - Filesharing - DesktopSharing - LogIncomingConnections - LogOutgoingConnections - PermanentPasswordDate - Security_Adminrights - vncviewer\MRU - Autostart_GUI - Meeting_UserName - BuddyLoginName - BuddyLoginTokenID - Always_Online - HKLM\SOFTWARE\Microsoft\CurrentVersion\Policies\System\EnableLinkedConnections - Software\recfg - \Keyboard Layout\Preload\ - \Keyboard Layout\Substitutes\ - HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ - \Client\Enabled - \Server\Enabled - Kitty\Sessions - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic - PuTTY\Sessions - Terminal Server Client\Servers - WinSCP 2\Sessions - + + Software\Microsoft\Office test\Special\Perf + + + \CurrentControlSet\Services\NTDS\LsaDbExtPt + + + \Services\NTDS\DirectoryServiceExtPt + + + GoToMyPc\FileTransfer\history + + + GoToMyPc\GuestInvite + + + Filesharing + + + DesktopSharing + + + LogIncomingConnections + + + LogOutgoingConnections + + + PermanentPasswordDate + + + Security_Adminrights + + + vncviewer\MRU + + + Autostart_GUI + + + Meeting_UserName + + + BuddyLoginName + + + BuddyLoginTokenID + + + Always_Online + + + HKLM\SOFTWARE\Microsoft\CurrentVersion\Policies\System\EnableLinkedConnections + + + Software\recfg + + + \Keyboard Layout\Preload\ + + + \Keyboard Layout\Substitutes\ + + + HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 + + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy + + + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ + + + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ + + + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman + + + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ + + + \Client\Enabled + + + \Server\Enabled + + + Kitty\Sessions + + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec + + + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic + + + PuTTY\Sessions + + + Terminal Server Client\Servers + + + WinSCP 2\Sessions + + C:\Program Files (x86)\Kaspersky Lab C:\Program Files\Kaspersky Lab C:\Program Files (x86)\ESET @@ -6490,37 +8912,99 @@ \ntsvcs ConnectPipe - \lsadump;\cachedump;\wceservicepipe - \9f81f59bc58452127884ce513865ed20 - \46a676ab7f179e511e30dd2dc41bd388 - tssmp_endpoint - \NamePipe_MoreWindows - \WCEServicePipe - \ahexec - \cachedumppipe - \csexec - \e710f28d59aa529d6792ca6ff0ca1b34 - \isapi_dg - \isapi_http - \isapi_http - \lsadump - \lsassw - \paexec - \pcheap_reuse - \gruntsvc - \remcom - \rpchlp_3 - \sdlrpc - \winsession - \adschemerpc - \AnonymousPipe - \bc367 - \bc31a7 - \testPipe - msf-pipe - \atsvc - \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc - \atctl;\userpipe;\iehelper;\sdlrpc;\comnap + + \lsadump;\cachedump;\wceservicepipe + + + \9f81f59bc58452127884ce513865ed20 + + + \46a676ab7f179e511e30dd2dc41bd388 + + + tssmp_endpoint + + + \NamePipe_MoreWindows + + + \WCEServicePipe + + + \ahexec + + + \cachedumppipe + + + \csexec + + + \e710f28d59aa529d6792ca6ff0ca1b34 + + + \isapi_dg + + + \isapi_http + + + \isapi_http + + + \lsadump + + + \lsassw + + + \paexec + + + \pcheap_reuse + + + \gruntsvc + + + \remcom + + + \rpchlp_3 + + + \sdlrpc + + + \winsession + + + \adschemerpc + + + \AnonymousPipe + + + \bc367 + + + \bc31a7 + + + \testPipe + + + msf-pipe + + + \atsvc + + + \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc + + + \atctl;\userpipe;\iehelper;\sdlrpc;\comnap + \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester;demoagent_ \wkssvc @@ -6546,8 +9030,12 @@ - \winreg - Anonymous Pipe + + \winreg + + + Anonymous Pipe + - census - researchscan - scanhub - shadow - shodan + + census + + + researchscan + + + scanhub + + + shadow + + + shodan + - .download - .kp - .su - .ss - .xn - .sy - .ve - .xxx - .cn - .click - .club - .ir - .ru - .host - .icu - .pw - .website - .ninja - .rocks - .top - .ua - .xyz + + .download + + + .kp + + + .su + + + .ss + + + .xn + + + .sy + + + .ve + + + .xxx + + + .cn + + + .click + + + .club + + + .ir + + + .ru + + + .host + + + .icu + + + .pw + + + .website + + + .ninja + + + .rocks + + + .top + + + .ua + + + .xyz + kuternull.com;rimrun.com;0ffice36o;asushotfix;infestexe;rahasn.webhop.org;rahasn.akamake.net;rahasn.homewealth.biz;winodwsupdates;israirairlines - githubusercontent.com;github.com + + githubusercontent.com;github.com + - api.ipify.org;whatismyipaddress.com;edns.ip-api.com;checkip.dyndns.org;icanhazip.com;ifconfig.me;ifconfig.co;ipaddress.com;ipecho.net;ident.me;api.ip.sb;www.myexternalip.com;ip.anysrc.net;wtfismyip.com;myexternalip.com;ipecho.net;checkip.amazonaws.com;goo.gl;git.io;bit.ly;ow.ly;ip-api.com + + api.ipify.org;whatismyipaddress.com;edns.ip-api.com;checkip.dyndns.org;icanhazip.com;ifconfig.me;ifconfig.co;ipaddress.com;ipecho.net;ident.me;api.ip.sb;www.myexternalip.com;ip.anysrc.net;wtfismyip.com;myexternalip.com;ipecho.net;checkip.amazonaws.com;goo.gl;git.io;bit.ly;ow.ly;ip-api.com + - tiny-share.com;paste.ee;pastebin.com + + tiny-share.com;paste.ee;pastebin.com + - afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com - darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org - adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk - gc._msdcs. - _kerberos._tcp.dc._msdcs. - _kerberos._udp.dc._msdcs. - _ldap._tcp.pdc._msdcs. - wpad + + afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com + + + darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org + + + adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk + + + gc._msdcs. + + + _kerberos._tcp.dc._msdcs. + + + _kerberos._udp.dc._msdcs. + + + _ldap._tcp.pdc._msdcs. + + + wpad + _ldap. C:\Windows\ @@ -6745,7 +9321,10 @@ type: 99 type: 33 --> - System;svchost.exe;services.exe;unknown process;\;; + + System;svchost.exe;services.exe;unknown process;\;; + C:\Program Files\Cavelo\Cavelo Agent\cavelo_windows_amd64.exe;C:\PROGRA~2\BEANYW~1\GETSUP~1\TCIntegratorCommHelper.exe;C:\ProgramData\Cavelo\jre\bin\java.exe;C:\Program Files\SentinelOne\;C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\NableUpdateService.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe;C:\Program Files (x86)\BeAnywhere Support Express\GetSupportService_N-Central\BASupSrvc.exe;C:\Program Files (x86)\lpagent\lpagent.exe;C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AgentMaint.exe;C:\Program Files (x86)\N-able Technologies\Reactive\bin\NableReactiveManagement.exe;C:\Program Files (x86)\N-able Technologies\AutomationManagerAgent\AutomationManager.AgentService.exe;C:\Program Files (x86)\N-able Technologies\AutomationManagerEngine\2.70.0.4\AutomationManager.ScriptRunner64.exe + @@ -6754,6 +9333,7 @@ C:\Program Files (x86)\Admin Arsenal\ C:\Program Files (x86)\CheckPoint\ C:\Program Files (x86)\Fortinet\ + C:\Program Files\SentinelOne\ C:\Program Files (x86)\OpenDNS\OpenDNS Connector C:\Program Files (x86)\Razer\Razer Services\ C:\Program Files (x86)\Trend Micro\ From d5382ff813a582a628b83e6de2103f640815c439 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 27 Jun 2023 17:24:24 -0400 Subject: [PATCH 439/471] Sysmon v15 update schema + 1 test rule for C:\users\*\Downloads --- sysmonconfig-export.xml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f37910c1..00d7df85 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -85,7 +85,7 @@ --> - + md5,sha1,sha256,imphash @@ -9625,5 +9625,19 @@ NETWORK SERVICE; LOCAL SERVICE + + + + + + C:\Users\ + \Downloads + + + + + + + \ No newline at end of file From aa679c7ba5bbac9497d4e66effe284e3b282328d Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 27 Jun 2023 17:51:43 -0400 Subject: [PATCH 440/471] Added Potential Noisy Rule, exclusions need to be added under global as its an or rule. --- sysmonconfig-export.xml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 00d7df85..665c854a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -9633,6 +9633,22 @@ C:\Users\ \Downloads + + .exe + .dll + .sys + .ocx + .scr + .cpl + .efi + .drv + .ax + .com + .acm + .mui + .ime + .tsp + From 306a62802a3dad97403ab7cb935cd0c4e22f4f7c Mon Sep 17 00:00:00 2001 From: ionstorm Date: Tue, 27 Jun 2023 17:53:32 -0400 Subject: [PATCH 441/471] Unusual File extension written as PE, enabled alerting --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 665c854a..f439018a 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -9633,7 +9633,7 @@ C:\Users\ \Downloads - + .exe .dll .sys From 6a5df4c6cf03448c80c83b9bc672e67273bdd1d7 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 5 Jul 2023 09:55:14 -0400 Subject: [PATCH 442/471] Big update thanks to Florian Roth, Majority of updates are mirrored and MITRE Tagged from Florian's Sysmon config here: https://github.com/Neo23x0/sysmon-config/blob/master/sysmonconfig-export.xml --- sysmonconfig-export.xml | 962 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 962 insertions(+) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f439018a..bc2cee26 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -9627,6 +9627,7 @@ + @@ -9649,6 +9650,967 @@ .ime .tsp + + C:\Users\Public\ + C:\Perflogs\ + C:\Windows\Fonts\ + C:\Windows\debug\ + C:\Windows\Tasks\ + C:\Windows\tracing\ + C:\Windows\Help\ + C:\Windows\Logs\ + C:\Windows\System32\spool\SERVERS\ + C:\Windows\System32\spool\PRINTERS\ + C:\Windows\Help\ + C:\Users\;\Music\ + C:\Users\;\Pictures\ + C:\Users\;\Videos\ + C:\Users\;\Contacts\ + + + .7z.exe + .doc.exe + .docm.exe + .docx.exe + .htm.exe + .html.exe + .iso.exe + .lnk.exe + .pdf.exe + .ppt.exe + .pptx.exe + .rar.exe + .rtf.exe + .txt.exe + .xls.exe + .xlsm.exe + .xlsx.exe + .zip.exe + + + \EntenLoader.exe + \SysmonQuiet.exe + \SharpEvtMute.exe + \EvtMuteHook.dll + \SysmonEOP.exe + + + IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 + IMPHASH=3A19059BD7688CB88E70005F18EFC439 + IMPHASH=bf6223a49e45d99094406777eb6004ba + IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 + IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 + IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF + IMPHASH=4C1B52A19748428E51B14C278D0F58E3 + IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F + IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A + IMPHASH=672B13F4A0B6F27D29065123FE882DFC + IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F + IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D + IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 + IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 + IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 + IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 + IMPHASH=D21BBC50DCC169D7B4D0F01962793154 + IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 + IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 + IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC + IMPHASH=F9A28C458284584A93B14216308D31BD + IMPHASH=6118619783FC175BC7EBECFF0769B46E + IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA + IMPHASH=563233BFA169ACC7892451F71AD5850A + IMPHASH=87575CB7A0E0700EB37F2E3668671A08 + IMPHASH=13F08707F759AF6003837A150A371BA1 + IMPHASH=1781F06048A7E58B323F0B9259BE798B + IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 + IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D + IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 + IMPHASH=713C29B396B907ED71A72482759ED757 + IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F + IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E + IMPHASH=8B114550386E31895DFAB371E741123D + IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 + IMPHASH=9D68781980370E00E0BD939EE5E6C141 + IMPHASH=B18A1401FF8F444056D29450FBC0A6CE + IMPHASH=CB567F9498452721D77A451374955F5F + IMPHASH=730073214094CD328547BF1F72289752 + IMPHASH=17B461A082950FC6332228572138B80C + IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 + IMPHASH=819B19D53CA6736448F9325A85736792 + IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E + IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 + IMPHASH=0588081AB0E63BA785938467E1B10CCA + IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C + IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 + IMPHASH=4DA924CF622D039D58BCE71CDF05D242 + IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 + IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF + IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE + IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 + IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 + IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E + IMPHASH=E6F9D5152DA699934B30DAAB206471F6 + IMPHASH=3AD59991CCF1D67339B319B15A41B35D + IMPHASH=FFDD59E0318B85A3E480874D9796D872 + IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 + IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 + IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 + IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 + IMPHASH=0E2216679CA6E1094D63322E3412D650 + IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB + IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 + IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 + IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 + IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F + IMPHASH=767637C23BB42CD5D7397CF58B0BE688 + IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 + IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC + IMPHASH=7D010C6BB6A3726F327F7E239166D127 + IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 + IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F + IMPHASH=5834ED4291BDEB928270428EBBAF7604 + IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 + IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 + IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 + IMPHASH=3DE09703C8E79ED2CA3F01074719906B + IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F + IMPHASH=E96A73C7BF33A464C510EDE582318BF2 + IMPHASH=32089B8851BBF8BC2D014E9F37288C83 + IMPHASH=09D278F9DE118EF09163C6140255C690 + IMPHASH=03866661686829d806989e2fc5a72606 + IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d + IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE + IMPHASH=19584675D94829987952432E018D5056 + IMPHASH=330768A4F172E10ACB6287B87289D83B + IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313 + IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC + IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28 + IMPHASH=96DF3A3731912449521F6F8D183279B1 + IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46 + IMPHASH=51791678F351C03A0EB4E2A7B05C6E17 + IMPHASH=25CE42B079282632708FC846129E98A5 + MD5=7B17F15713FCF13C764535AA2BDF52AA + SHA1=4E18320493042BCD7D21B53E258974BC460ACC78 + SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1 + + + winword.exe + excel.exe + powerpnt.exe + msaccess.exe + mspub.exe + eqnedt32.exe + visio.exe + wordpad.exe + wordview.exe + msohtmed.exe + + + onenote.exe + onenotem.exe + onenoteim.exe + + + + certutil.exe + certoc.exe + CertReq.exe + + Desktopimgdownldr.exe + esentutl.exe + + finger.exe + presentationhost.exe + + + notepad.exe + AcroRd32.exe + RdrCEF.exe + mshta.exe + hh.exe + calc.exe + mspaint.exe + + + SHA256=7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed + SHA256=0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb + SHA256=0ae8d1dd56a8a000ced74a627052933d2e9bff31d251de185b3c0c5fc94a44db + SHA256=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05 + SHA256=0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d + SHA256=0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917 + SHA256=0bc3685b0b8adc97931b5d31348da235cd7581a67edf6d79913e6a5709866135 + SHA256=0be4912bfd7a79f6ebfa1c06a59f0fb402bd4fe0158265780509edd0e562eac1 + SHA256=0c512b615eac374d4d494e3c36838d8e788b3dc2691bf27916f7f42694b14467 + SHA256=0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c + SHA256=0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c + SHA256=0cf6c6c2d231eaf67dfc87561cc9a56ecef89ab50baafee5a67962748d51faf3 + SHA256=0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f + SHA256=0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c + SHA256=0de4247e72d378713bcf22d5c5d3874d079203bb4364e25f67a90d5570bdcce8 + SHA256=0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b + SHA256=0ebaef662b14410c198395b13347e1d175334ec67919709ad37d65eba013adff + SHA256=0ee5067ce48883701824c5b1ad91695998916a3702cf8086962fbe58af74b2d6 + SHA256=0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8 + SHA256=0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf + SHA256=0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff + SHA256=0fd2df82341bf5ebb8a53682e60d08978100c01acb0bed7b6ce2876ada80f670 + SHA256=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd + SHA256=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece + SHA256=1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5 + SHA256=1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0 + SHA256=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c + SHA256=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b + SHA256=1afa03118f87b62c59a97617e595ebb26dde8dbdd16ee47ef3ddd1097c30ef6a + SHA256=1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e + SHA256=1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa + SHA256=1c8dfa14888bb58848b4792fb1d8a921976a9463be8334cff45cc96f1276049a + SHA256=1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687 + SHA256=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8 + SHA256=1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219 + SHA256=1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe + SHA256=1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee + SHA256=1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961 + SHA256=1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512 + SHA256=1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c + SHA256=1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501 + SHA256=2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486 + SHA256=2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e + SHA256=2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a + SHA256=2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8 + SHA256=2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4 + SHA256=2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30 + SHA256=2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a + SHA256=2b120de80a5462f8395cfb7153c86dfd44f29f0776ea156ec4a34fa64e5c4797 + SHA256=2b186926ed815d87eaf72759a69095a11274f5d13c33b8cc2b8700a1f020be1d + SHA256=2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1 + SHA256=2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250 + SHA256=2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14 + SHA256=2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1 + SHA256=2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b + SHA256=2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d + SHA256=2d195cd4400754cc6f6c3f8ab1fe31627932c3c1bf8d5d0507c292232d1a2396 + SHA256=2da330a2088409efc351118445a824f11edbe51cf3d653b298053785097fe40e + SHA256=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8 + SHA256=2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0 + SHA256=2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e + SHA256=2f60536b25ba8c9014e4a57d7a9a681bd3189fa414eea88c256d029750e15cae + SHA256=2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445 + SHA256=03e0581432f5c8cc727a8aa387f5b69ff84d38d0df6f1226c19c6e960a81e1e9 + SHA256=3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c25 + SHA256=3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0 + SHA256=3a95cc82173032b82a0ffc7d2e438df64c13bc16b4574214c9fe3be37250925e + SHA256=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46 + SHA256=3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b + SHA256=3c5d7069f85ec1d6f58147431f88c4d7c48df73baf94ffdefd664f2606baf09c + SHA256=3c6f9917418e991ed41540d8d882c8ca51d582a82fd01bff6cdf26591454faf5 + SHA256=3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc + SHA256=3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b + SHA256=3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f + SHA256=3cb75429944e60f6c820c7638adbf688883ad44951bca3f8912428afe72bc134 + SHA256=3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3 + SHA256=3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4 + SHA256=3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272 + SHA256=3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf + SHA256=3e9b62d2ea2be50a2da670746c4dbe807db9601980af3a1014bcd72d0248d84c + SHA256=3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75 + SHA256=3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8 + SHA256=3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5 + SHA256=3f9530c94b689f39cc83377d76979d443275012e022782a600dcb5cad4cca6aa + SHA256=3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e + SHA256=3ff50c67d51553c08dcb7c98342f68a0f54ad6658c5346c428bdcd1f185569f6 + SHA256=3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa + SHA256=04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162 + SHA256=4a3d4db86f580b1680d6454baee1c1a139e2dde7d55e972ba7c92ec3f555dce2 + SHA256=4a9093e8dbcb867e1b97a0a67ce99a8511900658f5201c34ffb8035881f2dbbe + SHA256=4ab41816abbf14d59e75b7fad49e2cb1c1feb27a3cb27402297a2a4793ff9da7 + SHA256=4b4c925c3b8285aeeab9b954e8b2a0773b4d2d0e18d07d4a9d268f4be90f6cae + SHA256=4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1 + SHA256=4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4 + SHA256=4cff6e53430b81ecc4fae453e59a0353bcfe73dd5780abfc35f299c16a97998e + SHA256=4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036 + SHA256=4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee + SHA256=4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba + SHA256=4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80 + SHA256=4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69 + SHA256=05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748 + SHA256=5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a + SHA256=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a + SHA256=5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe + SHA256=5b9623da9ba8e5c80c49473f40ffe7ad315dcadffc3230afdc9d9226d60a715a + SHA256=5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c + SHA256=5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921 + SHA256=5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a + SHA256=5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185 + SHA256=5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3 + SHA256=5ee292b605cd3751a24e5949aae615d472a3c72688632c3040dc311055b75a92 + SHA256=5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be + SHA256=5f7e47d728ac3301eb47b409801a0f4726a435f78f1ed02c30d2a926259c71f3 + SHA256=5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683 + SHA256=5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0 + SHA256=5f20541f859f21b3106e12d37182b1ea39bb75ffcfcddb2ece4f6edd42c0bab2 + SHA256=5f487829527802983d5c120e3b99f3cf89333ca14f5e49ac32df0798cfb1f7aa + SHA256=5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36 + SHA256=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50 + SHA256=6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5 + SHA256=6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74 + SHA256=6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63 + SHA256=6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e + SHA256=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44 + SHA256=6c64688444d3e004da77dcfb769d064bb38afceeef7ff915dfc71e60e19ff18a + SHA256=6cb6e23ba516570bbd158c32f7c7c99f19b24ca4437340ecb39253662afe4293 + SHA256=6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc + SHA256=6de84caa2ca18673e01b91af58220c60aecd5cccf269725ec3c7f226b2167492 + SHA256=6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf + SHA256=6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7 + SHA256=6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7 + SHA256=6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38 + SHA256=6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4 + SHA256=6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c + SHA256=6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d + SHA256=6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc + SHA256=07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357 + SHA256=7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf + SHA256=7aaf2aa194b936e48bc90f01ee854768c8383c0be50cfb41b346666aec0cf853 + SHA256=7b0f442ac0bb183906700097d65aed0b4b9d8678f9a01aca864854189fe368e7 + SHA256=7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b + SHA256=7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7 + SHA256=7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21 + SHA256=7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4 + SHA256=7cfa5e10dff8a99a5d544b011f676bc383991274c693e21e3af40cf6982adb8c + SHA256=7d8937c18d6e11a0952e53970a0934cf0e65515637ac24d6ca52ccf4b93d385f + SHA256=7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea + SHA256=7da6113183328d4fddf6937c0c85ef65ba69bfe133b1146193a25bcf6ae1f9dd + SHA256=7dfc2eb033d2e090540860b8853036f40736d02bd22099ff6cf665a90be659cd + SHA256=7e3b0b8d3e430074109d85729201d7c34bc5b918c0bcb9f64ce88c5e37e1a456 + SHA256=7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d + SHA256=7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7 + SHA256=7ec93f34eb323823eb199fbf8d06219086d517d0e8f4b9e348d7afd41ec9fd5d + SHA256=7f5dc63e5742096e4accaca39ae77a2a2142b438c10f97860dee4054b51d3b35 + SHA256=7f190f6e5ab0edafd63391506c2360230af4c2d56c45fc8996a168a1fc12d457 + SHA256=7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa + SHA256=08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6 + SHA256=8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2 + SHA256=8bda0108de82ebeae82f43108046c5feb6f042e312fa0115475a9e32274fae59 + SHA256=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6 + SHA256=8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9 + SHA256=8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f + SHA256=8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775 + SHA256=8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9 + SHA256=8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2 + SHA256=8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126 + SHA256=8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c + SHA256=8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f + SHA256=8ef0ad86500094e8fa3d9e7d53163aa6feef67c09575c169873c494ed66f057f + SHA256=8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00 + SHA256=8f23313adb35782adb0ba97fefbfbb8bbc5fc40ae272e07f6d4629a5305a3fa2 + SHA256=8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a + SHA256=09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184 + SHA256=09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1 + SHA256=9a1d66036b0868bbb1b2823209fedea61a301d5dd245f8e7d390bd31e52d663e + SHA256=9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7 + SHA256=9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba + SHA256=9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c + SHA256=9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c + SHA256=9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194 + SHA256=9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285 + SHA256=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4 + SHA256=9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449 + SHA256=9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2 + SHA256=9d58f640c7295952b71bdcb456cae37213baccdcd3032c1e3aeb54e79081f395 + SHA256=9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4 + SHA256=9ee33ffd80611a13779df6286c1e04d3c151f1e2f65e3d664a08997fcd098ef3 + SHA256=9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5 + SHA256=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33 + SHA256=9f1025601d17945c3a47026814bdec353ee363966e62dba7fe2673da5ce50def + SHA256=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374 + SHA256=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 + SHA256=11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b + SHA256=12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56 + SHA256=14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8 + SHA256=15c53eb3a0ea44bbd2901a45a6ebeae29bb123f9c1115c38dfb2cdbec0642229 + SHA256=15fb486b6b8c2a2f1b067f48fba10c2f164638fe5e6cee618fb84463578ecac9 + SHA256=16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1 + SHA256=18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506 + SHA256=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6 + SHA256=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0 + SHA256=19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775 + SHA256=19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0 + SHA256=20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb + SHA256=21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21 + SHA256=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c + SHA256=23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade + SHA256=025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4 + SHA256=26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097 + SHA256=26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43 + SHA256=26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712 + SHA256=27cd05527feb020084a4a76579c125458571da8843cdfc3733211760a11da970 + SHA256=29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6 + SHA256=29e0062a017a93b2f2f5207a608a96df4d554c5de976bd0276c2590a03bd3e94 + SHA256=30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb + SHA256=31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a + SHA256=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427 + SHA256=31f4140c12ac31f5729a8de4dc051d3acd07783564604df831a2a6722c979192 + SHA256=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351 + SHA256=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993 + SHA256=34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3 + SHA256=34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf + SHA256=36aafa127736c7226c50061ea065f71e14f64ec60321f705bc52686d24117e0d + SHA256=36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb + SHA256=36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289 + SHA256=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9 + SHA256=37dde6bd8a7a36111c3ac57e0ac20bbb93ce3374d0852bcacc9a2c8c8c30079e + SHA256=38b3eb8c86201d26353aab625cea672e60c2f66ce6f5e5eda673e8c3478bf305 + SHA256=38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7 + SHA256=38c18db050b0b2b07f657c03db1c9595febae0319c746c3eede677e21cd238b0 + SHA256=38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20 + SHA256=38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a + SHA256=39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e + SHA256=42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb + SHA256=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f + SHA256=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89 + SHA256=45abdbcd4c0916b7d9faaf1cd08543a3a5178871074628e0126a6eda890d26e0 + SHA256=45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a + SHA256=45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26 + SHA256=45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef + SHA256=47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84 + SHA256=47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005 + SHA256=47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc + SHA256=49ed27460730b62403c1d2e4930573121ab0c86c442854bc0a62415ca445a810 + SHA256=49f75746eebe14e5db11706b3e58accc62d4034d2f1c05c681ecef5d1ad933ba + SHA256=50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793 + SHA256=50db5480d0392a7dd6ab5df98389dc24d1ed1e9c98c9c35964b19dabcd6dc67f + SHA256=51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5 + SHA256=53eaefba7e7dca9ab74e385abf18762f9f1aa51594e7f7db5ba612d6c787dd7e + SHA256=55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9 + SHA256=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a + SHA256=56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7 + SHA256=57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572 + SHA256=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495 + SHA256=58c071cfe72e9ee867bba85cbd0abe72eb223d27978d6f0650d0103553839b59 + SHA256=59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879 + SHA256=60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289 + SHA256=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813 + SHA256=61a1bdddd3c512e681818debb5bee94db701768fc25e674fcad46592a3259bd0 + SHA256=61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf + SHA256=61d6e40601fa368800980801a662a5b3b36e3c23296e8ae1c85726a56ef18cc8 + SHA256=62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0 + SHA256=64f9e664bc6d4b8f5f68616dd50ae819c3e60452efd5e589d6604b9356841b57 + SHA256=65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9 + SHA256=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890 + SHA256=69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2 + SHA256=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009 + SHA256=71ff60722231c7641ad593756108cf6779dbaad21c7b08065fb1d4e225eab14d + SHA256=72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1 + SHA256=72c0d2d699d0440db17cb7cbbc06a253eaafd21465f14bb0fed8b85ae73153d1 + SHA256=074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761 + SHA256=74a846c61adc53692d3040aff4c1916f32987ad72b07fe226e9e7dbeff1036c4 + SHA256=075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85 + SHA256=76b86543ce05540048f954fed37bdda66360c4a3ddb8328213d5aef7a960c184 + SHA256=76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524 + SHA256=76fb4deaee57ef30e56c382c92abffe2cf616d08dbecb3368c8ee6b02e59f303 + SHA256=077aa8ff5e01747723b6d24cc8af460a7a00f30cd3bc80e41cc245ceb8305356 + SHA256=77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9 + SHA256=79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57 + SHA256=79e87b93fbed84ec09261b3a0145c935f7dfe4d4805edfb563b2f971a0d51463 + SHA256=80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085 + SHA256=80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3 + SHA256=80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1 + SHA256=81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0 + SHA256=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d + SHA256=82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989 + SHA256=83f7be0a13c1fccf024c31da5c68c0ea1decf4f48fc39d6e4fd324bbe789ae8a + SHA256=84bf1d0bcdf175cfe8aea2973e0373015793d43907410ae97e2071b2c4b8e2d4 + SHA256=84df20b1d9d87e305c92e5ffae21b10b325609d59d835a954dbd8750ef5dabf4 + SHA256=86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882 + SHA256=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219 + SHA256=88df37ede18bea511f1782c1a6c4915690b29591cf2c1bf5f52201fbbb4fa2b9 + SHA256=88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc + SHA256=89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be + SHA256=89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7 + SHA256=092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0 + SHA256=93b266f38c3c3eaab475d81597abbd7cc07943035068bb6fd670dbbe15de0131 + SHA256=93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63 + SHA256=94be67c319a67de75ebed050d5537cfaa795d72bba52f3d8cf349e7bd075410e + SHA256=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3 + SHA256=97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd + SHA256=98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb + SHA256=98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8 + SHA256=99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1 + SHA256=119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280 + SHA256=131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6 + SHA256=133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743 + SHA256=146d77e80ca70ea5cb17bfc9a5cea92334f809cbdc87a51c2d10b8579a4b9c88 + SHA256=159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980 + SHA256=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347 + SHA256=221dfbc74bbb255b0879360ccc71a74b756b2e0f16e9386b38a9ce9d4e2e34f9 + SHA256=263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24 + SHA256=0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5 + SHA256=316a27e2bdb86222bc7c8af4e5472166b02aec7f3f526901ce939094e5861f6d + SHA256=358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69 + SHA256=362c4f3dadc9c393682664a139d65d80e32caa2a97b6e0361dfd713a73267ecc + SHA256=399effe75d32bdab6fa0a6bffe02dbf0a59219d940b654837c3be1c0bd02e9aa + SHA256=436ccab6f62fa2d29827916e054ade7acae485b3de1d3e5c6c62d3debf1480e7 + SHA256=453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233 + SHA256=455bc98ba32adab8b47d2d89bdbadca4910f91c182ab2fc3211ba07d3784537b + SHA256=0466dac557ee161503f5dfbd3549f81ec760c3d6c7c4363a21a03e7a3f66aca8 + SHA256=475e5016c9c0f5a127896f9179a1b1577a67b357f399ab5a1e68aab07134729a + SHA256=478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0 + SHA256=496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b + SHA256=506f953bbb285aeb8af0549eb24f52f3b7af36afe740afa36735bac70573ce28 + SHA256=523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba + SHA256=525d9b51a80ca0cd4c5889a96f857e73f3a80da1ffbae59851e0f51bdfb0b6cd + SHA256=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9 + SHA256=591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52 + SHA256=592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c + SHA256=600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0 + SHA256=607dc4c75ac7aef82ae0616a453866b3b358c6cf5c8f9d29e4d37f844306b97c + SHA256=626fae47811450d080d08c3d9fd890aa64bfecdc45eacd42a40850c1833c8763 + SHA256=654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad + SHA256=673b63b67345773cd6d66f6adcf2c753e2d949232bff818d5bb6e05786538d92 + SHA256=673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b + SHA256=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf + SHA256=727e8ba66a8ff07bdc778eacb463b65f2d7167a6616ca2f259ea32571cacf8af + SHA256=771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd + SHA256=818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01 + SHA256=823da894b2c73ffcd39e77366b6f1abf0ae9604d9b20140a54e6d55053aadeba + SHA256=845f1e228de249fc1ddf8dc28c39d03e8ad328a6277b6502d3932e83b879a65a + SHA256=862d0ff27bb086145a33b9261142838651b0d2e1403be321145e197600eb5015 + SHA256=881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461 + SHA256=900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88 + SHA256=904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a + SHA256=909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880 + SHA256=910aa4685c735d8c07662aa04fafec463185699ad1a0cd1967b892fc33ec6c3c + SHA256=916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677 + SHA256=923ebbe8111e73d5b8ecc2db10f8ea2629a3264c3a535d01c3c118a3b4c91782 + SHA256=927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a + SHA256=950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9 + SHA256=955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad + SHA256=984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7 + SHA256=1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4 + SHA256=1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c + SHA256=1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1 + SHA256=1766fd66f846d9a21e648d649ad35d1ff94f8ca17a40a9a738444d6b8e07aacb + SHA256=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52 + SHA256=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d + SHA256=2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22 + SHA256=2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109 + SHA256=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6 + SHA256=2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f + SHA256=2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2 + SHA256=3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5 + SHA256=3243aab18e273a9b9c4280a57aecef278e10bfff19abb260d7a7820e41739099 + SHA256=3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5 + SHA256=3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de + SHA256=3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a + SHA256=3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b + SHA256=3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3 + SHA256=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838 + SHA256=4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca + SHA256=4324f3d1e4007f6499a3d0f0102cd92ed9f554332bc0b633305cd7b957ff16c8 + SHA256=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b + SHA256=4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6 + SHA256=4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8 + SHA256=4941c4298f4560fc1e59d0f16f84bab5c060793700b82be2fd7c63735f1657a8 + SHA256=5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48 + SHA256=5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02 + SHA256=5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b + SHA256=5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c + SHA256=6071db01b50c658cf78665c24f1d21f21b4a12d16bfcfaa6813bf6bbc4d0a1e8 + SHA256=6191c20426dd9b131122fb97e45be64a4d6ce98cc583406f38473434636ddedc + SHA256=06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf + SHA256=7049f3c939efe76a5556c2a2c04386db51daf61d56b679f4868bb0983c996ebb + SHA256=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129 + SHA256=7236c8ff33c0e5cfa956778aa7303f1979f3bf709c361399fa1ce101b7e355b8 + SHA256=7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408 + SHA256=7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca + SHA256=8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60 + SHA256=8399e5afd8e3e97139dffb1a9fb00db2186321b427f164403282217cab067c38 + SHA256=8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b + SHA256=8797d9afc7a6bb0933f100a8acbb5d0666ec691779d522ac66c66817155b1c0d + SHA256=09043c51719d4bf6405c9a7a292bb9bb3bcc782f639b708ddcc4eedb5e5c9ce9 + SHA256=9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b + SHA256=9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6 + SHA256=9790a7b9d624b2b18768bb655dda4a05a9929633cef0b1521e79e40d7de0a05b + SHA256=17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca + SHA256=17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229 + SHA256=18712a063574bfec315d58577dfe413ab45b650e54747d1e18a56c3c7337a12c + SHA256=19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758 + SHA256=26453afb1f808f64bec87a2532a9361b696c0ed501d6b973a1f1b5ae152a4d40 + SHA256=28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7 + SHA256=30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab + SHA256=37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba + SHA256=40061b30b1243be76d5283cbc8abfe007e148097d4de7337670ff1536c4c7ba1 + SHA256=42579a759f3f95f20a2c51d5ac2047a2662a2675b3fb9f46c1ed7f23393a0f00 + SHA256=42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0 + SHA256=49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668 + SHA256=54841d9f89e195196e65aa881834804fe3678f1cf6b328cab8703edd15e3ec57 + SHA256=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347 + SHA256=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd + SHA256=67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc + SHA256=70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4 + SHA256=72288d4978ee87ea6c8b1566dbd906107357087cef7364fb3dd1e1896d00baeb + SHA256=72322fa8bba20df6966acbcf41e83747893fd173cd29de99b5ad1a5d3bf8f2de + SHA256=76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a + SHA256=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22 + SHA256=77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c + SHA256=78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f + SHA256=81939e5c12bd627ff268e9887d6fb57e95e6049f28921f3437898757e7f21469 + SHA256=85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94 + SHA256=86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675 + SHA256=89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10 + SHA256=092349aebdac28294dbad1656759d8461f362d1a36b01054dccf861d97beadf0 + SHA256=94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5 + SHA256=101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558 + SHA256=238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4 + SHA256=258359a7fa3d975620c9810dab3a6493972876a024135feaf3ac8482179b2e79 + SHA256=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073 + SHA256=385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039 + SHA256=405472a8f9400a54bb29d03b436ccd58cfd6442fe686f6d2ed4f63f002854659 + SHA256=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c + SHA256=509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6 + SHA256=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91 + SHA256=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b + SHA256=708016fbe22c813a251098f8f992b177b476bd1bbc48c2ed4a122ff74910a965 + SHA256=771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c + SHA256=810513b3f4c8d29afb46f71816350088caacf46f1be361af55b26f3fee4662c3 + SHA256=841335eeb6af68dce5b8b24151776281a751b95056a894991b23afae80e9f33b + SHA256=0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06 + SHA256=952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4 + SHA256=2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c + SHA256=3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf + SHA256=3390919bb28d5c36cc348f9ef23be5fa49bfd81263eb7740826e4437cbe904cd + SHA256=4422851a0a102f654e95d3b79c357ae3af1b096d7d1576663c027cfbc04abaf9 + SHA256=7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d + SHA256=7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c + SHA256=7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504 + SHA256=8939116df1d6c8fd0ebd14b2d37b3dec38a8820aa666ecd487bc1bb794f2a587 + SHA256=9778136d2441439dc470861d15d96fa21dc9f16225232cd05b76791a5e0fde6f + SHA256=16768203a471a19ebb541c942f45716e9f432985abbfbe6b4b7d61a798cea354 + SHA256=18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805 + SHA256=22418016e980e0a4a2d01ca210a17059916a4208352c1018b0079ccb19aaf86a + SHA256=36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10 + SHA256=36875562e747136313ec5db58174e5fab870997a054ca8d3987d181599c7db6a + SHA256=0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3 + SHA256=55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa + SHA256=65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3 + SHA256=65025741ecd0ef516da01319b42c2d96e13cb8d78de53fb7e39cd53ea6d58c75 + SHA256=91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c + SHA256=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82 + SHA256=696679114f6a106ec94c21e2a33fe17af86368bcf9a796aaea37ea6e8748ad6a + SHA256=910479467ef17b9591d8d42305e7f6f247ad41c60ec890a1ffbe331f495ed135 + SHA256=8111085022bda87e5f6aa4c195e743cc6dd6a3a6d41add475d267dc6b105a69f + SHA256=9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d + SHA256=46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7 + SHA256=48891874441c6fa69e5518d98c53d83b723573e280c6c65ccfbde9039a6458c9 + SHA256=6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa + SHA256=a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1 + SHA256=a3e507e713f11901017fc328186ae98e23de7cea5594687480229f77d45848d8 + SHA256=a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad + SHA256=a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062 + SHA256=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc + SHA256=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200 + SHA256=a56c2a2425eb3a4260cc7fc5c8d7bed7a3b4cd2af256185f24471c668853aee8 + SHA256=a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df + SHA256=a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d + SHA256=a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5 + SHA256=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3 + SHA256=a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e + SHA256=a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499 + SHA256=a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9 + SHA256=a7860e110f7a292d621006b7208a634504fb5be417fd71e219060381b9a891e6 + SHA256=a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e + SHA256=a9706e320179993dade519a83061477ace195daa1b788662825484813001f526 + SHA256=a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433 + SHA256=a2353030d4ea3ad9e874a0f7ff35bbfa10562c98c949d88cabab27102bbb8e48 + SHA256=a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4 + SHA256=aa9ab1195dc866270e984f1bed5e1358d6ef24c515dfdb6c2a92d1e1b94bf608 + SHA256=aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c + SHA256=aafb95a443911e4c67d4e45ffa83cca103c91b42915b81100534dc439bec0c1b + SHA256=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89 + SHA256=ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd + SHA256=ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a + SHA256=ac3f613d457fc4d44fa27b2e0b1baa62c09415705efb5a40a4756da39b3ac165 + SHA256=ac63c26ca43701dddaa7fb1aea535d42190f88752900a03040fd5aaa24991e25 + SHA256=ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833 + SHA256=ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b + SHA256=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173 + SHA256=ad2477632b9b07588cfe0e692f244c05fa4202975c1fe91dd3b90fa911ac6058 + SHA256=ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47 + SHA256=adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee + SHA256=ae6fb53e4d8122dba3a65e5fa59185b36c3ac9df46e82fcfb6731ab55c6395aa + SHA256=ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471 + SHA256=ae79e760c739d6214c1e314728a78a6cb6060cce206fde2440a69735d639a0a2 + SHA256=aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399 + SHA256=af095de15a16255ca1b2c27dad365dff9ac32d2a75e8e288f5a1307680781685 + SHA256=af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a + SHA256=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508 + SHA256=b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414 + SHA256=b2ba6efeff1860614b150916a77c9278f19d51e459e67a069ccd15f985cbc0e1 + SHA256=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29 + SHA256=b4d47ea790920a4531e3df5a4b4b0721b7fea6b49a35679f0652f1e590422602 + SHA256=b6fd51e1f57a03006953e84fd56cc2821cc19e7c77c0474e1110aabaacaf03df + SHA256=b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d + SHA256=b8b94c2646b62f6ac08f16514b6efaa9866aa3c581e4c0435a7aeafe569b2418 + SHA256=b9a4e40a5d80fedd1037eaed958f9f9efed41eb01ada73d51b5dcd86e27e0cbf + SHA256=b9b3878ddc5dfb237d38f8d25067267870afd67d12a330397a8853209c4d889c + SHA256=b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a + SHA256=b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b + SHA256=b47be212352d407d0ef7458a7161c66b47c2aec8391dd101df11e65728337a6a + SHA256=b48a309ee0960da3caaaaf1e794e8c409993aeb3a2b64809f36b97aac8a1e62a + SHA256=b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e + SHA256=b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5 + SHA256=b95b2d9b29bd25659f1c7ba5a187f8d23cde01162d9b5b1a2c4aea8f64b38441 + SHA256=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de + SHA256=b1334a71cc73b3d0c54f62d8011bec330dfc355a239bf94a121f6e4c86a30a2e + SHA256=b1867d13a4cab66a76f4d4448824ca0cb3a176064626f9618c0c103ee3cb4f47 + SHA256=b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0 + SHA256=b61869b7945be062630f1dd4bae919aecee8927f7e1bc3954a21ff763f4c0867 + SHA256=b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704 + SHA256=b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3 + SHA256=bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa + SHA256=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc + SHA256=bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955 + SHA256=bb68552936a6b0a68fb53ce864a6387d2698332aac10a7adfdd5a48b97027ce3 + SHA256=bc7ebd191e0991fd0865a5c956a92e63792a0bb2ff888af43f7a63bb65a22248 + SHA256=bc13adeb6bf62b1e10ef41205ef92382e6c18d6a20669d288a0b11058e533d63 + SHA256=bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f + SHA256=bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f + SHA256=bda99629ec6c522c3efcbcc9ca33688d31903146f05b37d0d3b43db81bfb3961 + SHA256=bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c + SHA256=bdcacee3695583a0ca38b9a786b9f7334bf2a9a3387e4069c8e6ca378b2791d0 + SHA256=be03e9541f56ac6ed1e81407dcd7cc85c0ffc538c3c2c2c8a9c747edbcf13100 + SHA256=be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2 + SHA256=be54f7279e69fb7651f98e91d24069dbc7c4c67e65850e486622ccbdc44d9a57 + SHA256=c1c4310e5d467d24e864177bdbfc57cb5d29aac697481bfa9c11ddbeebfd4cc8 + SHA256=c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8 + SHA256=c2fcc0fec64d5647813b84b9049d430406c4c6a7b9f8b725da21bcae2ff12247 + SHA256=c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e + SHA256=c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9 + SHA256=c9b49b52b493b53cd49c12c3fa9553e57c5394555b64e32d1208f5b96a5b8c6e + SHA256=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8 + SHA256=c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924 + SHA256=c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26 + SHA256=c60fcff9c8e5243bbb22ec94618b9dcb02c59bb49b90c04d7d6ab3ebbd58dc3a + SHA256=c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc + SHA256=c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa + SHA256=c344e92a6d06155a217a9af7b4b35e6653665eec6569292e7b2e70f3a3027646 + SHA256=c470c9db58840149ce002f3e6003382ecf740884a683bae8f9d10831be218fa2 + SHA256=c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2 + SHA256=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5 + SHA256=c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada + SHA256=c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c + SHA256=c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d + SHA256=c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c + SHA256=c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd + SHA256=caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab + SHA256=cb57f3a7fe9e1f8e63332c563b0a319b26c944be839eabc03e9a3277756ba612 + SHA256=cb9890d4e303a4c03095d7bc176c42dee1b47d8aa58e2f442ec1514c8f9e3cec + SHA256=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6 + SHA256=cc383ad11e9d06047a1558ed343f389492da3ac2b84b71462aee502a2fa616c8 + SHA256=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64 + SHA256=cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b + SHA256=cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb + SHA256=cdd2a4575a46bada4837a6153a79c14d60ee3129830717ef09e0e3efd9d00812 + SHA256=cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc + SHA256=ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2 + SHA256=cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986 + SHA256=cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b + SHA256=cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190 + SHA256=cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb + SHA256=cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40 + SHA256=cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b + SHA256=cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab + SHA256=cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c + SHA256=d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889 + SHA256=d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605 + SHA256=d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f + SHA256=d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9 + SHA256=d7bc7306cb489fe4c285bbeddc6d1a09e814ef55cf30bd5b8daf87a52396f102 + SHA256=d7ddf874304556f8a10942a29b3d387cb5155a7419f87813557fe728cb14806d + SHA256=d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0 + SHA256=d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530 + SHA256=d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482 + SHA256=d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2 + SHA256=d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f + SHA256=d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3 + SHA256=d5562fb90b0b3deb633ab335bcbd82ce10953466a428b3f27cb5b226b453eaf3 + SHA256=d5586dc1e61796a9ae5e5d1ced397874753056c3df2eb963a8916287e1929a71 + SHA256=d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476 + SHA256=d8459f7d707c635e2c04d6d6d47b63f73ba3f6629702c7a6e0df0462f6478ae2 + SHA256=d25904fbf907e19f366d54962ff543d9f53b8fdfd2416c8b9796b6a8dd430e26 + SHA256=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e + SHA256=d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d + SHA256=d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1 + SHA256=da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24 + SHA256=da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d + SHA256=db2a9247177e8cdd50fe9433d066b86ffd2a84301aa6b2eb60f361cfff077004 + SHA256=db90e554ad249c2bd888282ecf7d8da4d1538dd364129a3327b54f8242dd5653 + SHA256=dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98 + SHA256=dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed + SHA256=dbe9f17313e1164f06401234b875fbc7f71d41dc7271de643865af1358841fef + SHA256=dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258 + SHA256=dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097 + SHA256=dd573f23d656818036fc9ae1064eda31aca86acb9bc44a6e127db3ea112a9094 + SHA256=dde6f28b3f7f2abbee59d4864435108791631e9cb4cdfb1f178e5aa9859956d8 + SHA256=de6bf572d39e2611773e7a01f0388f84fb25da6cba2f1f8b9b36ffba467de6fa + SHA256=de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c + SHA256=de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5 + SHA256=dec8a933dba04463ed9bb7d53338ff87f2c23cfb79e0e988449fc631252c9dcc + SHA256=ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d + SHA256=deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578 + SHA256=df0cc4e5c9802f8edaefeb130e375cad56b2c5490d8ebd77d8dbdcc6fdc7ecb6 + SHA256=df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15 + SHA256=dfaefd06b680f9ea837e7815fc1cc7d1f4cc375641ac850667ab20739f46ad22 + SHA256=e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b + SHA256=e2d8dd5dacc24051709f55a35184f5f99aef957a83bd358b0608b4479e1ec24f + SHA256=e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6 + SHA256=e3b257357be41a18319332df7023c4407e2b93ac4c9e0c6754032e29f3763eac + SHA256=e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918 + SHA256=e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd + SHA256=e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb + SHA256=e4c154a0073bbad3c9f8ab7218e9b3be252ae705c20c568861dae4088f17ffcc + SHA256=e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036 + SHA256=e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148 + SHA256=e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1 + SHA256=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53 + SHA256=e5b0772be02e2bc807804874cf669e97aa36f5aff1f12fa0a631a3c7b4dd0dc8 + SHA256=e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f + SHA256=e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48 + SHA256=e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f + SHA256=e50b25d94c1771937b2f632e10eea875ac6b19c57da703d52e23ad2b6299f0ae + SHA256=e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90 + SHA256=e61a54f6d3869b43c4eceac3016df73df67cce03878c5a6167166601c5d3f028 + SHA256=e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a + SHA256=e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4 + SHA256=e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f + SHA256=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf + SHA256=e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2 + SHA256=e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9 + SHA256=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf + SHA256=e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa + SHA256=e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06 + SHA256=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790 + SHA256=e81230217988f3e7ec6f89a06d231ec66039bdba340fd8ebb2bbb586506e3293 + SHA256=ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3 + SHA256=ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41 + SHA256=ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3 + SHA256=ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5 + SHA256=ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566 + SHA256=ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c + SHA256=ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282 + SHA256=ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39 + SHA256=ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7 + SHA256=ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe + SHA256=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b + SHA256=ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850 + SHA256=ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0 + SHA256=f1c8ca232789c2f11a511c8cd95a9f3830dd719cad5aa22cb7c3539ab8cb4dc3 + SHA256=f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b + SHA256=f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe + SHA256=f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f + SHA256=f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1 + SHA256=f37d609ea1f06660d970415dd3916c4c153bb5940bf7d2beb47fa34e8a8ffbfc + SHA256=f51bdb0ad924178131c21e39a8ccd191e46b5512b0f2e1cc8486f63e84e5d960 + SHA256=f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c + SHA256=f84f8173242b95f9f3c4fea99b5555b33f9ce37ca8188b643871d261cb081496 + SHA256=f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004 + SHA256=f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439 + SHA256=f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d + SHA256=f88ebb633406a086d9cca6bc8b66a4ea940c5476529f9033a9e0463512a23a57 + SHA256=f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af + SHA256=f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960 + SHA256=f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008 + SHA256=f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145 + SHA256=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65 + SHA256=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35 + SHA256=f8886a9c759e0426e08d55e410b02c5b05af3c287b15970175e4874316ffaf13 + SHA256=f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b + SHA256=f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478 + SHA256=f85784fa8e7a7ec86cb3fe76435802f6bb82256e1824ed7b5d61bf075f054573 + SHA256=f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54 + SHA256=f9895458e73d4b0ef01eda347fb695bb00e6598d9f5e2506161b70ad96bb7298 + SHA256=f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b + SHA256=fa875178ae2d7604d027510b0d0a7e2d9d675e10a4c9dda2d927ee891e0bcb91 + SHA256=fafa1bb36f0ac34b762a10e9f327dcab2152a6d0b16a19697362d49a31e7f566 + SHA256=fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22 + SHA256=fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f + SHA256=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2 + SHA256=fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c + SHA256=fcdfe570e6dc6e768ef75138033d9961f78045adca53beb6fdb520f6417e0df1 + SHA256=fd33fb2735cc5ef466a54807d3436622407287e325276fcd3ed1290c98bd0533 + SHA256=fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c + SHA256=fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03 + SHA256=fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280 + SHA256=ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7 + SHA256=ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339 + SHA256=ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5 + SHA256=ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f + + + SHA256=56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c + SHA256=06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4 + SHA256=86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62 + SHA256=06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f + SHA256=8dafe5f3d0527b66f6857559e3c81872699003e0f2ffda9202a1b5e29db2002e + SHA256=81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1 + SHA256=6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724 + SHA256=ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620 + SHA256=0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc + SHA256=c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c + SHA256=e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d + SHA256=18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7 + SHA256=139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988 + SHA256=b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427 + SHA256=1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e + SHA256=6b5cf41512255237064e9274ca8f8a3fef820c45aa6067c9c6a0e6f5751a0421 + SHA256=0d10c4b2f56364b475b60bd2933273c8b1ed2176353e59e65f968c61e93b7d99 + SHA256=ad938d15ecfd70083c474e1642a88b078c3cea02cdbddf66d4fb1c01b9b29d9a + SHA256=89698cad598a56f9e45efffd15d1841e494a2409cc12279150a03842cd6bb7f3 + SHA256=5f6fec8f7890d032461b127332759c88a1b7360aa10c6bd38482572f59d2ba8b + SHA256=fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5 + SHA256=05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4 + SHA256=6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77 + SHA256=6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f + SHA256=32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d + SHA256=fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8 + SHA256=6839fcae985774427c65fe38e773aa96ec451a412caa5354ad9e2b9b54ffe6c1 + SHA256=f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a + SHA256=7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376 + SHA256=96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc + SHA256=b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3 + SHA256=e6a7b0bc01a627a7d0ffb07faddb3a4dd96b6f5208ac26107bdaeb3ab1ec8217 + SHA256=200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a + SHA256=8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce + SHA256=c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497 + SHA256=23e89fd30a1c7db37f3ea81b779ce9acf8a4294397cbb54cff350d54afcfd931 + SHA256=575e58b62afab094c20c296604dc3b7dd2e1a50f5978d8ee24b7dca028e97316 + SHA256=5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d + SHA256=e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12 + SHA256=9bb09752cf3a464455422909edef518ac18fe63cf5e1e8d9d6c2e68db62e0c87 + SHA256=f8236fc01d4efaa48f032e301be2ebba4036b2cd945982a29046eca03944d2ae + SHA256=e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e + SHA256=9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c + SHA256=f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280 + SHA256=9c2f3e9811f7d0c7463eaa1ee6f39c23f902f3797b80891590b43bbe0fdf0e51 + SHA256=b8807e365be2813b7eccd2e4c49afb0d1e131086715638b7a6307cd7d7e9556c + SHA256=50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76 + SHA256=52d5c35325ce701516f8b04380c9fbdb78ec6bcc13b444f758fdb03d545b0677 + SHA256=7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6 + SHA256=8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104 + SHA256=8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330 + SHA256=4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4 + SHA256=88076e98d45ed3adf0c5355411fe8ca793eb7cec1a1c61f5e1ec337eae267463 + SHA256=749b0e8c8c8b7dda8c2063c708047cfe95afa0a4d86886b31a12f3018396e67c + SHA256=49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530 + SHA256=d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c + SHA256=f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d + SHA256=5c1585b1a1c956c7755429544f3596515dfdf928373620c51b0606a520c6245a + SHA256=5bc3994612624da168750455b363f2964e1861dba4f1c305df01b970ac02a7ae + SHA256=bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df + SHA256=42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25 + SHA256=f461414a2596555cece5cfee65a3c22648db0082ca211f6238af8230e41b3212 + SHA256=770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a + From 60f27bb3072ed576f12576addd33bd81e113566b Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 5 Jul 2023 10:19:00 -0400 Subject: [PATCH 443/471] Misc Updates & Tagging --- sysmonconfig-export.xml | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index bc2cee26..7672e447 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -8305,10 +8305,10 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ @@ -8774,10 +8774,10 @@ Software\recfg - + \Keyboard Layout\Preload\ - + \Keyboard Layout\Substitutes\ @@ -8828,6 +8828,15 @@ C:\Program Files (x86)\ESET C:\Program Files\ESET + + \EnableBHO + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports + + + Control\Print\Environments\Windows x64\Drivers + @@ -8854,7 +8863,7 @@ SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e - Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf + Startup;Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE From dac2f473a34493b5fbd2b4d6ec43ebdafd677c96 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 5 Jul 2023 11:01:01 -0400 Subject: [PATCH 444/471] Break out some Pe Executable rules with MITRE Tagging --- sysmonconfig-export.xml | 62 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 58 insertions(+), 4 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 7672e447..bb73a7e9 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -9659,6 +9659,12 @@ .ime .tsp + + powershell.exe;powershell_ise.exe;pwsh.exe;Sqlps.exe + + + cmd.exe;conhost.exe + C:\Users\Public\ C:\Perflogs\ @@ -9671,6 +9677,16 @@ C:\Windows\System32\spool\SERVERS\ C:\Windows\System32\spool\PRINTERS\ C:\Windows\Help\ + C:\Windows\SysWOW64\Tasks + C:\ProgramData\Intel + C:\ProgramData\Mozilla + C:\ProgramData\chocolatey\ + C:\ProgramData\Microsoft\DeviceSync + C:\ProgramData\Microsoft\PlayReady + C:\ProgramData\Microsoft\User Account Pictures + C:\ProgramData\Microsoft\Office\Heartbeat + C:\ProgramData\Microsoft\Windows\WER + C:\Users\All Users\ C:\Users\;\Music\ C:\Users\;\Pictures\ C:\Users\;\Videos\ @@ -9829,17 +9845,55 @@ esentutl.exe finger.exe - presentationhost.exe - notepad.exe AcroRd32.exe RdrCEF.exe - mshta.exe - hh.exe calc.exe mspaint.exe + + hh.exe + + + control.exe + + + CMSTP.exe + + + installutil.exe + + + mshta.exe + + + msiexec.exe + + + Odbcconf.exe + + + Regsvcs.exe;Regasm.exe + + + regsvr32.exe + + + Rundll32.exe + + + Verclsid.exe + + + mavinject.exe;mavinject64.exe + + + mmc.exe + + + Appvlp.exe;InfDefaultInstall.EXE;PresentationHost.exe;Register-cimprovider.exe;RegisterCimProvider2.exe;RegisterCimProvider.exe;ScriptRunner.exe;appcmd.exe;csi.exe;devtoolslauncher.exe;diskshadow.exe;extexport.exe;jjs.exe;msconfig.EXE;msdt.exe;rasautou.exe;rasdlui.exe;replace.exe;tttracer.exe;wab.exe;wsreset.exe + SHA256=7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed SHA256=0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb From 30c2337447ef21a1e9481b009c258e7b21da9cbf Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 5 Jul 2023 11:04:27 -0400 Subject: [PATCH 445/471] Add Spear Phishing detection, add @twitter tagging --- sysmonconfig-export.xml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index bb73a7e9..7ac39f00 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -4,8 +4,8 @@ _\ \/ // (_- _/_ _/ /__/ ,< /___/\_, /___/_/_/_/\___/_//_/ /_/ |_/_/ /_/ |_____/ \___/_/|_| /___/ - Author: ionstorm - Contributors: NerbalOne + Author: @ionstorm + Contributors: @NerbalOne Project: https://github.com/ion-storm/sysmon-config License: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text. Methodology: Detect the most Techniques per data source in MITRE ATT&CK. @@ -9643,6 +9643,10 @@ C:\Users\ \Downloads + + C:\Users\ + Content.Outlook + .exe .dll From 0ab30cc1652c88291fe7b270b4ac3e2737c752ea Mon Sep 17 00:00:00 2001 From: ionstorm Date: Wed, 5 Jul 2023 12:17:33 -0400 Subject: [PATCH 446/471] Add NerbalOne's Powershell Sysmon Installer, add exclusions for asus firmware bin file --- Sysmon_Installer.ps1 | 82 +++++++++++++++++++++++++++++++++++++++++ sysmonconfig-export.xml | 3 ++ 2 files changed, 85 insertions(+) create mode 100644 Sysmon_Installer.ps1 diff --git a/Sysmon_Installer.ps1 b/Sysmon_Installer.ps1 new file mode 100644 index 00000000..ea837097 --- /dev/null +++ b/Sysmon_Installer.ps1 @@ -0,0 +1,82 @@ +#Author: NerbalOne +#This PowerShell script will first create the Sysmon folder if it does not exist. It will then identify which OS architecture the endpoint is running and download the appropriate Sysmon version along with the Sysmon config and Sysmon Update script. It will then install Sysmon with the config and create a Scheduled Task to run hourly to update the Sysmon config. +#You may have issues while running this script on Windows Server 2012 R2 servers as it seems this server version only works with the Sysmon.exe and not the Sysmon64.exe with the newer Sysmon versions. + +# Define Sysmon URLs +$sysmon32URL = "https://live.sysinternals.com/sysmon.exe" +$sysmon64URL = "https://live.sysinternals.com/sysmon64.exe" +$sysmonConfigURL = "https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml" +$sysmonUpdateConfig = "https://raw.githubusercontent.com/ion-storm/sysmon-config/master/SysmonUpdateConfig.ps1" + +# Define Local Path for Sysmon File and Sysmon Config +$sysmon32Path = "C:\Programdata\Sysmon\sysmon.exe" +$sysmon64Path = "C:\Programdata\Sysmon\sysmon64.exe" +$sysmonConfigPath = "C:\Programdata\Sysmon\sysmonconfig-export.xml" +$sysmonUpdatePath = "C:\Programdata\Sysmon\SysmonUpdateConfig.ps1" +$sysmonFolderPath = "C:\ProgramData\Sysmon\" + +# Create Sysmon Folder if it Doesn't Exist +if (-not (Test-Path $sysmonFolderPath)) { + # Create the Folder + try { + New-Item -ItemType Directory -Path $sysmonFolderPath -Force + Write-Host "Folder created successfully at $folderPath" + } + catch { + Write-Host "Error creating the folder: $_" + } +} +else { + Write-Host "The folder already exists at $folderPath" +} + +# Check OS Architecture +$OSArchitecture = (Get-WmiObject -Query "Select * from Win32_OperatingSystem").OSArchitecture + +# Download Sysmon Update Script +Invoke-WebRequest -Uri $sysmonUpdateConfig -OutFile $sysmonUpdatePath + +# Download Sysmon Config +Invoke-WebRequest -Uri $sysmonConfigURL -OutFile $sysmonConfigPath + +# Depending on the OS Architecture, Download and Install Sysmon +if ($OSArchitecture -eq "32-bit") { + # Download Sysmon 32 bit + Invoke-WebRequest -Uri $sysmon32URL -OutFile $sysmon32Path + + # Install Sysmon with Config + Start-Process -FilePath $sysmon32Path -ArgumentList "-accepteula -i $sysmonConfigPath" -NoNewWindow -Wait + +} elseif ($OSArchitecture -eq "64-bit") { + # Download Sysmon 64 bit + Invoke-WebRequest -Uri $sysmon64URL -OutFile $sysmon64Path + + # Install Sysmon with Config + Start-Process -FilePath $sysmon64Path -ArgumentList "-accepteula -i $sysmonConfigPath" -NoNewWindow -Wait + +} else { + Write-Output "Unsupported architecture: $OSArchitecture" +} + +# Create a New Scheduled Task +Start-Process schtasks.exe -ArgumentList '/Create /RU SYSTEM /RL HIGHEST /SC HOURLY /TN Update_Sysmon_Rules /TR "powershell.exe -ExecutionPolicy Bypass -File "C:\Programdata\Sysmon\SysmonUpdateConfig.ps1"" /f' -Wait -WindowStyle Hidden +Start-Process schtasks.exe -ArgumentList '/Run /TN Update_Sysmon_Rules' -Wait -WindowStyle Hidden + +# Define Sysmon service Name Based on OS Architecture +$sysmonServiceName = if ($OSArchitecture -eq "64-bit") { "Sysmon64" } else { "Sysmon" } + +# Check if Sysmon Service Exists +try { + $service = Get-Service -Name $sysmonServiceName -ErrorAction Stop + Write-Output "Sysmon service exists" +} catch { + Throw "Sysmon service does not exist" +} + +# Check if Scheduled Task is Created Successfully +try { + $task = Get-ScheduledTask -TaskName "Update_Sysmon_Rules" -ErrorAction Stop + Write-Output "Scheduled task created successfully" +} catch { + Throw "Scheduled task creation failed" +} diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 7ac39f00..e012ceca 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -5302,6 +5302,7 @@ .bin + C:\Windows\System32\WUDFHost.exe C:\Windows\SysWOW64\Wbem @@ -5677,6 +5678,7 @@ C:\Users\Public\ + C:\Windows\System32\WUDFHost.exe C:\Windows\Temp\ @@ -5886,6 +5888,7 @@ .bin + C:\Windows\System32\WUDFHost.exe .cab From baaf02da504a9c56b419f17f5d04a63107cdd9ca Mon Sep 17 00:00:00 2001 From: ionstorm Date: Thu, 6 Jul 2023 17:20:31 -0400 Subject: [PATCH 447/471] misc Updates --- sysmonconfig-export.xml | 40 +++++++++++++++++++++++++++++++++++----- 1 file changed, 35 insertions(+), 5 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index e012ceca..7266ab8b 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -265,7 +265,7 @@ C:\Users\;$Recycle;\Temp\;\Downloads\ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 conhost.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\Msp.Ecosystem.Discovery.exe;TCIntegratorCommHelper.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\Msp.Ecosystem.Discovery.exe;TCIntegratorCommHelper.exe;\NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe @@ -521,6 +521,7 @@ C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe Sentinel\AutoRepair Update_Sysmon_Rules + C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe taskeng.exe @@ -535,7 +536,7 @@ schtasks.exe schtasks /TN RtkAudUService64_BG - -change;/change;-delete;/delete;-create;/create;Update_Sysmon_Rules + -change;/change;-delete;/delete;-create;/create;Update_Sysmon_Rules;AMDRyzenMasterSDKTask at.exe @@ -689,6 +690,8 @@ ..\;\.. + C:\Program Files;\Razer\Synapse3\Service\Razer Synapse Service.exe + C:\Program Files;\Razer\;\UserProcess\Razer Synapse Service Process.exe \cmd.exe /c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe /c del "C:\Users\*\Desktop\*.exe;\cmd.exe -c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe -c del "C:\Users\*\Desktop\*.exe @@ -960,9 +963,13 @@ firewall delete + ROGLiveService;C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe + C:\Program Files\ASUS\ROG Live Service\RLSInstallAction.exe firewall add + cmd.exe;ROGLiveService;C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe;enable=yes + C:\Program Files\ASUS\ROG Live Service\RLSInstallAction.exe firewall set opmode disable @@ -1050,6 +1057,7 @@ C:\Users\NetworkService\;C:\Users\NetworkService\;HarddiskVolumeShadowCopy;C:\Users\Default\;C:\Users\Public;C:\Users\Guest\;\administrateur\;C:\Windows\Media\;C:\Windows\addins\;tsclient\;\htdocs\;\config\systemprofile\;C:\PerfLogs\;c:\windows\ServiceProfiles\;C:\Intel\Logs\;C:\Windows\repair\;C:\Windows\Help\;$Recycle;C:\Windows\Debug\;C:\Windows\Security\;C:\Windows\Fonts\;\wwwroot\;\Contacts;C:\Windows\vss\ + C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;\CitrixReceiverUpdater.exe .exe @@ -2681,7 +2689,8 @@ - AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz + AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz + C:\Program Files;\LightingService\AsusInstallVerifier.exe @@ -2940,6 +2949,9 @@ C:\Windows\System32\WerFault.exe C:\Windows\System32\wbem\WmiPrvSE.exe + + C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe + @@ -5127,6 +5139,7 @@ C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git;\Intel\Driver and Support Assistant\DSAService.exe;C:\Program Files (x86)\N-able Technologies\AutomationManagerAgent\;C:\Program Files (x86)\MspPlatform\RequestHandlerAgent\RequestHandlerAgent.exe;C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe;C:\ProgramData\Cavelo\jre\bin\java.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe;C:\Program Files\Cavelo\Cavelo Agent\parser.exe C:\Windows\Microsoft.NET\Framework\;\NGenTask.exe \Intel\Driver and Support Assistant\ + C:\Program Files\AMD\CNext\CNext\Radeonsoftware.exe;C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.UserSessionHelper.exe C:\Windows\Microsoft.NET\Framework\;\ngen.exe @@ -5267,6 +5280,7 @@ C:\Windows\SoftwareDistribution C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch .exe + C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe proj @@ -5440,6 +5454,8 @@ !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;=READ=THIS=PLEASE=;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy C:\Users\;\Google\Chrome Beta\User Data\;\IndexedDB\ C:\Program Files\WindowsApps\Microsoft.YourPhone_;C:\Program Files\dotnet\shared\Microsoft.NETCore.App\;\Microsoft.NET\assembly\GAC_MSIL + \System.Security.Cryptography + Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe crackmapexec @@ -6871,7 +6887,7 @@ Temp\Temp1_ - + \Microsoft\;CLR_v;\UsageLogs\ @@ -7147,6 +7163,9 @@ SetValue \CurrentVersion\Run\ C:\Program Files\Microsoft OneDrive\Update\OneDriveSetup.exe;\AppData\Local\Microsoft\Teams\current\Teams.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe +
C:\Program Files\Google\Drive File Stream;\GoogleDriveFS.exe;startup_mode
+
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;no-startup-window;win-session-start;prefetch
+
\Application\chrome.exe;no-startup-window;win-session-start;prefetch
 \Microsoft\System\Scripts @@ -7439,7 +7458,8 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\SnapshotCleanupTask\SD HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office ClickToRun Service Monitor\SD HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Automatic Updates 2.0\SD - Microsoft\Windows\UpdateOrchestrator + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Automatic Updates 2.0\SD + Microsoft\Windows\UpdateOrchestrator;\AMDInstallLauncher\SD;\SD;ASUS Switch;\PowerToys\Autorun for HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree @@ -7641,6 +7661,7 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled
DWORD (0x00000000)
+ C:\WINDOWS\system32\DrvInst.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ @@ -8523,6 +8544,9 @@ Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations + + \Control\hivelist + \Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives\Volume Drive Type @@ -8840,6 +8864,12 @@ Control\Print\Environments\Windows x64\Drivers + + \Microsoft\.NETFramework;NGenAssemblyUsageLog + + + \REGISTRY\A\;LocalState\admin_settings + From 00185b9a96a2a4b9b5d32725210327a3ff1ce7d9 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 10 Jul 2023 13:11:57 -0400 Subject: [PATCH 448/471] Fix some inactive/broken rules and filtering --- sysmonconfig-export.xml | 35 +++++++++++++++++------------------ 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 7266ab8b..2aeba08c 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -304,10 +304,7 @@ wscript.exe - .jse - .js - .vba - .vbe + .jse;.js;.vba;.vbe \wscript.exe;\cscript.exe @@ -321,10 +318,7 @@ cscript.exe - .js - .jse - .vba - .vbe + .jse;.js;.vba;.vbe mshta vbscript:CreateObject("Wscript.Shell");mshta vbscript:Execute("Execute;mshta vbscript:CreateObject("Wscript.Shell").Run("mshta.exe;javascript:a= @@ -2484,10 +2478,10 @@ start-bitstransfer - expand \\ + expand;\\ - expand.exe \\ + expand.exe;\\ ieexec http @@ -2505,10 +2499,10 @@ esentutl.exe /y \\;esentutl.exe -y \\ - extrac32 \\ + extrac32;\\ - extrac32.exe \\ + extrac32.exe;\\ @@ -2650,10 +2644,16 @@ erase - -nw -exec= + -nw;-exec= + + + /nw;/exec= + + + -p;-nw - -p -nw + /p;/nw shred @@ -2678,8 +2678,7 @@ fsutil.exe - deletejournal - usn + usn;deletejournal @@ -2950,7 +2949,7 @@ C:\Windows\System32\wbem\WmiPrvSE.exe - C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe + C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe @@ -9680,7 +9679,7 @@ C:\Users\ Content.Outlook - + .exe .dll .sys From 91c9f540009ca4a94224d38d45d3e4837fc045c0 Mon Sep 17 00:00:00 2001 From: ionstorm Date: Mon, 10 Jul 2023 16:06:46 -0400 Subject: [PATCH 449/471] Re-enable Browser Extension monitoring for Chrome, added MITRE Tagging --- sysmonconfig-export.xml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 2aeba08c..c618df01 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -6753,10 +6753,10 @@ .mht - + \Chrome\User Data\Default\Extensions\ - + .crx @@ -7123,11 +7123,16 @@ - + Google\Chrome\Extensions update_url SetValue + + Google\Chrome + extensions.settings + SetValue + ForcePasswordReset @@ -8111,7 +8116,6 @@ Windows CE Services\AutoStartOnDisconnect - CurrentVersion\URL From 3ee217b7414a17e7916d3edaf4da1b0798a6508e Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Wed, 6 Sep 2023 10:40:46 -0400 Subject: [PATCH 450/471] Add files via upload --- sysmonconfig-export.xml | 43 ++++++++++++++++++++++++++--------------- 1 file changed, 27 insertions(+), 16 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index f439018a..c29e6938 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -4,8 +4,8 @@ _\ \/ // (_- _/_ _/ /__/ ,< /___/\_, /___/_/_/_/\___/_//_/ /_/ |_/_/ /_/ |_____/ \___/_/|_| /___/ - Author: ionstorm - Contributors: NerbalOne + Author: @ionstorm + Contributors: @NerbalOne, @cyberkryption Project: https://github.com/ion-storm/sysmon-config License: Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text. Methodology: Detect the most Techniques per data source in MITRE ATT&CK. @@ -52,13 +52,11 @@ Critical Risk: 90-100 Levels: (from Sigma) - (0) informational: Rule is intended for enrichment of events, e.g. by tagging them. No case or alerting should be triggered - by such rules because it is expected that a huge amount of events will match these rules. - (1) low: Notable event but rarely an incident. Low rated events can be relevant in high numbers or combination with others. - Immediate reaction shouldn't be necessary, but a regular review is recommended. - (2) medium: Relevant event that should be reviewed manually on a more frequent basis. - (3) high: Relevant event that should trigger an internal alert and requires a prompt review. - (4) critical: Highly relevant event that indicates an incident. Critical events should be reviewed immediately. + (0) Informational: Rule is intended for enrichment of events, e.g. by tagging them. No case or alerting should be triggered by such rules because it is expected that a huge amount of events will match these rules. + (1) Low: Notable event but rarely an incident. Low rated events can be relevant in high numbers or combination with others. Immediate reaction shouldn't be necessary, but a regular review is recommended. + (2) Medium: Relevant event that should be reviewed manually on a more frequent basis. + (3) High: Relevant event that should trigger an internal alert and requires a prompt review. + (4) Critical: Highly relevant event that indicates an incident. Critical events should be reviewed immediately. False Positive Rates: (FP=?) (0) Zero False Positives rate @@ -75,11 +73,10 @@ Other Notes: The Rulename field has a hard limit of 255 characters, make the best of the size available, shorten tags and descriptions as needed. - Add exclusions in line enclosed within a Compound rule rather than a global exclusion list. + Add exclusions in line enclosed within a compound rule rather than a global exclusion list. Contribution Guidelines: - Always submit new rule requests/pull requests in this format where possible, if the rule is highly accurate and should fire off a SIEM Alert replace Desc= with Alert=, - See Risk ratings and levels above for guidance. + Always submit new rule requests/pull requests in this format where possible, if the rule is highly accurate and should fire off a SIEM Alert replace Desc= with Alert=. See Risk ratings and levels above for guidance. Example Rule: @@ -265,7 +262,7 @@ C:\Users\;$Recycle;\Temp\;\Downloads\ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 conhost.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\Msp.Ecosystem.Discovery.exe;TCIntegratorCommHelper.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\Msp.Ecosystem.Discovery.exe;TCIntegratorCommHelper.exe svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe @@ -519,7 +516,7 @@ /create;-create;/change;-change C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe - Sentinel\AutoRepair + Sentinel\AutoRepair Update_Sysmon_Rules @@ -529,7 +526,7 @@ schtasks.exe /Run;-run - Sentinel\AutoRepair + Sentinel\AutoRepair C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ @@ -9633,7 +9630,7 @@ C:\Users\ \Downloads - + .exe .dll .sys @@ -9653,6 +9650,20 @@ + + C:\Users + Appdata + smartgit + + + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe + C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe + Msp.Ecosystem.Discovery.exe + + + C:\ProgramData\Microsoft\Windows Defender\Platform + MsMpEng.exe + From ee20ccd3a9b399255a7e12c25e434ea92a426795 Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Wed, 6 Sep 2023 13:28:03 -0400 Subject: [PATCH 451/471] Added changes from @ionstorm config. --- sysmonconfig-export.xml | 1115 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 1093 insertions(+), 22 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index c29e6938..9016300b 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -262,7 +262,7 @@ C:\Users\;$Recycle;\Temp\;\Downloads\ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 conhost.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\Msp.Ecosystem.Discovery.exe;TCIntegratorCommHelper.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\Msp.Ecosystem.Discovery.exe;TCIntegratorCommHelper.exe;\NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe @@ -518,6 +518,7 @@ C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe Sentinel\AutoRepair Update_Sysmon_Rules + C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe taskeng.exe @@ -532,7 +533,7 @@ schtasks.exe schtasks /TN RtkAudUService64_BG - -change;/change;-delete;/delete;-create;/create;Update_Sysmon_Rules + -change;/change;-delete;/delete;-create;/create;Update_Sysmon_Rules;AMDRyzenMasterSDKTask at.exe @@ -686,6 +687,8 @@ ..\;\.. + C:\Program Files;\Razer\Synapse3\Service\Razer Synapse Service.exe + C:\Program Files;\Razer\;\UserProcess\Razer Synapse Service Process.exe \cmd.exe /c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe /c del "C:\Users\*\Desktop\*.exe;\cmd.exe -c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe -c del "C:\Users\*\Desktop\*.exe @@ -957,9 +960,13 @@ firewall delete + ROGLiveService;C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe + C:\Program Files\ASUS\ROG Live Service\RLSInstallAction.exe firewall add + cmd.exe;ROGLiveService;C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe;enable=yes + C:\Program Files\ASUS\ROG Live Service\RLSInstallAction.exe firewall set opmode disable @@ -1047,6 +1054,7 @@ C:\Users\NetworkService\;C:\Users\NetworkService\;HarddiskVolumeShadowCopy;C:\Users\Default\;C:\Users\Public;C:\Users\Guest\;\administrateur\;C:\Windows\Media\;C:\Windows\addins\;tsclient\;\htdocs\;\config\systemprofile\;C:\PerfLogs\;c:\windows\ServiceProfiles\;C:\Intel\Logs\;C:\Windows\repair\;C:\Windows\Help\;$Recycle;C:\Windows\Debug\;C:\Windows\Security\;C:\Windows\Fonts\;\wwwroot\;\Contacts;C:\Windows\vss\ + C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;\CitrixReceiverUpdater.exe .exe @@ -2473,10 +2481,10 @@ start-bitstransfer - expand \\ + expand;\\ - expand.exe \\ + expand.exe;\\ ieexec http @@ -2494,10 +2502,10 @@ esentutl.exe /y \\;esentutl.exe -y \\ - extrac32 \\ + extrac32;\\ - extrac32.exe \\ + extrac32.exe;\\ @@ -2639,10 +2647,16 @@ erase - -nw -exec= + -nw;-exec= + + + /nw;/exec= + + + -p;-nw - -p -nw + /p;/nw shred @@ -2667,8 +2681,7 @@ fsutil.exe - deletejournal - usn + usn;deletejournal @@ -2678,7 +2691,8 @@ - AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz + AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz + C:\Program Files;\LightingService\AsusInstallVerifier.exe @@ -2937,6 +2951,9 @@ C:\Windows\System32\WerFault.exe C:\Windows\System32\wbem\WmiPrvSE.exe + + C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe + @@ -5124,6 +5141,7 @@ C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git;\Intel\Driver and Support Assistant\DSAService.exe;C:\Program Files (x86)\N-able Technologies\AutomationManagerAgent\;C:\Program Files (x86)\MspPlatform\RequestHandlerAgent\RequestHandlerAgent.exe;C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe;C:\ProgramData\Cavelo\jre\bin\java.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe;C:\Program Files\Cavelo\Cavelo Agent\parser.exe C:\Windows\Microsoft.NET\Framework\;\NGenTask.exe \Intel\Driver and Support Assistant\ + C:\Program Files\AMD\CNext\CNext\Radeonsoftware.exe;C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.UserSessionHelper.exe C:\Windows\Microsoft.NET\Framework\;\ngen.exe @@ -5264,6 +5282,7 @@ C:\Windows\SoftwareDistribution C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch .exe + C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe proj @@ -5299,6 +5318,7 @@ .bin + C:\Windows\System32\WUDFHost.exe C:\Windows\SysWOW64\Wbem @@ -5436,6 +5456,8 @@ !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;=READ=THIS=PLEASE=;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy C:\Users\;\Google\Chrome Beta\User Data\;\IndexedDB\ C:\Program Files\WindowsApps\Microsoft.YourPhone_;C:\Program Files\dotnet\shared\Microsoft.NETCore.App\;\Microsoft.NET\assembly\GAC_MSIL + \System.Security.Cryptography + Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe crackmapexec @@ -5674,6 +5696,7 @@ C:\Users\Public\ + C:\Windows\System32\WUDFHost.exe C:\Windows\Temp\ @@ -5883,6 +5906,7 @@ .bin + C:\Windows\System32\WUDFHost.exe .cab @@ -6732,10 +6756,10 @@ .mht - + \Chrome\User Data\Default\Extensions\ - + .crx @@ -6865,7 +6889,7 @@ Temp\Temp1_ - + \Microsoft\;CLR_v;\UsageLogs\ @@ -7102,11 +7126,16 @@ - + Google\Chrome\Extensions update_url SetValue + + Google\Chrome + extensions.settings + SetValue + ForcePasswordReset @@ -7141,6 +7170,9 @@ SetValue \CurrentVersion\Run\ C:\Program Files\Microsoft OneDrive\Update\OneDriveSetup.exe;\AppData\Local\Microsoft\Teams\current\Teams.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe +
C:\Program Files\Google\Drive File Stream;\GoogleDriveFS.exe;startup_mode
+
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;no-startup-window;win-session-start;prefetch
+
\Application\chrome.exe;no-startup-window;win-session-start;prefetch
 \Microsoft\System\Scripts @@ -7433,7 +7465,7 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\SnapshotCleanupTask\SD HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office ClickToRun Service Monitor\SD HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Automatic Updates 2.0\SD - Microsoft\Windows\UpdateOrchestrator + Microsoft\Windows\UpdateOrchestrator;\AMDInstallLauncher\SD;\SD;ASUS Switch;\PowerToys\Autorun for HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree @@ -7635,6 +7667,7 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled
DWORD (0x00000000)
+ C:\WINDOWS\system32\DrvInst.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ @@ -8302,10 +8335,10 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ @@ -8517,6 +8550,9 @@ Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations + + \Control\hivelist + \Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives\Volume Drive Type @@ -8771,10 +8807,10 @@ Software\recfg - + \Keyboard Layout\Preload\ - + \Keyboard Layout\Substitutes\ @@ -8825,6 +8861,21 @@ C:\Program Files (x86)\ESET C:\Program Files\ESET + + \EnableBHO + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports + + + Control\Print\Environments\Windows x64\Drivers + + + \Microsoft\.NETFramework;NGenAssemblyUsageLog + + + \REGISTRY\A\;LocalState\admin_settings + @@ -8851,7 +8902,7 @@ SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e - Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf + Startup;Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE @@ -9624,13 +9675,18 @@ + C:\Users\ \Downloads - + + C:\Users\ + Content.Outlook + + .exe .dll .sys @@ -9646,6 +9702,1021 @@ .ime .tsp + + powershell.exe;powershell_ise.exe;pwsh.exe;Sqlps.exe + + + cmd.exe;conhost.exe + + + C:\Users\Public\ + C:\Perflogs\ + C:\Windows\Fonts\ + C:\Windows\debug\ + C:\Windows\Tasks\ + C:\Windows\tracing\ + C:\Windows\Help\ + C:\Windows\Logs\ + C:\Windows\System32\spool\SERVERS\ + C:\Windows\System32\spool\PRINTERS\ + C:\Windows\Help\ + C:\Windows\SysWOW64\Tasks + C:\ProgramData\Intel + C:\ProgramData\Mozilla + C:\ProgramData\chocolatey\ + C:\ProgramData\Microsoft\DeviceSync + C:\ProgramData\Microsoft\PlayReady + C:\ProgramData\Microsoft\User Account Pictures + C:\ProgramData\Microsoft\Office\Heartbeat + C:\ProgramData\Microsoft\Windows\WER + C:\Users\All Users\ + C:\Users\;\Music\ + C:\Users\;\Pictures\ + C:\Users\;\Videos\ + C:\Users\;\Contacts\ + + + .7z.exe + .doc.exe + .docm.exe + .docx.exe + .htm.exe + .html.exe + .iso.exe + .lnk.exe + .pdf.exe + .ppt.exe + .pptx.exe + .rar.exe + .rtf.exe + .txt.exe + .xls.exe + .xlsm.exe + .xlsx.exe + .zip.exe + + + \EntenLoader.exe + \SysmonQuiet.exe + \SharpEvtMute.exe + \EvtMuteHook.dll + \SysmonEOP.exe + + + IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 + IMPHASH=3A19059BD7688CB88E70005F18EFC439 + IMPHASH=bf6223a49e45d99094406777eb6004ba + IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 + IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 + IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF + IMPHASH=4C1B52A19748428E51B14C278D0F58E3 + IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F + IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A + IMPHASH=672B13F4A0B6F27D29065123FE882DFC + IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F + IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D + IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 + IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 + IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 + IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 + IMPHASH=D21BBC50DCC169D7B4D0F01962793154 + IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 + IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 + IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC + IMPHASH=F9A28C458284584A93B14216308D31BD + IMPHASH=6118619783FC175BC7EBECFF0769B46E + IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA + IMPHASH=563233BFA169ACC7892451F71AD5850A + IMPHASH=87575CB7A0E0700EB37F2E3668671A08 + IMPHASH=13F08707F759AF6003837A150A371BA1 + IMPHASH=1781F06048A7E58B323F0B9259BE798B + IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 + IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D + IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 + IMPHASH=713C29B396B907ED71A72482759ED757 + IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F + IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E + IMPHASH=8B114550386E31895DFAB371E741123D + IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 + IMPHASH=9D68781980370E00E0BD939EE5E6C141 + IMPHASH=B18A1401FF8F444056D29450FBC0A6CE + IMPHASH=CB567F9498452721D77A451374955F5F + IMPHASH=730073214094CD328547BF1F72289752 + IMPHASH=17B461A082950FC6332228572138B80C + IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 + IMPHASH=819B19D53CA6736448F9325A85736792 + IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E + IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 + IMPHASH=0588081AB0E63BA785938467E1B10CCA + IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C + IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 + IMPHASH=4DA924CF622D039D58BCE71CDF05D242 + IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 + IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF + IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE + IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 + IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 + IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E + IMPHASH=E6F9D5152DA699934B30DAAB206471F6 + IMPHASH=3AD59991CCF1D67339B319B15A41B35D + IMPHASH=FFDD59E0318B85A3E480874D9796D872 + IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 + IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 + IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 + IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 + IMPHASH=0E2216679CA6E1094D63322E3412D650 + IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB + IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 + IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 + IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 + IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F + IMPHASH=767637C23BB42CD5D7397CF58B0BE688 + IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 + IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC + IMPHASH=7D010C6BB6A3726F327F7E239166D127 + IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 + IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F + IMPHASH=5834ED4291BDEB928270428EBBAF7604 + IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 + IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 + IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 + IMPHASH=3DE09703C8E79ED2CA3F01074719906B + IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F + IMPHASH=E96A73C7BF33A464C510EDE582318BF2 + IMPHASH=32089B8851BBF8BC2D014E9F37288C83 + IMPHASH=09D278F9DE118EF09163C6140255C690 + IMPHASH=03866661686829d806989e2fc5a72606 + IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d + IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE + IMPHASH=19584675D94829987952432E018D5056 + IMPHASH=330768A4F172E10ACB6287B87289D83B + IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313 + IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC + IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28 + IMPHASH=96DF3A3731912449521F6F8D183279B1 + IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46 + IMPHASH=51791678F351C03A0EB4E2A7B05C6E17 + IMPHASH=25CE42B079282632708FC846129E98A5 + MD5=7B17F15713FCF13C764535AA2BDF52AA + SHA1=4E18320493042BCD7D21B53E258974BC460ACC78 + SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1 + + + winword.exe + excel.exe + powerpnt.exe + msaccess.exe + mspub.exe + eqnedt32.exe + visio.exe + wordpad.exe + wordview.exe + msohtmed.exe + + + onenote.exe + onenotem.exe + onenoteim.exe + + + + certutil.exe + certoc.exe + CertReq.exe + + Desktopimgdownldr.exe + esentutl.exe + + finger.exe + + notepad.exe + AcroRd32.exe + RdrCEF.exe + calc.exe + mspaint.exe + + + hh.exe + + + control.exe + + + CMSTP.exe + + + installutil.exe + + + mshta.exe + + + msiexec.exe + + + Odbcconf.exe + + + Regsvcs.exe;Regasm.exe + + + regsvr32.exe + + + Rundll32.exe + + + Verclsid.exe + + + mavinject.exe;mavinject64.exe + + + mmc.exe + + + Appvlp.exe;InfDefaultInstall.EXE;PresentationHost.exe;Register-cimprovider.exe;RegisterCimProvider2.exe;RegisterCimProvider.exe;ScriptRunner.exe;appcmd.exe;csi.exe;devtoolslauncher.exe;diskshadow.exe;extexport.exe;jjs.exe;msconfig.EXE;msdt.exe;rasautou.exe;rasdlui.exe;replace.exe;tttracer.exe;wab.exe;wsreset.exe + + + SHA256=7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed + SHA256=0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb + SHA256=0ae8d1dd56a8a000ced74a627052933d2e9bff31d251de185b3c0c5fc94a44db + SHA256=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05 + SHA256=0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d + SHA256=0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917 + SHA256=0bc3685b0b8adc97931b5d31348da235cd7581a67edf6d79913e6a5709866135 + SHA256=0be4912bfd7a79f6ebfa1c06a59f0fb402bd4fe0158265780509edd0e562eac1 + SHA256=0c512b615eac374d4d494e3c36838d8e788b3dc2691bf27916f7f42694b14467 + SHA256=0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c + SHA256=0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c + SHA256=0cf6c6c2d231eaf67dfc87561cc9a56ecef89ab50baafee5a67962748d51faf3 + SHA256=0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f + SHA256=0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c + SHA256=0de4247e72d378713bcf22d5c5d3874d079203bb4364e25f67a90d5570bdcce8 + SHA256=0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b + SHA256=0ebaef662b14410c198395b13347e1d175334ec67919709ad37d65eba013adff + SHA256=0ee5067ce48883701824c5b1ad91695998916a3702cf8086962fbe58af74b2d6 + SHA256=0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8 + SHA256=0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf + SHA256=0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff + SHA256=0fd2df82341bf5ebb8a53682e60d08978100c01acb0bed7b6ce2876ada80f670 + SHA256=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd + SHA256=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece + SHA256=1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5 + SHA256=1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0 + SHA256=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c + SHA256=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b + SHA256=1afa03118f87b62c59a97617e595ebb26dde8dbdd16ee47ef3ddd1097c30ef6a + SHA256=1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e + SHA256=1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa + SHA256=1c8dfa14888bb58848b4792fb1d8a921976a9463be8334cff45cc96f1276049a + SHA256=1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687 + SHA256=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8 + SHA256=1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219 + SHA256=1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe + SHA256=1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee + SHA256=1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961 + SHA256=1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512 + SHA256=1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c + SHA256=1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501 + SHA256=2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486 + SHA256=2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e + SHA256=2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a + SHA256=2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8 + SHA256=2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4 + SHA256=2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30 + SHA256=2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a + SHA256=2b120de80a5462f8395cfb7153c86dfd44f29f0776ea156ec4a34fa64e5c4797 + SHA256=2b186926ed815d87eaf72759a69095a11274f5d13c33b8cc2b8700a1f020be1d + SHA256=2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1 + SHA256=2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250 + SHA256=2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14 + SHA256=2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1 + SHA256=2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b + SHA256=2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d + SHA256=2d195cd4400754cc6f6c3f8ab1fe31627932c3c1bf8d5d0507c292232d1a2396 + SHA256=2da330a2088409efc351118445a824f11edbe51cf3d653b298053785097fe40e + SHA256=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8 + SHA256=2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0 + SHA256=2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e + SHA256=2f60536b25ba8c9014e4a57d7a9a681bd3189fa414eea88c256d029750e15cae + SHA256=2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445 + SHA256=03e0581432f5c8cc727a8aa387f5b69ff84d38d0df6f1226c19c6e960a81e1e9 + SHA256=3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c25 + SHA256=3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0 + SHA256=3a95cc82173032b82a0ffc7d2e438df64c13bc16b4574214c9fe3be37250925e + SHA256=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46 + SHA256=3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b + SHA256=3c5d7069f85ec1d6f58147431f88c4d7c48df73baf94ffdefd664f2606baf09c + SHA256=3c6f9917418e991ed41540d8d882c8ca51d582a82fd01bff6cdf26591454faf5 + SHA256=3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc + SHA256=3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b + SHA256=3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f + SHA256=3cb75429944e60f6c820c7638adbf688883ad44951bca3f8912428afe72bc134 + SHA256=3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3 + SHA256=3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4 + SHA256=3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272 + SHA256=3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf + SHA256=3e9b62d2ea2be50a2da670746c4dbe807db9601980af3a1014bcd72d0248d84c + SHA256=3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75 + SHA256=3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8 + SHA256=3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5 + SHA256=3f9530c94b689f39cc83377d76979d443275012e022782a600dcb5cad4cca6aa + SHA256=3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e + SHA256=3ff50c67d51553c08dcb7c98342f68a0f54ad6658c5346c428bdcd1f185569f6 + SHA256=3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa + SHA256=04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162 + SHA256=4a3d4db86f580b1680d6454baee1c1a139e2dde7d55e972ba7c92ec3f555dce2 + SHA256=4a9093e8dbcb867e1b97a0a67ce99a8511900658f5201c34ffb8035881f2dbbe + SHA256=4ab41816abbf14d59e75b7fad49e2cb1c1feb27a3cb27402297a2a4793ff9da7 + SHA256=4b4c925c3b8285aeeab9b954e8b2a0773b4d2d0e18d07d4a9d268f4be90f6cae + SHA256=4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1 + SHA256=4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4 + SHA256=4cff6e53430b81ecc4fae453e59a0353bcfe73dd5780abfc35f299c16a97998e + SHA256=4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036 + SHA256=4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee + SHA256=4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba + SHA256=4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80 + SHA256=4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69 + SHA256=05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748 + SHA256=5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a + SHA256=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a + SHA256=5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe + SHA256=5b9623da9ba8e5c80c49473f40ffe7ad315dcadffc3230afdc9d9226d60a715a + SHA256=5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c + SHA256=5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921 + SHA256=5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a + SHA256=5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185 + SHA256=5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3 + SHA256=5ee292b605cd3751a24e5949aae615d472a3c72688632c3040dc311055b75a92 + SHA256=5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be + SHA256=5f7e47d728ac3301eb47b409801a0f4726a435f78f1ed02c30d2a926259c71f3 + SHA256=5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683 + SHA256=5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0 + SHA256=5f20541f859f21b3106e12d37182b1ea39bb75ffcfcddb2ece4f6edd42c0bab2 + SHA256=5f487829527802983d5c120e3b99f3cf89333ca14f5e49ac32df0798cfb1f7aa + SHA256=5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36 + SHA256=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50 + SHA256=6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5 + SHA256=6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74 + SHA256=6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63 + SHA256=6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e + SHA256=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44 + SHA256=6c64688444d3e004da77dcfb769d064bb38afceeef7ff915dfc71e60e19ff18a + SHA256=6cb6e23ba516570bbd158c32f7c7c99f19b24ca4437340ecb39253662afe4293 + SHA256=6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc + SHA256=6de84caa2ca18673e01b91af58220c60aecd5cccf269725ec3c7f226b2167492 + SHA256=6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf + SHA256=6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7 + SHA256=6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7 + SHA256=6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38 + SHA256=6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4 + SHA256=6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c + SHA256=6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d + SHA256=6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc + SHA256=07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357 + SHA256=7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf + SHA256=7aaf2aa194b936e48bc90f01ee854768c8383c0be50cfb41b346666aec0cf853 + SHA256=7b0f442ac0bb183906700097d65aed0b4b9d8678f9a01aca864854189fe368e7 + SHA256=7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b + SHA256=7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7 + SHA256=7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21 + SHA256=7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4 + SHA256=7cfa5e10dff8a99a5d544b011f676bc383991274c693e21e3af40cf6982adb8c + SHA256=7d8937c18d6e11a0952e53970a0934cf0e65515637ac24d6ca52ccf4b93d385f + SHA256=7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea + SHA256=7da6113183328d4fddf6937c0c85ef65ba69bfe133b1146193a25bcf6ae1f9dd + SHA256=7dfc2eb033d2e090540860b8853036f40736d02bd22099ff6cf665a90be659cd + SHA256=7e3b0b8d3e430074109d85729201d7c34bc5b918c0bcb9f64ce88c5e37e1a456 + SHA256=7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d + SHA256=7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7 + SHA256=7ec93f34eb323823eb199fbf8d06219086d517d0e8f4b9e348d7afd41ec9fd5d + SHA256=7f5dc63e5742096e4accaca39ae77a2a2142b438c10f97860dee4054b51d3b35 + SHA256=7f190f6e5ab0edafd63391506c2360230af4c2d56c45fc8996a168a1fc12d457 + SHA256=7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa + SHA256=08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6 + SHA256=8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2 + SHA256=8bda0108de82ebeae82f43108046c5feb6f042e312fa0115475a9e32274fae59 + SHA256=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6 + SHA256=8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9 + SHA256=8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f + SHA256=8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775 + SHA256=8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9 + SHA256=8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2 + SHA256=8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126 + SHA256=8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c + SHA256=8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f + SHA256=8ef0ad86500094e8fa3d9e7d53163aa6feef67c09575c169873c494ed66f057f + SHA256=8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00 + SHA256=8f23313adb35782adb0ba97fefbfbb8bbc5fc40ae272e07f6d4629a5305a3fa2 + SHA256=8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a + SHA256=09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184 + SHA256=09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1 + SHA256=9a1d66036b0868bbb1b2823209fedea61a301d5dd245f8e7d390bd31e52d663e + SHA256=9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7 + SHA256=9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba + SHA256=9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c + SHA256=9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c + SHA256=9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194 + SHA256=9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285 + SHA256=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4 + SHA256=9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449 + SHA256=9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2 + SHA256=9d58f640c7295952b71bdcb456cae37213baccdcd3032c1e3aeb54e79081f395 + SHA256=9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4 + SHA256=9ee33ffd80611a13779df6286c1e04d3c151f1e2f65e3d664a08997fcd098ef3 + SHA256=9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5 + SHA256=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33 + SHA256=9f1025601d17945c3a47026814bdec353ee363966e62dba7fe2673da5ce50def + SHA256=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374 + SHA256=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 + SHA256=11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b + SHA256=12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56 + SHA256=14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8 + SHA256=15c53eb3a0ea44bbd2901a45a6ebeae29bb123f9c1115c38dfb2cdbec0642229 + SHA256=15fb486b6b8c2a2f1b067f48fba10c2f164638fe5e6cee618fb84463578ecac9 + SHA256=16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1 + SHA256=18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506 + SHA256=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6 + SHA256=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0 + SHA256=19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775 + SHA256=19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0 + SHA256=20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb + SHA256=21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21 + SHA256=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c + SHA256=23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade + SHA256=025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4 + SHA256=26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097 + SHA256=26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43 + SHA256=26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712 + SHA256=27cd05527feb020084a4a76579c125458571da8843cdfc3733211760a11da970 + SHA256=29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6 + SHA256=29e0062a017a93b2f2f5207a608a96df4d554c5de976bd0276c2590a03bd3e94 + SHA256=30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb + SHA256=31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a + SHA256=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427 + SHA256=31f4140c12ac31f5729a8de4dc051d3acd07783564604df831a2a6722c979192 + SHA256=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351 + SHA256=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993 + SHA256=34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3 + SHA256=34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf + SHA256=36aafa127736c7226c50061ea065f71e14f64ec60321f705bc52686d24117e0d + SHA256=36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb + SHA256=36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289 + SHA256=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9 + SHA256=37dde6bd8a7a36111c3ac57e0ac20bbb93ce3374d0852bcacc9a2c8c8c30079e + SHA256=38b3eb8c86201d26353aab625cea672e60c2f66ce6f5e5eda673e8c3478bf305 + SHA256=38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7 + SHA256=38c18db050b0b2b07f657c03db1c9595febae0319c746c3eede677e21cd238b0 + SHA256=38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20 + SHA256=38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a + SHA256=39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e + SHA256=42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb + SHA256=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f + SHA256=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89 + SHA256=45abdbcd4c0916b7d9faaf1cd08543a3a5178871074628e0126a6eda890d26e0 + SHA256=45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a + SHA256=45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26 + SHA256=45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef + SHA256=47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84 + SHA256=47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005 + SHA256=47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc + SHA256=49ed27460730b62403c1d2e4930573121ab0c86c442854bc0a62415ca445a810 + SHA256=49f75746eebe14e5db11706b3e58accc62d4034d2f1c05c681ecef5d1ad933ba + SHA256=50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793 + SHA256=50db5480d0392a7dd6ab5df98389dc24d1ed1e9c98c9c35964b19dabcd6dc67f + SHA256=51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5 + SHA256=53eaefba7e7dca9ab74e385abf18762f9f1aa51594e7f7db5ba612d6c787dd7e + SHA256=55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9 + SHA256=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a + SHA256=56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7 + SHA256=57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572 + SHA256=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495 + SHA256=58c071cfe72e9ee867bba85cbd0abe72eb223d27978d6f0650d0103553839b59 + SHA256=59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879 + SHA256=60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289 + SHA256=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813 + SHA256=61a1bdddd3c512e681818debb5bee94db701768fc25e674fcad46592a3259bd0 + SHA256=61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf + SHA256=61d6e40601fa368800980801a662a5b3b36e3c23296e8ae1c85726a56ef18cc8 + SHA256=62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0 + SHA256=64f9e664bc6d4b8f5f68616dd50ae819c3e60452efd5e589d6604b9356841b57 + SHA256=65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9 + SHA256=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890 + SHA256=69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2 + SHA256=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009 + SHA256=71ff60722231c7641ad593756108cf6779dbaad21c7b08065fb1d4e225eab14d + SHA256=72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1 + SHA256=72c0d2d699d0440db17cb7cbbc06a253eaafd21465f14bb0fed8b85ae73153d1 + SHA256=074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761 + SHA256=74a846c61adc53692d3040aff4c1916f32987ad72b07fe226e9e7dbeff1036c4 + SHA256=075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85 + SHA256=76b86543ce05540048f954fed37bdda66360c4a3ddb8328213d5aef7a960c184 + SHA256=76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524 + SHA256=76fb4deaee57ef30e56c382c92abffe2cf616d08dbecb3368c8ee6b02e59f303 + SHA256=077aa8ff5e01747723b6d24cc8af460a7a00f30cd3bc80e41cc245ceb8305356 + SHA256=77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9 + SHA256=79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57 + SHA256=79e87b93fbed84ec09261b3a0145c935f7dfe4d4805edfb563b2f971a0d51463 + SHA256=80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085 + SHA256=80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3 + SHA256=80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1 + SHA256=81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0 + SHA256=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d + SHA256=82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989 + SHA256=83f7be0a13c1fccf024c31da5c68c0ea1decf4f48fc39d6e4fd324bbe789ae8a + SHA256=84bf1d0bcdf175cfe8aea2973e0373015793d43907410ae97e2071b2c4b8e2d4 + SHA256=84df20b1d9d87e305c92e5ffae21b10b325609d59d835a954dbd8750ef5dabf4 + SHA256=86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882 + SHA256=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219 + SHA256=88df37ede18bea511f1782c1a6c4915690b29591cf2c1bf5f52201fbbb4fa2b9 + SHA256=88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc + SHA256=89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be + SHA256=89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7 + SHA256=092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0 + SHA256=93b266f38c3c3eaab475d81597abbd7cc07943035068bb6fd670dbbe15de0131 + SHA256=93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63 + SHA256=94be67c319a67de75ebed050d5537cfaa795d72bba52f3d8cf349e7bd075410e + SHA256=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3 + SHA256=97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd + SHA256=98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb + SHA256=98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8 + SHA256=99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1 + SHA256=119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280 + SHA256=131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6 + SHA256=133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743 + SHA256=146d77e80ca70ea5cb17bfc9a5cea92334f809cbdc87a51c2d10b8579a4b9c88 + SHA256=159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980 + SHA256=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347 + SHA256=221dfbc74bbb255b0879360ccc71a74b756b2e0f16e9386b38a9ce9d4e2e34f9 + SHA256=263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24 + SHA256=0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5 + SHA256=316a27e2bdb86222bc7c8af4e5472166b02aec7f3f526901ce939094e5861f6d + SHA256=358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69 + SHA256=362c4f3dadc9c393682664a139d65d80e32caa2a97b6e0361dfd713a73267ecc + SHA256=399effe75d32bdab6fa0a6bffe02dbf0a59219d940b654837c3be1c0bd02e9aa + SHA256=436ccab6f62fa2d29827916e054ade7acae485b3de1d3e5c6c62d3debf1480e7 + SHA256=453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233 + SHA256=455bc98ba32adab8b47d2d89bdbadca4910f91c182ab2fc3211ba07d3784537b + SHA256=0466dac557ee161503f5dfbd3549f81ec760c3d6c7c4363a21a03e7a3f66aca8 + SHA256=475e5016c9c0f5a127896f9179a1b1577a67b357f399ab5a1e68aab07134729a + SHA256=478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0 + SHA256=496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b + SHA256=506f953bbb285aeb8af0549eb24f52f3b7af36afe740afa36735bac70573ce28 + SHA256=523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba + SHA256=525d9b51a80ca0cd4c5889a96f857e73f3a80da1ffbae59851e0f51bdfb0b6cd + SHA256=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9 + SHA256=591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52 + SHA256=592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c + SHA256=600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0 + SHA256=607dc4c75ac7aef82ae0616a453866b3b358c6cf5c8f9d29e4d37f844306b97c + SHA256=626fae47811450d080d08c3d9fd890aa64bfecdc45eacd42a40850c1833c8763 + SHA256=654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad + SHA256=673b63b67345773cd6d66f6adcf2c753e2d949232bff818d5bb6e05786538d92 + SHA256=673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b + SHA256=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf + SHA256=727e8ba66a8ff07bdc778eacb463b65f2d7167a6616ca2f259ea32571cacf8af + SHA256=771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd + SHA256=818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01 + SHA256=823da894b2c73ffcd39e77366b6f1abf0ae9604d9b20140a54e6d55053aadeba + SHA256=845f1e228de249fc1ddf8dc28c39d03e8ad328a6277b6502d3932e83b879a65a + SHA256=862d0ff27bb086145a33b9261142838651b0d2e1403be321145e197600eb5015 + SHA256=881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461 + SHA256=900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88 + SHA256=904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a + SHA256=909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880 + SHA256=910aa4685c735d8c07662aa04fafec463185699ad1a0cd1967b892fc33ec6c3c + SHA256=916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677 + SHA256=923ebbe8111e73d5b8ecc2db10f8ea2629a3264c3a535d01c3c118a3b4c91782 + SHA256=927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a + SHA256=950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9 + SHA256=955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad + SHA256=984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7 + SHA256=1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4 + SHA256=1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c + SHA256=1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1 + SHA256=1766fd66f846d9a21e648d649ad35d1ff94f8ca17a40a9a738444d6b8e07aacb + SHA256=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52 + SHA256=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d + SHA256=2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22 + SHA256=2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109 + SHA256=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6 + SHA256=2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f + SHA256=2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2 + SHA256=3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5 + SHA256=3243aab18e273a9b9c4280a57aecef278e10bfff19abb260d7a7820e41739099 + SHA256=3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5 + SHA256=3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de + SHA256=3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a + SHA256=3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b + SHA256=3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3 + SHA256=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838 + SHA256=4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca + SHA256=4324f3d1e4007f6499a3d0f0102cd92ed9f554332bc0b633305cd7b957ff16c8 + SHA256=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b + SHA256=4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6 + SHA256=4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8 + SHA256=4941c4298f4560fc1e59d0f16f84bab5c060793700b82be2fd7c63735f1657a8 + SHA256=5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48 + SHA256=5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02 + SHA256=5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b + SHA256=5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c + SHA256=6071db01b50c658cf78665c24f1d21f21b4a12d16bfcfaa6813bf6bbc4d0a1e8 + SHA256=6191c20426dd9b131122fb97e45be64a4d6ce98cc583406f38473434636ddedc + SHA256=06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf + SHA256=7049f3c939efe76a5556c2a2c04386db51daf61d56b679f4868bb0983c996ebb + SHA256=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129 + SHA256=7236c8ff33c0e5cfa956778aa7303f1979f3bf709c361399fa1ce101b7e355b8 + SHA256=7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408 + SHA256=7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca + SHA256=8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60 + SHA256=8399e5afd8e3e97139dffb1a9fb00db2186321b427f164403282217cab067c38 + SHA256=8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b + SHA256=8797d9afc7a6bb0933f100a8acbb5d0666ec691779d522ac66c66817155b1c0d + SHA256=09043c51719d4bf6405c9a7a292bb9bb3bcc782f639b708ddcc4eedb5e5c9ce9 + SHA256=9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b + SHA256=9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6 + SHA256=9790a7b9d624b2b18768bb655dda4a05a9929633cef0b1521e79e40d7de0a05b + SHA256=17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca + SHA256=17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229 + SHA256=18712a063574bfec315d58577dfe413ab45b650e54747d1e18a56c3c7337a12c + SHA256=19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758 + SHA256=26453afb1f808f64bec87a2532a9361b696c0ed501d6b973a1f1b5ae152a4d40 + SHA256=28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7 + SHA256=30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab + SHA256=37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba + SHA256=40061b30b1243be76d5283cbc8abfe007e148097d4de7337670ff1536c4c7ba1 + SHA256=42579a759f3f95f20a2c51d5ac2047a2662a2675b3fb9f46c1ed7f23393a0f00 + SHA256=42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0 + SHA256=49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668 + SHA256=54841d9f89e195196e65aa881834804fe3678f1cf6b328cab8703edd15e3ec57 + SHA256=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347 + SHA256=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd + SHA256=67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc + SHA256=70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4 + SHA256=72288d4978ee87ea6c8b1566dbd906107357087cef7364fb3dd1e1896d00baeb + SHA256=72322fa8bba20df6966acbcf41e83747893fd173cd29de99b5ad1a5d3bf8f2de + SHA256=76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a + SHA256=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22 + SHA256=77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c + SHA256=78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f + SHA256=81939e5c12bd627ff268e9887d6fb57e95e6049f28921f3437898757e7f21469 + SHA256=85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94 + SHA256=86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675 + SHA256=89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10 + SHA256=092349aebdac28294dbad1656759d8461f362d1a36b01054dccf861d97beadf0 + SHA256=94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5 + SHA256=101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558 + SHA256=238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4 + SHA256=258359a7fa3d975620c9810dab3a6493972876a024135feaf3ac8482179b2e79 + SHA256=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073 + SHA256=385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039 + SHA256=405472a8f9400a54bb29d03b436ccd58cfd6442fe686f6d2ed4f63f002854659 + SHA256=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c + SHA256=509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6 + SHA256=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91 + SHA256=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b + SHA256=708016fbe22c813a251098f8f992b177b476bd1bbc48c2ed4a122ff74910a965 + SHA256=771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c + SHA256=810513b3f4c8d29afb46f71816350088caacf46f1be361af55b26f3fee4662c3 + SHA256=841335eeb6af68dce5b8b24151776281a751b95056a894991b23afae80e9f33b + SHA256=0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06 + SHA256=952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4 + SHA256=2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c + SHA256=3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf + SHA256=3390919bb28d5c36cc348f9ef23be5fa49bfd81263eb7740826e4437cbe904cd + SHA256=4422851a0a102f654e95d3b79c357ae3af1b096d7d1576663c027cfbc04abaf9 + SHA256=7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d + SHA256=7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c + SHA256=7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504 + SHA256=8939116df1d6c8fd0ebd14b2d37b3dec38a8820aa666ecd487bc1bb794f2a587 + SHA256=9778136d2441439dc470861d15d96fa21dc9f16225232cd05b76791a5e0fde6f + SHA256=16768203a471a19ebb541c942f45716e9f432985abbfbe6b4b7d61a798cea354 + SHA256=18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805 + SHA256=22418016e980e0a4a2d01ca210a17059916a4208352c1018b0079ccb19aaf86a + SHA256=36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10 + SHA256=36875562e747136313ec5db58174e5fab870997a054ca8d3987d181599c7db6a + SHA256=0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3 + SHA256=55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa + SHA256=65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3 + SHA256=65025741ecd0ef516da01319b42c2d96e13cb8d78de53fb7e39cd53ea6d58c75 + SHA256=91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c + SHA256=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82 + SHA256=696679114f6a106ec94c21e2a33fe17af86368bcf9a796aaea37ea6e8748ad6a + SHA256=910479467ef17b9591d8d42305e7f6f247ad41c60ec890a1ffbe331f495ed135 + SHA256=8111085022bda87e5f6aa4c195e743cc6dd6a3a6d41add475d267dc6b105a69f + SHA256=9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d + SHA256=46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7 + SHA256=48891874441c6fa69e5518d98c53d83b723573e280c6c65ccfbde9039a6458c9 + SHA256=6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa + SHA256=a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1 + SHA256=a3e507e713f11901017fc328186ae98e23de7cea5594687480229f77d45848d8 + SHA256=a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad + SHA256=a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062 + SHA256=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc + SHA256=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200 + SHA256=a56c2a2425eb3a4260cc7fc5c8d7bed7a3b4cd2af256185f24471c668853aee8 + SHA256=a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df + SHA256=a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d + SHA256=a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5 + SHA256=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3 + SHA256=a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e + SHA256=a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499 + SHA256=a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9 + SHA256=a7860e110f7a292d621006b7208a634504fb5be417fd71e219060381b9a891e6 + SHA256=a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e + SHA256=a9706e320179993dade519a83061477ace195daa1b788662825484813001f526 + SHA256=a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433 + SHA256=a2353030d4ea3ad9e874a0f7ff35bbfa10562c98c949d88cabab27102bbb8e48 + SHA256=a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4 + SHA256=aa9ab1195dc866270e984f1bed5e1358d6ef24c515dfdb6c2a92d1e1b94bf608 + SHA256=aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c + SHA256=aafb95a443911e4c67d4e45ffa83cca103c91b42915b81100534dc439bec0c1b + SHA256=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89 + SHA256=ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd + SHA256=ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a + SHA256=ac3f613d457fc4d44fa27b2e0b1baa62c09415705efb5a40a4756da39b3ac165 + SHA256=ac63c26ca43701dddaa7fb1aea535d42190f88752900a03040fd5aaa24991e25 + SHA256=ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833 + SHA256=ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b + SHA256=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173 + SHA256=ad2477632b9b07588cfe0e692f244c05fa4202975c1fe91dd3b90fa911ac6058 + SHA256=ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47 + SHA256=adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee + SHA256=ae6fb53e4d8122dba3a65e5fa59185b36c3ac9df46e82fcfb6731ab55c6395aa + SHA256=ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471 + SHA256=ae79e760c739d6214c1e314728a78a6cb6060cce206fde2440a69735d639a0a2 + SHA256=aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399 + SHA256=af095de15a16255ca1b2c27dad365dff9ac32d2a75e8e288f5a1307680781685 + SHA256=af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a + SHA256=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508 + SHA256=b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414 + SHA256=b2ba6efeff1860614b150916a77c9278f19d51e459e67a069ccd15f985cbc0e1 + SHA256=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29 + SHA256=b4d47ea790920a4531e3df5a4b4b0721b7fea6b49a35679f0652f1e590422602 + SHA256=b6fd51e1f57a03006953e84fd56cc2821cc19e7c77c0474e1110aabaacaf03df + SHA256=b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d + SHA256=b8b94c2646b62f6ac08f16514b6efaa9866aa3c581e4c0435a7aeafe569b2418 + SHA256=b9a4e40a5d80fedd1037eaed958f9f9efed41eb01ada73d51b5dcd86e27e0cbf + SHA256=b9b3878ddc5dfb237d38f8d25067267870afd67d12a330397a8853209c4d889c + SHA256=b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a + SHA256=b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b + SHA256=b47be212352d407d0ef7458a7161c66b47c2aec8391dd101df11e65728337a6a + SHA256=b48a309ee0960da3caaaaf1e794e8c409993aeb3a2b64809f36b97aac8a1e62a + SHA256=b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e + SHA256=b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5 + SHA256=b95b2d9b29bd25659f1c7ba5a187f8d23cde01162d9b5b1a2c4aea8f64b38441 + SHA256=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de + SHA256=b1334a71cc73b3d0c54f62d8011bec330dfc355a239bf94a121f6e4c86a30a2e + SHA256=b1867d13a4cab66a76f4d4448824ca0cb3a176064626f9618c0c103ee3cb4f47 + SHA256=b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0 + SHA256=b61869b7945be062630f1dd4bae919aecee8927f7e1bc3954a21ff763f4c0867 + SHA256=b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704 + SHA256=b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3 + SHA256=bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa + SHA256=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc + SHA256=bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955 + SHA256=bb68552936a6b0a68fb53ce864a6387d2698332aac10a7adfdd5a48b97027ce3 + SHA256=bc7ebd191e0991fd0865a5c956a92e63792a0bb2ff888af43f7a63bb65a22248 + SHA256=bc13adeb6bf62b1e10ef41205ef92382e6c18d6a20669d288a0b11058e533d63 + SHA256=bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f + SHA256=bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f + SHA256=bda99629ec6c522c3efcbcc9ca33688d31903146f05b37d0d3b43db81bfb3961 + SHA256=bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c + SHA256=bdcacee3695583a0ca38b9a786b9f7334bf2a9a3387e4069c8e6ca378b2791d0 + SHA256=be03e9541f56ac6ed1e81407dcd7cc85c0ffc538c3c2c2c8a9c747edbcf13100 + SHA256=be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2 + SHA256=be54f7279e69fb7651f98e91d24069dbc7c4c67e65850e486622ccbdc44d9a57 + SHA256=c1c4310e5d467d24e864177bdbfc57cb5d29aac697481bfa9c11ddbeebfd4cc8 + SHA256=c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8 + SHA256=c2fcc0fec64d5647813b84b9049d430406c4c6a7b9f8b725da21bcae2ff12247 + SHA256=c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e + SHA256=c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9 + SHA256=c9b49b52b493b53cd49c12c3fa9553e57c5394555b64e32d1208f5b96a5b8c6e + SHA256=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8 + SHA256=c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924 + SHA256=c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26 + SHA256=c60fcff9c8e5243bbb22ec94618b9dcb02c59bb49b90c04d7d6ab3ebbd58dc3a + SHA256=c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc + SHA256=c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa + SHA256=c344e92a6d06155a217a9af7b4b35e6653665eec6569292e7b2e70f3a3027646 + SHA256=c470c9db58840149ce002f3e6003382ecf740884a683bae8f9d10831be218fa2 + SHA256=c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2 + SHA256=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5 + SHA256=c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada + SHA256=c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c + SHA256=c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d + SHA256=c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c + SHA256=c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd + SHA256=caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab + SHA256=cb57f3a7fe9e1f8e63332c563b0a319b26c944be839eabc03e9a3277756ba612 + SHA256=cb9890d4e303a4c03095d7bc176c42dee1b47d8aa58e2f442ec1514c8f9e3cec + SHA256=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6 + SHA256=cc383ad11e9d06047a1558ed343f389492da3ac2b84b71462aee502a2fa616c8 + SHA256=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64 + SHA256=cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b + SHA256=cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb + SHA256=cdd2a4575a46bada4837a6153a79c14d60ee3129830717ef09e0e3efd9d00812 + SHA256=cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc + SHA256=ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2 + SHA256=cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986 + SHA256=cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b + SHA256=cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190 + SHA256=cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb + SHA256=cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40 + SHA256=cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b + SHA256=cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab + SHA256=cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c + SHA256=d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889 + SHA256=d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605 + SHA256=d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f + SHA256=d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9 + SHA256=d7bc7306cb489fe4c285bbeddc6d1a09e814ef55cf30bd5b8daf87a52396f102 + SHA256=d7ddf874304556f8a10942a29b3d387cb5155a7419f87813557fe728cb14806d + SHA256=d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0 + SHA256=d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530 + SHA256=d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482 + SHA256=d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2 + SHA256=d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f + SHA256=d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3 + SHA256=d5562fb90b0b3deb633ab335bcbd82ce10953466a428b3f27cb5b226b453eaf3 + SHA256=d5586dc1e61796a9ae5e5d1ced397874753056c3df2eb963a8916287e1929a71 + SHA256=d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476 + SHA256=d8459f7d707c635e2c04d6d6d47b63f73ba3f6629702c7a6e0df0462f6478ae2 + SHA256=d25904fbf907e19f366d54962ff543d9f53b8fdfd2416c8b9796b6a8dd430e26 + SHA256=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e + SHA256=d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d + SHA256=d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1 + SHA256=da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24 + SHA256=da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d + SHA256=db2a9247177e8cdd50fe9433d066b86ffd2a84301aa6b2eb60f361cfff077004 + SHA256=db90e554ad249c2bd888282ecf7d8da4d1538dd364129a3327b54f8242dd5653 + SHA256=dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98 + SHA256=dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed + SHA256=dbe9f17313e1164f06401234b875fbc7f71d41dc7271de643865af1358841fef + SHA256=dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258 + SHA256=dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097 + SHA256=dd573f23d656818036fc9ae1064eda31aca86acb9bc44a6e127db3ea112a9094 + SHA256=dde6f28b3f7f2abbee59d4864435108791631e9cb4cdfb1f178e5aa9859956d8 + SHA256=de6bf572d39e2611773e7a01f0388f84fb25da6cba2f1f8b9b36ffba467de6fa + SHA256=de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c + SHA256=de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5 + SHA256=dec8a933dba04463ed9bb7d53338ff87f2c23cfb79e0e988449fc631252c9dcc + SHA256=ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d + SHA256=deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578 + SHA256=df0cc4e5c9802f8edaefeb130e375cad56b2c5490d8ebd77d8dbdcc6fdc7ecb6 + SHA256=df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15 + SHA256=dfaefd06b680f9ea837e7815fc1cc7d1f4cc375641ac850667ab20739f46ad22 + SHA256=e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b + SHA256=e2d8dd5dacc24051709f55a35184f5f99aef957a83bd358b0608b4479e1ec24f + SHA256=e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6 + SHA256=e3b257357be41a18319332df7023c4407e2b93ac4c9e0c6754032e29f3763eac + SHA256=e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918 + SHA256=e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd + SHA256=e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb + SHA256=e4c154a0073bbad3c9f8ab7218e9b3be252ae705c20c568861dae4088f17ffcc + SHA256=e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036 + SHA256=e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148 + SHA256=e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1 + SHA256=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53 + SHA256=e5b0772be02e2bc807804874cf669e97aa36f5aff1f12fa0a631a3c7b4dd0dc8 + SHA256=e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f + SHA256=e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48 + SHA256=e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f + SHA256=e50b25d94c1771937b2f632e10eea875ac6b19c57da703d52e23ad2b6299f0ae + SHA256=e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90 + SHA256=e61a54f6d3869b43c4eceac3016df73df67cce03878c5a6167166601c5d3f028 + SHA256=e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a + SHA256=e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4 + SHA256=e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f + SHA256=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf + SHA256=e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2 + SHA256=e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9 + SHA256=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf + SHA256=e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa + SHA256=e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06 + SHA256=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790 + SHA256=e81230217988f3e7ec6f89a06d231ec66039bdba340fd8ebb2bbb586506e3293 + SHA256=ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3 + SHA256=ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41 + SHA256=ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3 + SHA256=ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5 + SHA256=ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566 + SHA256=ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c + SHA256=ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282 + SHA256=ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39 + SHA256=ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7 + SHA256=ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe + SHA256=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b + SHA256=ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850 + SHA256=ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0 + SHA256=f1c8ca232789c2f11a511c8cd95a9f3830dd719cad5aa22cb7c3539ab8cb4dc3 + SHA256=f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b + SHA256=f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe + SHA256=f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f + SHA256=f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1 + SHA256=f37d609ea1f06660d970415dd3916c4c153bb5940bf7d2beb47fa34e8a8ffbfc + SHA256=f51bdb0ad924178131c21e39a8ccd191e46b5512b0f2e1cc8486f63e84e5d960 + SHA256=f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c + SHA256=f84f8173242b95f9f3c4fea99b5555b33f9ce37ca8188b643871d261cb081496 + SHA256=f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004 + SHA256=f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439 + SHA256=f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d + SHA256=f88ebb633406a086d9cca6bc8b66a4ea940c5476529f9033a9e0463512a23a57 + SHA256=f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af + SHA256=f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960 + SHA256=f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008 + SHA256=f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145 + SHA256=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65 + SHA256=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35 + SHA256=f8886a9c759e0426e08d55e410b02c5b05af3c287b15970175e4874316ffaf13 + SHA256=f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b + SHA256=f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478 + SHA256=f85784fa8e7a7ec86cb3fe76435802f6bb82256e1824ed7b5d61bf075f054573 + SHA256=f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54 + SHA256=f9895458e73d4b0ef01eda347fb695bb00e6598d9f5e2506161b70ad96bb7298 + SHA256=f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b + SHA256=fa875178ae2d7604d027510b0d0a7e2d9d675e10a4c9dda2d927ee891e0bcb91 + SHA256=fafa1bb36f0ac34b762a10e9f327dcab2152a6d0b16a19697362d49a31e7f566 + SHA256=fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22 + SHA256=fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f + SHA256=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2 + SHA256=fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c + SHA256=fcdfe570e6dc6e768ef75138033d9961f78045adca53beb6fdb520f6417e0df1 + SHA256=fd33fb2735cc5ef466a54807d3436622407287e325276fcd3ed1290c98bd0533 + SHA256=fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c + SHA256=fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03 + SHA256=fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280 + SHA256=ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7 + SHA256=ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339 + SHA256=ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5 + SHA256=ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f + + + SHA256=56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c + SHA256=06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4 + SHA256=86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62 + SHA256=06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f + SHA256=8dafe5f3d0527b66f6857559e3c81872699003e0f2ffda9202a1b5e29db2002e + SHA256=81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1 + SHA256=6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724 + SHA256=ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620 + SHA256=0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc + SHA256=c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c + SHA256=e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d + SHA256=18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7 + SHA256=139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988 + SHA256=b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427 + SHA256=1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e + SHA256=6b5cf41512255237064e9274ca8f8a3fef820c45aa6067c9c6a0e6f5751a0421 + SHA256=0d10c4b2f56364b475b60bd2933273c8b1ed2176353e59e65f968c61e93b7d99 + SHA256=ad938d15ecfd70083c474e1642a88b078c3cea02cdbddf66d4fb1c01b9b29d9a + SHA256=89698cad598a56f9e45efffd15d1841e494a2409cc12279150a03842cd6bb7f3 + SHA256=5f6fec8f7890d032461b127332759c88a1b7360aa10c6bd38482572f59d2ba8b + SHA256=fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5 + SHA256=05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4 + SHA256=6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77 + SHA256=6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f + SHA256=32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d + SHA256=fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8 + SHA256=6839fcae985774427c65fe38e773aa96ec451a412caa5354ad9e2b9b54ffe6c1 + SHA256=f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a + SHA256=7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376 + SHA256=96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc + SHA256=b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3 + SHA256=e6a7b0bc01a627a7d0ffb07faddb3a4dd96b6f5208ac26107bdaeb3ab1ec8217 + SHA256=200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a + SHA256=8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce + SHA256=c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497 + SHA256=23e89fd30a1c7db37f3ea81b779ce9acf8a4294397cbb54cff350d54afcfd931 + SHA256=575e58b62afab094c20c296604dc3b7dd2e1a50f5978d8ee24b7dca028e97316 + SHA256=5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d + SHA256=e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12 + SHA256=9bb09752cf3a464455422909edef518ac18fe63cf5e1e8d9d6c2e68db62e0c87 + SHA256=f8236fc01d4efaa48f032e301be2ebba4036b2cd945982a29046eca03944d2ae + SHA256=e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e + SHA256=9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c + SHA256=f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280 + SHA256=9c2f3e9811f7d0c7463eaa1ee6f39c23f902f3797b80891590b43bbe0fdf0e51 + SHA256=b8807e365be2813b7eccd2e4c49afb0d1e131086715638b7a6307cd7d7e9556c + SHA256=50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76 + SHA256=52d5c35325ce701516f8b04380c9fbdb78ec6bcc13b444f758fdb03d545b0677 + SHA256=7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6 + SHA256=8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104 + SHA256=8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330 + SHA256=4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4 + SHA256=88076e98d45ed3adf0c5355411fe8ca793eb7cec1a1c61f5e1ec337eae267463 + SHA256=749b0e8c8c8b7dda8c2063c708047cfe95afa0a4d86886b31a12f3018396e67c + SHA256=49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530 + SHA256=d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c + SHA256=f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d + SHA256=5c1585b1a1c956c7755429544f3596515dfdf928373620c51b0606a520c6245a + SHA256=5bc3994612624da168750455b363f2964e1861dba4f1c305df01b970ac02a7ae + SHA256=bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df + SHA256=42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25 + SHA256=f461414a2596555cece5cfee65a3c22648db0082ca211f6238af8230e41b3212 + SHA256=770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a + From ca6f0aa641b7a2d9fe6f05380da675a2308a7b8e Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Wed, 6 Sep 2023 13:28:49 -0400 Subject: [PATCH 452/471] Update sysmonconfig-export.xml --- sysmonconfig-export.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 9016300b..1cbb31f5 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -10738,4 +10738,4 @@ - \ No newline at end of file + From 5316d5dd52a90987887fb1b67c6707409cacebbf Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Thu, 7 Sep 2023 08:57:46 -0400 Subject: [PATCH 453/471] Revert "Added changes from @ion-storm config." This reverts commit ee20ccd3a9b399255a7e12c25e434ea92a426795. --- sysmonconfig-export.xml | 1115 +-------------------------------------- 1 file changed, 22 insertions(+), 1093 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 1cbb31f5..58259a75 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -262,7 +262,7 @@ C:\Users\;$Recycle;\Temp\;\Downloads\ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 conhost.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\Msp.Ecosystem.Discovery.exe;TCIntegratorCommHelper.exe;\NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\Msp.Ecosystem.Discovery.exe;TCIntegratorCommHelper.exe svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe @@ -518,7 +518,6 @@ C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe Sentinel\AutoRepair Update_Sysmon_Rules - C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe taskeng.exe @@ -533,7 +532,7 @@ schtasks.exe schtasks /TN RtkAudUService64_BG - -change;/change;-delete;/delete;-create;/create;Update_Sysmon_Rules;AMDRyzenMasterSDKTask + -change;/change;-delete;/delete;-create;/create;Update_Sysmon_Rules at.exe @@ -687,8 +686,6 @@ ..\;\.. - C:\Program Files;\Razer\Synapse3\Service\Razer Synapse Service.exe - C:\Program Files;\Razer\;\UserProcess\Razer Synapse Service Process.exe \cmd.exe /c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe /c del "C:\Users\*\Desktop\*.exe;\cmd.exe -c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe -c del "C:\Users\*\Desktop\*.exe @@ -960,13 +957,9 @@ firewall delete - ROGLiveService;C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe - C:\Program Files\ASUS\ROG Live Service\RLSInstallAction.exe firewall add - cmd.exe;ROGLiveService;C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe;enable=yes - C:\Program Files\ASUS\ROG Live Service\RLSInstallAction.exe firewall set opmode disable @@ -1054,7 +1047,6 @@ C:\Users\NetworkService\;C:\Users\NetworkService\;HarddiskVolumeShadowCopy;C:\Users\Default\;C:\Users\Public;C:\Users\Guest\;\administrateur\;C:\Windows\Media\;C:\Windows\addins\;tsclient\;\htdocs\;\config\systemprofile\;C:\PerfLogs\;c:\windows\ServiceProfiles\;C:\Intel\Logs\;C:\Windows\repair\;C:\Windows\Help\;$Recycle;C:\Windows\Debug\;C:\Windows\Security\;C:\Windows\Fonts\;\wwwroot\;\Contacts;C:\Windows\vss\ - C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;\CitrixReceiverUpdater.exe .exe @@ -2481,10 +2473,10 @@ start-bitstransfer - expand;\\ + expand \\ - expand.exe;\\ + expand.exe \\ ieexec http @@ -2502,10 +2494,10 @@ esentutl.exe /y \\;esentutl.exe -y \\ - extrac32;\\ + extrac32 \\ - extrac32.exe;\\ + extrac32.exe \\ @@ -2647,16 +2639,10 @@ erase - -nw;-exec= - - - /nw;/exec= - - - -p;-nw + -nw -exec= - /p;/nw + -p -nw shred @@ -2681,7 +2667,8 @@ fsutil.exe - usn;deletejournal + deletejournal + usn @@ -2691,8 +2678,7 @@ - AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz - C:\Program Files;\LightingService\AsusInstallVerifier.exe + AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz @@ -2951,9 +2937,6 @@ C:\Windows\System32\WerFault.exe C:\Windows\System32\wbem\WmiPrvSE.exe - - C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe - @@ -5141,7 +5124,6 @@ C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git;\Intel\Driver and Support Assistant\DSAService.exe;C:\Program Files (x86)\N-able Technologies\AutomationManagerAgent\;C:\Program Files (x86)\MspPlatform\RequestHandlerAgent\RequestHandlerAgent.exe;C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe;C:\ProgramData\Cavelo\jre\bin\java.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe;C:\Program Files\Cavelo\Cavelo Agent\parser.exe C:\Windows\Microsoft.NET\Framework\;\NGenTask.exe \Intel\Driver and Support Assistant\ - C:\Program Files\AMD\CNext\CNext\Radeonsoftware.exe;C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.UserSessionHelper.exe C:\Windows\Microsoft.NET\Framework\;\ngen.exe @@ -5282,7 +5264,6 @@ C:\Windows\SoftwareDistribution C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch .exe - C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe proj @@ -5318,7 +5299,6 @@ .bin - C:\Windows\System32\WUDFHost.exe C:\Windows\SysWOW64\Wbem @@ -5456,8 +5436,6 @@ !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;=READ=THIS=PLEASE=;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy C:\Users\;\Google\Chrome Beta\User Data\;\IndexedDB\ C:\Program Files\WindowsApps\Microsoft.YourPhone_;C:\Program Files\dotnet\shared\Microsoft.NETCore.App\;\Microsoft.NET\assembly\GAC_MSIL - \System.Security.Cryptography - Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe crackmapexec @@ -5696,7 +5674,6 @@ C:\Users\Public\ - C:\Windows\System32\WUDFHost.exe C:\Windows\Temp\ @@ -5906,7 +5883,6 @@ .bin - C:\Windows\System32\WUDFHost.exe .cab @@ -6756,10 +6732,10 @@ .mht - + \Chrome\User Data\Default\Extensions\ - + .crx @@ -6889,7 +6865,7 @@ Temp\Temp1_ - + \Microsoft\;CLR_v;\UsageLogs\ @@ -7126,16 +7102,11 @@ - + Google\Chrome\Extensions update_url SetValue - - Google\Chrome - extensions.settings - SetValue - ForcePasswordReset @@ -7170,9 +7141,6 @@ SetValue \CurrentVersion\Run\ C:\Program Files\Microsoft OneDrive\Update\OneDriveSetup.exe;\AppData\Local\Microsoft\Teams\current\Teams.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe -
C:\Program Files\Google\Drive File Stream;\GoogleDriveFS.exe;startup_mode
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;no-startup-window;win-session-start;prefetch
-
\Application\chrome.exe;no-startup-window;win-session-start;prefetch
 \Microsoft\System\Scripts @@ -7465,7 +7433,7 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\SnapshotCleanupTask\SD HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office ClickToRun Service Monitor\SD HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Automatic Updates 2.0\SD - Microsoft\Windows\UpdateOrchestrator;\AMDInstallLauncher\SD;\SD;ASUS Switch;\PowerToys\Autorun for + Microsoft\Windows\UpdateOrchestrator HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree @@ -7667,7 +7635,6 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled
DWORD (0x00000000)
- C:\WINDOWS\system32\DrvInst.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ @@ -8335,10 +8302,10 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ @@ -8550,9 +8517,6 @@ Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations - - \Control\hivelist - \Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives\Volume Drive Type @@ -8807,10 +8771,10 @@ Software\recfg - + \Keyboard Layout\Preload\ - + \Keyboard Layout\Substitutes\ @@ -8861,21 +8825,6 @@ C:\Program Files (x86)\ESET C:\Program Files\ESET - - \EnableBHO - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports - - - Control\Print\Environments\Windows x64\Drivers - - - \Microsoft\.NETFramework;NGenAssemblyUsageLog - - - \REGISTRY\A\;LocalState\admin_settings - @@ -8902,7 +8851,7 @@ SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e - Startup;Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf + Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE @@ -9675,18 +9624,13 @@ - C:\Users\ \Downloads - - C:\Users\ - Content.Outlook - - + .exe .dll .sys @@ -9702,1021 +9646,6 @@ .ime .tsp - - powershell.exe;powershell_ise.exe;pwsh.exe;Sqlps.exe - - - cmd.exe;conhost.exe - - - C:\Users\Public\ - C:\Perflogs\ - C:\Windows\Fonts\ - C:\Windows\debug\ - C:\Windows\Tasks\ - C:\Windows\tracing\ - C:\Windows\Help\ - C:\Windows\Logs\ - C:\Windows\System32\spool\SERVERS\ - C:\Windows\System32\spool\PRINTERS\ - C:\Windows\Help\ - C:\Windows\SysWOW64\Tasks - C:\ProgramData\Intel - C:\ProgramData\Mozilla - C:\ProgramData\chocolatey\ - C:\ProgramData\Microsoft\DeviceSync - C:\ProgramData\Microsoft\PlayReady - C:\ProgramData\Microsoft\User Account Pictures - C:\ProgramData\Microsoft\Office\Heartbeat - C:\ProgramData\Microsoft\Windows\WER - C:\Users\All Users\ - C:\Users\;\Music\ - C:\Users\;\Pictures\ - C:\Users\;\Videos\ - C:\Users\;\Contacts\ - - - .7z.exe - .doc.exe - .docm.exe - .docx.exe - .htm.exe - .html.exe - .iso.exe - .lnk.exe - .pdf.exe - .ppt.exe - .pptx.exe - .rar.exe - .rtf.exe - .txt.exe - .xls.exe - .xlsm.exe - .xlsx.exe - .zip.exe - - - \EntenLoader.exe - \SysmonQuiet.exe - \SharpEvtMute.exe - \EvtMuteHook.dll - \SysmonEOP.exe - - - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 - IMPHASH=3A19059BD7688CB88E70005F18EFC439 - IMPHASH=bf6223a49e45d99094406777eb6004ba - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF - IMPHASH=4C1B52A19748428E51B14C278D0F58E3 - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A - IMPHASH=672B13F4A0B6F27D29065123FE882DFC - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 - IMPHASH=D21BBC50DCC169D7B4D0F01962793154 - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC - IMPHASH=F9A28C458284584A93B14216308D31BD - IMPHASH=6118619783FC175BC7EBECFF0769B46E - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA - IMPHASH=563233BFA169ACC7892451F71AD5850A - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 - IMPHASH=13F08707F759AF6003837A150A371BA1 - IMPHASH=1781F06048A7E58B323F0B9259BE798B - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 - IMPHASH=713C29B396B907ED71A72482759ED757 - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E - IMPHASH=8B114550386E31895DFAB371E741123D - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 - IMPHASH=9D68781980370E00E0BD939EE5E6C141 - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE - IMPHASH=CB567F9498452721D77A451374955F5F - IMPHASH=730073214094CD328547BF1F72289752 - IMPHASH=17B461A082950FC6332228572138B80C - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 - IMPHASH=819B19D53CA6736448F9325A85736792 - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 - IMPHASH=0588081AB0E63BA785938467E1B10CCA - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 - IMPHASH=4DA924CF622D039D58BCE71CDF05D242 - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E - IMPHASH=E6F9D5152DA699934B30DAAB206471F6 - IMPHASH=3AD59991CCF1D67339B319B15A41B35D - IMPHASH=FFDD59E0318B85A3E480874D9796D872 - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 - IMPHASH=0E2216679CA6E1094D63322E3412D650 - IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB - IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 - IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 - IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 - IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F - IMPHASH=767637C23BB42CD5D7397CF58B0BE688 - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC - IMPHASH=7D010C6BB6A3726F327F7E239166D127 - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F - IMPHASH=5834ED4291BDEB928270428EBBAF7604 - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 - IMPHASH=3DE09703C8E79ED2CA3F01074719906B - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F - IMPHASH=E96A73C7BF33A464C510EDE582318BF2 - IMPHASH=32089B8851BBF8BC2D014E9F37288C83 - IMPHASH=09D278F9DE118EF09163C6140255C690 - IMPHASH=03866661686829d806989e2fc5a72606 - IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE - IMPHASH=19584675D94829987952432E018D5056 - IMPHASH=330768A4F172E10ACB6287B87289D83B - IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313 - IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC - IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28 - IMPHASH=96DF3A3731912449521F6F8D183279B1 - IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46 - IMPHASH=51791678F351C03A0EB4E2A7B05C6E17 - IMPHASH=25CE42B079282632708FC846129E98A5 - MD5=7B17F15713FCF13C764535AA2BDF52AA - SHA1=4E18320493042BCD7D21B53E258974BC460ACC78 - SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1 - - - winword.exe - excel.exe - powerpnt.exe - msaccess.exe - mspub.exe - eqnedt32.exe - visio.exe - wordpad.exe - wordview.exe - msohtmed.exe - - - onenote.exe - onenotem.exe - onenoteim.exe - - - - certutil.exe - certoc.exe - CertReq.exe - - Desktopimgdownldr.exe - esentutl.exe - - finger.exe - - notepad.exe - AcroRd32.exe - RdrCEF.exe - calc.exe - mspaint.exe - - - hh.exe - - - control.exe - - - CMSTP.exe - - - installutil.exe - - - mshta.exe - - - msiexec.exe - - - Odbcconf.exe - - - Regsvcs.exe;Regasm.exe - - - regsvr32.exe - - - Rundll32.exe - - - Verclsid.exe - - - mavinject.exe;mavinject64.exe - - - mmc.exe - - - Appvlp.exe;InfDefaultInstall.EXE;PresentationHost.exe;Register-cimprovider.exe;RegisterCimProvider2.exe;RegisterCimProvider.exe;ScriptRunner.exe;appcmd.exe;csi.exe;devtoolslauncher.exe;diskshadow.exe;extexport.exe;jjs.exe;msconfig.EXE;msdt.exe;rasautou.exe;rasdlui.exe;replace.exe;tttracer.exe;wab.exe;wsreset.exe - - - SHA256=7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed - SHA256=0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb - SHA256=0ae8d1dd56a8a000ced74a627052933d2e9bff31d251de185b3c0c5fc94a44db - SHA256=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05 - SHA256=0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d - SHA256=0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917 - SHA256=0bc3685b0b8adc97931b5d31348da235cd7581a67edf6d79913e6a5709866135 - SHA256=0be4912bfd7a79f6ebfa1c06a59f0fb402bd4fe0158265780509edd0e562eac1 - SHA256=0c512b615eac374d4d494e3c36838d8e788b3dc2691bf27916f7f42694b14467 - SHA256=0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c - SHA256=0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c - SHA256=0cf6c6c2d231eaf67dfc87561cc9a56ecef89ab50baafee5a67962748d51faf3 - SHA256=0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f - SHA256=0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c - SHA256=0de4247e72d378713bcf22d5c5d3874d079203bb4364e25f67a90d5570bdcce8 - SHA256=0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b - SHA256=0ebaef662b14410c198395b13347e1d175334ec67919709ad37d65eba013adff - SHA256=0ee5067ce48883701824c5b1ad91695998916a3702cf8086962fbe58af74b2d6 - SHA256=0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8 - SHA256=0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf - SHA256=0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff - SHA256=0fd2df82341bf5ebb8a53682e60d08978100c01acb0bed7b6ce2876ada80f670 - SHA256=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd - SHA256=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece - SHA256=1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5 - SHA256=1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0 - SHA256=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c - SHA256=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b - SHA256=1afa03118f87b62c59a97617e595ebb26dde8dbdd16ee47ef3ddd1097c30ef6a - SHA256=1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e - SHA256=1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa - SHA256=1c8dfa14888bb58848b4792fb1d8a921976a9463be8334cff45cc96f1276049a - SHA256=1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687 - SHA256=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8 - SHA256=1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219 - SHA256=1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe - SHA256=1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee - SHA256=1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961 - SHA256=1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512 - SHA256=1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c - SHA256=1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501 - SHA256=2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486 - SHA256=2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e - SHA256=2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a - SHA256=2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8 - SHA256=2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4 - SHA256=2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30 - SHA256=2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a - SHA256=2b120de80a5462f8395cfb7153c86dfd44f29f0776ea156ec4a34fa64e5c4797 - SHA256=2b186926ed815d87eaf72759a69095a11274f5d13c33b8cc2b8700a1f020be1d - SHA256=2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1 - SHA256=2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250 - SHA256=2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14 - SHA256=2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1 - SHA256=2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b - SHA256=2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d - SHA256=2d195cd4400754cc6f6c3f8ab1fe31627932c3c1bf8d5d0507c292232d1a2396 - SHA256=2da330a2088409efc351118445a824f11edbe51cf3d653b298053785097fe40e - SHA256=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8 - SHA256=2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0 - SHA256=2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e - SHA256=2f60536b25ba8c9014e4a57d7a9a681bd3189fa414eea88c256d029750e15cae - SHA256=2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445 - SHA256=03e0581432f5c8cc727a8aa387f5b69ff84d38d0df6f1226c19c6e960a81e1e9 - SHA256=3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c25 - SHA256=3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0 - SHA256=3a95cc82173032b82a0ffc7d2e438df64c13bc16b4574214c9fe3be37250925e - SHA256=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46 - SHA256=3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b - SHA256=3c5d7069f85ec1d6f58147431f88c4d7c48df73baf94ffdefd664f2606baf09c - SHA256=3c6f9917418e991ed41540d8d882c8ca51d582a82fd01bff6cdf26591454faf5 - SHA256=3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc - SHA256=3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b - SHA256=3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f - SHA256=3cb75429944e60f6c820c7638adbf688883ad44951bca3f8912428afe72bc134 - SHA256=3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3 - SHA256=3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4 - SHA256=3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272 - SHA256=3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf - SHA256=3e9b62d2ea2be50a2da670746c4dbe807db9601980af3a1014bcd72d0248d84c - SHA256=3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75 - SHA256=3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8 - SHA256=3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5 - SHA256=3f9530c94b689f39cc83377d76979d443275012e022782a600dcb5cad4cca6aa - SHA256=3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e - SHA256=3ff50c67d51553c08dcb7c98342f68a0f54ad6658c5346c428bdcd1f185569f6 - SHA256=3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa - SHA256=04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162 - SHA256=4a3d4db86f580b1680d6454baee1c1a139e2dde7d55e972ba7c92ec3f555dce2 - SHA256=4a9093e8dbcb867e1b97a0a67ce99a8511900658f5201c34ffb8035881f2dbbe - SHA256=4ab41816abbf14d59e75b7fad49e2cb1c1feb27a3cb27402297a2a4793ff9da7 - SHA256=4b4c925c3b8285aeeab9b954e8b2a0773b4d2d0e18d07d4a9d268f4be90f6cae - SHA256=4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1 - SHA256=4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4 - SHA256=4cff6e53430b81ecc4fae453e59a0353bcfe73dd5780abfc35f299c16a97998e - SHA256=4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036 - SHA256=4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee - SHA256=4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba - SHA256=4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80 - SHA256=4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69 - SHA256=05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748 - SHA256=5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a - SHA256=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a - SHA256=5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe - SHA256=5b9623da9ba8e5c80c49473f40ffe7ad315dcadffc3230afdc9d9226d60a715a - SHA256=5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c - SHA256=5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921 - SHA256=5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a - SHA256=5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185 - SHA256=5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3 - SHA256=5ee292b605cd3751a24e5949aae615d472a3c72688632c3040dc311055b75a92 - SHA256=5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be - SHA256=5f7e47d728ac3301eb47b409801a0f4726a435f78f1ed02c30d2a926259c71f3 - SHA256=5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683 - SHA256=5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0 - SHA256=5f20541f859f21b3106e12d37182b1ea39bb75ffcfcddb2ece4f6edd42c0bab2 - SHA256=5f487829527802983d5c120e3b99f3cf89333ca14f5e49ac32df0798cfb1f7aa - SHA256=5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36 - SHA256=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50 - SHA256=6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5 - SHA256=6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74 - SHA256=6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63 - SHA256=6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e - SHA256=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44 - SHA256=6c64688444d3e004da77dcfb769d064bb38afceeef7ff915dfc71e60e19ff18a - SHA256=6cb6e23ba516570bbd158c32f7c7c99f19b24ca4437340ecb39253662afe4293 - SHA256=6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc - SHA256=6de84caa2ca18673e01b91af58220c60aecd5cccf269725ec3c7f226b2167492 - SHA256=6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf - SHA256=6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7 - SHA256=6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7 - SHA256=6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38 - SHA256=6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4 - SHA256=6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c - SHA256=6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d - SHA256=6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc - SHA256=07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357 - SHA256=7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf - SHA256=7aaf2aa194b936e48bc90f01ee854768c8383c0be50cfb41b346666aec0cf853 - SHA256=7b0f442ac0bb183906700097d65aed0b4b9d8678f9a01aca864854189fe368e7 - SHA256=7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b - SHA256=7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7 - SHA256=7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21 - SHA256=7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4 - SHA256=7cfa5e10dff8a99a5d544b011f676bc383991274c693e21e3af40cf6982adb8c - SHA256=7d8937c18d6e11a0952e53970a0934cf0e65515637ac24d6ca52ccf4b93d385f - SHA256=7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea - SHA256=7da6113183328d4fddf6937c0c85ef65ba69bfe133b1146193a25bcf6ae1f9dd - SHA256=7dfc2eb033d2e090540860b8853036f40736d02bd22099ff6cf665a90be659cd - SHA256=7e3b0b8d3e430074109d85729201d7c34bc5b918c0bcb9f64ce88c5e37e1a456 - SHA256=7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d - SHA256=7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7 - SHA256=7ec93f34eb323823eb199fbf8d06219086d517d0e8f4b9e348d7afd41ec9fd5d - SHA256=7f5dc63e5742096e4accaca39ae77a2a2142b438c10f97860dee4054b51d3b35 - SHA256=7f190f6e5ab0edafd63391506c2360230af4c2d56c45fc8996a168a1fc12d457 - SHA256=7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa - SHA256=08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6 - SHA256=8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2 - SHA256=8bda0108de82ebeae82f43108046c5feb6f042e312fa0115475a9e32274fae59 - SHA256=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6 - SHA256=8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9 - SHA256=8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f - SHA256=8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775 - SHA256=8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9 - SHA256=8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2 - SHA256=8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126 - SHA256=8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c - SHA256=8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f - SHA256=8ef0ad86500094e8fa3d9e7d53163aa6feef67c09575c169873c494ed66f057f - SHA256=8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00 - SHA256=8f23313adb35782adb0ba97fefbfbb8bbc5fc40ae272e07f6d4629a5305a3fa2 - SHA256=8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a - SHA256=09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184 - SHA256=09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1 - SHA256=9a1d66036b0868bbb1b2823209fedea61a301d5dd245f8e7d390bd31e52d663e - SHA256=9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7 - SHA256=9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba - SHA256=9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c - SHA256=9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c - SHA256=9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194 - SHA256=9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285 - SHA256=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4 - SHA256=9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449 - SHA256=9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2 - SHA256=9d58f640c7295952b71bdcb456cae37213baccdcd3032c1e3aeb54e79081f395 - SHA256=9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4 - SHA256=9ee33ffd80611a13779df6286c1e04d3c151f1e2f65e3d664a08997fcd098ef3 - SHA256=9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5 - SHA256=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33 - SHA256=9f1025601d17945c3a47026814bdec353ee363966e62dba7fe2673da5ce50def - SHA256=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374 - SHA256=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 - SHA256=11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b - SHA256=12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56 - SHA256=14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8 - SHA256=15c53eb3a0ea44bbd2901a45a6ebeae29bb123f9c1115c38dfb2cdbec0642229 - SHA256=15fb486b6b8c2a2f1b067f48fba10c2f164638fe5e6cee618fb84463578ecac9 - SHA256=16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1 - SHA256=18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506 - SHA256=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6 - SHA256=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0 - SHA256=19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775 - SHA256=19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0 - SHA256=20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb - SHA256=21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21 - SHA256=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c - SHA256=23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade - SHA256=025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4 - SHA256=26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097 - SHA256=26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43 - SHA256=26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712 - SHA256=27cd05527feb020084a4a76579c125458571da8843cdfc3733211760a11da970 - SHA256=29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6 - SHA256=29e0062a017a93b2f2f5207a608a96df4d554c5de976bd0276c2590a03bd3e94 - SHA256=30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb - SHA256=31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a - SHA256=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427 - SHA256=31f4140c12ac31f5729a8de4dc051d3acd07783564604df831a2a6722c979192 - SHA256=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351 - SHA256=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993 - SHA256=34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3 - SHA256=34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf - SHA256=36aafa127736c7226c50061ea065f71e14f64ec60321f705bc52686d24117e0d - SHA256=36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb - SHA256=36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289 - SHA256=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9 - SHA256=37dde6bd8a7a36111c3ac57e0ac20bbb93ce3374d0852bcacc9a2c8c8c30079e - SHA256=38b3eb8c86201d26353aab625cea672e60c2f66ce6f5e5eda673e8c3478bf305 - SHA256=38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7 - SHA256=38c18db050b0b2b07f657c03db1c9595febae0319c746c3eede677e21cd238b0 - SHA256=38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20 - SHA256=38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a - SHA256=39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e - SHA256=42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb - SHA256=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f - SHA256=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89 - SHA256=45abdbcd4c0916b7d9faaf1cd08543a3a5178871074628e0126a6eda890d26e0 - SHA256=45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a - SHA256=45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26 - SHA256=45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef - SHA256=47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84 - SHA256=47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005 - SHA256=47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc - SHA256=49ed27460730b62403c1d2e4930573121ab0c86c442854bc0a62415ca445a810 - SHA256=49f75746eebe14e5db11706b3e58accc62d4034d2f1c05c681ecef5d1ad933ba - SHA256=50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793 - SHA256=50db5480d0392a7dd6ab5df98389dc24d1ed1e9c98c9c35964b19dabcd6dc67f - SHA256=51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5 - SHA256=53eaefba7e7dca9ab74e385abf18762f9f1aa51594e7f7db5ba612d6c787dd7e - SHA256=55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9 - SHA256=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a - SHA256=56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7 - SHA256=57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572 - SHA256=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495 - SHA256=58c071cfe72e9ee867bba85cbd0abe72eb223d27978d6f0650d0103553839b59 - SHA256=59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879 - SHA256=60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289 - SHA256=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813 - SHA256=61a1bdddd3c512e681818debb5bee94db701768fc25e674fcad46592a3259bd0 - SHA256=61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf - SHA256=61d6e40601fa368800980801a662a5b3b36e3c23296e8ae1c85726a56ef18cc8 - SHA256=62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0 - SHA256=64f9e664bc6d4b8f5f68616dd50ae819c3e60452efd5e589d6604b9356841b57 - SHA256=65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9 - SHA256=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890 - SHA256=69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2 - SHA256=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009 - SHA256=71ff60722231c7641ad593756108cf6779dbaad21c7b08065fb1d4e225eab14d - SHA256=72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1 - SHA256=72c0d2d699d0440db17cb7cbbc06a253eaafd21465f14bb0fed8b85ae73153d1 - SHA256=074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761 - SHA256=74a846c61adc53692d3040aff4c1916f32987ad72b07fe226e9e7dbeff1036c4 - SHA256=075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85 - SHA256=76b86543ce05540048f954fed37bdda66360c4a3ddb8328213d5aef7a960c184 - SHA256=76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524 - SHA256=76fb4deaee57ef30e56c382c92abffe2cf616d08dbecb3368c8ee6b02e59f303 - SHA256=077aa8ff5e01747723b6d24cc8af460a7a00f30cd3bc80e41cc245ceb8305356 - SHA256=77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9 - SHA256=79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57 - SHA256=79e87b93fbed84ec09261b3a0145c935f7dfe4d4805edfb563b2f971a0d51463 - SHA256=80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085 - SHA256=80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3 - SHA256=80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1 - SHA256=81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0 - SHA256=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d - SHA256=82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989 - SHA256=83f7be0a13c1fccf024c31da5c68c0ea1decf4f48fc39d6e4fd324bbe789ae8a - SHA256=84bf1d0bcdf175cfe8aea2973e0373015793d43907410ae97e2071b2c4b8e2d4 - SHA256=84df20b1d9d87e305c92e5ffae21b10b325609d59d835a954dbd8750ef5dabf4 - SHA256=86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882 - SHA256=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219 - SHA256=88df37ede18bea511f1782c1a6c4915690b29591cf2c1bf5f52201fbbb4fa2b9 - SHA256=88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc - SHA256=89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be - SHA256=89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7 - SHA256=092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0 - SHA256=93b266f38c3c3eaab475d81597abbd7cc07943035068bb6fd670dbbe15de0131 - SHA256=93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63 - SHA256=94be67c319a67de75ebed050d5537cfaa795d72bba52f3d8cf349e7bd075410e - SHA256=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3 - SHA256=97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd - SHA256=98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb - SHA256=98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8 - SHA256=99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1 - SHA256=119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280 - SHA256=131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6 - SHA256=133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743 - SHA256=146d77e80ca70ea5cb17bfc9a5cea92334f809cbdc87a51c2d10b8579a4b9c88 - SHA256=159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980 - SHA256=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347 - SHA256=221dfbc74bbb255b0879360ccc71a74b756b2e0f16e9386b38a9ce9d4e2e34f9 - SHA256=263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24 - SHA256=0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5 - SHA256=316a27e2bdb86222bc7c8af4e5472166b02aec7f3f526901ce939094e5861f6d - SHA256=358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69 - SHA256=362c4f3dadc9c393682664a139d65d80e32caa2a97b6e0361dfd713a73267ecc - SHA256=399effe75d32bdab6fa0a6bffe02dbf0a59219d940b654837c3be1c0bd02e9aa - SHA256=436ccab6f62fa2d29827916e054ade7acae485b3de1d3e5c6c62d3debf1480e7 - SHA256=453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233 - SHA256=455bc98ba32adab8b47d2d89bdbadca4910f91c182ab2fc3211ba07d3784537b - SHA256=0466dac557ee161503f5dfbd3549f81ec760c3d6c7c4363a21a03e7a3f66aca8 - SHA256=475e5016c9c0f5a127896f9179a1b1577a67b357f399ab5a1e68aab07134729a - SHA256=478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0 - SHA256=496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b - SHA256=506f953bbb285aeb8af0549eb24f52f3b7af36afe740afa36735bac70573ce28 - SHA256=523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba - SHA256=525d9b51a80ca0cd4c5889a96f857e73f3a80da1ffbae59851e0f51bdfb0b6cd - SHA256=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9 - SHA256=591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52 - SHA256=592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c - SHA256=600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0 - SHA256=607dc4c75ac7aef82ae0616a453866b3b358c6cf5c8f9d29e4d37f844306b97c - SHA256=626fae47811450d080d08c3d9fd890aa64bfecdc45eacd42a40850c1833c8763 - SHA256=654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad - SHA256=673b63b67345773cd6d66f6adcf2c753e2d949232bff818d5bb6e05786538d92 - SHA256=673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b - SHA256=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf - SHA256=727e8ba66a8ff07bdc778eacb463b65f2d7167a6616ca2f259ea32571cacf8af - SHA256=771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd - SHA256=818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01 - SHA256=823da894b2c73ffcd39e77366b6f1abf0ae9604d9b20140a54e6d55053aadeba - SHA256=845f1e228de249fc1ddf8dc28c39d03e8ad328a6277b6502d3932e83b879a65a - SHA256=862d0ff27bb086145a33b9261142838651b0d2e1403be321145e197600eb5015 - SHA256=881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461 - SHA256=900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88 - SHA256=904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a - SHA256=909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880 - SHA256=910aa4685c735d8c07662aa04fafec463185699ad1a0cd1967b892fc33ec6c3c - SHA256=916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677 - SHA256=923ebbe8111e73d5b8ecc2db10f8ea2629a3264c3a535d01c3c118a3b4c91782 - SHA256=927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a - SHA256=950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9 - SHA256=955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad - SHA256=984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7 - SHA256=1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4 - SHA256=1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c - SHA256=1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1 - SHA256=1766fd66f846d9a21e648d649ad35d1ff94f8ca17a40a9a738444d6b8e07aacb - SHA256=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52 - SHA256=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d - SHA256=2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22 - SHA256=2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109 - SHA256=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6 - SHA256=2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f - SHA256=2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2 - SHA256=3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5 - SHA256=3243aab18e273a9b9c4280a57aecef278e10bfff19abb260d7a7820e41739099 - SHA256=3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5 - SHA256=3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de - SHA256=3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a - SHA256=3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b - SHA256=3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3 - SHA256=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838 - SHA256=4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca - SHA256=4324f3d1e4007f6499a3d0f0102cd92ed9f554332bc0b633305cd7b957ff16c8 - SHA256=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b - SHA256=4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6 - SHA256=4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8 - SHA256=4941c4298f4560fc1e59d0f16f84bab5c060793700b82be2fd7c63735f1657a8 - SHA256=5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48 - SHA256=5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02 - SHA256=5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b - SHA256=5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c - SHA256=6071db01b50c658cf78665c24f1d21f21b4a12d16bfcfaa6813bf6bbc4d0a1e8 - SHA256=6191c20426dd9b131122fb97e45be64a4d6ce98cc583406f38473434636ddedc - SHA256=06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf - SHA256=7049f3c939efe76a5556c2a2c04386db51daf61d56b679f4868bb0983c996ebb - SHA256=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129 - SHA256=7236c8ff33c0e5cfa956778aa7303f1979f3bf709c361399fa1ce101b7e355b8 - SHA256=7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408 - SHA256=7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca - SHA256=8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60 - SHA256=8399e5afd8e3e97139dffb1a9fb00db2186321b427f164403282217cab067c38 - SHA256=8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b - SHA256=8797d9afc7a6bb0933f100a8acbb5d0666ec691779d522ac66c66817155b1c0d - SHA256=09043c51719d4bf6405c9a7a292bb9bb3bcc782f639b708ddcc4eedb5e5c9ce9 - SHA256=9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b - SHA256=9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6 - SHA256=9790a7b9d624b2b18768bb655dda4a05a9929633cef0b1521e79e40d7de0a05b - SHA256=17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca - SHA256=17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229 - SHA256=18712a063574bfec315d58577dfe413ab45b650e54747d1e18a56c3c7337a12c - SHA256=19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758 - SHA256=26453afb1f808f64bec87a2532a9361b696c0ed501d6b973a1f1b5ae152a4d40 - SHA256=28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7 - SHA256=30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab - SHA256=37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba - SHA256=40061b30b1243be76d5283cbc8abfe007e148097d4de7337670ff1536c4c7ba1 - SHA256=42579a759f3f95f20a2c51d5ac2047a2662a2675b3fb9f46c1ed7f23393a0f00 - SHA256=42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0 - SHA256=49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668 - SHA256=54841d9f89e195196e65aa881834804fe3678f1cf6b328cab8703edd15e3ec57 - SHA256=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347 - SHA256=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd - SHA256=67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc - SHA256=70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4 - SHA256=72288d4978ee87ea6c8b1566dbd906107357087cef7364fb3dd1e1896d00baeb - SHA256=72322fa8bba20df6966acbcf41e83747893fd173cd29de99b5ad1a5d3bf8f2de - SHA256=76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a - SHA256=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22 - SHA256=77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c - SHA256=78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f - SHA256=81939e5c12bd627ff268e9887d6fb57e95e6049f28921f3437898757e7f21469 - SHA256=85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94 - SHA256=86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675 - SHA256=89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10 - SHA256=092349aebdac28294dbad1656759d8461f362d1a36b01054dccf861d97beadf0 - SHA256=94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5 - SHA256=101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558 - SHA256=238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4 - SHA256=258359a7fa3d975620c9810dab3a6493972876a024135feaf3ac8482179b2e79 - SHA256=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073 - SHA256=385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039 - SHA256=405472a8f9400a54bb29d03b436ccd58cfd6442fe686f6d2ed4f63f002854659 - SHA256=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c - SHA256=509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6 - SHA256=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91 - SHA256=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b - SHA256=708016fbe22c813a251098f8f992b177b476bd1bbc48c2ed4a122ff74910a965 - SHA256=771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c - SHA256=810513b3f4c8d29afb46f71816350088caacf46f1be361af55b26f3fee4662c3 - SHA256=841335eeb6af68dce5b8b24151776281a751b95056a894991b23afae80e9f33b - SHA256=0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06 - SHA256=952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4 - SHA256=2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c - SHA256=3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf - SHA256=3390919bb28d5c36cc348f9ef23be5fa49bfd81263eb7740826e4437cbe904cd - SHA256=4422851a0a102f654e95d3b79c357ae3af1b096d7d1576663c027cfbc04abaf9 - SHA256=7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d - SHA256=7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c - SHA256=7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504 - SHA256=8939116df1d6c8fd0ebd14b2d37b3dec38a8820aa666ecd487bc1bb794f2a587 - SHA256=9778136d2441439dc470861d15d96fa21dc9f16225232cd05b76791a5e0fde6f - SHA256=16768203a471a19ebb541c942f45716e9f432985abbfbe6b4b7d61a798cea354 - SHA256=18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805 - SHA256=22418016e980e0a4a2d01ca210a17059916a4208352c1018b0079ccb19aaf86a - SHA256=36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10 - SHA256=36875562e747136313ec5db58174e5fab870997a054ca8d3987d181599c7db6a - SHA256=0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3 - SHA256=55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa - SHA256=65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3 - SHA256=65025741ecd0ef516da01319b42c2d96e13cb8d78de53fb7e39cd53ea6d58c75 - SHA256=91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c - SHA256=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82 - SHA256=696679114f6a106ec94c21e2a33fe17af86368bcf9a796aaea37ea6e8748ad6a - SHA256=910479467ef17b9591d8d42305e7f6f247ad41c60ec890a1ffbe331f495ed135 - SHA256=8111085022bda87e5f6aa4c195e743cc6dd6a3a6d41add475d267dc6b105a69f - SHA256=9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d - SHA256=46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7 - SHA256=48891874441c6fa69e5518d98c53d83b723573e280c6c65ccfbde9039a6458c9 - SHA256=6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa - SHA256=a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1 - SHA256=a3e507e713f11901017fc328186ae98e23de7cea5594687480229f77d45848d8 - SHA256=a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad - SHA256=a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062 - SHA256=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc - SHA256=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200 - SHA256=a56c2a2425eb3a4260cc7fc5c8d7bed7a3b4cd2af256185f24471c668853aee8 - SHA256=a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df - SHA256=a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d - SHA256=a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5 - SHA256=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3 - SHA256=a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e - SHA256=a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499 - SHA256=a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9 - SHA256=a7860e110f7a292d621006b7208a634504fb5be417fd71e219060381b9a891e6 - SHA256=a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e - SHA256=a9706e320179993dade519a83061477ace195daa1b788662825484813001f526 - SHA256=a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433 - SHA256=a2353030d4ea3ad9e874a0f7ff35bbfa10562c98c949d88cabab27102bbb8e48 - SHA256=a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4 - SHA256=aa9ab1195dc866270e984f1bed5e1358d6ef24c515dfdb6c2a92d1e1b94bf608 - SHA256=aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c - SHA256=aafb95a443911e4c67d4e45ffa83cca103c91b42915b81100534dc439bec0c1b - SHA256=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89 - SHA256=ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd - SHA256=ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a - SHA256=ac3f613d457fc4d44fa27b2e0b1baa62c09415705efb5a40a4756da39b3ac165 - SHA256=ac63c26ca43701dddaa7fb1aea535d42190f88752900a03040fd5aaa24991e25 - SHA256=ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833 - SHA256=ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b - SHA256=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173 - SHA256=ad2477632b9b07588cfe0e692f244c05fa4202975c1fe91dd3b90fa911ac6058 - SHA256=ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47 - SHA256=adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee - SHA256=ae6fb53e4d8122dba3a65e5fa59185b36c3ac9df46e82fcfb6731ab55c6395aa - SHA256=ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471 - SHA256=ae79e760c739d6214c1e314728a78a6cb6060cce206fde2440a69735d639a0a2 - SHA256=aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399 - SHA256=af095de15a16255ca1b2c27dad365dff9ac32d2a75e8e288f5a1307680781685 - SHA256=af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a - SHA256=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508 - SHA256=b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414 - SHA256=b2ba6efeff1860614b150916a77c9278f19d51e459e67a069ccd15f985cbc0e1 - SHA256=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29 - SHA256=b4d47ea790920a4531e3df5a4b4b0721b7fea6b49a35679f0652f1e590422602 - SHA256=b6fd51e1f57a03006953e84fd56cc2821cc19e7c77c0474e1110aabaacaf03df - SHA256=b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d - SHA256=b8b94c2646b62f6ac08f16514b6efaa9866aa3c581e4c0435a7aeafe569b2418 - SHA256=b9a4e40a5d80fedd1037eaed958f9f9efed41eb01ada73d51b5dcd86e27e0cbf - SHA256=b9b3878ddc5dfb237d38f8d25067267870afd67d12a330397a8853209c4d889c - SHA256=b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a - SHA256=b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b - SHA256=b47be212352d407d0ef7458a7161c66b47c2aec8391dd101df11e65728337a6a - SHA256=b48a309ee0960da3caaaaf1e794e8c409993aeb3a2b64809f36b97aac8a1e62a - SHA256=b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e - SHA256=b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5 - SHA256=b95b2d9b29bd25659f1c7ba5a187f8d23cde01162d9b5b1a2c4aea8f64b38441 - SHA256=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de - SHA256=b1334a71cc73b3d0c54f62d8011bec330dfc355a239bf94a121f6e4c86a30a2e - SHA256=b1867d13a4cab66a76f4d4448824ca0cb3a176064626f9618c0c103ee3cb4f47 - SHA256=b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0 - SHA256=b61869b7945be062630f1dd4bae919aecee8927f7e1bc3954a21ff763f4c0867 - SHA256=b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704 - SHA256=b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3 - SHA256=bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa - SHA256=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc - SHA256=bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955 - SHA256=bb68552936a6b0a68fb53ce864a6387d2698332aac10a7adfdd5a48b97027ce3 - SHA256=bc7ebd191e0991fd0865a5c956a92e63792a0bb2ff888af43f7a63bb65a22248 - SHA256=bc13adeb6bf62b1e10ef41205ef92382e6c18d6a20669d288a0b11058e533d63 - SHA256=bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f - SHA256=bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f - SHA256=bda99629ec6c522c3efcbcc9ca33688d31903146f05b37d0d3b43db81bfb3961 - SHA256=bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c - SHA256=bdcacee3695583a0ca38b9a786b9f7334bf2a9a3387e4069c8e6ca378b2791d0 - SHA256=be03e9541f56ac6ed1e81407dcd7cc85c0ffc538c3c2c2c8a9c747edbcf13100 - SHA256=be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2 - SHA256=be54f7279e69fb7651f98e91d24069dbc7c4c67e65850e486622ccbdc44d9a57 - SHA256=c1c4310e5d467d24e864177bdbfc57cb5d29aac697481bfa9c11ddbeebfd4cc8 - SHA256=c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8 - SHA256=c2fcc0fec64d5647813b84b9049d430406c4c6a7b9f8b725da21bcae2ff12247 - SHA256=c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e - SHA256=c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9 - SHA256=c9b49b52b493b53cd49c12c3fa9553e57c5394555b64e32d1208f5b96a5b8c6e - SHA256=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8 - SHA256=c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924 - SHA256=c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26 - SHA256=c60fcff9c8e5243bbb22ec94618b9dcb02c59bb49b90c04d7d6ab3ebbd58dc3a - SHA256=c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc - SHA256=c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa - SHA256=c344e92a6d06155a217a9af7b4b35e6653665eec6569292e7b2e70f3a3027646 - SHA256=c470c9db58840149ce002f3e6003382ecf740884a683bae8f9d10831be218fa2 - SHA256=c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2 - SHA256=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5 - SHA256=c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada - SHA256=c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c - SHA256=c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d - SHA256=c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c - SHA256=c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd - SHA256=caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab - SHA256=cb57f3a7fe9e1f8e63332c563b0a319b26c944be839eabc03e9a3277756ba612 - SHA256=cb9890d4e303a4c03095d7bc176c42dee1b47d8aa58e2f442ec1514c8f9e3cec - SHA256=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6 - SHA256=cc383ad11e9d06047a1558ed343f389492da3ac2b84b71462aee502a2fa616c8 - SHA256=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64 - SHA256=cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b - SHA256=cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb - SHA256=cdd2a4575a46bada4837a6153a79c14d60ee3129830717ef09e0e3efd9d00812 - SHA256=cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc - SHA256=ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2 - SHA256=cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986 - SHA256=cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b - SHA256=cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190 - SHA256=cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb - SHA256=cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40 - SHA256=cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b - SHA256=cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab - SHA256=cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c - SHA256=d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889 - SHA256=d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605 - SHA256=d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f - SHA256=d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9 - SHA256=d7bc7306cb489fe4c285bbeddc6d1a09e814ef55cf30bd5b8daf87a52396f102 - SHA256=d7ddf874304556f8a10942a29b3d387cb5155a7419f87813557fe728cb14806d - SHA256=d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0 - SHA256=d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530 - SHA256=d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482 - SHA256=d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2 - SHA256=d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f - SHA256=d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3 - SHA256=d5562fb90b0b3deb633ab335bcbd82ce10953466a428b3f27cb5b226b453eaf3 - SHA256=d5586dc1e61796a9ae5e5d1ced397874753056c3df2eb963a8916287e1929a71 - SHA256=d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476 - SHA256=d8459f7d707c635e2c04d6d6d47b63f73ba3f6629702c7a6e0df0462f6478ae2 - SHA256=d25904fbf907e19f366d54962ff543d9f53b8fdfd2416c8b9796b6a8dd430e26 - SHA256=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e - SHA256=d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d - SHA256=d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1 - SHA256=da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24 - SHA256=da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d - SHA256=db2a9247177e8cdd50fe9433d066b86ffd2a84301aa6b2eb60f361cfff077004 - SHA256=db90e554ad249c2bd888282ecf7d8da4d1538dd364129a3327b54f8242dd5653 - SHA256=dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98 - SHA256=dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed - SHA256=dbe9f17313e1164f06401234b875fbc7f71d41dc7271de643865af1358841fef - SHA256=dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258 - SHA256=dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097 - SHA256=dd573f23d656818036fc9ae1064eda31aca86acb9bc44a6e127db3ea112a9094 - SHA256=dde6f28b3f7f2abbee59d4864435108791631e9cb4cdfb1f178e5aa9859956d8 - SHA256=de6bf572d39e2611773e7a01f0388f84fb25da6cba2f1f8b9b36ffba467de6fa - SHA256=de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c - SHA256=de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5 - SHA256=dec8a933dba04463ed9bb7d53338ff87f2c23cfb79e0e988449fc631252c9dcc - SHA256=ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d - SHA256=deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578 - SHA256=df0cc4e5c9802f8edaefeb130e375cad56b2c5490d8ebd77d8dbdcc6fdc7ecb6 - SHA256=df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15 - SHA256=dfaefd06b680f9ea837e7815fc1cc7d1f4cc375641ac850667ab20739f46ad22 - SHA256=e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b - SHA256=e2d8dd5dacc24051709f55a35184f5f99aef957a83bd358b0608b4479e1ec24f - SHA256=e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6 - SHA256=e3b257357be41a18319332df7023c4407e2b93ac4c9e0c6754032e29f3763eac - SHA256=e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918 - SHA256=e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd - SHA256=e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb - SHA256=e4c154a0073bbad3c9f8ab7218e9b3be252ae705c20c568861dae4088f17ffcc - SHA256=e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036 - SHA256=e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148 - SHA256=e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1 - SHA256=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53 - SHA256=e5b0772be02e2bc807804874cf669e97aa36f5aff1f12fa0a631a3c7b4dd0dc8 - SHA256=e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f - SHA256=e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48 - SHA256=e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f - SHA256=e50b25d94c1771937b2f632e10eea875ac6b19c57da703d52e23ad2b6299f0ae - SHA256=e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90 - SHA256=e61a54f6d3869b43c4eceac3016df73df67cce03878c5a6167166601c5d3f028 - SHA256=e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a - SHA256=e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4 - SHA256=e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f - SHA256=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf - SHA256=e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2 - SHA256=e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9 - SHA256=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf - SHA256=e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa - SHA256=e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06 - SHA256=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790 - SHA256=e81230217988f3e7ec6f89a06d231ec66039bdba340fd8ebb2bbb586506e3293 - SHA256=ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3 - SHA256=ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41 - SHA256=ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3 - SHA256=ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5 - SHA256=ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566 - SHA256=ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c - SHA256=ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282 - SHA256=ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39 - SHA256=ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7 - SHA256=ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe - SHA256=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b - SHA256=ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850 - SHA256=ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0 - SHA256=f1c8ca232789c2f11a511c8cd95a9f3830dd719cad5aa22cb7c3539ab8cb4dc3 - SHA256=f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b - SHA256=f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe - SHA256=f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f - SHA256=f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1 - SHA256=f37d609ea1f06660d970415dd3916c4c153bb5940bf7d2beb47fa34e8a8ffbfc - SHA256=f51bdb0ad924178131c21e39a8ccd191e46b5512b0f2e1cc8486f63e84e5d960 - SHA256=f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c - SHA256=f84f8173242b95f9f3c4fea99b5555b33f9ce37ca8188b643871d261cb081496 - SHA256=f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004 - SHA256=f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439 - SHA256=f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d - SHA256=f88ebb633406a086d9cca6bc8b66a4ea940c5476529f9033a9e0463512a23a57 - SHA256=f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af - SHA256=f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960 - SHA256=f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008 - SHA256=f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145 - SHA256=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65 - SHA256=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35 - SHA256=f8886a9c759e0426e08d55e410b02c5b05af3c287b15970175e4874316ffaf13 - SHA256=f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b - SHA256=f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478 - SHA256=f85784fa8e7a7ec86cb3fe76435802f6bb82256e1824ed7b5d61bf075f054573 - SHA256=f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54 - SHA256=f9895458e73d4b0ef01eda347fb695bb00e6598d9f5e2506161b70ad96bb7298 - SHA256=f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b - SHA256=fa875178ae2d7604d027510b0d0a7e2d9d675e10a4c9dda2d927ee891e0bcb91 - SHA256=fafa1bb36f0ac34b762a10e9f327dcab2152a6d0b16a19697362d49a31e7f566 - SHA256=fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22 - SHA256=fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f - SHA256=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2 - SHA256=fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c - SHA256=fcdfe570e6dc6e768ef75138033d9961f78045adca53beb6fdb520f6417e0df1 - SHA256=fd33fb2735cc5ef466a54807d3436622407287e325276fcd3ed1290c98bd0533 - SHA256=fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c - SHA256=fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03 - SHA256=fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280 - SHA256=ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7 - SHA256=ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339 - SHA256=ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5 - SHA256=ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f - - - SHA256=56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c - SHA256=06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4 - SHA256=86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62 - SHA256=06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f - SHA256=8dafe5f3d0527b66f6857559e3c81872699003e0f2ffda9202a1b5e29db2002e - SHA256=81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1 - SHA256=6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724 - SHA256=ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620 - SHA256=0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc - SHA256=c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c - SHA256=e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d - SHA256=18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7 - SHA256=139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988 - SHA256=b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427 - SHA256=1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e - SHA256=6b5cf41512255237064e9274ca8f8a3fef820c45aa6067c9c6a0e6f5751a0421 - SHA256=0d10c4b2f56364b475b60bd2933273c8b1ed2176353e59e65f968c61e93b7d99 - SHA256=ad938d15ecfd70083c474e1642a88b078c3cea02cdbddf66d4fb1c01b9b29d9a - SHA256=89698cad598a56f9e45efffd15d1841e494a2409cc12279150a03842cd6bb7f3 - SHA256=5f6fec8f7890d032461b127332759c88a1b7360aa10c6bd38482572f59d2ba8b - SHA256=fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5 - SHA256=05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4 - SHA256=6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77 - SHA256=6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f - SHA256=32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d - SHA256=fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8 - SHA256=6839fcae985774427c65fe38e773aa96ec451a412caa5354ad9e2b9b54ffe6c1 - SHA256=f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a - SHA256=7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376 - SHA256=96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc - SHA256=b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3 - SHA256=e6a7b0bc01a627a7d0ffb07faddb3a4dd96b6f5208ac26107bdaeb3ab1ec8217 - SHA256=200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a - SHA256=8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce - SHA256=c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497 - SHA256=23e89fd30a1c7db37f3ea81b779ce9acf8a4294397cbb54cff350d54afcfd931 - SHA256=575e58b62afab094c20c296604dc3b7dd2e1a50f5978d8ee24b7dca028e97316 - SHA256=5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d - SHA256=e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12 - SHA256=9bb09752cf3a464455422909edef518ac18fe63cf5e1e8d9d6c2e68db62e0c87 - SHA256=f8236fc01d4efaa48f032e301be2ebba4036b2cd945982a29046eca03944d2ae - SHA256=e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e - SHA256=9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c - SHA256=f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280 - SHA256=9c2f3e9811f7d0c7463eaa1ee6f39c23f902f3797b80891590b43bbe0fdf0e51 - SHA256=b8807e365be2813b7eccd2e4c49afb0d1e131086715638b7a6307cd7d7e9556c - SHA256=50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76 - SHA256=52d5c35325ce701516f8b04380c9fbdb78ec6bcc13b444f758fdb03d545b0677 - SHA256=7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6 - SHA256=8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104 - SHA256=8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330 - SHA256=4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4 - SHA256=88076e98d45ed3adf0c5355411fe8ca793eb7cec1a1c61f5e1ec337eae267463 - SHA256=749b0e8c8c8b7dda8c2063c708047cfe95afa0a4d86886b31a12f3018396e67c - SHA256=49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530 - SHA256=d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c - SHA256=f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d - SHA256=5c1585b1a1c956c7755429544f3596515dfdf928373620c51b0606a520c6245a - SHA256=5bc3994612624da168750455b363f2964e1861dba4f1c305df01b970ac02a7ae - SHA256=bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df - SHA256=42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25 - SHA256=f461414a2596555cece5cfee65a3c22648db0082ca211f6238af8230e41b3212 - SHA256=770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a - From 7449900e0ede8da9e957b1d7ecf6e444c02baab8 Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Thu, 7 Sep 2023 09:02:11 -0400 Subject: [PATCH 454/471] Update sysmonconfig-export.xml --- sysmonconfig-export.xml | 1119 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 1096 insertions(+), 23 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index 58259a75..c2283c19 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -262,7 +262,7 @@ C:\Users\;$Recycle;\Temp\;\Downloads\ \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 conhost.exe - C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\Msp.Ecosystem.Discovery.exe;TCIntegratorCommHelper.exe + C:\Program Files (x86)\N-able Technologies\Windows Agent\Temp\Msp.Ecosystem.Discovery.exe;TCIntegratorCommHelper.exe;\NVIDIA\NvBackend\ApplicationOntology\OAWrapper.exe svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe @@ -518,6 +518,7 @@ C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe Sentinel\AutoRepair Update_Sysmon_Rules + C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe taskeng.exe @@ -532,7 +533,7 @@ schtasks.exe schtasks /TN RtkAudUService64_BG - -change;/change;-delete;/delete;-create;/create;Update_Sysmon_Rules + -change;/change;-delete;/delete;-create;/create;Update_Sysmon_Rules;AMDRyzenMasterSDKTask at.exe @@ -686,6 +687,8 @@ ..\;\.. + C:\Program Files;\Razer\Synapse3\Service\Razer Synapse Service.exe + C:\Program Files;\Razer\;\UserProcess\Razer Synapse Service Process.exe \cmd.exe /c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe /c del "C:\Users\*\Desktop\*.exe;\cmd.exe -c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe -c del "C:\Users\*\Desktop\*.exe @@ -957,9 +960,13 @@ firewall delete + ROGLiveService;C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe + C:\Program Files\ASUS\ROG Live Service\RLSInstallAction.exe firewall add + cmd.exe;ROGLiveService;C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe;enable=yes + C:\Program Files\ASUS\ROG Live Service\RLSInstallAction.exe firewall set opmode disable @@ -1047,6 +1054,7 @@ C:\Users\NetworkService\;C:\Users\NetworkService\;HarddiskVolumeShadowCopy;C:\Users\Default\;C:\Users\Public;C:\Users\Guest\;\administrateur\;C:\Windows\Media\;C:\Windows\addins\;tsclient\;\htdocs\;\config\systemprofile\;C:\PerfLogs\;c:\windows\ServiceProfiles\;C:\Intel\Logs\;C:\Windows\repair\;C:\Windows\Help\;$Recycle;C:\Windows\Debug\;C:\Windows\Security\;C:\Windows\Fonts\;\wwwroot\;\Contacts;C:\Windows\vss\ + C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;\CitrixReceiverUpdater.exe .exe @@ -2473,10 +2481,10 @@ start-bitstransfer - expand \\ + expand;\\ - expand.exe \\ + expand.exe;\\ ieexec http @@ -2494,10 +2502,10 @@ esentutl.exe /y \\;esentutl.exe -y \\ - extrac32 \\ + extrac32;\\ - extrac32.exe \\ + extrac32.exe;\\ @@ -2639,10 +2647,16 @@ erase - -nw -exec= + -nw;-exec= + + + /nw;/exec= + + + -p;-nw - -p -nw + /p;/nw shred @@ -2667,8 +2681,7 @@ fsutil.exe - deletejournal - usn + usn;deletejournal @@ -2678,7 +2691,8 @@ - AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz + AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz + C:\Program Files;\LightingService\AsusInstallVerifier.exe @@ -2937,6 +2951,9 @@ C:\Windows\System32\WerFault.exe C:\Windows\System32\wbem\WmiPrvSE.exe + + C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe + @@ -5124,6 +5141,7 @@ C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git;\Intel\Driver and Support Assistant\DSAService.exe;C:\Program Files (x86)\N-able Technologies\AutomationManagerAgent\;C:\Program Files (x86)\MspPlatform\RequestHandlerAgent\RequestHandlerAgent.exe;C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe;C:\ProgramData\Cavelo\jre\bin\java.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe;C:\Program Files\Cavelo\Cavelo Agent\parser.exe C:\Windows\Microsoft.NET\Framework\;\NGenTask.exe \Intel\Driver and Support Assistant\ + C:\Program Files\AMD\CNext\CNext\Radeonsoftware.exe;C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.UserSessionHelper.exe C:\Windows\Microsoft.NET\Framework\;\ngen.exe @@ -5264,6 +5282,7 @@ C:\Windows\SoftwareDistribution C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch .exe + C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe proj @@ -5299,6 +5318,7 @@ .bin + C:\Windows\System32\WUDFHost.exe C:\Windows\SysWOW64\Wbem @@ -5436,6 +5456,8 @@ !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;=READ=THIS=PLEASE=;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy C:\Users\;\Google\Chrome Beta\User Data\;\IndexedDB\ C:\Program Files\WindowsApps\Microsoft.YourPhone_;C:\Program Files\dotnet\shared\Microsoft.NETCore.App\;\Microsoft.NET\assembly\GAC_MSIL + \System.Security.Cryptography + Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe crackmapexec @@ -5674,6 +5696,7 @@ C:\Users\Public\ + C:\Windows\System32\WUDFHost.exe C:\Windows\Temp\ @@ -5883,6 +5906,7 @@ .bin + C:\Windows\System32\WUDFHost.exe .cab @@ -6732,10 +6756,10 @@ .mht - + \Chrome\User Data\Default\Extensions\ - + .crx @@ -6865,7 +6889,7 @@ Temp\Temp1_ - + \Microsoft\;CLR_v;\UsageLogs\ @@ -7102,11 +7126,16 @@ - + Google\Chrome\Extensions update_url SetValue + + Google\Chrome + extensions.settings + SetValue + ForcePasswordReset @@ -7141,6 +7170,9 @@ SetValue \CurrentVersion\Run\ C:\Program Files\Microsoft OneDrive\Update\OneDriveSetup.exe;\AppData\Local\Microsoft\Teams\current\Teams.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe +
C:\Program Files\Google\Drive File Stream;\GoogleDriveFS.exe;startup_mode
+
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;no-startup-window;win-session-start;prefetch
+
\Application\chrome.exe;no-startup-window;win-session-start;prefetch
 \Microsoft\System\Scripts @@ -7433,7 +7465,7 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\SnapshotCleanupTask\SD HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office ClickToRun Service Monitor\SD HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Automatic Updates 2.0\SD - Microsoft\Windows\UpdateOrchestrator + Microsoft\Windows\UpdateOrchestrator;\AMDInstallLauncher\SD;\SD;ASUS Switch;\PowerToys\Autorun for HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree @@ -7516,6 +7548,7 @@ C:\Programdata\sysmon\sysmon64.exe C:\Programdata\sysmon\sysmon.exe C:\Windows\TEMP\sysmon.exe + C:\Windows\TEMP\SYS @@ -7635,6 +7668,7 @@ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ \Enabled
DWORD (0x00000000)
+ C:\WINDOWS\system32\DrvInst.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ @@ -8302,10 +8336,10 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - + HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ @@ -8517,6 +8551,9 @@ Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations + + \Control\hivelist + \Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives\Volume Drive Type @@ -8771,10 +8808,10 @@ Software\recfg - + \Keyboard Layout\Preload\ - + \Keyboard Layout\Substitutes\ @@ -8825,6 +8862,21 @@ C:\Program Files (x86)\ESET C:\Program Files\ESET + + \EnableBHO + + + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports + + + Control\Print\Environments\Windows x64\Drivers + + + \Microsoft\.NETFramework;NGenAssemblyUsageLog + + + \REGISTRY\A\;LocalState\admin_settings + @@ -8851,7 +8903,7 @@ SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e - Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf + Startup;Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE @@ -9624,13 +9676,18 @@ + C:\Users\ \Downloads - + + C:\Users\ + Content.Outlook + + .exe .dll .sys @@ -9645,6 +9702,1022 @@ .mui .ime .tsp + C:\Windows\system32\MpSigStub.exe + + + powershell.exe;powershell_ise.exe;pwsh.exe;Sqlps.exe + + + cmd.exe;conhost.exe + + + C:\Users\Public\ + C:\Perflogs\ + C:\Windows\Fonts\ + C:\Windows\debug\ + C:\Windows\Tasks\ + C:\Windows\tracing\ + C:\Windows\Help\ + C:\Windows\Logs\ + C:\Windows\System32\spool\SERVERS\ + C:\Windows\System32\spool\PRINTERS\ + C:\Windows\Help\ + C:\Windows\SysWOW64\Tasks + C:\ProgramData\Intel + C:\ProgramData\Mozilla + C:\ProgramData\chocolatey\ + C:\ProgramData\Microsoft\DeviceSync + C:\ProgramData\Microsoft\PlayReady + C:\ProgramData\Microsoft\User Account Pictures + C:\ProgramData\Microsoft\Office\Heartbeat + C:\ProgramData\Microsoft\Windows\WER + C:\Users\All Users\ + C:\Users\;\Music\ + C:\Users\;\Pictures\ + C:\Users\;\Videos\ + C:\Users\;\Contacts\ + + + .7z.exe + .doc.exe + .docm.exe + .docx.exe + .htm.exe + .html.exe + .iso.exe + .lnk.exe + .pdf.exe + .ppt.exe + .pptx.exe + .rar.exe + .rtf.exe + .txt.exe + .xls.exe + .xlsm.exe + .xlsx.exe + .zip.exe + + + \EntenLoader.exe + \SysmonQuiet.exe + \SharpEvtMute.exe + \EvtMuteHook.dll + \SysmonEOP.exe + + + IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 + IMPHASH=3A19059BD7688CB88E70005F18EFC439 + IMPHASH=bf6223a49e45d99094406777eb6004ba + IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 + IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 + IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF + IMPHASH=4C1B52A19748428E51B14C278D0F58E3 + IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F + IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A + IMPHASH=672B13F4A0B6F27D29065123FE882DFC + IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F + IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D + IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 + IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 + IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 + IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 + IMPHASH=D21BBC50DCC169D7B4D0F01962793154 + IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 + IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 + IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC + IMPHASH=F9A28C458284584A93B14216308D31BD + IMPHASH=6118619783FC175BC7EBECFF0769B46E + IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA + IMPHASH=563233BFA169ACC7892451F71AD5850A + IMPHASH=87575CB7A0E0700EB37F2E3668671A08 + IMPHASH=13F08707F759AF6003837A150A371BA1 + IMPHASH=1781F06048A7E58B323F0B9259BE798B + IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 + IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D + IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 + IMPHASH=713C29B396B907ED71A72482759ED757 + IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F + IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E + IMPHASH=8B114550386E31895DFAB371E741123D + IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 + IMPHASH=9D68781980370E00E0BD939EE5E6C141 + IMPHASH=B18A1401FF8F444056D29450FBC0A6CE + IMPHASH=CB567F9498452721D77A451374955F5F + IMPHASH=730073214094CD328547BF1F72289752 + IMPHASH=17B461A082950FC6332228572138B80C + IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 + IMPHASH=819B19D53CA6736448F9325A85736792 + IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E + IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 + IMPHASH=0588081AB0E63BA785938467E1B10CCA + IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C + IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 + IMPHASH=4DA924CF622D039D58BCE71CDF05D242 + IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 + IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF + IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE + IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 + IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 + IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E + IMPHASH=E6F9D5152DA699934B30DAAB206471F6 + IMPHASH=3AD59991CCF1D67339B319B15A41B35D + IMPHASH=FFDD59E0318B85A3E480874D9796D872 + IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 + IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 + IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 + IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 + IMPHASH=0E2216679CA6E1094D63322E3412D650 + IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB + IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 + IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 + IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 + IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F + IMPHASH=767637C23BB42CD5D7397CF58B0BE688 + IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 + IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC + IMPHASH=7D010C6BB6A3726F327F7E239166D127 + IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 + IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F + IMPHASH=5834ED4291BDEB928270428EBBAF7604 + IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 + IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 + IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 + IMPHASH=3DE09703C8E79ED2CA3F01074719906B + IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F + IMPHASH=E96A73C7BF33A464C510EDE582318BF2 + IMPHASH=32089B8851BBF8BC2D014E9F37288C83 + IMPHASH=09D278F9DE118EF09163C6140255C690 + IMPHASH=03866661686829d806989e2fc5a72606 + IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d + IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE + IMPHASH=19584675D94829987952432E018D5056 + IMPHASH=330768A4F172E10ACB6287B87289D83B + IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313 + IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC + IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28 + IMPHASH=96DF3A3731912449521F6F8D183279B1 + IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46 + IMPHASH=51791678F351C03A0EB4E2A7B05C6E17 + IMPHASH=25CE42B079282632708FC846129E98A5 + MD5=7B17F15713FCF13C764535AA2BDF52AA + SHA1=4E18320493042BCD7D21B53E258974BC460ACC78 + SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1 + + + winword.exe + excel.exe + powerpnt.exe + msaccess.exe + mspub.exe + eqnedt32.exe + visio.exe + wordpad.exe + wordview.exe + msohtmed.exe + + + onenote.exe + onenotem.exe + onenoteim.exe + + + + certutil.exe + certoc.exe + CertReq.exe + + Desktopimgdownldr.exe + esentutl.exe + + finger.exe + + notepad.exe + AcroRd32.exe + RdrCEF.exe + calc.exe + mspaint.exe + + + hh.exe + + + control.exe + + + CMSTP.exe + + + installutil.exe + + + mshta.exe + + + msiexec.exe + + + Odbcconf.exe + + + Regsvcs.exe;Regasm.exe + + + regsvr32.exe + + + Rundll32.exe + + + Verclsid.exe + + + mavinject.exe;mavinject64.exe + + + mmc.exe + + + Appvlp.exe;InfDefaultInstall.EXE;PresentationHost.exe;Register-cimprovider.exe;RegisterCimProvider2.exe;RegisterCimProvider.exe;ScriptRunner.exe;appcmd.exe;csi.exe;devtoolslauncher.exe;diskshadow.exe;extexport.exe;jjs.exe;msconfig.EXE;msdt.exe;rasautou.exe;rasdlui.exe;replace.exe;tttracer.exe;wab.exe;wsreset.exe + + + SHA256=7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed + SHA256=0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb + SHA256=0ae8d1dd56a8a000ced74a627052933d2e9bff31d251de185b3c0c5fc94a44db + SHA256=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05 + SHA256=0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d + SHA256=0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917 + SHA256=0bc3685b0b8adc97931b5d31348da235cd7581a67edf6d79913e6a5709866135 + SHA256=0be4912bfd7a79f6ebfa1c06a59f0fb402bd4fe0158265780509edd0e562eac1 + SHA256=0c512b615eac374d4d494e3c36838d8e788b3dc2691bf27916f7f42694b14467 + SHA256=0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c + SHA256=0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c + SHA256=0cf6c6c2d231eaf67dfc87561cc9a56ecef89ab50baafee5a67962748d51faf3 + SHA256=0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f + SHA256=0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c + SHA256=0de4247e72d378713bcf22d5c5d3874d079203bb4364e25f67a90d5570bdcce8 + SHA256=0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b + SHA256=0ebaef662b14410c198395b13347e1d175334ec67919709ad37d65eba013adff + SHA256=0ee5067ce48883701824c5b1ad91695998916a3702cf8086962fbe58af74b2d6 + SHA256=0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8 + SHA256=0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf + SHA256=0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff + SHA256=0fd2df82341bf5ebb8a53682e60d08978100c01acb0bed7b6ce2876ada80f670 + SHA256=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd + SHA256=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece + SHA256=1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5 + SHA256=1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0 + SHA256=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c + SHA256=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b + SHA256=1afa03118f87b62c59a97617e595ebb26dde8dbdd16ee47ef3ddd1097c30ef6a + SHA256=1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e + SHA256=1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa + SHA256=1c8dfa14888bb58848b4792fb1d8a921976a9463be8334cff45cc96f1276049a + SHA256=1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687 + SHA256=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8 + SHA256=1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219 + SHA256=1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe + SHA256=1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee + SHA256=1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961 + SHA256=1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512 + SHA256=1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c + SHA256=1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501 + SHA256=2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486 + SHA256=2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e + SHA256=2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a + SHA256=2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8 + SHA256=2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4 + SHA256=2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30 + SHA256=2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a + SHA256=2b120de80a5462f8395cfb7153c86dfd44f29f0776ea156ec4a34fa64e5c4797 + SHA256=2b186926ed815d87eaf72759a69095a11274f5d13c33b8cc2b8700a1f020be1d + SHA256=2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1 + SHA256=2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250 + SHA256=2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14 + SHA256=2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1 + SHA256=2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b + SHA256=2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d + SHA256=2d195cd4400754cc6f6c3f8ab1fe31627932c3c1bf8d5d0507c292232d1a2396 + SHA256=2da330a2088409efc351118445a824f11edbe51cf3d653b298053785097fe40e + SHA256=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8 + SHA256=2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0 + SHA256=2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e + SHA256=2f60536b25ba8c9014e4a57d7a9a681bd3189fa414eea88c256d029750e15cae + SHA256=2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445 + SHA256=03e0581432f5c8cc727a8aa387f5b69ff84d38d0df6f1226c19c6e960a81e1e9 + SHA256=3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c25 + SHA256=3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0 + SHA256=3a95cc82173032b82a0ffc7d2e438df64c13bc16b4574214c9fe3be37250925e + SHA256=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46 + SHA256=3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b + SHA256=3c5d7069f85ec1d6f58147431f88c4d7c48df73baf94ffdefd664f2606baf09c + SHA256=3c6f9917418e991ed41540d8d882c8ca51d582a82fd01bff6cdf26591454faf5 + SHA256=3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc + SHA256=3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b + SHA256=3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f + SHA256=3cb75429944e60f6c820c7638adbf688883ad44951bca3f8912428afe72bc134 + SHA256=3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3 + SHA256=3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4 + SHA256=3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272 + SHA256=3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf + SHA256=3e9b62d2ea2be50a2da670746c4dbe807db9601980af3a1014bcd72d0248d84c + SHA256=3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75 + SHA256=3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8 + SHA256=3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5 + SHA256=3f9530c94b689f39cc83377d76979d443275012e022782a600dcb5cad4cca6aa + SHA256=3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e + SHA256=3ff50c67d51553c08dcb7c98342f68a0f54ad6658c5346c428bdcd1f185569f6 + SHA256=3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa + SHA256=04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162 + SHA256=4a3d4db86f580b1680d6454baee1c1a139e2dde7d55e972ba7c92ec3f555dce2 + SHA256=4a9093e8dbcb867e1b97a0a67ce99a8511900658f5201c34ffb8035881f2dbbe + SHA256=4ab41816abbf14d59e75b7fad49e2cb1c1feb27a3cb27402297a2a4793ff9da7 + SHA256=4b4c925c3b8285aeeab9b954e8b2a0773b4d2d0e18d07d4a9d268f4be90f6cae + SHA256=4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1 + SHA256=4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4 + SHA256=4cff6e53430b81ecc4fae453e59a0353bcfe73dd5780abfc35f299c16a97998e + SHA256=4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036 + SHA256=4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee + SHA256=4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba + SHA256=4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80 + SHA256=4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69 + SHA256=05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748 + SHA256=5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a + SHA256=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a + SHA256=5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe + SHA256=5b9623da9ba8e5c80c49473f40ffe7ad315dcadffc3230afdc9d9226d60a715a + SHA256=5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c + SHA256=5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921 + SHA256=5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a + SHA256=5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185 + SHA256=5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3 + SHA256=5ee292b605cd3751a24e5949aae615d472a3c72688632c3040dc311055b75a92 + SHA256=5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be + SHA256=5f7e47d728ac3301eb47b409801a0f4726a435f78f1ed02c30d2a926259c71f3 + SHA256=5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683 + SHA256=5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0 + SHA256=5f20541f859f21b3106e12d37182b1ea39bb75ffcfcddb2ece4f6edd42c0bab2 + SHA256=5f487829527802983d5c120e3b99f3cf89333ca14f5e49ac32df0798cfb1f7aa + SHA256=5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36 + SHA256=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50 + SHA256=6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5 + SHA256=6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74 + SHA256=6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63 + SHA256=6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e + SHA256=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44 + SHA256=6c64688444d3e004da77dcfb769d064bb38afceeef7ff915dfc71e60e19ff18a + SHA256=6cb6e23ba516570bbd158c32f7c7c99f19b24ca4437340ecb39253662afe4293 + SHA256=6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc + SHA256=6de84caa2ca18673e01b91af58220c60aecd5cccf269725ec3c7f226b2167492 + SHA256=6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf + SHA256=6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7 + SHA256=6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7 + SHA256=6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38 + SHA256=6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4 + SHA256=6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c + SHA256=6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d + SHA256=6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc + SHA256=07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357 + SHA256=7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf + SHA256=7aaf2aa194b936e48bc90f01ee854768c8383c0be50cfb41b346666aec0cf853 + SHA256=7b0f442ac0bb183906700097d65aed0b4b9d8678f9a01aca864854189fe368e7 + SHA256=7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b + SHA256=7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7 + SHA256=7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21 + SHA256=7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4 + SHA256=7cfa5e10dff8a99a5d544b011f676bc383991274c693e21e3af40cf6982adb8c + SHA256=7d8937c18d6e11a0952e53970a0934cf0e65515637ac24d6ca52ccf4b93d385f + SHA256=7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea + SHA256=7da6113183328d4fddf6937c0c85ef65ba69bfe133b1146193a25bcf6ae1f9dd + SHA256=7dfc2eb033d2e090540860b8853036f40736d02bd22099ff6cf665a90be659cd + SHA256=7e3b0b8d3e430074109d85729201d7c34bc5b918c0bcb9f64ce88c5e37e1a456 + SHA256=7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d + SHA256=7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7 + SHA256=7ec93f34eb323823eb199fbf8d06219086d517d0e8f4b9e348d7afd41ec9fd5d + SHA256=7f5dc63e5742096e4accaca39ae77a2a2142b438c10f97860dee4054b51d3b35 + SHA256=7f190f6e5ab0edafd63391506c2360230af4c2d56c45fc8996a168a1fc12d457 + SHA256=7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa + SHA256=08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6 + SHA256=8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2 + SHA256=8bda0108de82ebeae82f43108046c5feb6f042e312fa0115475a9e32274fae59 + SHA256=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6 + SHA256=8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9 + SHA256=8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f + SHA256=8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775 + SHA256=8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9 + SHA256=8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2 + SHA256=8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126 + SHA256=8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c + SHA256=8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f + SHA256=8ef0ad86500094e8fa3d9e7d53163aa6feef67c09575c169873c494ed66f057f + SHA256=8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00 + SHA256=8f23313adb35782adb0ba97fefbfbb8bbc5fc40ae272e07f6d4629a5305a3fa2 + SHA256=8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a + SHA256=09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184 + SHA256=09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1 + SHA256=9a1d66036b0868bbb1b2823209fedea61a301d5dd245f8e7d390bd31e52d663e + SHA256=9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7 + SHA256=9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba + SHA256=9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c + SHA256=9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c + SHA256=9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194 + SHA256=9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285 + SHA256=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4 + SHA256=9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449 + SHA256=9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2 + SHA256=9d58f640c7295952b71bdcb456cae37213baccdcd3032c1e3aeb54e79081f395 + SHA256=9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4 + SHA256=9ee33ffd80611a13779df6286c1e04d3c151f1e2f65e3d664a08997fcd098ef3 + SHA256=9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5 + SHA256=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33 + SHA256=9f1025601d17945c3a47026814bdec353ee363966e62dba7fe2673da5ce50def + SHA256=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374 + SHA256=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 + SHA256=11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b + SHA256=12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56 + SHA256=14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8 + SHA256=15c53eb3a0ea44bbd2901a45a6ebeae29bb123f9c1115c38dfb2cdbec0642229 + SHA256=15fb486b6b8c2a2f1b067f48fba10c2f164638fe5e6cee618fb84463578ecac9 + SHA256=16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1 + SHA256=18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506 + SHA256=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6 + SHA256=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0 + SHA256=19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775 + SHA256=19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0 + SHA256=20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb + SHA256=21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21 + SHA256=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c + SHA256=23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade + SHA256=025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4 + SHA256=26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097 + SHA256=26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43 + SHA256=26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712 + SHA256=27cd05527feb020084a4a76579c125458571da8843cdfc3733211760a11da970 + SHA256=29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6 + SHA256=29e0062a017a93b2f2f5207a608a96df4d554c5de976bd0276c2590a03bd3e94 + SHA256=30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb + SHA256=31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a + SHA256=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427 + SHA256=31f4140c12ac31f5729a8de4dc051d3acd07783564604df831a2a6722c979192 + SHA256=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351 + SHA256=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993 + SHA256=34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3 + SHA256=34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf + SHA256=36aafa127736c7226c50061ea065f71e14f64ec60321f705bc52686d24117e0d + SHA256=36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb + SHA256=36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289 + SHA256=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9 + SHA256=37dde6bd8a7a36111c3ac57e0ac20bbb93ce3374d0852bcacc9a2c8c8c30079e + SHA256=38b3eb8c86201d26353aab625cea672e60c2f66ce6f5e5eda673e8c3478bf305 + SHA256=38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7 + SHA256=38c18db050b0b2b07f657c03db1c9595febae0319c746c3eede677e21cd238b0 + SHA256=38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20 + SHA256=38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a + SHA256=39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e + SHA256=42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb + SHA256=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f + SHA256=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89 + SHA256=45abdbcd4c0916b7d9faaf1cd08543a3a5178871074628e0126a6eda890d26e0 + SHA256=45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a + SHA256=45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26 + SHA256=45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef + SHA256=47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84 + SHA256=47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005 + SHA256=47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc + SHA256=49ed27460730b62403c1d2e4930573121ab0c86c442854bc0a62415ca445a810 + SHA256=49f75746eebe14e5db11706b3e58accc62d4034d2f1c05c681ecef5d1ad933ba + SHA256=50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793 + SHA256=50db5480d0392a7dd6ab5df98389dc24d1ed1e9c98c9c35964b19dabcd6dc67f + SHA256=51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5 + SHA256=53eaefba7e7dca9ab74e385abf18762f9f1aa51594e7f7db5ba612d6c787dd7e + SHA256=55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9 + SHA256=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a + SHA256=56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7 + SHA256=57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572 + SHA256=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495 + SHA256=58c071cfe72e9ee867bba85cbd0abe72eb223d27978d6f0650d0103553839b59 + SHA256=59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879 + SHA256=60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289 + SHA256=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813 + SHA256=61a1bdddd3c512e681818debb5bee94db701768fc25e674fcad46592a3259bd0 + SHA256=61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf + SHA256=61d6e40601fa368800980801a662a5b3b36e3c23296e8ae1c85726a56ef18cc8 + SHA256=62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0 + SHA256=64f9e664bc6d4b8f5f68616dd50ae819c3e60452efd5e589d6604b9356841b57 + SHA256=65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9 + SHA256=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890 + SHA256=69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2 + SHA256=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009 + SHA256=71ff60722231c7641ad593756108cf6779dbaad21c7b08065fb1d4e225eab14d + SHA256=72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1 + SHA256=72c0d2d699d0440db17cb7cbbc06a253eaafd21465f14bb0fed8b85ae73153d1 + SHA256=074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761 + SHA256=74a846c61adc53692d3040aff4c1916f32987ad72b07fe226e9e7dbeff1036c4 + SHA256=075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85 + SHA256=76b86543ce05540048f954fed37bdda66360c4a3ddb8328213d5aef7a960c184 + SHA256=76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524 + SHA256=76fb4deaee57ef30e56c382c92abffe2cf616d08dbecb3368c8ee6b02e59f303 + SHA256=077aa8ff5e01747723b6d24cc8af460a7a00f30cd3bc80e41cc245ceb8305356 + SHA256=77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9 + SHA256=79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57 + SHA256=79e87b93fbed84ec09261b3a0145c935f7dfe4d4805edfb563b2f971a0d51463 + SHA256=80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085 + SHA256=80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3 + SHA256=80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1 + SHA256=81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0 + SHA256=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d + SHA256=82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989 + SHA256=83f7be0a13c1fccf024c31da5c68c0ea1decf4f48fc39d6e4fd324bbe789ae8a + SHA256=84bf1d0bcdf175cfe8aea2973e0373015793d43907410ae97e2071b2c4b8e2d4 + SHA256=84df20b1d9d87e305c92e5ffae21b10b325609d59d835a954dbd8750ef5dabf4 + SHA256=86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882 + SHA256=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219 + SHA256=88df37ede18bea511f1782c1a6c4915690b29591cf2c1bf5f52201fbbb4fa2b9 + SHA256=88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc + SHA256=89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be + SHA256=89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7 + SHA256=092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0 + SHA256=93b266f38c3c3eaab475d81597abbd7cc07943035068bb6fd670dbbe15de0131 + SHA256=93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63 + SHA256=94be67c319a67de75ebed050d5537cfaa795d72bba52f3d8cf349e7bd075410e + SHA256=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3 + SHA256=97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd + SHA256=98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb + SHA256=98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8 + SHA256=99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1 + SHA256=119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280 + SHA256=131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6 + SHA256=133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743 + SHA256=146d77e80ca70ea5cb17bfc9a5cea92334f809cbdc87a51c2d10b8579a4b9c88 + SHA256=159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980 + SHA256=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347 + SHA256=221dfbc74bbb255b0879360ccc71a74b756b2e0f16e9386b38a9ce9d4e2e34f9 + SHA256=263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24 + SHA256=0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5 + SHA256=316a27e2bdb86222bc7c8af4e5472166b02aec7f3f526901ce939094e5861f6d + SHA256=358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69 + SHA256=362c4f3dadc9c393682664a139d65d80e32caa2a97b6e0361dfd713a73267ecc + SHA256=399effe75d32bdab6fa0a6bffe02dbf0a59219d940b654837c3be1c0bd02e9aa + SHA256=436ccab6f62fa2d29827916e054ade7acae485b3de1d3e5c6c62d3debf1480e7 + SHA256=453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233 + SHA256=455bc98ba32adab8b47d2d89bdbadca4910f91c182ab2fc3211ba07d3784537b + SHA256=0466dac557ee161503f5dfbd3549f81ec760c3d6c7c4363a21a03e7a3f66aca8 + SHA256=475e5016c9c0f5a127896f9179a1b1577a67b357f399ab5a1e68aab07134729a + SHA256=478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0 + SHA256=496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b + SHA256=506f953bbb285aeb8af0549eb24f52f3b7af36afe740afa36735bac70573ce28 + SHA256=523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba + SHA256=525d9b51a80ca0cd4c5889a96f857e73f3a80da1ffbae59851e0f51bdfb0b6cd + SHA256=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9 + SHA256=591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52 + SHA256=592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c + SHA256=600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0 + SHA256=607dc4c75ac7aef82ae0616a453866b3b358c6cf5c8f9d29e4d37f844306b97c + SHA256=626fae47811450d080d08c3d9fd890aa64bfecdc45eacd42a40850c1833c8763 + SHA256=654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad + SHA256=673b63b67345773cd6d66f6adcf2c753e2d949232bff818d5bb6e05786538d92 + SHA256=673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b + SHA256=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf + SHA256=727e8ba66a8ff07bdc778eacb463b65f2d7167a6616ca2f259ea32571cacf8af + SHA256=771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd + SHA256=818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01 + SHA256=823da894b2c73ffcd39e77366b6f1abf0ae9604d9b20140a54e6d55053aadeba + SHA256=845f1e228de249fc1ddf8dc28c39d03e8ad328a6277b6502d3932e83b879a65a + SHA256=862d0ff27bb086145a33b9261142838651b0d2e1403be321145e197600eb5015 + SHA256=881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461 + SHA256=900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88 + SHA256=904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a + SHA256=909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880 + SHA256=910aa4685c735d8c07662aa04fafec463185699ad1a0cd1967b892fc33ec6c3c + SHA256=916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677 + SHA256=923ebbe8111e73d5b8ecc2db10f8ea2629a3264c3a535d01c3c118a3b4c91782 + SHA256=927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a + SHA256=950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9 + SHA256=955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad + SHA256=984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7 + SHA256=1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4 + SHA256=1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c + SHA256=1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1 + SHA256=1766fd66f846d9a21e648d649ad35d1ff94f8ca17a40a9a738444d6b8e07aacb + SHA256=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52 + SHA256=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d + SHA256=2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22 + SHA256=2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109 + SHA256=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6 + SHA256=2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f + SHA256=2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2 + SHA256=3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5 + SHA256=3243aab18e273a9b9c4280a57aecef278e10bfff19abb260d7a7820e41739099 + SHA256=3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5 + SHA256=3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de + SHA256=3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a + SHA256=3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b + SHA256=3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3 + SHA256=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838 + SHA256=4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca + SHA256=4324f3d1e4007f6499a3d0f0102cd92ed9f554332bc0b633305cd7b957ff16c8 + SHA256=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b + SHA256=4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6 + SHA256=4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8 + SHA256=4941c4298f4560fc1e59d0f16f84bab5c060793700b82be2fd7c63735f1657a8 + SHA256=5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48 + SHA256=5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02 + SHA256=5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b + SHA256=5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c + SHA256=6071db01b50c658cf78665c24f1d21f21b4a12d16bfcfaa6813bf6bbc4d0a1e8 + SHA256=6191c20426dd9b131122fb97e45be64a4d6ce98cc583406f38473434636ddedc + SHA256=06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf + SHA256=7049f3c939efe76a5556c2a2c04386db51daf61d56b679f4868bb0983c996ebb + SHA256=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129 + SHA256=7236c8ff33c0e5cfa956778aa7303f1979f3bf709c361399fa1ce101b7e355b8 + SHA256=7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408 + SHA256=7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca + SHA256=8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60 + SHA256=8399e5afd8e3e97139dffb1a9fb00db2186321b427f164403282217cab067c38 + SHA256=8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b + SHA256=8797d9afc7a6bb0933f100a8acbb5d0666ec691779d522ac66c66817155b1c0d + SHA256=09043c51719d4bf6405c9a7a292bb9bb3bcc782f639b708ddcc4eedb5e5c9ce9 + SHA256=9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b + SHA256=9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6 + SHA256=9790a7b9d624b2b18768bb655dda4a05a9929633cef0b1521e79e40d7de0a05b + SHA256=17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca + SHA256=17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229 + SHA256=18712a063574bfec315d58577dfe413ab45b650e54747d1e18a56c3c7337a12c + SHA256=19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758 + SHA256=26453afb1f808f64bec87a2532a9361b696c0ed501d6b973a1f1b5ae152a4d40 + SHA256=28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7 + SHA256=30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab + SHA256=37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba + SHA256=40061b30b1243be76d5283cbc8abfe007e148097d4de7337670ff1536c4c7ba1 + SHA256=42579a759f3f95f20a2c51d5ac2047a2662a2675b3fb9f46c1ed7f23393a0f00 + SHA256=42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0 + SHA256=49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668 + SHA256=54841d9f89e195196e65aa881834804fe3678f1cf6b328cab8703edd15e3ec57 + SHA256=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347 + SHA256=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd + SHA256=67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc + SHA256=70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4 + SHA256=72288d4978ee87ea6c8b1566dbd906107357087cef7364fb3dd1e1896d00baeb + SHA256=72322fa8bba20df6966acbcf41e83747893fd173cd29de99b5ad1a5d3bf8f2de + SHA256=76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a + SHA256=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22 + SHA256=77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c + SHA256=78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f + SHA256=81939e5c12bd627ff268e9887d6fb57e95e6049f28921f3437898757e7f21469 + SHA256=85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94 + SHA256=86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675 + SHA256=89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10 + SHA256=092349aebdac28294dbad1656759d8461f362d1a36b01054dccf861d97beadf0 + SHA256=94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5 + SHA256=101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558 + SHA256=238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4 + SHA256=258359a7fa3d975620c9810dab3a6493972876a024135feaf3ac8482179b2e79 + SHA256=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073 + SHA256=385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039 + SHA256=405472a8f9400a54bb29d03b436ccd58cfd6442fe686f6d2ed4f63f002854659 + SHA256=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c + SHA256=509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6 + SHA256=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91 + SHA256=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b + SHA256=708016fbe22c813a251098f8f992b177b476bd1bbc48c2ed4a122ff74910a965 + SHA256=771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c + SHA256=810513b3f4c8d29afb46f71816350088caacf46f1be361af55b26f3fee4662c3 + SHA256=841335eeb6af68dce5b8b24151776281a751b95056a894991b23afae80e9f33b + SHA256=0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06 + SHA256=952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4 + SHA256=2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c + SHA256=3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf + SHA256=3390919bb28d5c36cc348f9ef23be5fa49bfd81263eb7740826e4437cbe904cd + SHA256=4422851a0a102f654e95d3b79c357ae3af1b096d7d1576663c027cfbc04abaf9 + SHA256=7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d + SHA256=7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c + SHA256=7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504 + SHA256=8939116df1d6c8fd0ebd14b2d37b3dec38a8820aa666ecd487bc1bb794f2a587 + SHA256=9778136d2441439dc470861d15d96fa21dc9f16225232cd05b76791a5e0fde6f + SHA256=16768203a471a19ebb541c942f45716e9f432985abbfbe6b4b7d61a798cea354 + SHA256=18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805 + SHA256=22418016e980e0a4a2d01ca210a17059916a4208352c1018b0079ccb19aaf86a + SHA256=36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10 + SHA256=36875562e747136313ec5db58174e5fab870997a054ca8d3987d181599c7db6a + SHA256=0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3 + SHA256=55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa + SHA256=65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3 + SHA256=65025741ecd0ef516da01319b42c2d96e13cb8d78de53fb7e39cd53ea6d58c75 + SHA256=91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c + SHA256=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82 + SHA256=696679114f6a106ec94c21e2a33fe17af86368bcf9a796aaea37ea6e8748ad6a + SHA256=910479467ef17b9591d8d42305e7f6f247ad41c60ec890a1ffbe331f495ed135 + SHA256=8111085022bda87e5f6aa4c195e743cc6dd6a3a6d41add475d267dc6b105a69f + SHA256=9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d + SHA256=46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7 + SHA256=48891874441c6fa69e5518d98c53d83b723573e280c6c65ccfbde9039a6458c9 + SHA256=6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa + SHA256=a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1 + SHA256=a3e507e713f11901017fc328186ae98e23de7cea5594687480229f77d45848d8 + SHA256=a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad + SHA256=a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062 + SHA256=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc + SHA256=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200 + SHA256=a56c2a2425eb3a4260cc7fc5c8d7bed7a3b4cd2af256185f24471c668853aee8 + SHA256=a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df + SHA256=a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d + SHA256=a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5 + SHA256=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3 + SHA256=a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e + SHA256=a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499 + SHA256=a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9 + SHA256=a7860e110f7a292d621006b7208a634504fb5be417fd71e219060381b9a891e6 + SHA256=a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e + SHA256=a9706e320179993dade519a83061477ace195daa1b788662825484813001f526 + SHA256=a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433 + SHA256=a2353030d4ea3ad9e874a0f7ff35bbfa10562c98c949d88cabab27102bbb8e48 + SHA256=a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4 + SHA256=aa9ab1195dc866270e984f1bed5e1358d6ef24c515dfdb6c2a92d1e1b94bf608 + SHA256=aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c + SHA256=aafb95a443911e4c67d4e45ffa83cca103c91b42915b81100534dc439bec0c1b + SHA256=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89 + SHA256=ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd + SHA256=ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a + SHA256=ac3f613d457fc4d44fa27b2e0b1baa62c09415705efb5a40a4756da39b3ac165 + SHA256=ac63c26ca43701dddaa7fb1aea535d42190f88752900a03040fd5aaa24991e25 + SHA256=ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833 + SHA256=ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b + SHA256=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173 + SHA256=ad2477632b9b07588cfe0e692f244c05fa4202975c1fe91dd3b90fa911ac6058 + SHA256=ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47 + SHA256=adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee + SHA256=ae6fb53e4d8122dba3a65e5fa59185b36c3ac9df46e82fcfb6731ab55c6395aa + SHA256=ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471 + SHA256=ae79e760c739d6214c1e314728a78a6cb6060cce206fde2440a69735d639a0a2 + SHA256=aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399 + SHA256=af095de15a16255ca1b2c27dad365dff9ac32d2a75e8e288f5a1307680781685 + SHA256=af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a + SHA256=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508 + SHA256=b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414 + SHA256=b2ba6efeff1860614b150916a77c9278f19d51e459e67a069ccd15f985cbc0e1 + SHA256=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29 + SHA256=b4d47ea790920a4531e3df5a4b4b0721b7fea6b49a35679f0652f1e590422602 + SHA256=b6fd51e1f57a03006953e84fd56cc2821cc19e7c77c0474e1110aabaacaf03df + SHA256=b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d + SHA256=b8b94c2646b62f6ac08f16514b6efaa9866aa3c581e4c0435a7aeafe569b2418 + SHA256=b9a4e40a5d80fedd1037eaed958f9f9efed41eb01ada73d51b5dcd86e27e0cbf + SHA256=b9b3878ddc5dfb237d38f8d25067267870afd67d12a330397a8853209c4d889c + SHA256=b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a + SHA256=b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b + SHA256=b47be212352d407d0ef7458a7161c66b47c2aec8391dd101df11e65728337a6a + SHA256=b48a309ee0960da3caaaaf1e794e8c409993aeb3a2b64809f36b97aac8a1e62a + SHA256=b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e + SHA256=b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5 + SHA256=b95b2d9b29bd25659f1c7ba5a187f8d23cde01162d9b5b1a2c4aea8f64b38441 + SHA256=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de + SHA256=b1334a71cc73b3d0c54f62d8011bec330dfc355a239bf94a121f6e4c86a30a2e + SHA256=b1867d13a4cab66a76f4d4448824ca0cb3a176064626f9618c0c103ee3cb4f47 + SHA256=b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0 + SHA256=b61869b7945be062630f1dd4bae919aecee8927f7e1bc3954a21ff763f4c0867 + SHA256=b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704 + SHA256=b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3 + SHA256=bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa + SHA256=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc + SHA256=bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955 + SHA256=bb68552936a6b0a68fb53ce864a6387d2698332aac10a7adfdd5a48b97027ce3 + SHA256=bc7ebd191e0991fd0865a5c956a92e63792a0bb2ff888af43f7a63bb65a22248 + SHA256=bc13adeb6bf62b1e10ef41205ef92382e6c18d6a20669d288a0b11058e533d63 + SHA256=bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f + SHA256=bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f + SHA256=bda99629ec6c522c3efcbcc9ca33688d31903146f05b37d0d3b43db81bfb3961 + SHA256=bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c + SHA256=bdcacee3695583a0ca38b9a786b9f7334bf2a9a3387e4069c8e6ca378b2791d0 + SHA256=be03e9541f56ac6ed1e81407dcd7cc85c0ffc538c3c2c2c8a9c747edbcf13100 + SHA256=be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2 + SHA256=be54f7279e69fb7651f98e91d24069dbc7c4c67e65850e486622ccbdc44d9a57 + SHA256=c1c4310e5d467d24e864177bdbfc57cb5d29aac697481bfa9c11ddbeebfd4cc8 + SHA256=c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8 + SHA256=c2fcc0fec64d5647813b84b9049d430406c4c6a7b9f8b725da21bcae2ff12247 + SHA256=c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e + SHA256=c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9 + SHA256=c9b49b52b493b53cd49c12c3fa9553e57c5394555b64e32d1208f5b96a5b8c6e + SHA256=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8 + SHA256=c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924 + SHA256=c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26 + SHA256=c60fcff9c8e5243bbb22ec94618b9dcb02c59bb49b90c04d7d6ab3ebbd58dc3a + SHA256=c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc + SHA256=c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa + SHA256=c344e92a6d06155a217a9af7b4b35e6653665eec6569292e7b2e70f3a3027646 + SHA256=c470c9db58840149ce002f3e6003382ecf740884a683bae8f9d10831be218fa2 + SHA256=c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2 + SHA256=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5 + SHA256=c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada + SHA256=c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c + SHA256=c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d + SHA256=c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c + SHA256=c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd + SHA256=caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab + SHA256=cb57f3a7fe9e1f8e63332c563b0a319b26c944be839eabc03e9a3277756ba612 + SHA256=cb9890d4e303a4c03095d7bc176c42dee1b47d8aa58e2f442ec1514c8f9e3cec + SHA256=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6 + SHA256=cc383ad11e9d06047a1558ed343f389492da3ac2b84b71462aee502a2fa616c8 + SHA256=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64 + SHA256=cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b + SHA256=cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb + SHA256=cdd2a4575a46bada4837a6153a79c14d60ee3129830717ef09e0e3efd9d00812 + SHA256=cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc + SHA256=ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2 + SHA256=cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986 + SHA256=cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b + SHA256=cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190 + SHA256=cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb + SHA256=cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40 + SHA256=cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b + SHA256=cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab + SHA256=cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c + SHA256=d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889 + SHA256=d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605 + SHA256=d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f + SHA256=d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9 + SHA256=d7bc7306cb489fe4c285bbeddc6d1a09e814ef55cf30bd5b8daf87a52396f102 + SHA256=d7ddf874304556f8a10942a29b3d387cb5155a7419f87813557fe728cb14806d + SHA256=d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0 + SHA256=d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530 + SHA256=d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482 + SHA256=d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2 + SHA256=d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f + SHA256=d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3 + SHA256=d5562fb90b0b3deb633ab335bcbd82ce10953466a428b3f27cb5b226b453eaf3 + SHA256=d5586dc1e61796a9ae5e5d1ced397874753056c3df2eb963a8916287e1929a71 + SHA256=d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476 + SHA256=d8459f7d707c635e2c04d6d6d47b63f73ba3f6629702c7a6e0df0462f6478ae2 + SHA256=d25904fbf907e19f366d54962ff543d9f53b8fdfd2416c8b9796b6a8dd430e26 + SHA256=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e + SHA256=d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d + SHA256=d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1 + SHA256=da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24 + SHA256=da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d + SHA256=db2a9247177e8cdd50fe9433d066b86ffd2a84301aa6b2eb60f361cfff077004 + SHA256=db90e554ad249c2bd888282ecf7d8da4d1538dd364129a3327b54f8242dd5653 + SHA256=dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98 + SHA256=dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed + SHA256=dbe9f17313e1164f06401234b875fbc7f71d41dc7271de643865af1358841fef + SHA256=dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258 + SHA256=dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097 + SHA256=dd573f23d656818036fc9ae1064eda31aca86acb9bc44a6e127db3ea112a9094 + SHA256=dde6f28b3f7f2abbee59d4864435108791631e9cb4cdfb1f178e5aa9859956d8 + SHA256=de6bf572d39e2611773e7a01f0388f84fb25da6cba2f1f8b9b36ffba467de6fa + SHA256=de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c + SHA256=de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5 + SHA256=dec8a933dba04463ed9bb7d53338ff87f2c23cfb79e0e988449fc631252c9dcc + SHA256=ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d + SHA256=deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578 + SHA256=df0cc4e5c9802f8edaefeb130e375cad56b2c5490d8ebd77d8dbdcc6fdc7ecb6 + SHA256=df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15 + SHA256=dfaefd06b680f9ea837e7815fc1cc7d1f4cc375641ac850667ab20739f46ad22 + SHA256=e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b + SHA256=e2d8dd5dacc24051709f55a35184f5f99aef957a83bd358b0608b4479e1ec24f + SHA256=e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6 + SHA256=e3b257357be41a18319332df7023c4407e2b93ac4c9e0c6754032e29f3763eac + SHA256=e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918 + SHA256=e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd + SHA256=e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb + SHA256=e4c154a0073bbad3c9f8ab7218e9b3be252ae705c20c568861dae4088f17ffcc + SHA256=e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036 + SHA256=e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148 + SHA256=e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1 + SHA256=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53 + SHA256=e5b0772be02e2bc807804874cf669e97aa36f5aff1f12fa0a631a3c7b4dd0dc8 + SHA256=e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f + SHA256=e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48 + SHA256=e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f + SHA256=e50b25d94c1771937b2f632e10eea875ac6b19c57da703d52e23ad2b6299f0ae + SHA256=e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90 + SHA256=e61a54f6d3869b43c4eceac3016df73df67cce03878c5a6167166601c5d3f028 + SHA256=e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a + SHA256=e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4 + SHA256=e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f + SHA256=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf + SHA256=e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2 + SHA256=e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9 + SHA256=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf + SHA256=e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa + SHA256=e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06 + SHA256=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790 + SHA256=e81230217988f3e7ec6f89a06d231ec66039bdba340fd8ebb2bbb586506e3293 + SHA256=ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3 + SHA256=ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41 + SHA256=ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3 + SHA256=ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5 + SHA256=ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566 + SHA256=ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c + SHA256=ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282 + SHA256=ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39 + SHA256=ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7 + SHA256=ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe + SHA256=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b + SHA256=ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850 + SHA256=ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0 + SHA256=f1c8ca232789c2f11a511c8cd95a9f3830dd719cad5aa22cb7c3539ab8cb4dc3 + SHA256=f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b + SHA256=f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe + SHA256=f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f + SHA256=f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1 + SHA256=f37d609ea1f06660d970415dd3916c4c153bb5940bf7d2beb47fa34e8a8ffbfc + SHA256=f51bdb0ad924178131c21e39a8ccd191e46b5512b0f2e1cc8486f63e84e5d960 + SHA256=f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c + SHA256=f84f8173242b95f9f3c4fea99b5555b33f9ce37ca8188b643871d261cb081496 + SHA256=f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004 + SHA256=f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439 + SHA256=f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d + SHA256=f88ebb633406a086d9cca6bc8b66a4ea940c5476529f9033a9e0463512a23a57 + SHA256=f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af + SHA256=f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960 + SHA256=f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008 + SHA256=f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145 + SHA256=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65 + SHA256=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35 + SHA256=f8886a9c759e0426e08d55e410b02c5b05af3c287b15970175e4874316ffaf13 + SHA256=f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b + SHA256=f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478 + SHA256=f85784fa8e7a7ec86cb3fe76435802f6bb82256e1824ed7b5d61bf075f054573 + SHA256=f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54 + SHA256=f9895458e73d4b0ef01eda347fb695bb00e6598d9f5e2506161b70ad96bb7298 + SHA256=f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b + SHA256=fa875178ae2d7604d027510b0d0a7e2d9d675e10a4c9dda2d927ee891e0bcb91 + SHA256=fafa1bb36f0ac34b762a10e9f327dcab2152a6d0b16a19697362d49a31e7f566 + SHA256=fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22 + SHA256=fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f + SHA256=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2 + SHA256=fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c + SHA256=fcdfe570e6dc6e768ef75138033d9961f78045adca53beb6fdb520f6417e0df1 + SHA256=fd33fb2735cc5ef466a54807d3436622407287e325276fcd3ed1290c98bd0533 + SHA256=fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c + SHA256=fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03 + SHA256=fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280 + SHA256=ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7 + SHA256=ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339 + SHA256=ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5 + SHA256=ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f + + + SHA256=56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c + SHA256=06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4 + SHA256=86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62 + SHA256=06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f + SHA256=8dafe5f3d0527b66f6857559e3c81872699003e0f2ffda9202a1b5e29db2002e + SHA256=81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1 + SHA256=6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724 + SHA256=ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620 + SHA256=0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc + SHA256=c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c + SHA256=e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d + SHA256=18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7 + SHA256=139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988 + SHA256=b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427 + SHA256=1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e + SHA256=6b5cf41512255237064e9274ca8f8a3fef820c45aa6067c9c6a0e6f5751a0421 + SHA256=0d10c4b2f56364b475b60bd2933273c8b1ed2176353e59e65f968c61e93b7d99 + SHA256=ad938d15ecfd70083c474e1642a88b078c3cea02cdbddf66d4fb1c01b9b29d9a + SHA256=89698cad598a56f9e45efffd15d1841e494a2409cc12279150a03842cd6bb7f3 + SHA256=5f6fec8f7890d032461b127332759c88a1b7360aa10c6bd38482572f59d2ba8b + SHA256=fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5 + SHA256=05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4 + SHA256=6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77 + SHA256=6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f + SHA256=32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d + SHA256=fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8 + SHA256=6839fcae985774427c65fe38e773aa96ec451a412caa5354ad9e2b9b54ffe6c1 + SHA256=f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a + SHA256=7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376 + SHA256=96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc + SHA256=b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3 + SHA256=e6a7b0bc01a627a7d0ffb07faddb3a4dd96b6f5208ac26107bdaeb3ab1ec8217 + SHA256=200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a + SHA256=8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce + SHA256=c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497 + SHA256=23e89fd30a1c7db37f3ea81b779ce9acf8a4294397cbb54cff350d54afcfd931 + SHA256=575e58b62afab094c20c296604dc3b7dd2e1a50f5978d8ee24b7dca028e97316 + SHA256=5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d + SHA256=e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12 + SHA256=9bb09752cf3a464455422909edef518ac18fe63cf5e1e8d9d6c2e68db62e0c87 + SHA256=f8236fc01d4efaa48f032e301be2ebba4036b2cd945982a29046eca03944d2ae + SHA256=e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e + SHA256=9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c + SHA256=f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280 + SHA256=9c2f3e9811f7d0c7463eaa1ee6f39c23f902f3797b80891590b43bbe0fdf0e51 + SHA256=b8807e365be2813b7eccd2e4c49afb0d1e131086715638b7a6307cd7d7e9556c + SHA256=50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76 + SHA256=52d5c35325ce701516f8b04380c9fbdb78ec6bcc13b444f758fdb03d545b0677 + SHA256=7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6 + SHA256=8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104 + SHA256=8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330 + SHA256=4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4 + SHA256=88076e98d45ed3adf0c5355411fe8ca793eb7cec1a1c61f5e1ec337eae267463 + SHA256=749b0e8c8c8b7dda8c2063c708047cfe95afa0a4d86886b31a12f3018396e67c + SHA256=49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530 + SHA256=d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c + SHA256=f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d + SHA256=5c1585b1a1c956c7755429544f3596515dfdf928373620c51b0606a520c6245a + SHA256=5bc3994612624da168750455b363f2964e1861dba4f1c305df01b970ac02a7ae + SHA256=bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df + SHA256=42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25 + SHA256=f461414a2596555cece5cfee65a3c22648db0082ca211f6238af8230e41b3212 + SHA256=770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a @@ -9667,4 +10740,4 @@ - + \ No newline at end of file From 9b94ebd424797b499b54298301f2ba62e7f82190 Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Thu, 7 Sep 2023 09:12:41 -0400 Subject: [PATCH 455/471] Delete .gitignore Not used? --- .gitignore | 2 -- 1 file changed, 2 deletions(-) delete mode 100644 .gitignore diff --git a/.gitignore b/.gitignore deleted file mode 100644 index 44c9f960..00000000 --- a/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -sysmonconfig-export.xml.bak -/Graylog_Content_Pack/ From 3aecb5d3abafe38627a8dad4da22dd239dec9ceb Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Thu, 7 Sep 2023 09:28:23 -0400 Subject: [PATCH 456/471] Added PS scripts to install Sysmon with Config --- .gitignore | 2 -- Sysmon Install.ps1 | 59 ++++++++++++++++++++++++++++++++++++++++++ SysmonUpdateConfig.ps1 | 23 ++++++++++++++++ 3 files changed, 82 insertions(+), 2 deletions(-) delete mode 100644 .gitignore create mode 100644 Sysmon Install.ps1 create mode 100644 SysmonUpdateConfig.ps1 diff --git a/.gitignore b/.gitignore deleted file mode 100644 index 44c9f960..00000000 --- a/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -sysmonconfig-export.xml.bak -/Graylog_Content_Pack/ diff --git a/Sysmon Install.ps1 b/Sysmon Install.ps1 new file mode 100644 index 00000000..4394b2ad --- /dev/null +++ b/Sysmon Install.ps1 @@ -0,0 +1,59 @@ +#Author: NerbalOne +#This PowerShell script will first create the Sysmon folder if it does not exist. It will then download Sysmon.exe, which supports both 32 bit and 64 bit, along with the Sysmon config and Sysmon Update script. It will then install Sysmon with the config and create a Scheduled Task to run hourly to update the Sysmon config. + +# Define Sysmon URLs +$sysmonURL = "https://live.sysinternals.com/sysmon.exe" +$sysmonConfigURL = "https://raw.githubusercontent.com/NerbalOne/sysmon-config/master/sysmonconfig-export.xml" +$sysmonUpdateConfig = "https://raw.githubusercontent.com/NerbalOne/sysmon-config/master/SysmonUpdateConfig.ps1" + +# Define Local Path for Sysmon File and Sysmon Config +$sysmonPath = "C:\Programdata\Sysmon\sysmon.exe" +$sysmonConfigPath = "C:\Programdata\Sysmon\sysmonconfig-export.xml" +$sysmonUpdatePath = "C:\Programdata\Sysmon\SysmonUpdateConfig.ps1" +$sysmonFolderPath = "C:\ProgramData\Sysmon\" + +# Create Sysmon Folder if it Doesn't Exist +if (-not (Test-Path $sysmonFolderPath)) { + # Create the Folder + try { + New-Item -ItemType Directory -Path $sysmonFolderPath -Force + Write-Host "Folder created successfully at $folderPath" + } + catch { + Write-Host "Error creating the folder: $_" + } +} +else { + Write-Host "The folder already exists at $folderPath" +} + +# Download Sysmon, Config, and Update Script +Invoke-WebRequest -Uri $sysmonURL -OutFile $sysmonPath +Invoke-WebRequest -Uri $sysmonConfigURL -OutFile $sysmonConfigPath +Invoke-WebRequest -Uri $sysmonUpdateConfig -OutFile $sysmonUpdatePath + +# Install Sysmon with Config +Start-Process -FilePath $sysmonPath -ArgumentList "-accepteula -i $sysmonConfigPath" -NoNewWindow -Wait + +# Create a New Scheduled Task +Start-Process schtasks.exe -ArgumentList '/Create /RU SYSTEM /RL HIGHEST /SC HOURLY /TN Update_Sysmon_Rules /TR "powershell.exe -ExecutionPolicy Bypass -File "C:\Programdata\Sysmon\SysmonUpdateConfig.ps1"" /f' -Wait -WindowStyle Hidden +Start-Process schtasks.exe -ArgumentList '/Run /TN Update_Sysmon_Rules' -Wait -WindowStyle Hidden + +# Define Sysmon service Name +$sysmonServiceName = "Sysmon" + +# Check if Sysmon Service Exists +try { + $service = Get-Service -Name $sysmonServiceName -ErrorAction Stop + Write-Output "Sysmon service exists" +} catch { + Throw "Sysmon service does not exist" +} + +# Check if Scheduled Task is Created Successfully +try { + $task = Get-ScheduledTask -TaskName "Update_Sysmon_Rules" -ErrorAction Stop + Write-Output "Scheduled task created successfully" +} catch { + Throw "Scheduled task creation failed" +} diff --git a/SysmonUpdateConfig.ps1 b/SysmonUpdateConfig.ps1 new file mode 100644 index 00000000..45db31db --- /dev/null +++ b/SysmonUpdateConfig.ps1 @@ -0,0 +1,23 @@ +#Author: NerbalOne +#This PowerShell script will first download the latest Sysmon config. Then it will apply this config to Sysmon. + +# Define Sysmon Path +$sysmonPath = "C:\ProgramData\Sysmon\sysmon.exe" +$sysmonConfigPath = "C:\ProgramData\Sysmon\sysmonconfig-export.xml" + +# Define Sysmon Config URL +$sysmonConfigURL = "https://raw.githubusercontent.com/NerbalOne/sysmon-config/master/sysmonconfig-export.xml" + +# Download the Latest Sysmon Config +Invoke-WebRequest -Uri $sysmonConfigURL -OutFile $sysmonConfigPath + +# Run sysmon.exe with Config +& $sysmonPath -c $sysmonConfigPath + +# Check the Exit Code of the Previous Command +if ($LASTEXITCODE -eq 0) { + Write-Output "Sysmon executed successfully." +} else { + Write-Output "Sysmon execution failed." +} + From e60c40b72a6ff1e19e73d17df84a86dd4a77a7e0 Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Thu, 7 Sep 2023 09:30:45 -0400 Subject: [PATCH 457/471] Delete Auto_Update.bat --- Auto_Update.bat | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 Auto_Update.bat diff --git a/Auto_Update.bat b/Auto_Update.bat deleted file mode 100644 index 25685148..00000000 --- a/Auto_Update.bat +++ /dev/null @@ -1,5 +0,0 @@ -@echo on -cd C:\ProgramData\sysmon\ -@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" -sysmon64 -c sysmonconfig-export.xml -exit From 729a19816316830375a268a180189b6a00d68693 Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Thu, 7 Sep 2023 09:31:11 -0400 Subject: [PATCH 458/471] Delete Install Sysmon.bat --- Install Sysmon.bat | 28 ---------------------------- 1 file changed, 28 deletions(-) delete mode 100644 Install Sysmon.bat diff --git a/Install Sysmon.bat b/Install Sysmon.bat deleted file mode 100644 index d14c506b..00000000 --- a/Install Sysmon.bat +++ /dev/null @@ -1,28 +0,0 @@ -@echo off -setlocal -set hour=%time:~0,2% -set minute=%time:~3,2% -set /A minute+=2 -if %minute% GTR 59 ( - set /A minute-=60 - set /A hour+=1 -) -if %hour%==24 set hour=00 -if "%hour:~0,1%"==" " set hour=0%hour:~1,1% -if "%hour:~1,1%"=="" set hour=0%hour% -if "%minute:~1,1%"=="" set minute=0%minute% -set tasktime=%hour%:%minute% -mkdir C:\ProgramData\sysmon -pushd "C:\ProgramData\sysmon\" -echo [+] Downloading Sysmon... -@powershell (new-object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon.exe','C:\ProgramData\sysmon\sysmon.exe')" -echo [+] Downloading Sysmon config... -@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml','C:\ProgramData\sysmon\sysmonconfig-export.xml')" -@powershell (new-object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ion-storm/sysmon-config/master/Auto_Update.bat','C:\ProgramData\sysmon\Auto_Update.bat')" -sysmon.exe -accepteula -i sysmonconfig-export.xml -sc failure Sysmon actions= restart/10000/restart/10000// reset= 120 -echo [+] Sysmon Successfully Installed! -echo [+] Creating Auto Update Task set to Hourly.. -SchTasks /Create /RU SYSTEM /RL HIGHEST /SC HOURLY /TN Update_Sysmon_Rules /TR C:\ProgramData\sysmon\Auto_Update.bat /F /ST %tasktime% -timeout /t 10 -exit \ No newline at end of file From 470a8b9e634a1b2074b17a0bb0890382cae3a005 Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Fri, 8 Sep 2023 08:34:25 -0400 Subject: [PATCH 459/471] Updating grammar and links. --- README.md | 46 +++++++++++++++++++++------------------------- 1 file changed, 21 insertions(+), 25 deletions(-) diff --git a/README.md b/README.md index f41fe5e2..86b43a47 100644 --- a/README.md +++ b/README.md @@ -1,26 +1,26 @@ # Sysmon ATT&CK Configuration # -The file provided should function as a great starting point for system monitoring in a self-contained package. This configuration and results should give you a good idea of what's possible for Sysmon. +The file provided should function as a great starting point for system monitoring in a self-contained package. This configuration and results should give you a good idea of what's possible for Sysmon. Please beware that you may need to fine tune and add exclusions depending on your environment. High CPU usage may be seen if exclusions are not added and one or more rules are firing off multiple times every second. -      **[sysmonconfig-export.xml](https://github.com/ion-storm/sysmon-config/blob/master/sysmonconfig-export.xml)** +      **[sysmonconfig-export.xml](https://github.com/NerbalOne/sysmon-config/blob/master/sysmonconfig-export.xml)** -Pull requests and issue tickets are welcome, and new additions will be credited in-line or on Git, tag your name with Author=YourName within the rulename field. +Pull requests and issue tickets are welcomed. Any new additions will be credited in-line or on Git. Tag your name with Author=YourName within the rulename field. -This Sysmon ATT&CK Configuration is designed "Explicitly" to enrich your SIEM for threat intelligence, forensics, UEBA, use cases. You'll want to create a key-value parser for the +This Sysmon ATT&CK Configuration is designed "Explicitly" to enrich your SIEM for threat intelligence, forensics, and UEBA use cases. You'll want to create a key-value parser for the rulename field to create field names per event within your SIEM. -Ideally this is best used with an Alerting Repository/Index where the "Alert=" field is marked and a non-alerting visibility index/repository where threat hunting, investigations can be done -that contains added context and story line information of user behavior and activity leading up to an attack. Non-Alerting Visibility rules are tagged with Desc=, and Forensic= and are -meant to provide contextual information for analysts to build cases and identify what is happening with SIEM enrichments. Some of these non-alerting visibility rules can be graduated +Ideally this is best used with an Alerting Repository/Index where the "Alert=" field is marked and a non-alerting visibility index/repository where threat hunting and investigations can be done +that contains added context and story line information of user behavior and activity leading up to an attack. Non-Alerting visibility rules are tagged with "Desc=" and "Forensic=" and are +meant to provide contextual information for analysts to build cases and identify what is happening with SIEM enrichments. Some of these non-alerting visibility rules can be graduated to the Alerting rules or can be used with correlation rules within a SIEM/SOAR/XDR. The goal with this configuration is a "Control" configuration that provides ultimate visibility that should be ran in conjunction with an EDR. -As we know, allot of EDR's today provide little contextual information, forensic information that is tagged, categorized, risk rated, some alerts EDR vendors choose to not alert -on due to the differences between each environment and how hard it is to baseline some detections. There is many use cases where EDR's fall short, they are not the greatest at -identifying suspicious activity that may fall short of being labeled as malicious. The goal here is to detect all common user activity that would lead to exfiltration, infiltration, -malware, malicious activity, questionable activity. If a user is poking around the registry, sending data to cloud storage, downloading and executing random attachments and files, -copying files, we want to know. We also want to leave an audit trail by monitoring the registry, artifact locations and provide our forensic analysts as much detail as possible. +As we know, allot of EDR's today provide little contextual information, forensic information that is tagged, categorized, risk rated, and some alerts EDR vendors choose to not alert +on due to the differences between each environment and how hard it is to baseline some detections. There is many use cases where EDR's fall short. They are not the greatest at +identifying suspicious activity that may fall short of being labeled as malicious. The goal here is to detect all common user activity that would lead to exfiltration, infiltration, +malware, malicious activity, and questionable activity. If a user is poking around the registry, sending data to cloud storage, downloading and executing random attachments and files, and/or +copying files, we want to know. We also want to leave an audit trail by monitoring the registry, artifact locations, and provide our forensic analysts as much detail as possible. -If you have forensic registry keys, file locations, artifacts, behavior detections and anything that may be beneficial here, feel free to put in a pull request. -The goal here is as much visibility as possible, with accurate alerts that are not noisy. +If you have forensic registry keys, file locations, artifacts, behavior detections, and anything that may be beneficial here, feel free to put in a pull request. +The goal here is as much visibility as possible with accurate alerts that are not noisy. This now has an Auto Updater script to update to the latest Sysmon config hourly. This is great for mass deployments without having to manually update thousands of systems. @@ -28,24 +28,26 @@ This now has an Auto Updater script to update to the latest Sysmon config hourly ## Use ## ### Auto-Install with Auto Update Script:### +The two below PowerShell scripts that are contained in this repo will download and install Sysmon and the config along with creating a scheduled task to run hourly to update the config. ~~~~ -Install Sysmon.bat +Sysmon Install.ps1 +SysmonUpdateConfig.ps1 ~~~~ ### Install ### -Run with administrator rights +Run with administrator rights. ~~~~ sysmon.exe -accepteula -i sysmonconfig-export.xml ~~~~ -### Update existing configuration ### -Run with administrator rights +### Update Existing Configuration ### +Run with administrator rights. ~~~~ sysmon.exe -c sysmonconfig-export.xml ~~~~ ### Uninstall ### -Run with administrator rights +Run with administrator rights. ~~~~ sysmon.exe -u ~~~~ @@ -56,9 +58,3 @@ Hide: sc sdset Sysmon D:(D;;DCLCWPDTSD;;;IU)(D;;DCLCWPDTSD;;;SU)(D;;DCLCWPDTSD;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) Restore: sc sdset Sysmon D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) - -~~~~ - -### Graylog Configuration ### - -(https://github.com/ion-storm/Graylog_Sysmon) From 3b462032a84334f4831383ec2034c7cd5b9ac329 Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Fri, 8 Sep 2023 08:38:08 -0400 Subject: [PATCH 460/471] Update README.md --- README.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/README.md b/README.md index 86b43a47..f88e91ab 100644 --- a/README.md +++ b/README.md @@ -22,9 +22,6 @@ copying files, we want to know. We also want to leave an audit trail by monitori If you have forensic registry keys, file locations, artifacts, behavior detections, and anything that may be beneficial here, feel free to put in a pull request. The goal here is as much visibility as possible with accurate alerts that are not noisy. - -This now has an Auto Updater script to update to the latest Sysmon config hourly. This is great for mass deployments without having to manually update thousands of systems. - ## Use ## ### Auto-Install with Auto Update Script:### From 559a4e799c68ebdbbaf06af7e6dcdba4b6c25187 Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Fri, 8 Sep 2023 08:38:19 -0400 Subject: [PATCH 461/471] Update README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index f88e91ab..66dc3dbf 100644 --- a/README.md +++ b/README.md @@ -22,6 +22,7 @@ copying files, we want to know. We also want to leave an audit trail by monitori If you have forensic registry keys, file locations, artifacts, behavior detections, and anything that may be beneficial here, feel free to put in a pull request. The goal here is as much visibility as possible with accurate alerts that are not noisy. + ## Use ## ### Auto-Install with Auto Update Script:### From e7830ee26fc7aa95571e62bc2e079c8c2e6ee2ed Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Fri, 8 Sep 2023 08:38:51 -0400 Subject: [PATCH 462/471] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 66dc3dbf..b0bab9fc 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ The goal here is as much visibility as possible with accurate alerts that are no ## Use ## -### Auto-Install with Auto Update Script:### +### Auto Install with Auto Update Script ### The two below PowerShell scripts that are contained in this repo will download and install Sysmon and the config along with creating a scheduled task to run hourly to update the config. ~~~~ Sysmon Install.ps1 From 6c3876d4404e8e1db1bb695b572dc549f951990c Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Fri, 8 Sep 2023 13:09:28 -0400 Subject: [PATCH 463/471] Update Sysmon Install.ps1 --- Sysmon Install.ps1 | 1 + 1 file changed, 1 insertion(+) diff --git a/Sysmon Install.ps1 b/Sysmon Install.ps1 index 4394b2ad..48ae560a 100644 --- a/Sysmon Install.ps1 +++ b/Sysmon Install.ps1 @@ -28,6 +28,7 @@ else { } # Download Sysmon, Config, and Update Script +[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Invoke-WebRequest -Uri $sysmonURL -OutFile $sysmonPath Invoke-WebRequest -Uri $sysmonConfigURL -OutFile $sysmonConfigPath Invoke-WebRequest -Uri $sysmonUpdateConfig -OutFile $sysmonUpdatePath From d34a18e011d2530aab296d5424b3f5acec363656 Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Fri, 8 Sep 2023 14:45:26 -0400 Subject: [PATCH 464/471] Added exclusions and fixed some rules. --- sysmonconfig-export.xml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index c2283c19..0905da02 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -7446,7 +7446,7 @@ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{;}\EDGEMITMP_;.tmp\setup.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe C:\Program Files\Microsoft Office\root\integration\integrator.exe - C:\Program Files\Google\Chrome Beta\Application\;\Installer\setup.exe + \Installer\setup.exe;C:\Program Files\Google\Chrome Beta\Application\ C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\;\OfficeClickToRun.exe @@ -9084,6 +9084,8 @@ Anonymous Pipe + C:\Program Files\Cavelo\Cavelo Agent\cavelo_windows_amd64.exe;C:\Program Files\Cavelo\Cavelo Agent\parser.exe + C:\Program Files (x86)\N-Able Technologies\AutomationManagerAgent\AutomationManager.AgentService.exe;\AutomationManager.ScriptRunner64.exe @@ -9383,6 +9385,7 @@ C:\Program Files (x86)\CheckPoint\ C:\Program Files (x86)\Fortinet\ C:\Program Files\SentinelOne\ + \Ranger\SentinelRanger.exe C:\Program Files (x86)\OpenDNS\OpenDNS Connector C:\Program Files (x86)\Razer\Razer Services\ C:\Program Files (x86)\Trend Micro\ @@ -9399,6 +9402,7 @@ C:\Program Files (x86)\Lenovo\System Update\Tvsukernel.exe C:\Program Files\VMware\vCenter Server\jre\bin\java.exe C:\Program Files\VMware\vCenter Server\python\python.exe + C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Manager.exe C:\Windows\SysWOW64\SearchProtocolHost.exe C:\Windows\System32\dsregcmd.exe C:\Windows\sysmon64.exe @@ -9675,7 +9679,7 @@ - + @@ -9702,6 +9706,7 @@ .mui .ime .tsp + .ico C:\Windows\system32\MpSigStub.exe From dd4d07666ff369ac42c9fc292a3b4450014df7cc Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Fri, 8 Sep 2023 14:45:58 -0400 Subject: [PATCH 465/471] Added line to force TLS 1.2 --- SysmonUpdateConfig.ps1 | 1 + 1 file changed, 1 insertion(+) diff --git a/SysmonUpdateConfig.ps1 b/SysmonUpdateConfig.ps1 index 45db31db..c01ae1e5 100644 --- a/SysmonUpdateConfig.ps1 +++ b/SysmonUpdateConfig.ps1 @@ -9,6 +9,7 @@ $sysmonConfigPath = "C:\ProgramData\Sysmon\sysmonconfig-export.xml" $sysmonConfigURL = "https://raw.githubusercontent.com/NerbalOne/sysmon-config/master/sysmonconfig-export.xml" # Download the Latest Sysmon Config +[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Invoke-WebRequest -Uri $sysmonConfigURL -OutFile $sysmonConfigPath # Run sysmon.exe with Config From 326413457ec318c041f1ad2c9e8649164dc61436 Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Fri, 8 Sep 2023 14:58:40 -0400 Subject: [PATCH 466/471] Delete sysmonconfig-export_blocking.xml Not used --- sysmonconfig-export_blocking.xml | 7049 ------------------------------ 1 file changed, 7049 deletions(-) delete mode 100644 sysmonconfig-export_blocking.xml diff --git a/sysmonconfig-export_blocking.xml b/sysmonconfig-export_blocking.xml deleted file mode 100644 index 30796a47..00000000 --- a/sysmonconfig-export_blocking.xml +++ /dev/null @@ -1,7049 +0,0 @@ - - - md5,sha1,sha256,imphash - - - - - - - - - TEMP\nessus_;nessus_task_list - TEMP\nessus_;nessus_task_list - - - rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe - advanced_port_scanner.exe;rcpping.exe;nc.exe;nc64.exe;netcat.exe;ncat.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe - Network Scanner;Advanced IP Scanner - - - adfind - adfind - -gcb -sc;/gcb /sc;-f (objectcategory=;/f (objectcategory=;trustdmp - - - - - - - - - - - - - - PurpleSharp;xyz123456 - PurpleSharp - - - - - /serverlevelplugindll - - - add;sslcert;http - - http del sslcert - - - - - - - C:\Users\ - Content.Outlook - - - .SettingContent-ms - immersivecontrolpanel - - - Hwp.exe - gbb.exe - - - - iexplore.exe;chrome.exe;firefox.exe;browser_broker.exe;vivaldi.exe;microsoftedge.exe;microsoftedgecp.exe;brave.exe;vivaldi.exe - tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe - apt-config - - - cmd.exe /c C:\Windows\Setup\Scripts\SetupComplete.cmd;cmd.exe /c C:\Windows\Setup\Scripts\PartnerSetupComplete.cmd - C:\Windows\Setup - C:\Windows\SysWOW64 - C:\Windows\System32 - C:\Windows\WinSxS - - - consent.exe - http - iexplore.exe - SYSTEM - - - - w3wp.exe - \csc.exe;\TranscodingService.exe;\werfault.exe;\appcmd.exe - - - - - w3wp.exe - appcmd.exe - appcmd.exe add module;system.enterpriseservices.internal.publish;\gacutil.exe /I;gacutil.exe -I - - - apache;php-cgi.exe;nginx.exe;httpd.exe;tomcat;php.exe - arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;certutil.exe - - - cmd.exe - ping 127.0.0.1 - c:\windows\system32\inetsrv\ - - - svchost.exe;termsvcs - rdpclip.exe;csrss.exe;wininit.exe - - - dns.exe - werfault.exe;conhost.exe;dnscmd.exe;dns.exe - - - UMWorkerProcess.exe;UMService.exe - perfenabled - - - UMWorkerProcess.exe;UMService.exe - perfenabled - wemgr.exe;werfault.exe - - - \wwwroot\ - - - \Atlassian\Confluence\jre\bin\java.exe - cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin - - - DesktopCentral_Server\jre\bin\java.exe - cmd;powershell;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin - - - \jre\bin\java.exe - cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe - - \Atlassian\Confluence\jre\bin\java.exe - - - sqlservr - arp.exe;at.exe;cscript.exe;wscript.exe;cmd.exe;powershell;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;sh.exe;ping.exe;whoami.exe;net.exe;net1.exe;systeminfo.exe;bitsadmin.exe;dsget.exe;dsquery.exe;find.exe;findstr.exe;fsutil.exe;hostname.exe;ipconfig.exe;nbtstat.exe;net.exe;net1.exe;netdom.exe;netsh.exe;netstat.exe;nltest.exe;nslookup.exe;ntdutil.exe;pathping.exe;qprocess.exe;query.exe;qwinsta.exe;reg.exe;rundll32.exe;sc.exe;schtasks.exe;systeminfo.exe;tasklist.exe;tracert.exe;ver.exe;vssadmin.exe;wevtutil.exe;whoami.exe;wmic.exe;wusa.exe;sh.exe;bash.exe - - - keytool.exe - cmd;powershell;pwsh;certutil;curl;whoami;ipconfig;mshta;wscript;cscript;rundll32;bitsadmin;pwsh.exe;bitsadmin;hh.exe;wmic.exe;rundll32.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;curl.exe - - - bash.exe;cmd.exe;powershell.exe;pwsh.exe - id -Gn `;id /Gn `;id -Gn ';id /Gn ' - - - - e=Access&;y=Guest&;&p=;&c=;&k= - - - - - - - - - - - wmic.exe - process;call;create - - - wmic.exe - call set priority;call terminate;product get name;bios, get serialNumber;BIOS GET SERIALNUMBER;onboarddevice get;useraccount where name;useraccount get;path win32_networkadapter where index=;process list;useraccount get /ALL;useraccount list;qfe get description,installedOn /format:csv;process get caption,executablepath,commandline;service get name,displayname,pathname,startmode;share list;win32_share - - - - C:\Users\;$Recycle;\Temp\;\Downloads\ - \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 - conhost.exe - - - svchost.exe;lsass.exe;services.exe;smss.exe;winlogon.exe;explorer.exe;dllhost.exe;rundll32.exe;regsvr32.exe;userinit.exe;winit.exe;spoolsv.exe;wermgr.exe;csrss.exe;ctfmon.exe;werfault.exe - conhost.exe - - - conhost.exe - :\Windows\splwow64.exe;:\Windows\System32\WerFault.exe;:\Windows\System32\conhost.exe - - - \cmd.exe;WindowsTerminal;powershell - explorer.exe - - - cmd.exe - powershell.exe;powershell_ise.exe - Get-ItemProperty HKLM:\software\wow6432node\microsoft\windows\currentversion\uninstall\ - mysql server - select-object displayversion,displayname - - - cscript.exe;wscript.exe - powershell.exe;powershell_ise.exe - - - cscript.exe;wscript.exe - powershell.exe;powershell_ise.exe - - - powershell.exe;powershell_ise.exe - mshta.exe - - - wscript.exe;cscript.exe - IEX;Net.WebClient;ospp.vbs;powershell;slmgr.vbs;spiceworks_upload - - - wscript.exe - .jse - .js - .vba - .vbe - - - \wscript.exe;\cscript.exe - \rundll32.exe;regsvr32.exe - - - \rundll32.exe;regsvr32.exe - .dll;.cpl;.ocx;localserver;enable-speech-input;auto-scan-plugin;enable-media-stream;CastMediaRouteProvider;-eoim;/eoim - setupapi;InstallHinfSection;DefaultInstall;SplunkUniversalForwarder\bin\spl;rundll32.exe "C:\Windows\Installer\MSI - \MSI;.tmp",zzzInvokeManagerCustomActionOutOfProc - - - cscript.exe - .js - .jse - .vba - .vbe - - - mshta vbscript:CreateObject("Wscript.Shell");mshta vbscript:Execute("Execute;mshta vbscript:CreateObject("Wscript.Shell").Run("mshta.exe;javascript:a= - .jpg;.png;.lnk;.xls;.doc;.zip;.sct;.hta - - - C:\Windows\Temp\hpqhvind.exe;C:\ProgramData\DRM\;Test.exe - C:\ProgramData\DRM;wmplayer.exe;C:\ProgramData\DRM\CLR\CLR.EXE - - - regedit.exe - explorer.exe - - - \svchost.exe;\taskhostw.exe;\userinit.exe;\smss.exe;\csrss.exe;\wininit.exe;\winlogon.exe;\lsass.exe;\logonui.exe;\services.exe - C:\windows\System32\;C:\windows\syswow64\ - \wininit.exe;\winlogon.exe;\services.exe;\dwm.exe;System;\smss.exe;\svchost.exe - - - \spoolsv.exe;\PrintIsolationHost.exe - C:\Windows\System32\spoolsv.exe;\GPLGS\gswin32c.exe;C:\Windows\System32\spool\drivers\;\bin\gswin64c.exe;C:\PROGRA~2\CUTEPD~1\;C:\Windows\EEFPrinter.exe - C:\Windows\system32\spool\DRIVERS - Brother Industries;Thomson Reuters - - COMSPEC - ScriptFile - \Temp\7z - \Temp\Temp1_ - \Temp\Rar$ - - - powershell.exe;powershell_ise.exe - C:\users\ - Microsoft VS Code\Code.exe - \Deployment tool extract\setupodt.exe - - Shellcode - - ipy.exe - python.exe - - -agentpath: - -agentlib: - - - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe - tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe;msidb.exe - .cmd;- - C:\Windows\system32\spool\DRIVERS\ - PhotoViewer.dll - - - outlook.exe - http:;https:;ftp:;mailto:;tel: - .html - - - outlook.exe - http:;https:;ftp:;mailto:;tel: - .html" - - - outlook.exe - http:;https:;ftp:;mailto:;tel: - .html" - - - outlook.exe - .pdf" - - - outlook.exe - .pdf - - - outlook.exe - .iso" - - - outlook.exe - .iso - - - outlook.exe - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe;BrowserAssist.exe;\msedgewebview;\msedge.exe - http:;https:;ftp:;mailto:;tel: - - - outlook.exe - http:;https:;ftp:;mailto:;tel: - \Content.Outlook\;\Downloads\;\Documents\;:\Users\Public\;\Desktop\ - - - outlook.exe - \\ - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe - C:\Users\ - .exe - Zoom Video - Firefox - Microsoft Edge - Microsoft Teams - GrammarlyAddInSetupe - Teams.exe - Zoom.exe - browser_broker.exe - chrome.exe - edge.exe - firefox.exe - iexplore.exe - vivaldi.exe - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe - C:\ProgramData\ - Firefox - Microsoft Edge - Microsoft Teams - Zoom Video - - - .zip\ - - - acrobat.exe;acrord32.exe - tracert.exe;csc.exe;cscript.exe;wscript.exe;cmd.exe;powershell.exe;bash.exe;scrcons.exe;schtasks.exe;hh.exe;regsvr32.exe;regsvcs.exe;sh.exe;wmic.exe;mshta.exe;rundll32.exe;msiexec.exe;forfiles.exe;scriptrunner.exe;mftrace.exe;AppVLP.exe;svchost.exe;MicroScMgmt.exe;FLTLDR.exe;wmic.exe;Microsoft.Workflow.Compiler.exe;atbroker.exe;bginfo.exe;certutil.exe;csi.exe;dnx.exe;cdb.exe;bitsadmin.exe;forfiles.exe;fsi.exe;ftp.exe;hostname.exe;gpresult.exe;ipconfig.exe;nbtstat.exe;ping.exe;pwsh.exe;qprocess.exe;quser.exe;qwinsta.exe;reg.exe;svchost.exe;installutil.exe;pwsh.exe;msxsl.exe;ieexec.exe;msdt.exe;verclsid.exe - - - winword.exe;powerpnt.exe;excel.exe - control.exe - input.dll - - - msdt.exe - msdt.exe - BrowseForFile=;PCWDiagnostic - /af;-af - - - msdt.exe - pcwrun.exe - PCWDiagnostic - - - msdt.exe - /cab;-cab - .diagcab - - - powershell.exe;pwsh.exe;cmd.exe;mshta.exe;cscript.exe;wscript.exe;wsl.exe;rundll32.exe;regsvr32.exe - msdt.exe - - EQNEDT32.EXE - - winword.exe;excel.exe;powerpnt.exe - FLTLDR.EXE - - - /dde;-dde - - - - schtasks.exe - /create;-create;/change;-change - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - - taskeng.exe - - schtasks.exe - /Run;-run - Sentinel\AutoRepair - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - - - schtasks.exe - schtasks /TN RtkAudUService64_BG - -change;/change;-delete;/delete;-create;/create - - at.exe - at.exe - - C:\Windows\System32\svchost.exe - netsvcs;-p;-s;Schedule - netsvcs;-p;-s;Schedule - - - - - - net.exe;net1.exe;net2.exe - stop - tvsu_tmp - - - net.exe;net1.exe;net2.exe - start - tvsu_tmp - - - wmiprvse.exe;mmc.exe;explorer.exe;services.exe - &1;cmd.exe;\\127.0.0.1\;/Q /c - - - wmiprvse.exe;mmc.exe;explorer.exe;services.exe - &1;cmd.exe;\\127.0.0.1\;-Q -c - - - schtasks;Create;ONLOGON;TN;Updater;TR;powershell - - - sc.exe - create - \NIC_Emulex_Firmware\;C:\Windows\Temp\ExchangeSetup\ - - - sc.exe - config;binpath - - - cmd.exe;powershell.exe - services.exe - - new-service - psexesvc.exe - - Execute processes remotely - psexe - PsExec Service - PsExec Launched - - - accepteula - - - Execute processes remotely - -s;/s - - psexec.exe - pskill.exe - pskill - - C:\WINDOWS\system32\svchost.exe -k NetworkService -p - - - C:\WINDOWS\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation - - - C:\WINDOWS\System32\svchost.exe -k netprofm -p -s netprofm - - - C:\WINDOWS\system32\svchost.exe;RPCSS - - - C:\WINDOWS\system32\svchost.exe;RPCSS - werfault.exe - - - - && type - > - cmd.exe" /c cd - - - ntdsutil;/set {default} recoveryenabled no;telnet ;-dumpcr;putty;bash.exe;pssh;shareenum;sekurlsa;reg save;reg save;psscan;shellexec;vbscript:createobject;/output:clipboard;root\\default;root\\subscription;Wmiclass;WmiCl'+'as'+'s;export-mft;ApplicationImpersonation - - - ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy - ERROR kuhl;windows/meterpreter;InjectDLL;ReflectiveLoader;Koadic.;@subtee;-donate-level=;stratum+tcp;Win32_TaskService;FilterToConsumerBinding;Invoke-Stager;Invoke-FruityC2;smbscanner;Invoke-ReverseDNSLookup;Invoke-ARPScan;Invoke-Paranoia;Find-TrustedDocuments;Find-Fruit;Get-RickAstley;PowerView;Invoke-Tater;Get-System;Get-SiteListPassword;PowerBreach;Invoke-BackdoorLNK;Install-SSP;Get-SecurityPackages;Invoke-SSHCommand;Invoke-PsExec;Invoke-InveighRelay;Set-Wallpaper;Invoke-VoiceTroll;Invoke-ThunderStruck;Exploit-Jboss;Invoke-PowerDump;Invoke-DCSync;Get-VaultCredential;Set-MacAttribute;New-HoneyHash;MailRaider;Invoke-RunAs;Invoke-PSInject;Invoke-EgressCheck;Invoke-NetRipper;Invoke-Inveigh;Get-Screenshot;Get-IndexedItem;Get-FoxDump'Get-Clipboard;Get-ChromeDump;Start-CaptureServer;Add-Persistence;Add-Exfiltration;Invoke-PowerShellWMI;Invoke-PowerShellTCP;Invoke-PoshRatHttp;Show-TargetScreen;Get-PassHashes;Get-LSASecret;Check-VM;Remove-Update;Enabled-DuplicateToken;Invoke-ADSBackdoor;Gupt-Backdoor;Add-ScrnSaveBackdoor;Add-RegBackdoor;Get-Unconstrained;Get-RegAlwaysInstallElevated;Get-ApplicationHost;Get-WebConfig;Get-UnattendedInstallFile;Get-VulnAutoRun;Get-RegAutoLogon;Install-ServiceBinary;Invoke-ServiceAbuse;Get-ServicePermission;Get-ServiceFilePermission;Get-ServiceUnquoted;Invoke-DowngradeAccount;Invoke-ACLScanner;Find-GPOLocation;Invoke-UserHunter;Invoke-ReflectivePEInjectionInvoke-ReflectivePEInjection;Invoke-ReflectivePEInjection;VolumeShadowCopyTools;Out-Minidump;Invoke-TokenManipulation;Invoke-DllInjection;Invoke-SessionGopher;Invoke-Shellcode;Invoke-WmiCommand;Get-GPPPassword;Get-Keystrokes;Get-TimedScreenshot;Get-VaultCredential;Invoke-CredentialInjection;Invoke-NinjaCopy - - --disable-http2 --disable-quic - /Client/Login?id= - JABzA - - 2f40abbb4f78e77745f0e657a19903fc953cc664;478dc5a5f934c62a9246f7d1fc275868f568bc07;37b4496e650b3994312c838435013560b3ca8571;37b4496e650b3994312c838435013560b3ca8571;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;807d86da63f0db1fc746d1f0b05bc357;849a2b0dc80aeca3d175c139efe5221c;86A4CAC227078B9C95C560C8F0370BF0;98908ce6f80ecc48628c8d2bf5b2a50c;a4b42c2c95d1f2ff12171a01c86cd64f;4abe604916c04fe3dd8b9cb3d501d3f;eac3e3ece94bc84e922ec077efb15edd;128CECC59C91C0D0574BC1075FE7CB40;88777aacd5f16599547926a4c9202862;0f49621b06f2cdaac8850c6e9581a594;17a36ac3e31f3a18936552aff2c80249;322cb39bc049aa69136925137906d855;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;3d129263f6a48647f103a04446fb0c2f;37cd353621b0f4fc6981b50071c94f01;1b60021baedc3f9201bcdb40e9b87f62;71345b139166482acaa568ac8816c7bc;5E022694C0DBD1FBBC263D608E577949;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc5733c013378fa418d13773f5bfe6f1;c579341f86f7e962719c7113943bb6e4;d326e629a90e78825645963b35e53a6a;5E022694C0DBD1FBBC263D608E577949;53841a0c6a3ff92976db08bfdf95e083;dc7e564809d6c2a2f3457c3c9b91f22b;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b;FE2CA1BE3BDA2A757036A89E54CC02DB;FE2CA1BE3BDA2A757036A89E54CC02DB - - 22d142f11cf2a30ea4953e1fffb0fa7e;2317d65da4639f4246de200650a70753;27612cb03c89158225ca201721ea1aad;412956675fbc3f8c51f438c1abc100eb;daf2da52475fd8981b19ec3c321a983c;490a140093b5870a47edc29f33542fd2;51a7068640af42c3a7c1b94f1c11ab9d;533340c54bd25256873b3dca34d7f74e;684eca6b62d69ce899a3ec3bb04d0a5b;69a19abf5ba56ee07cdd3425b07cf8bf;6cfd131fef548fcd60fbcdb59317df8e;72dc98449b45a7f1ccdef27d51e31e91;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;80c37e062aa4c94697f287352acf2e9d;815f1f8a7bc1e6f94cb5c416e381a110;a43d3b31575846fa4c3992b4143a06da;08e82dc7bae524884b7dc2134942aadb;7bcd736a2394fc49f3e27b3987cce640;57314359df11ffdf476f809671ec0275;b72737b464e50aa3664321e8e001ff32;ce8ce92fb6565181572dce00d69c24f8;5985087678414143d33ffc6e8863b887;84730a6e426fbd3cf6b821c59674c8a0;d5377dc1821c935302c065ad8432c0d2;d8f1356bebda9e77f480a6a60eab36bb;92f8e3f0f1f7cc49fad797a62a169acd;9003cfaac523e94d5479dc6a10575e60;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;c1e7850da5604e081b9647b58248d7e8;99828721ac1a0e32e4582c3f615d6e57;f559c87b4a14a4be1bd84df6553aaf56;b9c208ea8115232bfd9ec2c62f32d6b8;061089d8cb0ca58e660ce2e433a689b3;0e9afd3a870906ebf34a0b66d8b07435;9c115e9a81d25f9d88e7aaa4313d9a8f;520ee02668a1c7b7c262708e12b1ba6b;7bfba2c69bed6b160261bdbf2b826401;77a745b07d9c453650dd7f683b02b3ed;3a771efb7ba2cd0df247ab570e1408b2;0969b2b399a8d4cd2d751824d0d842b4;fc53f2cd780cd3a01a4299b8445f8511;4e39620afca6f60bb30e031ddc5a4330;bfe3f6a79cad5b9c642bb56f8037c43b;3dfebce4703f30eed713d795b90538b5;9793afcea43110610757bd3b800de517;36db24006e2b492cafb75f2663f241b2;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;649ef1dd4a5411d3afcf108d57ff87af;320b2f1d9551b5d1df4fb19bd9ab253a;3d75c72144d873b3c1c4977fbafe9184;b9cf4301b7b186a75e82a04e87b30fe4;b4e67706103c3b8ee148394ebee3f268;7bfbd72441e1f2ed48fbc0f33be00f24;cdb303f61a47720c7a8c5086e6b2a743;2a6f7ec77ab6bd4297e7b15ae06e2e61;8403a28e0bffa9cc085e7b662d0d5412;3ffd2915d285ad748202469d4a04e1f5;04078ef95a70a04e95bda06cc7bec3fa;235d427f94630575a4ea4bff180ecf5d;8035a8a143765551ca7db4bc5efb5dfd;cacaa3bf3b2801956318251db5e90f3c;1aadf739782afcae6d1c3e4d1f315cbd;c3e255888211d74cc6e3fb66b69bbffb;d9e9f22988d43d73d79db6ee178d70a4;16ab79fb2fd92db0b1f38bedb2f02ed8;8da15a97eaf69ff7ee184fc446f19cf1;ffc7305cb24c1955f9625e525d58aeee;c0e72eb4c9f897410c795c1b360090ef;9ad6fa6fdedb2df8055b3d30bd6f64f1;44619a88a6cff63523163c6a4cf375dd;a571660c9cf1696a2f4689b2007a12c7;81229c1e272218eeda14892fa8425883;0ac48cfa2ff8351365e99c1d26e082ad;afcdf79be1557326c854b6e20cb900a7 - a53a02b997935fd8eedcb5f7abab9b9f - e96a73c7bf33a464c510ede582318bf2 - serialfunc.exe - - e PAA;en PAA;enc PAA;enco PAA;encode PAA;encoded PAA;encodedco PAA;encodedcom PAA;encodedcomm PAA;encodedcomma PAA;encodedcomman PAA;encodedcommand PAA;e IAA;en IAA;enc IAA;enco IAA;encode IAA;encoded IAA;encodedco IAA;encodedcom IAA;encodedcomm IAA;encodedcomma IAA;encodedcomman IAA;encodedcommand IAA;e JAB;en JAB;enc JAB;enco JAB;encode JAB;encoded JAB;encodedco JAB;encodedcom JAB;encodedcomm JAB;encodedcomma JAB;encodedcomman JAB;encodedcommand JAB;e cwBFAFQA;en cwBFAFQA;enc cwBFAFQA;enco cwBFAFQA;encode cwBFAFQA;encoded cwBFAFQA;encodedco cwBFAFQA;encodedcom cwBFAFQA;encodedcomm cwBFAFQA;encodedcomma cwBFAFQA;encodedcomman cwBFAFQA;encodedcommand cwBFAFQA;e SQBFAF;en SQBFAF;enc SQBFAF;enco SQBFAF;encode SQBFAF;encoded SQBFAF;encodedco SQBFAF;encodedcom SQBFAF;encodedcomm SQBFAF;encodedcomma SQBFAF;encodedcomman SQBFAF;encodedcommand SQBFAF;e UwBFAFQA;en UwBFAFQA;enc UwBFAFQA;enco UwBFAFQA;encode UwBFAFQA;encoded UwBFAFQA;encodedco UwBFAFQA;encodedcom UwBFAFQA;encodedcomm UwBFAFQA;encodedcomma UwBFAFQA;encodedcomman UwBFAFQA;encodedcommand UwBFAFQA;e IABpAE4AdgBPAEsAZQAt;en IABpAE4AdgBPAEsAZQAt;enc IABpAE4AdgBPAEsAZQAt;enco IABpAE4AdgBPAEsAZQAt;encode IABpAE4AdgBPAEsAZQAt;encoded IABpAE4AdgBPAEsAZQAt;encodedco IABpAE4AdgBPAEsAZQAt;encodedcom IABpAE4AdgBPAEsAZQAt;encodedcomm IABpAE4AdgBPAEsAZQAt;encodedcomma IABpAE4AdgBPAEsAZQAt;encodedcomman IABpAE4AdgBPAEsAZQAt;encodedcommand IABpAE4AdgBPAEsAZQAt;e SQBmACgAJAB;en SQBmACgAJAB;enc SQBmACgAJAB;enco SQBmACgAJAB;encode SQBmACgAJAB;encoded SQBmACgAJAB;encodedco SQBmACgAJAB;encodedcom SQBmACgAJAB;encodedcomm SQBmACgAJAB;encodedcomma SQBmACgAJAB;encodedcomman SQBmACgAJAB;encodedcommand SQBmACgAJAB;e J;en J;enc J;enco J;encode J;encoded J;encodedco J;encodedcom J;encodedcomm J;encodedcomma J;encodedcomman J;encodedcommand J;e SUVY;en SUVY;enc SUVY;enco SUVY;encode SUVY;encoded SUVY;encodedco SUVY;encodedcom SUVY;encodedcomm SUVY;encodedcomma SUVY;encodedcomman SUVY;encodedcommand SUVY;e aWV4;en aWV4;enc aWV4;enco aWV4;encode aWV4;encoded aWV4;encodedco aWV4;encodedcom aWV4;encodedcomm aWV4;encodedcomma aWV4;encodedcomman aWV4;encodedcommand aWV4;e dmFy;en dmFy;enc dmFy;enco dmFy;encode dmFy;encoded dmFy;encodedco dmFy;encodedcom dmFy;encodedcomm dmFy;encodedcomma dmFy;encodedcomman dmFy;encodedcommand dmFy;e dgBhA;en dgBhA;enc dgBhA;enco dgBhA;encode dgBhA;encoded dgBhA;encodedco dgBhA;encodedcom dgBhA;encodedcomm dgBhA;encodedcomma dgBhA;encodedcomman dgBhA;encodedcommand dgBhA;e R2V0;en R2V0;enc R2V0;enco R2V0;encode R2V0;encoded R2V0;encodedco R2V0;encodedcom R2V0;encodedcomm R2V0;encodedcomma R2V0;encodedcomman R2V0;encodedcommand R2V0;e IAAgAH;en IAAgAH;enc IAAgAH;enco IAAgAH;encode IAAgAH;encoded IAAgAH;encodedco IAAgAH;encodedcom IAAgAH;encodedcomm IAAgAH;encodedcomma IAAgAH;encodedcomman IAAgAH;encodedcommand IAAgAH;e TVq;en TVq;enc TVq;enco TVq;encode TVq;encoded TVq;encodedco TVq;encodedcom TVq;encodedcomm TVq;encodedcomma TVq;encodedcomman TVq;encodedcommand TVq;e aQBIA;en aQBIA;enc aQBIA;enco aQBIA;encode aQBIA;encoded aQBIA;encodedco aQBIA;encodedcom aQBIA;encodedcomm aQBIA;encodedcomma aQBIA;encodedcomman aQBIA;encodedcommand aQBIA;e UEs;en UEs;enc UEs;enco UEs;encode UEs;encoded UEs;encodedco UEs;encodedcom UEs;encodedcomm UEs;encodedcomma UEs;encodedcomman UEs;encodedcommand UEs;e H4s;en H4s;enc H4s;enco H4s;encode H4s;encoded H4s;encodedco H4s;encodedcom H4s;encodedcomm H4s;encodedcomma H4s;encodedcomman H4s;encodedcommand H4s;e dXNpbm;en dXNpbm;enc dXNpbm;enco dXNpbm;encode dXNpbm;encoded dXNpbm;encodedco dXNpbm;encodedcom dXNpbm;encodedcomm dXNpbm;encodedcomma dXNpbm;encodedcomman dXNpbm;encodedcommand dXNpbm;e cwBhA;en cwBhA;enc cwBhA;enco cwBhA;encode cwBhA;encoded cwBhA;encodedco cwBhA;encodedcom cwBhA;encodedcomm cwBhA;encodedcomma cwBhA;encodedcomman cwBhA;encodedcommand cwBhA;JABzA - - - FromBase64String - JAB;SUVY;aWV4;dmFy;dgBhA;R2V0;SQBFAF;TVq;aQBIA;UEs;H4s;dXNpbm;cwBhA - - - /v Word experienced;/v Excel experienced;-v Word experienced;-v Excel experienced - - - JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ;QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA;kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA;IgAoACcAKgAnACkAOwAkA;IAKAAnACoAJwApADsAJA;iACgAJwAqACcAKQA7ACQA - - - e^;^en^;^nc - - - ^ - - - ..\;\.. - - - \cmd.exe /c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe /c del "C:\Users\*\Desktop\*.exe;\cmd.exe -c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe -c del "C:\Users\*\Desktop\*.exe - - ping.exe -n 6 127.0.0.1 &ping.exe /n 6 127.0.0.1 & type - System.Net.Networkinformation.ping - - mofcomp.exe - - - - - net.exe;net1.exe;net2.exe - user;group;localgroup - remove;delete;active;del - tvsu_tmp - - - - - - - - - net.exe;net1.exe;net2.exe - user - add - tvsu_tmp - - dsmod.exe - dsadd.exe - - - - WerFault.exe - -s;/s - - - - - - - - - - - - - - - cmd.exe - echo;\pipe\;> - - - cmd.exe - /c;copy;dll;\\;admin$ - - - rundll32.exe - ,;StartW - - - rundll32.exe - ,;update;appdata;temp;/i: - - - rundll32.exe - ,;update;appdata;temp;-i: - - - dllhost.exe - {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} - - - dllhost.exe - {3E5FC7F9-9A51-4367-9063-A120244FBEC7};{3E000D72-A845-4CD9-BD83-80C07C3B881F};{D2E7041B-2927-42fb-8E9F-7CE93B6DC937};{02B49784-1CA2-436C-BC08-72FA3956507D};{BEF590BE-11A6-442A-A85B-656C1081E04C} - - - - winlogon.exe;services.exe;lsass.exe;csrss.exe;wininit.exe;spoolsv.exe;searchindexer.exe - powershell.exe;pwsh.exe;cmd.exe - AUTHORI;AUTORI - route ; ADD - - - - eventvwr.exe - c:\windows\system32\mmc.exe - - fodhelper.exe - InstallUtil.exe - Invoke-PsUaCme - BypassUAC - PowerUp - computerdefaults.exe - dism.exe - fodhelper.exe - - - NT AUTHORITY\NETWORK SERVICE;NT AUTHORITY\LOCAL SERVICE;SERVICE LOCAL;ERVICE RÉSEAU;NETZWERKDIENST;LOKALER DIENST;NETZWERKDIENST;SERVICIO DE RED;ERVICIO LOC - NT AUTHORITY\SYSTEM;СИСТЕМА;NT-AUTORITÄT\SYSTEM;AUTORITE NT\SYSTEM - - c:\windows\system32\svchost.exe -k netsvcs -s Appinfo - runas.exe - - - - - - - - Cmd.Exe - winlogon.exe - utilman.exe - - - Cmd.Exe - winlogon.exe - sethc.exe - - - utilman.exe - C:\Windows\System32\ATBroker.exe;Magnify.exe;C:\Windows\System32\osk.exe - - sethc.exe - osk.exe - Magnify.exe - DisplaySwitch.exe - Narrator.exe - AtBroker.exe - - sdbinst.exe - - - dwm.exe - - - cmd.exe - 7zFM.exe - ;/c;-c - - - cmd.exe - elevation_service.exe - System - - - - - - - - unknown process - \LocalState\rootfs\ - \LocalState\rootfs\ - - - - - - - - - - - auditpol - /set;-set;/restore;-restore;/clear;-clear;/remove;-remove;/resourceSACL;-resourceSACL - - - - - - - +s;+h - attrib.exe - - - Hidden;Attributes - powershell.exe - - - - - Sysinternals Sysmon - /u;/c;-u;-c - C:\ProgramdData\sysmon\ - - - MpCmdRun.exe - Add-MpPreference;RemoveDefinitions;DisableIOAVProtection - - - - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE - - - IMPHASH=19584675D94829987952432E018D5056 - - - IMPHASH=330768a4f172e10acb6287b87289d83b - - - PsKill.exe - - Set-MpPreference;Add-MpPreference;Remove-MpPreference;MpCmdRun.exe - RemoveDefinitions;RemoveDynamicSignature;DisableIOAVProtection;DisableRealTimeMonitoring;DisableBehaviorMonitoring;DisableBlockAtFirstSeen;DisableIOAVProtection;DisablePrivacyMode;DisableScriptScanning;DisableRealtimeMonitoring;DisableScanningNetworkFiles;DisableScanningMappedNetworkDrivesForFullScan;DisableRestorePoint;DisableRemovableDriveScanning;SignatureDisableUpdateOnStartupWithoutEngine;DisableIntrusionPreventionSystem;DisableScanOnRealtimeEnable;DisableArchiveScanning;DisableIntrusionPreventionSystem;DisableScriptScanning;DisableOnAccessProtection;ExclusionExtension;ExclusionPath;ExclusionProcess;ThreatDefaultAction;TamperProtection - - interface ipv6 set - interface ipv4 set - taskkill.exe - - firewall delete - firewall add - firewall set opmode disable - Core Networking - Router Solicitation - netsh advfirewall firewall - - - wevtutil.exe - cl - wevtutil im - wevtutil.exe im - ClickToRun - - - fltMC.exe - detach;unload - - - appcmd.exe - DontLog;True - iisetup.exe - - - set;NGenAssemblyUsageLog - New-ItemProperty;NGenAssemblyUsageLog - reg;add;dword;NGenAssemblyUsageLog - $env;NGenAssemblyUsageLog - - - set;COMPlus_ETWEnabled - New-ItemProperty;COMPlus_ETWEnabled - reg;add;dword;COMPlus_ETWEnabled - $env;COMPlus_ETWEnabled - - - - bash.exe;wsl.exe;ubuntu.exe;kali.exe - -e;/e;-u root;--exec bash;dev/tcp;~ -d;~ /d - - wsl.exe - wsl.exe - wslhost.exe - wslhost.exe - ubuntu.exe - ubuntu.exe - kali.exe - kali.exe - distro-id;vm-id - - pcalua.exe - pcalua.exe - bash.exe - bash.exe - forfiles.exe - forfiles.exe - .com - -appvscript - - - - C:\Users\NetworkService\;C:\Users\NetworkService\;HarddiskVolumeShadowCopy;C:\Users\Default\;C:\Users\Public;C:\Users\Guest\;\administrateur\;C:\Windows\Media\;C:\Windows\addins\;tsclient\;\htdocs\;\config\systemprofile\;C:\PerfLogs\;c:\windows\ServiceProfiles\;C:\Intel\Logs\;C:\Windows\repair\;C:\Windows\Help\;$Recycle;C:\Windows\Debug\;C:\Windows\Security\;C:\Windows\Fonts\;\wwwroot\;\Contacts;C:\Windows\vss\ - - - .exe - .7z.exe - .doc.exe - .doc.exe - .docx.exe - .ico.exe - .iso.exe - .lnk.exe - .pdf.exe - .ppt.exe - .pptx.exe - .rar.exe - .rtf.exe - .txt.exe - .xls.exe - .xlsx.exe - .zip.exe - ______.exe - - - - - reg add hkcu\software\classes\ - reg.exe add hkcu\software\classes\ - C:\WINDOWS\system32\svchost.exe -k localService -s RemoteRegistry - - regedit.exe - : - - - reg.exe - delete - - - regedit.exe - /d;-d - - - HKCU:;HKLM - remove-item - - - HKCU:;HKLM - set-item;new-item - - - - - - chcp.exe - 936 - 1256 - 864 - 1258 - 855 - 866 - - - powershell.exe - -e ;-en;-enc;-enco;-encod;-encode;-encoded;-encodedc;-encodedco;-encodedcom;-encodedcomm;-encodedcomma;-encodedcomman;-encodedcommand;/e ;/en;/enc;/enco;/encod;/encode;/encoded;/encodedc;/encodedco;/encodedcom;/encodedcomm;/encodedcomma;/encodedcomman;/encodedcommand - - - powershell.exe - -w h;-wi h;-win h;-wind h;-windo h;-window h;-windows h;-windowst h;-windowsty h;-windowstyl h;-windowstyle h;/w h;/wi h;/win h;/wind h;/windo h;/window h;/windows h;/windowst h;/windowsty h;/windowstyl h;/windowstyle h - - - powershell.exe - -ex;/ex - bypass - - - powershell.exe - -noni;/noni - Import-Module FileServerResourceManager - C:\Program Files\LogicMonitor - - - powershell.exe - hextobin;iex;io.filestream;system.text;base64;system.io;io.file;IMAGE_SUBSYSTEM_WINDOWS_GUI;IMAGE_NT_OPTIONAL_HDR32;IMAGE_NT_OPTIONAL_HDR64;DllCharacteristicsType;GetDelegateForFunctionPointer;WriteProcessMemory;ReadProcessMemory;ImpersonateSelf;AdjustTokenPrivileges;NtCreateThreadEx;CreateRemoteThread;io.seek;iwr;-bxor;invoke-expression;remove.to.string;shellcode;System.Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;unicode;-useb;msxml2.serverxmlhttp;wscript.shell;-comobject;frombase64;io.compression;system.convert;io.streamreader;io.memorystream;compression.gzipstream;text.encoding;executioncontext;text.enc;convertto-securestring;runtime.interop;verbosepreference;[[string]]::join - - - powershell.exe - SUVYI;aWV4I;SQBFAFgA;aQBlA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC;UwB0AGE - - - C^om^S^pEc;^c^o^m^S^p^E^c^;Wscript.Shell;-ComObject;MsXml2.ServerXmlHttp;Remove.ToString;System.Convert;-UseB;[Byte[];^h^t^t^p;h"t"t"p - - IwAjACMAd;IyM=;SUVYI;aWV4I;SQBFAFgA;aQBlAHgA;TW96aWxsYS;1vemlsbGEv;Nb3ppbGxhL;TQBvAHoAaQBsAGwAYQAv;0AbwB6AGkAbABsAGEAL;BNAG8AegBpAGwAbABhAC - WindowStyle Hidden function;WindowStyle Hidden;windowstyle h;windowstyl h;windowsty h;windowst h;windows h;window h;windo h;wind h;win h;wi h;-w h;/w h;win hi;win hid;win hidd;win hidde;win hidden - ^ - TYPE CON > - copy CON > - - FromBase64String;action=create keyvalue=;VerbosePreference.ToString;SecureString;CSharpCodeProvider;runtime.interopservices.marshal;system.globalization.numberstyles;system.reflection.assembly;hextobin;VerbosePreference.ToString;system.text.encoding;io.filestream;io.filestream;io.seekorigin;text.encoding;unicode.getstring;FromBase64;[Convert]::;System.IO.File]::ReadAllText;|iex - ngen.exe;install - - - - certutil - decode;encode - - - ping.exe - 0x - - - - csc.exe - \AppData\;\Windows\Temp\ - - - csc.exe - wscript.exe - cscript.exe - mshta.exe - - - mofcomp.exe - .mof - C:\WINDOWS\Installer\MSI - MsMpEng.exe - aspnet_regiis.exe - msiexec.exe - - - csc.exe - out:;target:library - - Microsoft.Workflow.Compiler.exe - - - - - autochk.exe - \smss.exe;\fontdrvhost.exe;\dwm.exe - - - \consent.exe;\Runtimebroker.exe;\TiWorker.exe - \svchost.exe - - - - - \consent.exe;\Runtimebroker.exe;\TiWorker.exe - svchost.exe - - - - - SearchProtocolHost.exe - \SearchIndexer.exe;\dllhost.exe - - - - - dllhost.exe - \services.exe;\svchost.exe - - - - - smss.exe - \smss.exe - System - - - - - csrss.exe - - - \smss.exe;svchost.exe - - - wininit.exe - - - \smss.exe - - - winlogon.exe - \smss.exe - - - \lsass.exe;LsaIso.exe - \wininit.exe - - - LogonUI.exe - \wininit.exe;\winlogon.exe - - - services.exe - \wininit.exe - - - svchost.exe - - - \MsMpEng.exe;\services.exe - - - spoolsv.exe - \services.exe - - - taskhost.exe - \services.exe;\svchost.exe - - - userinit.exe - \dwm.exe;\winlogon.exe - - - \wmiprvse.exe;\wsmprovhost.exe;\winrshost.exe - - - \svchost.exe - - - \SearchProtocolHost.exe;\taskhost.exe;\csrss.exe - \werfault.exe;\wermgr.exe;\WerFaultSecure.exe - - - autochk.exe - \chkdsk.exe;\doskey.exe;\WerFault.exe - - - smss.exe - \autochk.exe;\smss.exe;\csrss.exe;\wininit.exe;\winlogon.exe;\setupcl.exe;\WerFault.exe - - - wermgr.exe - \WerFaultSecure.exe;\wermgr.exe;\WerFault.exe - - - wermgr.exe - wermgr.exe - - - \rundll32.exe;\regsvr32.exe - \explorer.exe;\wermgr.exe;\msra.exe;\OneDriveSetup.exe;\mobsync.exe;\xwizard.exe - .exe - - - conhost.exe - \mscorsvw.exe;\wermgr.exe;\WerFault.exe;\WerFaultSecure.exe - - - System.Management.Automation - "C:\Windows\Microsoft.NET\Framework\;\ngen.exe;install - - - - - - - - InstallUtil.exe - /logfile=;/LogToConsole=false;/U - - - InstallUtil.exe - -logfile=;-LogToConsole=false;-U - - - Mavinject.exe;mavinject64.exe - INJECTRUNNING - - - CMSTP.exe - /ni;/s - - - CMSTP.exe - /ns;/s - - - CMSTP.exe - -ni;-s - - - CMSTP.exe - -ns;-s - - - rundll32.exe;shell32.dll;_RunDLL - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - - - odbcconf.exe - /S /A {REGSVR;-S -A {REGSVR - - script:http - Register-cimprovider - Scriptrunner.exe -appvscript - bginfo - cbd - runscripthelper.exe surfacecheck - xwizard RunWizard - PresentationHost - driver executeinf - control.exe /name;control.exe -name - Control_RunDLL - SyncAppvPublishingServer.exe - Scriptrunner.exe - ATBroker.exe - Appvlp.exe - InfDefaultInstall.EXE - PresentationHost.exe - RegisterCimProvider2.exe - RegisterCimProvider.exe - ScriptRunner.exe - csi.exe - extexport.exe - msconfig.EXE - rasdlui.exe - tttracer.exe - verclsid.exe - wab.exe - Register-cimprovider.exe - csi.exe - devtoolslauncher.exe LaunchForDeploy - bginfo - devtoolslauncher.exe - wab.exe - wsreset.exe - - cmstp.exe /ni /s;cmstp.exe -ni -s - cmstp /ni /s;cmstp -ni -s - - Mavinject.exe - INJECTRUNNING - - - rundll32.exe - DllRegisterServer - xapauthenticodesip.dll - - - regsvr32.exe - C:\Users;Appdata;Temp - - - regsvr32.exe - C:\Users;Public - - Microsoft(C) Register Server - SyncAppvPublishingServer.exe - control.exe - rasautou.exe - control.exe /name;control.exe -name - Control_RunDLL - - - msiexec.exe - /y;-y - C:\Windows\SysWOW64\DartSock.dll - C:\Windows\SysWOW64\ImageViewer2.OCX - C:\Windows\SysWOW64\SysTray.ocx - C:\Windows\SysWOW64\tdbg6.ocx - C:\Windows\SysWOW64\tdbg7.ocx - C:\Windows\SysWOW64\tdbg7.ocx - C:\Windows\SysWOW64\todg7.ocx - C:\Windows\SysWOW64\todgub7.dll - C:\Windows\SysWOW64\xarraydb.ocx - - - msiexec.exe - /i;-i - http - - - - RUNDLL32.EXE - ,;# - C:\Windows\resources\themes\Aero\AeroLite.msstyles - uxtheme.dll - ImageView_Fullscreen - EDGEHTML.dll - PhotoViewer.dll - \AppData\Local\WebEx\WebEx\ - - - RUNDLL32.EXE - -sta;/sta - - - RUNDLL32.EXE - -localserver;/localserver - - - RUNDLL32.EXE - shell32.dll;OpenAs_RunDLL - - - RUNDLL32.EXE - powershell - - - RUNDLL32.EXE - url.dll;OpenURL - - - RUNDLL32.EXE - url.dll;FileProtocolHandler - - - RUNDLL32.EXE - zipfldr.dll;RouteTheCall - - - RUNDLL32.EXE - Shell32.dll;Control_RunDLL - - - RUNDLL32.EXE - javascript: - - - RUNDLL32.EXE - RegisterXLL - - - rundll32.exe - C:\Users;Public - rdpinit.exe - rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe - - - rundll32.exe - C:\Users;Appdata;Temp - ImageView_ - rdpinit.exe - rdpinit.exe;G2MInstaller;GoToMeeting;LogMeIn;firefox.exe - - advpack.dll;LaunchINFSection - ieadvpack.dll;LaunchINFSection - syssetup.dll;SetupInfObjectInstallAction - setupapi.dll;InstallHinfSection - InstallHinfSection - infDefaultInstall.exe - rundll32.exe "C:\Windows\twain_64.dll" - shdocvw.dll;OpenURL - advpack.dll;RegisterOCX - Zipfldr.dll;RouteTheCall - url.dll;FileProtocolHandler - url.dll;FileProtocolHandler - OpenURLA;file: - OpenURL;file: - - - mshta.exe - cmd.exe;powershell.exe;wscript.exe;cscript.exe;sh.exe;bash.exe;reg.exe;regsvr32.exe;bitsadmin - - - mshta.exe - - RunHTMLApplication - mshtml - vbscript:CreateObject - - odbcconf.exe - - - manage-bde.wsf - - - - - powershell.exe;powershell_ise.exe - msbuild.exe - - - msbuild.exe - regasm.exe - - - msbuild.exe - userinit.exe - - - msbuild.exe - .xml - - - regasm.exe - \conhost.exe - - - msbuild.exe - .lnk - - .csproj - - - - - - - msxsl.exe - msxsl.exe - - - - - - - - - /stext - keylog - keyscan_ - Get-Keystrokes - /scomma - - - - - - sniff - C:\Program Files\Adobe\ - - - tcpdump.exe;tcpdump.c;tshark.exe;tshark.c;windump.exe;windump.c;wireshark.c;wireshark.exe - windump;tshark;tcpdump;windump;wireshark - netsh;trace;start;capture=yes - - - - vssadmin.exe - create;shadow - - - wmic.exe - shadowcopy;call;create - - - wmic.exe - call;create;esentutl;vss - - - win32_shadowcopy;create;clientaccessible - - - mklink;GLOBALROOT;Shadow - - - copy;NTDS\ntds.dit - - - ntdsutil.exe - - - copy;System32\config\SYSTEM - - - reg;save;HKLM - - - mimikatz;mimidrv;mimilove;mimilib;sekurlsa;lsadump;dumpcreds;privilege::;token::;logonpasswords;mimikittenz;mimiauth;::;kerberos::;misc::skeleton;privilege::debug;dpapi::cred;vault::cred;lsadump;misc::;Krbtgt;TOKEN::;invoke-mimi - - - cmdkey - - rpcping.exe - nltest.exe - - -ma lsass.exe;Do-Exfiltration;Powersploit;GPPPassword;gpprefdecrypt;gsecdump;hashdump;laZagne;ntds.dit;ppldump;pwdump;pwdumpx;secretsdump;/listcreds:;-listcreds: - - VaultCloseVault - VaultEnumerateItem - VaultFree - VaultGetItem - VaultOpenVault - Vaultcmd - vaultcli.dll - select * from moz_login - Invoke-WinEnum - System.Net.CredentialCache - create shadow - wlan;export;profile;key=clear - dcsync - HKCU /f password;HKCU -f password - HKLM /f password;HKLM -f password - nltest.exe - ProcDump.exe - ProcDump - - - asktgt;asktgs - createnetonly /program:;createnetonly -program: - dump /service:krbtgt;dump -service:krbtgt - harvest /interval:;harvest -interval: - renew /ticket:;renew -ticket: - asreproast - impersonateuser: - kerberoast - ptt /ticket: - klist.exe - hh.exe - - - - appcmd.exe - list;text;password - - - - quser.exe - - net.exe;net1.exe;net2.exe - group;localgroup; user - /domain - SUService - \users - tvsu_tmp - - - net.exe;net1.exe;net2.exe - group;localgroup; user - /domain - SUService - \users - tvsu_tmp - - - sharphound;bloodhound;azurehound;CollectionMethod;encryptzip;randomizefilenames;dumpcomputerstatus - sharphound;bloodhound - sharphound;bloodhound - sharphound;bloodhound - sharphound;bloodhound - sharphound;bloodhound - sharphound;bloodhound - - dscl . list /Groups;dscl . list -Groups - dscl . list /Users;dscl . list -Users - dsquery.exe - query.exe - - - - - - - - - - - tree.com - - - auditpol - /get;-get;/list;-list;/backup;-backup - - gpresult.exe - get-gpo;get-gpresult;get-gpreg - - - - - - - - tasklist.exe - qprocess.exe - - reg query - reg.exe query - driverquery.exe - - - tracert.exe - pathping.exe - - - - find;385201 - select-string;385201 - - - find;virus - select-string;virus - process;Description;virus - find;cb - select-string;cb - process;Description;cb - find;defender - select-string;defender - process;Description;defender - find;crowdstrike - select-string;crowdstrike - process;Description;crowdstrike - find;sentinel - select-string;sentinel - process;Description;sentinel - find;nessusd - select-string;nessusd - process;Description;nessusd - find;td-agent - select-string;td-agent - process;Description;td-agent - find;cbagentd - select-string;cbagentd - process;Description;cbagentd - find;sysmon - select-string;sysmon - process;Description;sysmon - find;winlogbeat - select-string;winlogbeat - process;Description;winlogbeat - find;winlogbeat - select-string;winlogbeat - process;Description;winlogbeat - find;csfalcon - select-string;csfalcon - process;Description;csfalcon - find;splunk - select-string;splunk - process;Description;splunk - find;sidecar - select-string;sidecar - process;Description;sidecar - - - fltMC.exe - misc::mflt - - AntiVirusProduct - root\SecurityCenter2 - - sysinfo.exe - systeminfo - - - - netsh.exe - get;list;show - - - netsh.exe - get;list;show - - ipconfig.exe - - netstat.exe - arp -a - arp.exe -a - arp -a - - - whoami.exe;whoami1.exe - - - wmic.exe - get;useraccount - - - netsh.exe - add;set - encryption;dohtemplate - - - netsh.exe - add;del;set - - - nbtstat - nessus - - - route.exe - print - - - route.exe - ADD;DEL;CHANGE;-f - - qwinsta.exe - rwinsta.exe - - - - - - - - Microsoft Office\root\Office - Microsoft Office\root\Office - automation;Embedding - - - admin$ - davclnt.dll - WebClientGroup - - - - - - - /shadow;-shadow - noConsentPrompt - - - tscon.exe - dest:rdp-tcp: - - - powershell.exe - WmiPrvSE.exe - - - WmiPrvSE.exe - \Users\ - - - NetworkDetective - WmiPrvSE.exe - - - sc.exe - tenable - WmiPrvSE.exe - - - cmd.exe - WmiPrvSE.exe - do_vbsUpload;Spiceworks - - - regsvr32.exe - WmiPrvSE.exe - - - cmd.exe - WmiPrvSE.exe - - - powershell.exe - WmiPrvSE.exe - - - dsa.msc - - - virtmgmt.msc - - - wmiprvse.exe - CompMgmtLauncher.exe - DismHost.exe - Microsoft.NET\Framework - NetEvtFwdr.exe - ServerManager.exe - WerFault.exe - chcp.com - g2mupdate.exe - slack.exe - - - wsmprovhost.exe - cmd.exe - sh.exe - bash.exe - wsl.exe - powershell.exe - powershell_ise.exe - schtasks.exe - at.exe - certutil.exe - mshta.exe - whoami.exe - ping.exe - ping.exe - bitsadmin.exe - - winrm.cmd - winrs.exe - winrshost.exe - waitfor.exe - wsmprovhost.exe - winrshost.exe - wsmprovhost.exe - - wmiprvse.exe - mshta.exe - - - ssh.exe;putty.exe;kitty.exe;kitty_portable.exe - - PuTTY suite - - sftp;psftp - - - rundll32.exe - - - rundll32.exe - ..\;, - - - rundll32.exe - ,StartW - - psshutdown - psservice - PsPasswd - mstsc.exe - telnet.exe - tftp.exe - powershellcustomhost - - - -Embedding - c:\windows\system32\mmc.exe - - --execm;atexec - {4991d34b-80a1-4291-83b6-3328366b9097} - {00020812-0000-0000-C000-000000000046} - {40AEEAB6-8FDA-41e3-9A5F-8350D4CFCA91} - {7e0423cd-1119-0928-900c-e6d4a52a0715} - {0006F04A-0000-0000-C000-000000000046} - {048EB43E-2059-422F-95E0-557DA96038AF} - {13709620-C279-11CE-A49E-444553540000} - {c08afd90-f2a1-11d1-8455-00a0c91f3880} - 9BA05972-F6A8-11CF-A442-00A0C90A8F39 - {00021A20-0000-0000-C000-000000000046} - {72C24DD5-D70A-438B-8A42-98424B88AFB8} - {00020906-0000-0000-C000-000000000046} - {cc5bbec3-db4a-4bed-828d-08d78ee3e1ed} - {1b7cd997-e5ff-4932-a7a6-2a9e636da385} - {16d51579-a30b-4c8b-a276-0ff4dc41e755} - rundll32.exe -sta;rundll32.exe /sta;rundll32 -sta;rundll32 /sta - shell32.dll;SHCreateLocalServerRunDll - -k DcomLaunch;/k DcomLaunch - - - - - - - - - - 7z.exe - a -mx9 -r0 -p;a -v500m -mx9 -r0 -p - - - 7z - 7z - - - winrar - winrar - - - winrar - winrar - - - winzip - winzip - - - Compress-Archive - - - WindowsAudioDevice-Powershell-Cmdlet - SoundRecorder.exe - - - - clip.exe - get-clipboard - - - - - - - - - - New-MailboxExportRequest - - - add-pssnapin;exchange;new-managementroleassignment;applicationimpersonation - - - - screencapture - system.drawing.Imaging - system.drawing.bitmap - system.windows.forms.screen - - - - - - - odHRwczovL;aHR0cDovL;h0dHA6Ly;odHRwOi8v;aHR0cHM6Ly;h0dHBzOi8v - ie_to_edge_stub.exe;chrome.exe;firefox.exe;iexplore.exe;brave.exe;vivaldi.exe;msedge.exe;webex;teams.exe;goto opener.exe;lynx.exe;\Webex\webexAppLauncherLatest.exe;\WebEx\webexAppLauncher.exe;\WebEx\Applications\webexAppLauncher.exe;WebEx\webex.exe - wbx:;/SITE_TOKEN=;msteams:;PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSI - msedgeupdate.dll - - - VFZvQUFBQ;RWb0FBQU;UVm9BQUFB;VFZxQUFBR;RWcUFBQU;UVnFBQUFF;VFZwUUFBS;RWcFFBQU;UVnBRQUFJ;VFZxUUFBT;RWcVFBQU;UVnFRQUFN;VFZwVEFRR;RWcFRBUU;UVnBUQVFF - - - powershell.exe - AAAAYInlM;OiCAAAAYInlM;OiJAAAAYInlM;RwBlAHQAL;WwBOAGUAdAAuAFM;W05ldC5TZXJ2aWNl - - - Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք - - - - - - - - certutil.exe - urlcache;split;f - - - DownloadFile;DownloadString;Net.WebClient;System.Net.WebRequest;System.Net.SecurityProtocolType;Invoke-Expression;Invoke-WebRequest - powershell.exe;cmd.exe - - - bitsadmin.exe - CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME - util;setieproxy;localsystem;AUTODETECT - - - BITS administration utility - CREATE;TRANSFER;DOWNLOAD;UPLOAD;ADDFILE;SetNotifyFlags;SetNotifyCmdLine;SetMinRetryDelay;SetCustomHeaders;RESUME - - - \curl.exe;\wget.exe;\www.exe - - - \curl.exe;\wget.exe;\www.exe - - - certutil - split;f - - - certutil - verifyctl;URL - - - C:\Perflogs\;C:\Users\Public\;C:\root\ - - - C:\Perflogs\;C:\Users\Public\;C:\root\ - - start-bitstransfer - expand \\ - expand.exe \\ - ieexec http - ieexec.exe http - powercat - esentutl /y \\;esentutl -y \\ - esentutl.exe /y \\;esentutl.exe -y \\ - extrac32 \\ - extrac32.exe \\ - - - - - - portproxy - tor.exe - - TeamViewer_Desktop.exe - - psexec - - - - - - - winscp.exe;winscp.com;scp.exe;pscp - - - - bitch.exe;bitch.bat;bitch_lasagna.exe;Admin Cracker.exe;BulletsPassView.exe;ChromePass.exe;Dialupass.exe;LSASecretsView.exe;OpenedFilesView.exe;OperaPassView.exe;PasswordFox.exe;ProduKey.exe;RouterPassView.exe;USBDeview.exe;USBStealer.exe;VNCPassView.exe;WebBrowserPassView.exe;WirelessKeyView.exe;WirelessKeyView.exe;empv.exe;netpass.exe;pspv.exe;usbdll.exe;rdpv.exe;WirelessKeyView.exe;lasagna.exe;all -vvv >>;rsync -r - - - CredsLeaker;Windows.Security.Credentials.UI.CredentialPicker;function Leaker;function Await - - - .exe -url https://;dll,Run https://;Invoke-Merlin;-m SimpleHTTPServer;/m SimpleHTTPServer - - - - - -q=txt;/q=txt - nslookup.exe - - - rclone - Rsync for cloud storage - rclone - rclone - \rclone - - - s3browser - s3browser - s3browser - s3browser - - - add-ftp;.UploadFile( - ftp.exe - - - rundll32.exe - davclnt.dll;DavSetCookie - - - - - - - - - - - - bcdedit.exe - safeboot - - - bootcfg.exe - safeboot - - - -startvm;vrun.exe -vm - - - - - vssadmin.exe - delete;resize - - - wmic.exe - shadowcopy;delete - - - wbadmin.exe - SYSTEMSTATEBACKUP;delete - - - wmic.exe - wmic shadowstorage SET MaxSpace= - - - wmic.exe - cleareventlog;call disable;nteventlog where filename - - - diskpart.exe - format;clean;delete;remove - - - manage-bde.exe - changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw - - - manage-bde.wsf - changepin;changepassword;changekey;wipefreespace;lock;/on;-on;/off;-off;-add;/add;-pw;/pw - - format - format - bootstatuspolicy ignoreallfailures - recoveryenabled No - Win32_Shadowcopy - sdelete - delete catalog - wbadmin delete catalog - erase - -nw -exec= - -p -nw - shred - diskshadow - - del ; /f - del ; -f - rmdir ; /s ; /q - rmdir ; -s ; -q - rd ; /s ; /q - rd ; -s ; -q - - - usn deletejournal - - - - - fsutil.exe - deletejournal - usn - - - - - - - - - AdjustTokenPrivileges;IMAGE_NT_OPTIONAL_HDR64_MAGIC;LSA_UNICODE_STRING;Management.Automation.RuntimeException;Metasploit;Microsoft.Win32.UnsafeNativeMethods;Mimikatz;MiniDumpWriteDump;Net.Sockets.SocketFlags;PAGE_EXECUTE_READ;ReadProcessMemory.Invoke;Reflection.Assembly;Runtime.InteropServices;SECURITY_DELEGATION;SE_PRIVILEGE_ENABLED;System.Runtime.InteropServices;System.Security.Cryptography;TOKEN_ADJUST_PRIVILEGES;TOKEN_ALL_ACCESS;TOKEN_ASSIGN_PRIMARY;TOKEN_DUPLICATE;TOKEN_ELEVATION;TOKEN_IMPERSONATE;TOKEN_INFORMATION_CLASS;TOKEN_PRIVILEGES;TOKEN_QUERY;powerkatz - - - ahashpool;blazepool;blockmasters;blockmasterscoins;ccminer;cgminer;coinhive;hashrefinery;minergate;miningpoolhubcoins;nicehash;poolname;poolpassword;poolurl;rainbowminer;sgminer;stratum+tcp;xmrMiner;xmrig;yiimp;zergpool;zergpoolcoins;zpool - CPU miner;GPU miner;Lime Miner;XMRig CPU miner; miner - - - b91ce2fa41029f6955bff20079468448;02af7cec58b9a5da1c542b5a32151ba1;2c4a910a1299cdae2a4e55988a2f102e;846e27a652a5e1bfbd0ddd38a16dc865;4f2eb62fa529c0283b28d05ddd311fae;56ceb6d0011d87b6e4d7023d7ef85676 - - 87AECF008D87EC86EC8B00A2394B3E6C - FB3F0D0DE8B80EA8CFAB2A025EC6B833 - F4067FBF7FFF6945D0BB485B727B39AA - 4a069c1abe5aca148d5a8fdabc26751e;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;304772c80b157a916c7041f2f15939fb;291ff87948e45914424cec9510c297da;a4b42c2c95d1f2ff12171a01c86cd64f;98908ce6f80ecc48628c8d2bf5b2a50c;849a2b0dc80aeca3d175c139efe5221c;807d86da63f0db1fc746d1f0b05bc357;322cb39bc049aa69136925137906d855;86A4CAC227078B9C95C560C8F0370BF0;36dd195269979e01a29e37c488928497;7d9d29c1c03461608bcab930fef2f568;eac3e3ece94bc84e922ec077efb15edd;b4abe604916c04fe3dd8b9cb3d501d3f;88777aacd5f16599547926a4c9202862;128CECC59C91C0D0574BC1075FE7CB40;17a36ac3e31f3a18936552aff2c80249;0f49621b06f2cdaac8850c6e9581a594;3d129263f6a48647f103a04446fb0c2f;71345b139166482acaa568ac8816c7bc;1b60021baedc3f9201bcdb40e9b87f62;5E022694C0DBD1FBBC263D608E577949;cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5;b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04;2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec;6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11;5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c;37cd353621b0f4fc6981b50071c94f01;daf2da52475fd8981b19ec3c321a983c;afcdf79be1557326c854b6e20cb900a7;2f40abbb4f78e77745f0e657a19903fc953cc664;37b4496e650b3994312c838435013560b3ca8571;478dc5a5f934c62a9246f7d1fc275868f568bc07;1a2ab4df156ccd685f795baee7df49f8e701f271d3e5676b507112e30ce03c42;2c1d3d0a9c6f76726994b88589219cb8d9c39dd9924bc8d2d02bf41d955fe326;5c776a33568f4c16fee7140c249c0d2b1e0798a96c7a01bfd2d5684e58c9bb32;5fc4b0076eac7aa7815302b0c3158076e3569086c4c6aa2f71cd258238440d14;08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949;758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272;bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;c96ed56bf7ee85a4398cc43a98b4db86d3da311c619f17c8540ae424ca6546e1;e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230;0ac48cfa2ff8351365e99c1d26e082ad;0e9afd3a870906ebf34a0b66d8b07435;1aadf739782afcae6d1c3e4d1f315cbd;2a6f7ec77ab6bd4297e7b15ae06e2e61;3a771efb7ba2cd0df247ab570e1408b2;3d75c72144d873b3c1c4977fbafe9184;3dfebce4703f30eed713d795b90538b5;3ffd2915d285ad748202469d4a04e1f5;4e39620afca6f60bb30e031ddc5a4330;6cfd131fef548fcd60fbcdb59317df8e;7bcd736a2394fc49f3e27b3987cce640;7bfba2c69bed6b160261bdbf2b826401;7bfbd72441e1f2ed48fbc0f33be00f24;7c733607a0932b1b9a9e27cd6ab55fe0;7d5265e814843b24fcb3787768129040;08e82dc7bae524884b7dc2134942aadb;8da15a97eaf69ff7ee184fc446f19cf1;9ad6fa6fdedb2df8055b3d30bd6f64f1;9c115e9a81d25f9d88e7aaa4313d9a8f;16ab79fb2fd92db0b1f38bedb2f02ed8;21feb6aa15e02bb0cddbd544605aabad;21feb6aa15e02bb0cddbd544605aabad;22d142f11cf2a30ea4953e1fffb0fa7e;36db24006e2b492cafb75f2663f241b2;51a7068640af42c3a7c1b94f1c11ab9d;69a19abf5ba56ee07cdd3425b07cf8bf;72dc98449b45a7f1ccdef27d51e31e91;77a745b07d9c453650dd7f683b02b3ed;80c37e062aa4c94697f287352acf2e9d;92f8e3f0f1f7cc49fad797a62a169acd;235d427f94630575a4ea4bff180ecf5d;320b2f1d9551b5d1df4fb19bd9ab253a;490a140093b5870a47edc29f33542fd2;520ee02668a1c7b7c262708e12b1ba6b;649ef1dd4a5411d3afcf108d57ff87af;684eca6b62d69ce899a3ec3bb04d0a5b;815f1f8a7bc1e6f94cb5c416e381a110;0969b2b399a8d4cd2d751824d0d842b4;2317d65da4639f4246de200650a70753;04078ef95a70a04e95bda06cc7bec3fa;8035a8a143765551ca7db4bc5efb5dfd;8403a28e0bffa9cc085e7b662d0d5412;9003cfaac523e94d5479dc6a10575e60;9793afcea43110610757bd3b800de517;27612cb03c89158225ca201721ea1aad;44619a88a6cff63523163c6a4cf375dd;061089d8cb0ca58e660ce2e433a689b3;81229c1e272218eeda14892fa8425883;84730a6e426fbd3cf6b821c59674c8a0;533340c54bd25256873b3dca34d7f74e;57314359df11ffdf476f809671ec0275;99828721ac1a0e32e4582c3f615d6e57;412956675fbc3f8c51f438c1abc100eb;5985087678414143d33ffc6e8863b887;a43d3b31575846fa4c3992b4143a06da;a571660c9cf1696a2f4689b2007a12c7;b4e67706103c3b8ee148394ebee3f268;b9c208ea8115232bfd9ec2c62f32d6b8;b9cf4301b7b186a75e82a04e87b30fe4;b72737b464e50aa3664321e8e001ff32;bfe3f6a79cad5b9c642bb56f8037c43b;c0e72eb4c9f897410c795c1b360090ef;c1e7850da5604e081b9647b58248d7e8;c3e255888211d74cc6e3fb66b69bbffb;cacaa3bf3b2801956318251db5e90f3c;cdb303f61a47720c7a8c5086e6b2a743;ce8ce92fb6565181572dce00d69c24f8;d8f1356bebda9e77f480a6a60eab36bb;d9e9f22988d43d73d79db6ee178d70a4;d5377dc1821c935302c065ad8432c0d2;df91b86189adb0a11c47ce2405878fa1;e17bd40f5b5005f4a0c61f9e79a9d8c2;f559c87b4a14a4be1bd84df6553aaf56;fc53f2cd780cd3a01a4299b8445f8511;ffc7305cb24c1955f9625e525d58aeee - e96a73c7bf33a464c510ede582318bf2;a53a02b997935fd8eedcb5f7abab9b9f - d326e629a90e78825645963b35e53a6a;c579341f86f7e962719c7113943bb6e4;dc5733c013378fa418d13773f5bfe6f1;b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d;965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26;4a069c1abe5aca148d5a8fdabc26751e;dc7e564809d6c2a2f3457c3c9b91f22b;FE2CA1BE3BDA2A757036A89E54CC02DB;5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b - 53841a0c6a3ff92976db08bfdf95e083 - - - zoommtg - pwd= - - - zoommtg - zc=0 - - - zoommtg - zc=1 - - - msteams: - - - wbx: - - - C:\Users\ - \Downloads\ - - - C:\Users\ - \Desktop\ - - - \awk.exe;\sed.exe - - - C:\Users\Public\;$Recyclebin;\Desktop\;\Content.Outlook\ - - - C:\Users\Public\;$Recyclebin;\Desktop\;\Content.Outlook\;\Downloads\ - .html;.hta;.iso;.js;.bat;.cmd;.cmdline;.vbs;.vb;.vbe;.reg;.com - - listena - -s -n -u -i:http: - /s /n /u /i:http: - assoc - del - expand - md - move - rd - ren - set - setx - bginfo.bgi /popup /nolicprompt;bginfo.bgi -popup -nolicprompt - find.exe - grabff - routerscan - pythonEngine.Execute - sesshijack - file:// - HTML Application host - Manager Profile Installer - Microsoft Application Virtualization Injector - Application Compatibility Database Installer - popd.exe - pushd.exe - subst.exe - doskey.exe - cls.exe - \ - C:\Windows\system32\svchost.exe -k iissvcs - \ - acrobat.exe - acrord32.exe - java.exe - javaw.exe - - - - - C:\Windows\system32\svchost.exe - - cacls.exe - takeown.exe - /x Macro - - \pipe\ - > - - /noprofile - /sc ONEVENT - \\VBOXSVR - | more - |more - \\tsclient - %PROCESSOR_ARCHITECTURE% - sysnative - AutoIt - Microsoft Filter Loader - more.com - :\Windows\Microsoft.NET\ - acrord32.exe - gpupdate.exe - :\Windows\Microsoft.NET\ - System - - explorer.exe - \regedit.exe;\cmd.exe;terminal;\powershell - - - - - - - - - C:\Windows\System32\WerFault.exe - C:\Windows\System32\wbem\WmiPrvSE.exe - - - - - - - C:\Users - C:\ProgramData - \Temp\ - \tmp\ - \drivers\ - \Download - - - - - C:\Windows\system32\backgroundTaskHost.exe - TrustedInstaller.exe - OneDrive.exe - vivaldi.exe - chrome.exe - C:\WINDOWS\system32\backgroundTaskHost.exe - setup - AppData\Local\Microsoft\Teams\current\Teams.exe - \AppData\Local\Microsoft\Edge SxS\Application\msedge.exe - - - - - - - - census - researchscan - scanhub - shadow - shodan - - 137.184.67.33;206.188.196.77;125.212.220.48;5.180.61.17;47.242.39.92;61.244.94.85;86.48.6.69;86.48.12.64;94.140.8.48;94.140.8.113;103.9.76.208;103.9.76.211;104.244.79.6;112.118.48.186;122.155.174.188;125.212.241.134;185.220.101.182;194.150.167.88;212.119.34.11 - 137.184.67. - httpbin.org - - - advanced-ip-scanner.com - - - kali.download - - shodan - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - wscript.exe - - - - - - - - at.exe - schtasks.exe - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \temp\ - 127.0.0.1 - - - \wwwroot\ - - \Windows\addins\ - C:\Windows\repair\ - \htdocs\ - C:\Windows\system32\config\systemprofile\ - C:\Intel\Logs\ - C:\Windows\addins\ - C:\Windows\security\ - C:\Windows\Help\ - $RECYCLE.BIN - C:\Windows\Debug\ - C:\Windows\Fonts\ - C:\PerfLogs\ - :\$Recycle.bin\ - :\Users\Default\ - C:\Users\NetworkService\ - C:\Users\Public\ - C:\Windows\Media\ - \Windows\IME\ - C:\ProgramData - - - - - - - - CSC.exe - - - - - - - - - - infDefaultInstall.exe - SyncAppvPublishingServer.exe - - - InstallUtil.exe - - msiexec.exe - - - regasm.exe;regsvcs.exe - - - Mavinject.exe - - - - - - msbuild.exe - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - dsquery.exe - - - - - - - - - - - - - driverquery.exe - - - - nbtstat.exe - - net.exe - net1.exe - - qwinsta.exe - rwinsta.exe - - - - - - - - - - - - true - 3389 - AutomationManager.ScriptRunner64.exe - C:\Program Files (x86)\VMware\VMware Remote Console\vmrc.exe - C:\Program Files\VMware\VMware Remote Console\vmrc.exe - C:\Program Files\WindowsApps\Microsoft.RemoteDesktop_ - CtxLicUsageRecorder.exe - FSAssessment.exe - FSDiscovery.exe - MobaRTE.exe - RDCMan.exe - RSSensor.exe - RTS2App.exe - RTSApp.exe - RemoteDesktopManager64.exe - RemoteDesktopManager.exe - RemoteDesktopManagerFree.exe - Terminals.exe - chrome.exe - mRemote.exe - mRemoteNG.exe - mstsc.exe - spiceworks-finder.exe - svchost.exe - thor64.exe - thor.exe - - - true - 3391 - AutomationManager.ScriptRunner64.exe - C:\Program Files (x86)\VMware\VMware Remote Console\vmrc.exe - C:\Program Files\VMware\VMware Remote Console\vmrc.exe - C:\Program Files\WindowsApps\Microsoft.RemoteDesktop_ - CtxLicUsageRecorder.exe - FSAssessment.exe - FSDiscovery.exe - MobaRTE.exe - RDCMan.exe - RSSensor.exe - RTS2App.exe - RTSApp.exe - RemoteDesktopManager64.exe - RemoteDesktopManager.exe - RemoteDesktopManagerFree.exe - Terminals.exe - chrome.exe - mRemote.exe - mRemoteNG.exe - mstsc.exe - spiceworks-finder.exe - svchost.exe - thor64.exe - thor.exe - - - true - 3389 - 127.0.0.1;0:0:0:0:0:0:0:1 - - - true - 3389 - fe80:0 - - - putty.exe;kitty.exe;kitty_portable.exe - - - wsmprovhost.exe - - - psftp.exe - - reg.exe - psshutdown - PsPasswd - psservice - ssh.exe - psexe - tftp.exe - telnet.exe - mstsc.exe - wmic.exe - sc.exe - pskill - dsquery.exe - plink.exe - vnc.exe - vncviewer.exe - vncservice.exe - omniinet.exe - hpsmhd.exe - - - - - - - - - - - - - - - - - - - - - - - - - - - 50050 - true - - - 25 - \Bin\EdgeTransport.exe;Bin\MSExchangeFrontendTransport.exe - true - - - - - - - - - - - powershell.exe - 0:0:0:0:0:0:0:;127.0.0.1 - - mshta.exe - cmd.exe - certutil.exe - certutil.exe - notepad.exe - regsvcs.exe - regsvr32.exe - rundll32.exe - - - - - - - tor.exe - hiddenservice.net;onion.city;onion.direct;onion.direct;onion.link;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org;onion.to - - - - - - - - - dns.google;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;doh.opendns.com;.quad9.net;dns.cleanbrowsing.org;dns-family.adguard.com;dns.adguard.com;.233py.com;dnscrypt;dnscrypt-cert.oszx.co;dns.oszx.co;doh.dns.sb;doh.defaultroutes.de;doh.tiarap.org;doh.tiar.app;doh.captnemo.in;.aaflalo.me;doh.appliedprivacy.net;doh.dnswarden.com;commons.host;dns.twnic.tw;ibuki.cgnat.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;.seby.io;rdns.faelix.net;doh.li;.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk;adblock.mydns.network;ibksturm.synology.me;jcdns.fun - - - - - - - privatlab.com - mega.nz;mega.co.nz - .pcloud.com - - - - - - - - - - - - - 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;analytics.blue;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;estream.to;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;nimpool.io;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;supportxmr;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool - - - - - C:\Windows\system32\svchost.exe - 3389 - 22 - 21 - 5985 - false - - - C:\Windows\system32\svchost.exe - true - 135 - 445 - 5985 - - - System - svchost.exe - 445 - - - System - svchost.exe;lsass.exe - 389 - - - C:\Windows\System32\lsass.exe - 389 - 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 - EXCH - 127.0.0.1;0:0:0:0:0:0:0:1;fe80:0 - false - - - notepad.exe - 127.0.0.1 - - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe - 80 - 443 - true - - github - githubusercontent.com - - dropboxapi.com - \Dropbox\Client\Dropbox.exe;\Dropbox\bin\Dropbox.exe;\Oracle\Java\ - - - 1drv - - C:\Program Files\Microsoft OneDrive\OneDrive.exe;\AppData\Local\Microsoft\OneDrive\OneDrive.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe;\Internet Explorer\iexplore.exe;C:\Windows\System32\AppHostRegistrationVerifier.exe;C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe;C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe;C:\Program Files\Mozilla Firefox\firefox.exe - - - .box.com;upload - - - mega.nz;mega.co.nz - - - privatlab.com - - - tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat - - - efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet - - - .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com - - - apache.exe - - - java.exe - - - w3wp.exe - - - \php-cgi.exe;\php.exe - - - setup - - - tomcat - - - unins - - - unknown process - - - explorer.exe - - - inetinfo.exe - - - netcat.exe;nc.exe;nc64.exe;ncat.exe - procdump - psexe - vnc;vncs;vncv - - rcpping;tcpping;tcping;routerscan;grabff;Port-Scan;netscan;\nmap;ipscan;nacmdline.exe;advanced_port_scanner.exe;rcpping.exe;nmap.exe;zenmap.exe;advanced_ip_scanner.exe - - - 0 - 5985 - 5986 - 1293 - 1701 - 1194 - 3540 - 3389 - 22 - 1080 - 3128 - 8080 - 1723 - 23 - 4500 - 9001 - 9030 - 5900 - 5800 - - 0 - 80 - 443 - 636 - 5900 - 443 - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe - 80 - true - - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - https - true - - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe - http - true - - - \iexplore.exe;\chrome.exe;\firefox.exe;\MicrosoftEdge;browser_broker.exe;\vivaldi.exe;\brave.exe;\opera.exe - 443 - true - - - afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com - - - - - udp - - System;svchost.exe;oracle.exe;apache.exe;java.exe;php-cgi.exe;w3wp.exe;httpd;ServerManager.exe;unknown process;sql;wscript;cscript;schtasks;at.exe;reg.exe;C:\Windows\System32\find.exe - 127.0.0.1;0:0:0:0:0:0:0:1 - 127.0.0.1;0:0:0:0:0:0:0:1 - - - - C:\Windows\System32\lsass.exe - 88 - - - epmap - llmnr - microsoft-ds - netbios-dgm - ntp - ssdp - epmap - llmnr - microsoft-ds - netbios-dgm - ntp - ssdp - - 53 - 67 - 68 - 1434 - 1812 - 3544 - 3702 - 5228 - 5353 - 5357 - 5989 - 6007 - 49154 - 49209 - 52176 - 59241 - 53 - 67 - 68 - 1812 - 3702 - 6007 - 49154 - 49209 - 50646 - 52176 - 59241 - - .bing.com - .cloudapp.net - .lync.com - .microsoft.com - .outlook.com - .search.msn.com - .wns.windows.com - aps.windows.com - arc.msn.com.nsatc.net - arc.msn.com - atson.telemetry.microsoft.com - au.download.windowsupdate.com - b.akamaiedge.net - bingforbusiness.com - client-office365-tas.msedge.net - config.edge.skype.com - csp.digicert.com - ctldl.windowsupdate.com - cy2.licensing.md.mp.microsoft.com.akadns.net - cy2.settings.data.microsoft.com.akadns.net - displaycatalog.mp.microsoft.com - download.windowsupdate.com - e-msedge.net - e3.delivery.dsp.mp.microsoft.com.nsatc.net - emdl.ws.microsoft.com - ettings-win.data.microsoft.com - fe2.update.microsoft.com - fe3.delivery.dsp.mp.microsoft.com.nsatc.net - fe3.delivery.mp.microsoft.com - g.akamaiedge.net - g.live.com - g.msn.com.nsatc.net - geo-prod.do.dsp.mp.microsoft.com - geo-prod.dodsp.mp.microsoft.com.nsatc.net - ile-service.weather.microsoft.com - ip5.afdorigin-prod-am02.afdogw.com - ipv4.login.msa.akadns6.net - licensing.mp.microsoft.com - m3p.wns.notify.windows.com.akadns.net - microsoft.com.akadns.net - microsoft.com.nsatc.net - microsoft.com - modern.watson.data.microsoft.com.akadns.net - msedge.net - msn.com.nsatc.net - msn.com - ocation-inference-westus.cloudapp.net - ocos-office365-s2s.msedge.net - ocsp.digicert.com - odern.watson.data.microsoft.com.akadns.net - oneclient.sfx.ms - pv4.login.msa.akadns6.net - query.prod.cms.rt.microsoft.com - ris.api.iris.microsoft.com.akadns.net - ris.api.iris.microsoft.com - s-msedge.net - settings.data.microsoft.com - sfe.trafficshaping.dsp.mp.microsoft.com - sls.update.microsoft.com - storecatalogrevocation.storequality.microsoft.com - storeedgefd.dsx.mp.microsoft.com - telecommand.telemetry.microsoft.com.akadns.net - tile-service.weather.microsoft.com - tlu.dl.delivery.mp.microsoft.com - tsfe.trafficshaping.dsp.mp.microsoft.com - vip5.afdorigin-prod-am02.afdogw.com - vip5.afdorigin-prod-ch02.afdogw.com - virtualearth.net - windows.net - windowsupdate.com - y2.displaycatalog.md.mp.microsoft.com.akadns.net - y2.licensing.md.mp.microsoft.com.akadns.net - y2.settings.data.microsoft.com.akadns.net - EdgeTransport.exe - MSExchangeDelivery.exe - MSExchangeFrontendTransport.exe - MSExchangeHMWorker.exe - MSExchangeSubmission.exe - \ - - - C:\Program Files (x86)\Kaspersky Lab - C:\Program Files\Kaspersky Lab - C:\Program Files (x86)\ESET - C:\Program Files\ESET - - - - - - - - - - - - - - C:\Windows\ - \System32\;Syswow64;sysmon.exe;sysmon64.exe - - - C:\Windows\system32\ - config\systemprofile\ - - - C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe - - - A:\;B:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;N:\;O:\;P:\;Q:\;R:\;S:\;T:\;U:\;V:\;W:\;X:\;Y:\;Z:\;AA:\;BB:\;CC:\;DD:\;EE:\;FF:\;GG:\;HH:\;II:\;JJ:\;KK:\;LL:\;MM:\;NN:\;OO:\;PP:\;QQ:\;RR:\;SS:\;TT:\;UU:\;VV:\;WW:\;XX:\;YY;ZZ:\ - :\PROGRA~ - :\Program Files - :\Program Files - :\Program Files - :\ProgramData\ - :\Users\ - :\Windows\ - :\inetpub\ - :\$SysReset - :\$WinREAgent - :\inetpub\ - - - \ - - - C:\Users\ - - - C:\ProgramData\ - C:\ProgramData\sysmon\sysmon64.exe;C:\ProgramData\sysmon\sysmon.exe - - - C:\Program Files;C:\PROGRA~ - - - C:\inetpub\ - - - $RECYCLE.BIN - packetbeat.exe;metricbeat.exe;filebeat.exe;winlogbeat.exe;o365beat.exe;graylog-sidecar.exe;graylog-collector-sidecar.exe;splunkd.exe;splunk.exe;syslogng.exe;syslog-ng.exe;nxlog-processor.exe;snarecore.exe;fluentd;td-agent - C:\Windows\system32\config\systemprofile\ - C:\Windows\sysWOW64\config\systemprofile\ - \Temp\ - C:\Users\ - - - - - Microsoft\Teams\current\Teams.exe - \git.exe - Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe - C:\ProgramData\Lenovo\ImController\ - - - - - - - 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - - - 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5;c948ae14761095e4d76b55d9de86412258be7afd;c996d7971c49252c582171d9380360f2;ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1;10b30bdee43b3a2ec4aa63375577ade650269d25;d2fd132ab7bbc6bbb87a84f026fa0244 - - DumpExt.dll - mimidrv - lsremora - wceaux.dll - npcap - \Temp - :\Users - ChongKim Chan - ? - Revoked - Unavailable - Valid - false - - - SHA1=2261198385d62d2117f50f631652eded0ecc71db - SHA1=8db869c0674221a2d3280143cbb0807fac08e0cc - SHA1=27d3ebea7655a72e6e8b95053753a25db944ec0f - SHA1=33cdab3bbc8b3adce4067a1b042778607dce2acd - SHA1=21e6c104fe9731c874fab5c9560c929b2857b918 - SHA1=d979353d04bf65cc92ad3412605bc81edbb75ec2 - SHA1=2f991435a6f58e25c103a657d24ed892b99690b8 - SHA1=f02af84393e9627ba808d4159841854a6601cf80 - SHA1=bb962c9a8dda93e94fef504c4159de881e4706fe - SHA1=b97a8d506be2e7eaa4385f70c009b22adbd071ba - SHA1=92f251358b3fe86fd5e7aa9b17330afa0d64a705 - SHA1=8b6aa5b2bff44766ef7afbe095966a71bc4183fa - SHA1=af6e1f2cfb230907476e8b2d676129b6d6657124 - SHA1=fcde5275ee1913509927ce5f0f85e6681064c9d2 - SHA1=00a442a4305c62cefa8105c0b4c4a9a5f4d1e93b - SHA1=6523b3fd87de39eb5db1332e4523ce99556077dc - SHA1=72966ca845759d239d09da0de7eebe3abe86fee3 - SHA1=57511ef5ff8162a9d793071b5bf7ebe8371759de - SHA1=2d503a2457a787014a1fdd48a2ece2e6cbe98ea7 - SHA1=400f833dcc2ef0a122dd0e0b1ec4ec929340d90e - SHA1=89cd760e8cb19d29ee08c430fb17a5fd4455c741 - SHA1=1d0df45ee3fa758f0470e055915004e6eae54c95 - SHA1=d5fd9fe10405c4f90235e583526164cd0902ed86 - SHA1=c52cef5b9e1d4a78431b7af56a6fdb6aa1bcad65 - SHA1=609fa1efcf61e26d64a5ceb13b044175ab2b3a13 - SHA1=7d7c03e22049a725ace2a9812c72b53a66c2548b - SHA1=f9519d033d75e1ab6b82b2e156eafe9607edbcfb - SHA1=468e2e5505a3d924b14fedee4ddf240d09393776 - SHA1=2e3de9bff43d7712707ef8a0b10f7e4ad8427fd8 - SHA1=c9cbfdd0be7b35751a017ec59ff7237ffdc4df1f - SHA1=078ae07dec258db4376d5a2a05b9b508d68c0123 - SHA1=623cd2abef6c92255f79cbbd3309cb59176771da - SHA1=1f3a9265963b660392c4053329eb9436deeed339 - SHA1=4a235f0b84ff615e2879fa9e0ec0d745fcfdaa5c - SHA1=ace6b9e34e3e2e73fe584f3bbdb4e4ec106e0a7d - SHA1=4268f30b79ce125a81d0d588bef0d4e2ad409bbb - SHA1=c834c4931b074665d56ccab437dfcc326649d612 - SHA1=8f5cd4a56e6e15935491aa40adb1ecad61eafe7c - SHA1=51b60eaa228458dee605430aae1bc26f3fc62325 - SHA1=3270720a066492b046d7180ca6e60602c764cac7 - SHA1=2a6e6bd51c7062ad24c02a4d2c1b5e948908d131 - SHA1=19bd488fe54b011f387e8c5d202a70019a204adf - SHA1=a6fe4f30ca7cb94d74bc6d42cdd09a136056952e - SHA1=ea877092d57373cb466b44e7dbcad4ce9a547344 - SHA1=205c69f078a563f54f4c0da2d02a25e284370251 - SHA1=f9feb60b23ca69072ce42264cd821fe588a186a6 - SHA1=b25170e09c9fb7c0599bfba3cf617187f6a733ac - SHA1=160c96b5e5db8c96b821895582b501e3c2d5d6e7 - SHA1=a2e0b3162cfa336cd4ab40a2acc95abe7dc53843 - SHA1=4e826430a1389032f3fe06e2cc292f643fb0c417 - SHA1=7ab4565ba24268f0adadb03a5506d4eb1dc7c181 - SHA1=dc7b022f8bd149efbcb2204a48dce75c72633526 - SHA1=0307d76750dd98d707c699aee3b626643afb6936 - SHA1=5711c88e9e64e45b8fc4b90ab6f2dd6437dc5a8a - SHA1=6714380bc0b8ab09b9a0d2fa66d1b025b646b946 - SHA1=8626ab1da6bfbdf61bd327eb944b39fd9df33d1d - SHA1=30a224b22592d952fbe2e6ad97eda4a8f2c734e0 - SHA1=c95db1e82619fb16f8eec9a8209b7b0e853a4ebe - SHA1=fe1d909ab38de1389a2a48352fd1c8415fd2eab0 - SHA1=b4d1554ec19504215d27de0758e13c35ddd6db3e - SHA1=5dd2c31c4357a8b76db095364952b3d0e3935e1d - SHA1=ecb4d096a9c58643b02f328d2c7742a38e017cf0 - SHA1=4a705af959af61bad48ef7579f839cb5ebd654d2 - SHA1=d2e6fc9259420f0c9b6b1769be3b1f63eb36dc57 - SHA1=c948ae14761095e4d76b55d9de86412258be7afd - SHA1=ddbe809b731a0962e404a045ab9e65a0b64917ad - SHA1=745bad097052134548fe159f158c04be5616afc2 - SHA1=8d59fd14a445c8f3f0f7991fa6cd717d466b3754 - SHA1=2dfcb799b3c42ecb0472e27c19b24ac7532775ce - SHA1=cc51be79ae56bc97211f6b73cc905c3492da8f9d - SHA1=ac13941f436139b909d105ad55637e1308f49d9a - SHA1=2b0bb408ff0e66bcdf6574f1ca52cbf4015b257b - SHA1=cc0e0440adc058615e31e8a52372abadf658e6b1 - SHA1=5520ac25d81550a255dc16a0bb89d4b275f6f809 - SHA1=6afc6b04cf73dd461e4a4956365f25c1f1162387 - SHA1=4b009e91bae8d27b160dc195f10c095f8a2441e1 - SHA1=6003184788cd3d2fc624ca801df291ccc4e225ee - SHA1=0466e90bf0e83b776ca8716e01d35a8a2e5f96d3 - SHA1=e6305dddd06490d7f87e3b06d09e9d4c1c643af0 - SHA1=89909fa481ff67d7449ee90d24c167b17b0612f1 - SHA1=d7e8aef8c8feb87ce722c0b9abf34a7e6bab6eb4 - SHA1=5e6ddd2b39a3de0016385cbd7aa50e49451e376d - SHA1=976777d39d73034df6b113dfce1aa6e1d00ffcfd - SHA1=9c6749fc6c1127f8788bff70e0ce9062959637c9 - SHA1=53acd4d9e7ba0b1056cf52af0d191f226eddf312 - SHA1=3abb9d0a9d600200ae19c706e570465ef0a15643 - SHA1=27eab595ec403580236e04101172247c4f5d5426 - SHA1=78b9481607ca6f3a80b4515c432ddfe6550b18a8 - SHA1=414cd15d6c991d19fb5be02e3b9fb0e6c5ce731c - SHA1=d9c09dd725bc7bc3c19b4db37866015817a516ef - SHA1=9c256edd10823ca76c0443a330e523027b70522d - SHA1=35829e096a15e559fcbabf3441d99e580ca3b26e - SHA1=b8de3a1aeeda9deea43e3f768071125851c85bd0 - SHA1=054a50293c7b4eea064c91ef59cf120d8100f237 - SHA1=d94f2fb3198e14bfe69b44fb9f00f2551f7248b2 - SHA1=01a578a3a39697c4de8e3dab04dba55a4c35163e - SHA1=14bf0eaa90e012169745b3e30c281a327751e316 - SHA1=f50c6b84dfb8f2d53ba3bce000a55f0a486c0e79 - SHA1=6100eb82a25d64a7a7702e94c2b21333bc15bd08 - SHA1=bf87e32a651bdfd9b9244a8cf24fca0e459eb614 - SHA1=28b1c0b91eb6afd2d26b239c9f93beb053867a1a - SHA1=879fcc6795cebe67718388228e715c470de87dca - SHA1=1f7501e01d84a2297c85cb39880ec4e40ac3fe8a - SHA1=152b6bb9ffd2ffec00cc46f5c6e29362d0e66e67 - SHA1=5f8356ffa8201f338dd2ea979eb47881a6db9f03 - SHA1=a7bd05de737f8ea57857f1e0845a25677df01872 - SHA1=cce9b82f01ec68f450f5fe4312f40d929c6a506e - SHA1=e35a2b009d54e1a0b231d8a276251f64231b66a3 - SHA1=37364cb5f5cefd68e5eca56f95c0ab4aff43afcc - SHA1=d62fa51e520022483bdc5847141658de689c0c29 - SHA1=93aa3bb934b74160446df3a47fa085fd7f3a6be9 - SHA1=ec4cc6de4c779bb1ca1dd32ee3a03f7e8d633a9b - SHA1=35f1ba60ba0da8512a0b1b15ee8e30fe240d77cd - SHA1=3805e4e08ad342d224973ecdade8b00c40ed31be - SHA1=65d8a7c2e867b22d1c14592b020c548dd0665646 - SHA1=c8d87f3cd34c572870e63a696cf771580e6ea81b - SHA1=c4d7fb9db3c3459f7e8c0e3d48c95c7c9c4cff60 - SHA1=d34a7c497c603f3f7fcad546dc4097c2da17c430 - SHA1=1fd7f881ea4a1dbb5c9aeb9e7ad659a85421745b - SHA1=0b8b83f245d94107cb802a285e6529161d9a834d - SHA1=c969f1f73922fd95db1992a5b552fbc488366a40 - SHA1=ac600a2bc06b312d92e649b7b55e3e91e9d63451 - SHA1=da9cea92f996f938f699902482ac5313d5e8b28e - SHA1=33285b2e97a0aeb317166cce91f6733cf9c1ad53 - SHA1=21edff2937eb5cd6f6b0acb7ee5247681f624260 - SHA1=f052dc35b74a1a6246842fbb35eb481577537826 - SHA1=f0c463d29a5914b01e4607889094f1b7d95e7aaf - SHA1=0c26ab1299adcd9a385b541ef1653728270aa23e - SHA1=f36a47edfacd85e0c6d4d22133dd386aee4eec15 - SHA1=460008b1ffd31792a6deadfa6280fb2a30c8a5d2 - SHA1=738b7918d85e5cb4395df9e3f6fc94ddad90e939 - SHA1=43419df1f9a07430a18c5f3b3cc74de621be0f8e - SHA1=558aad879b6a47d94a968f39d0a4e3a3aaef1ef1 - SHA1=7fb52290883a6b69a96d480f2867643396727e83 - - SHA1=f5696fb352a3fbd14fb1a89ad21a71776027f9ab - SHA1=693a2645c28fc3b248fda95179c36c3ac64f6fc2 - SHA1=05c0c49e8bcf11b883d41441ce87a2ee7a3aba1d - SHA1=d25340ae8e92a6d29f599fef426a2bc1b5217299 - SHA1=7c1b25518dee1e30b5a6eaa1ea8e4a3780c24d0c - SHA1=fe10018af723986db50701c8532df5ed98b17c39 - SHA1=bfe55cacc7c56c9f7bd75bdb4b352c0b745d071b - SHA1=a21c84c6bf2e21d69fa06daaf19b4cc34b589347 - SHA1=82ba5513c33e056c3f54152c8555abf555f3e745 - SHA1=d098600152e5ee6a8238d414d2a77a34da8afaaa - SHA1=64e4ac8b9ea2f050933b7ec76a55dd04e97773b4 - SHA1=bbc1e5fd826961d93b76abd161314cb3592c4436 - SHA1=90a76945fd2fa45fab2b7bcfdaf6563595f94891 - SHA1=b03b1996a40bfea72e4584b82f6b845c503a9748 - SHA1=c771ea59f075170e952c393cfd6fc784b265027c - SHA1=cb44c6f0ee51cb4c5836499bc61dd6c1fbdf8aa1 - SHA1=0918277fcdc64a9dc51c04324377b3468fa1269b - SHA1=b09bcc042d60d2f4c0d08284818ed198cededa04 - - SHA1=8dc2097a90eb7e9d6ee31a7c7a95e7a0b2093b89 - SHA1=15df139494d2c40a645fb010908551185c27f3c5 - SHA1=012db3a80faf1f7f727b538cbe5d94064e7159de - SHA1=d04e5db5b6c848a29732bfd52029001f23c3da75 - SHA1=490109fa6739f114651f4199196c5121d1c6bdf2 - SHA1=b4d014b5edd6e19ce0e8395a64faedf49688ecb5 - SHA1=a87d6eac2d70a3fbc04e59412326b28001c179de - SHA1=3f223581409492172a1e875f130f3485b90fbe5f - SHA1=5db61d00a001fd493591dc919f69b14713889fc5 - - SHA1=9923c8f1e565a05b3c738d283cf5c0ed61a0b90f - SHA1=15d1a6a904c8409fb47a82aefa42f8c3c7d8c370 - SHA1=9d07df024ec457168bf0be7e0009619f6ac4f13c - SHA1=9a35ae9a1f95ce4be64adc604c80079173e4a676 - SHA1=c6bd965300f07012d1b651a9b8776028c45b149a - SHA1=e83458c4a6383223759cd8024e60c17be4e7c85f - SHA1=cb3de54667548a5c9abf5d8fa47db4097fcee9f1 - SHA1=9c24dd75e4074041dbe03bf21f050c77d748b8e9 - SHA1=dc55217b6043d819eadebd423ff07704ee103231 - SHA1=e92817a8744ebc4e4fa5383cdce2b2977f01ecd4 - SHA1=dc0e97adb756c0f30b41840a59b85218cbdd198f - SHA1=26c4a7b392d7e7bd7f0a2a758534e45c0d9a56ab - SHA1=d0d39e1061f30946141b6ecfa0957f8cc3ddeb63 - SHA1=c6d349823bbb1f5b44bae91357895dba653c5861 - SHA1=f42f28d164205d9f6dab9317c9fecad54c38d5d2 - SHA1=bbc0b9fd67c8f4cefa3d76fcb29ff3cef996b825 - SHA1=8183a341ba6c3ce1948bf9be49ab5320e0ee324d - SHA1=eb1ecad3d37bb980f908bf1a912415cff32e79e6 - SHA1=eb0d45aa6f537f5b2f90f3ad99013606eafcd162 - SHA1=6053d258096bccb07cb0057d700fe05233ab1fbb - SHA1=29a190727140f40cea9514a6420f5a195e36386b - SHA1=a4b2c56c12799855162ca3b004b4b2078c6ecf77 - SHA1=7667b72471689151e176baeba4e1cd9cd006a09a - SHA1=d7f7594ff084201c0d9fa2f4ef1626635b67bce5 - SHA1=99201c9555e5faf6e8d82da793b148311f8aa4b8 - SHA1=947db58d6f36a8df9fa2a1057f3a7f653ccbc42e - SHA1=6a3d3b9ab3d201cd6b0316a7f9c3fb4d34d0f403 - SHA1=d702d88b12233be9413446c445f22fda4a92a1d9 - SHA1=910cb12aa49e9f35ecc4907e8304adf0dcca8cf1 - SHA1=643383938d5e0d4fd30d302af3e9293a4798e392 - SHA1=c4ed28fdfba7b8a8dfe39e591006f25d39990f07 - - - SHA1=b0032b8d8e6f4bd19a31619ce38d8e010f29a816 - SHA1=db6245578ec57bd767b27ecf8085095e1c8e5a6e - SHA1=166759fd511613414d3213942fe2575b926a6226 - SHA1=02a8b74899591da7b7f49c0450328d39b939d7e4 - SHA1=98ceed786f79288becc08c3b82c57e8d4bfa1bca - SHA1=f6b3577ea4b1a5641ae3421151a26268434c3db8 - SHA1=4de33d03fee52f396a1c788000ca868d56ac30de - SHA1=c6920171fa6dff2c17eb83befb5fd28e8dddf5f0 - SHA1=fbc6d2448739ddec35bb5d6c94b46df4148f648d - SHA1=6b54f8f137778c1391285fee6150dfa58a8120b1 - SHA1=943593e880b4d340f2548548e6e673ef6f61eed3 - SHA1=5ac4d0e2381fc4a8aebe94a0fb6fe5e7558e4dcd - SHA1=e44297a2b750ec1958bef265e2f1ae6fa4323b28 - SHA1=aa2ea973bb248b18973e57339307cfb8d309f687 - SHA1=3a5d176c50f97b71d139767ed795d178623f491d - SHA1=25d812a5ece19ea375178ef9d60415841087726e - SHA1=3795e32592ab6d8074b6f7ad33759c6a39b0df07 - SHA1=fc121ed6fb37e97a004b6faf217435b772dfc4c0 - SHA1=ab2b8602e4baef828b58b995d0889a8e5b8dbd02 - SHA1=cf040040628b58f4a811f98c2690913c1e8e4e3c - SHA1=3296844d22c87dd5eba3aa378a8242b41d59db7a - SHA1=bc47e15537fa7c32dfefd23168d7e1741f8477ed - SHA1=cb22723faa5ae2809476e5c5e9b9a597b26cab9b - SHA1=f3c5e723ae009b336cd2719137b8cd194c9ee51d - SHA1=41f2d0f9863bce8920c207b1ef5d3d32b603edef - SHA1=eb93d2f564fea9b3dc350f386b45de2cd9a3e001 - SHA1=3cd037fbba8aae82c1b111c9f8755349c98bcb3c - SHA1=9401389fba314d1810f83edce33c37e84a78e112 - SHA1=7eb34cc1fcffb4fdb5cb7e97184dd64a65cb9371 - SHA1=16d7ecf09fc98798a6170e4cef2745e0bee3f5c7 - SHA1=fcd615df88645d1f57ff5702bd6758b77efea6d0 - SHA1=f3db629cfe37a73144d5258e64d9dd8b38084cf4 - SHA1=a00e444120449e35641d58e62ed64bb9c9f518d2 - SHA1=38571f14fc014487194d1eecfa80561ee8644e09 - SHA1=4d41248078181c7f61e6e4906aa96bbdea320dc2 - SHA1=3599ea2ac1fa78f423423a4cf90106ea0938dde8 - SHA1=3d6d53b0f1cc908b898610227b9f1b9352137aba - SHA1=4c18754dca481f107f0923fb8ef5e149d128525d - SHA1=8c377ab4eebc5f4d8dd7bb3f90c0187dfdd3349f - SHA1=cde32654a041fedc7b0fa1083f6005b950760062 - SHA1=5fb9421be8a8b08ec395d05e00fd45eb753b593a - SHA1=b480c54391a2a2f917a44f91a5e9e4590648b332 - SHA1=4f7a8e26a97980544be634b26899afbefb0a833c - - SHA256=05F052C64D192CF69A462A5EC16DDA0D43CA5D0245900C9FCB9201685A2E7748 - SHA256=4045AE77859B1DBF13972451972EAAF6F3C97BEA423E9E78F1C2F14330CD47CA - SHA256=6948480954137987A0BE626C24CF594390960242CD75F094CD6AAA5C2E7A54FA - SHA256=8CB62C5D41148DE416014F80BD1FD033FD4D2BD504CB05B90EEB6992A382D58F - SHA256=B1D96233235A62DBB21B8DBE2D1AE333199669F67664B107BFF1AD49B41D9414 - SHA256=7196187FB1EF8D108B380D37B2AF8EFDEB3CA1F6EEFD37B5DC114C609147216D - SHA256=7F375639A0DF7FE51E5518CF87C3F513C55BC117DB47D28DA8C615642EB18BFA - SHA256=42579A759F3F95F20A2C51D5AC2047A2662A2675B3FB9F46C1ED7F23393A0F00 - SHA256=2DA330A2088409EFC351118445A824F11EDBE51CF3D653B298053785097FE40E - SHA256=436CCAB6F62FA2D29827916E054ADE7ACAE485B3DE1D3E5C6C62D3DEBF1480E7 - SHA256=B4D47EA790920A4531E3DF5A4B4B0721B7FEA6B49A35679F0652F1E590422602 - SHA256=DDE6F28B3F7F2ABBEE59D4864435108791631E9CB4CDFB1F178E5AA9859956D8 - SHA256=B48A309EE0960DA3CAAAAF1E794E8C409993AEB3A2B64809F36B97AAC8A1E62A - SHA256=025E7BE9FCEFD6A83F4471BBA0C11F1C11BD5047047D26626DA24EE9A419CDC4 - SHA256=2AA1B08F47FBB1E2BD2E4A492F5D616968E703E1359A921F62B38B8E4662F0C4 - SHA256=ECE0A900EA089E730741499614C0917432246CEB5E11599EE3A1BB679E24FD2C - SHA256=F40435488389B4FB3B945CA21A8325A51E1B5F80F045AB019748D0EC66056A8B - SHA256=2A652DE6B680D5AD92376AD323021850DAB2C653ABF06EDF26120F7714B8E08A - SHA256=950A4C0C772021CEE26011A92194F0E58D61588F77F2873AA0599DFF52A160C9 - SHA256=0AAFA9F47ACF69D46C9542985994FF5321F00842A28DF2396D4A3076776A83CB - SHA256=47F08F7D30D824A8F4BB8A98916401A37C0FD8502DB308ABA91FE3112B892DCC - SHA256=B9A4E40A5D80FEDD1037EAED958F9F9EFED41EB01ADA73D51B5DCD86E27E0CBF - SHA256=5C04C274A708C9A7D993E33BE3EA9E6119DC29527A767410DBAF93996F87369A - SHA256=0040153302B88BEE27EB4F1ECA6855039E1A057370F5E8C615724FA5215BADA3 - SHA256=3326E2D32BBABD69FEB6024809AFC56C7E39241EBE70A53728C77E80995422A5 - SHA256=36B9E31240AB0341873C7092B63E2E0F2CAB2962EBF9B25271C3A1216B7669EB - SHA256=29E0062A017A93B2F2F5207A608A96DF4D554C5DE976BD0276C2590A03BD3E94 - SHA256=45ABDBCD4C0916B7D9FAAF1CD08543A3A5178871074628E0126A6EDA890D26E0 - SHA256=50DB5480D0392A7DD6AB5DF98389DC24D1ED1E9C98C9C35964B19DABCD6DC67F - SHA256=607DC4C75AC7AEF82AE0616A453866B3B358C6CF5C8F9D29E4D37F844306B97C - SHA256=61D6E40601FA368800980801A662A5B3B36E3C23296E8AE1C85726A56EF18CC8 - SHA256=74A846C61ADC53692D3040AFF4C1916F32987AD72B07FE226E9E7DBEFF1036C4 - SHA256=76FB4DEAEE57EF30E56C382C92ABFFE2CF616D08DBECB3368C8EE6B02E59F303 - SHA256=81939E5C12BD627FF268E9887D6FB57E95E6049F28921F3437898757E7F21469 - SHA256=9790A7B9D624B2B18768BB655DDA4A05A9929633CEF0B1521E79E40D7DE0A05B - SHA256=9A1D66036B0868BBB1B2823209FEDEA61A301D5DD245F8E7D390BD31E52D663E - SHA256=AA9AB1195DC866270E984F1BED5E1358D6EF24C515DFDB6C2A92D1E1B94BF608 - SHA256=AF095DE15A16255CA1B2C27DAD365DFF9AC32D2A75E8E288F5A1307680781685 - SHA256=D5586DC1E61796A9AE5E5D1CED397874753056C3DF2EB963A8916287E1929A71 - SHA256=D8459F7D707C635E2C04D6D6D47B63F73BA3F6629702C7A6E0DF0462F6478AE2 - SHA256=E81230217988F3E7EC6F89A06D231EC66039BDBA340FD8EBB2BBB586506E3293 - SHA256=F88EBB633406A086D9CCA6BC8B66A4EA940C5476529F9033A9E0463512A23A57 - SHA256=1C8DFA14888BB58848B4792FB1D8A921976A9463BE8334CFF45CC96F1276049A - SHA256=22418016E980E0A4A2D01CA210A17059916A4208352C1018B0079CCB19AAF86A - SHA256=405472A8F9400A54BB29D03B436CCD58CFD6442FE686F6D2ED4F63F002854659 - SHA256=49F75746EEBE14E5DB11706B3E58ACCC62D4034D2F1C05C681ECEF5D1AD933BA - SHA256=4A3D4DB86F580B1680D6454BAEE1C1A139E2DDE7D55E972BA7C92EC3F555DCE2 - SHA256=4AB41816ABBF14D59E75B7FAD49E2CB1C1FEB27A3CB27402297A2A4793FF9DA7 - SHA256=54841D9F89E195196E65AA881834804FE3678F1CF6B328CAB8703EDD15E3EC57 - SHA256=5EE292B605CD3751A24E5949AAE615D472A3C72688632C3040DC311055B75A92 - SHA256=76B86543CE05540048F954FED37BDDA66360C4A3DDB8328213D5AEF7A960C184 - SHA256=7F190F6E5AB0EDAFD63391506C2360230AF4C2D56C45FC8996A168A1FC12D457 - SHA256=845F1E228DE249FC1DDF8DC28C39D03E8AD328A6277B6502D3932E83B879A65A - SHA256=84BF1D0BCDF175CFE8AEA2973E0373015793D43907410AE97E2071B2C4B8E2D4 - SHA256=8EF0AD86500094E8FA3D9E7D53163AA6FEEF67C09575C169873C494ED66F057F - SHA256=A56C2A2425EB3A4260CC7FC5C8D7BED7A3B4CD2AF256185F24471C668853AEE8 - SHA256=AC3F613D457FC4D44FA27B2E0B1BAA62C09415705EFB5A40A4756DA39B3AC165 - SHA256=B1334A71CC73B3D0C54F62D8011BEC330DFC355A239BF94A121F6E4C86A30A2E - SHA256=B47BE212352D407D0EF7458A7161C66B47C2AEC8391DD101DF11E65728337A6A - SHA256=B9B3878DDC5DFB237D38F8D25067267870AFD67D12A330397A8853209C4D889C - SHA256=DB90E554AD249C2BD888282ECF7D8DA4D1538DD364129A3327B54F8242DD5653 - SHA256=E61A54F6D3869B43C4ECEAC3016DF73DF67CCE03878C5A6167166601C5D3F028 - SHA256=3871E16758A1778907667F78589359734F7F62F9DC953EC558946DCDBE6951E3 - SHA256=DED2927F9A4E64EEFD09D0CABA78E94F309E3A6292841AE81D5528CAB109F95D - SHA256=0296E2CE999E67C76352613A718E11516FE1B0EFC3FFDB8918FC999DD76A73A5 - SHA256=80CBBA9F404DF3E642F22C476664D63D7C229D45D34F5CD0E19C65EB41BECEC3 - SHA256=BB50818A07B0EB1BD317467139B7EB4BAD6CD89053FECDABFEAE111689825955 - SHA256=FF6729518A380BF57F1BC6F1EC0AA7F3012E1618B8D9B0F31A61D299EE2B4339 - SHA256=3A5EC83FE670E5E23AEF3AFA0A7241053F5B6BE5E6CA01766D6B5F9177183C25 - SHA256=61A1BDDDD3C512E681818DEBB5BEE94DB701768FC25E674FCAD46592A3259BD0 - SHA256=07B6D69BAFCFD767F1B63A490A8843C3BB1F8E1BBEA56176109B5743C8F7D357 - SHA256=21CCDD306B5183C00ECFD0475B3152E7D94B921E858E59B68A03E925D1715F21 - SHA256=2D83CCB1AD9839C9F5B3F10B1F856177DF1594C66CBBC7661677D4B462EBF44D - SHA256=F581DECC2888EF27EE1EA85EA23BBB5FB2FE6A554266FF5A1476ACD1D29D53AF - SHA256=F8965FDCE668692C3785AFA3559159F9A18287BC0D53ABB21902895A8ECF221B - SHA256=3D23BDBAF9905259D858DF5BF991EB23D2DC9F4ECDA7F9F77839691ACEF1B8C4 - SHA256=DD4A1253D47DE14EF83F1BC8B40816A86CCF90D1E624C5ADF9203AE9D51D4097 - SHA256=509628B6D16D2428031311D7BD2ADD8D5F5160E9ECC0CD909F1E82BBBB3234D6 - SHA256=525D9B51A80CA0CD4C5889A96F857E73F3A80DA1FFBAE59851E0F51BDFB0B6CD - SHA256=6DE84CAA2CA18673E01B91AF58220C60AECD5CCCF269725EC3C7F226B2167492 - SHA256=09BEDBF7A41E0F8DABE4F41D331DB58373CE15B2E9204540873A1884F38BDDE1 - SHA256=101402D4F5D1AE413DED499C78A5FCBBC7E3BAE9B000D64C1DD64E3C48C37558 - SHA256=131D5490CEB9A5B2324D8E927FEA5BECFC633015661DE2F4C2F2375A3A3B64C6 - SHA256=1DDFE4756F5DB9FB319D6C6DA9C41C588A729D9E7817190B027B38E9C076D219 - SHA256=1E8B0C1966E566A523D652E00F7727D8B0663F1DFDCE3B9A09B9ADFAEF48D8EE - SHA256=2BBE65CBEC3BB069E92233924F7EE1F95FFA16173FCEB932C34F68D862781250 - SHA256=30706F110725199E338E9CC1C940D9A644D19A14F0EB8847712CBA4CACDA67AB - SHA256=3124B0411B8077605DB2A9B7909D8240E0D554496600E2706E531C93C931E1B5 - SHA256=38FA0C663C8689048726666F1C5E019FEAA9DA8278F1DF6FF62DA33961891D2A - SHA256=39CFDE7D401EFCE4F550E0A9461F5FC4D71FA07235E1336E4F0B4882BD76550E - SHA256=3D9E83B189FCF5C3541C62D1F54A0DA0A4E5B62C3243D2989AFC46644056C8E3 - SHA256=3F2FDA9A7A9C57B7138687BBCE49A2E156D6095DDDABB3454EA09737E02C3FA5 - SHA256=47F0CDAA2359A63AD1389EF4A635F1F6EEE1F63BDF6EF177F114BDCDADC2E005 - SHA256=50D5EAA168C077CE5B7F15B3F2C43BD2B86B07B1E926C1B332F8CB13BD2E0793 - SHA256=56A3C9AC137D862A85B4004F043D46542A1B61C6ACB438098A9640469E2D80E7 - SHA256=591BD5E92DFA0117B3DAA29750E73E2DB25BAA717C31217539D30FFB1F7F3A52 - SHA256=5D530E111400785D183057113D70623E17AF32931668AB7C7FC826F0FD4F91A3 - SHA256=6F1FF29E2E710F6D064DC74E8E011331D807C32CC2A622CBE507FD4B4D43F8F4 - SHA256=79E2D37632C417138970B4FEBA91B7E10C2EA251C5EFE3D1FC6FA0190F176B57 - SHA256=85866E8C25D82C1EC91D7A8076C7D073CCCF421CF57D9C83D80D63943A4EDD94 - SHA256=89B0017BC30CC026E32B758C66A1AF88BD54C6A78E11EC2908FF854E00AC46BE - SHA256=9254F012009D55F555418FF85F7D93B184AB7CB0E37AECDFDAB62CFE94DEA96B - SHA256=984A77E5424C6D099051441005F2938AE92B31B5AD8F6521C6B001932862ADD7 - SHA256=98B734DDA78C16EBCAA4AFEB31007926542B63B2F163B2F733FA0D00DBB344D8 - SHA256=99F4994A0E5BD1BF6E3F637D3225C69FF4CD620557E23637533E7F18D7D6CBA1 - SHA256=9C10E2EC4F9EF591415F9A784B93DC9C9CDAFA7C69602C0DC860C5B62222E449 - SHA256=A961F5939088238D76757669A9A81905E33F247C9C635B908DAAC146AE063499 - SHA256=A9706E320179993DADE519A83061477ACE195DAA1B788662825484813001F526 - SHA256=B7A20B5F15E1871B392782C46EBCC897929443D82073EE4DCB3874B6A5976B5D - SHA256=CC586254E9E89E88334ADEE44E332166119307E79C2F18F6C2AB90CE8BA7FC9B - SHA256=CD4A249C3EF65AF285D0F8F30A8A96E83688486AAB515836318A2559757A89BB - SHA256=CF4B5FA853CE809F1924DF3A3AE3C4E191878C4EA5248D8785DC7E51807A512B - SHA256=D0BD1AE72AEB5F3EABF1531A635F990E5EAAE7FDD560342F915F723766C80889 - SHA256=D8B58F6A89A7618558E37AFC360CD772B6731E3BA367F8D58734ECEE2244A530 - SHA256=D92EAB70BCECE4432258C9C9A914483A2267F6AB5CE2630048D3A99E8CB1B482 - SHA256=E005E8D183E853A27AD3BB56F25489F369C11B0D47E3D4095AAD9291B3343BF1 - SHA256=E68D453D333854787F8470C8BAEF3E0D082F26DF5AA19C0493898BCF3401E39A - SHA256=E83908EBA2501A00EF9E74E7D1C8B4FF1279F1CD6051707FD51824F87E4378FA - SHA256=EF86C4E5EE1DBC4F81CD864E8CD2F4A2A85EE4475B9A9AB698A4AE1CC71FBEB0 - SHA256=F088B2BA27DACD5C28F8EE428F1350DCA4BC7C6606309C287C801B2E1DA1A53D - SHA256=FD8669794C67B396C12FC5F08E9C004FDF851A82FAF302846878173E4FBECB03 - SHA256=91314768DA140999E682D2A290D48B78BB25A35525EA12C1B1F9634D14602B2C - SHA256=F0605DDA1DEF240DC7E14EFA73927D6C6D89988C01EA8647B671667B2B167008 - SHA256=6CB51AE871FBD5D07C5AAD6FF8EEA43D34063089528603CA9CEB8B4F52F68DDC - SHA256=DB2A9247177E8CDD50FE9433D066B86FFD2A84301AA6B2EB60F361CFFF077004 - SHA256=7EC93F34EB323823EB199FBF8D06219086D517D0E8F4B9E348D7AFD41EC9FD5D - SHA256=7049F3C939EFE76A5556C2A2C04386DB51DAF61D56B679F4868BB0983C996EBB - SHA256=7877C1B0E7429453B750218CA491C2825DAE684AD9616642EFF7B41715C70ACA - SHA256=159E7C5A12157AF92E0D14A0D3EA116F91C09E21A9831486E6DC592C93C10980 - SHA256=3243AAB18E273A9B9C4280A57AECEF278E10BFFF19ABB260D7A7820E41739099 - SHA256=7CFA5E10DFF8A99A5D544B011F676BC383991274C693E21E3AF40CF6982ADB8C - SHA256=C9B49B52B493B53CD49C12C3FA9553E57C5394555B64E32D1208F5B96A5B8C6E - SHA256=3EC5AD51E6879464DFBCCB9F4ED76C6325056A42548D5994BA869DA9C4C039A8 - SHA256=47EAEBC920CCF99E09FC9924FEB6B19B8A28589F52783327067C9B09754B5E84 - - SHA256=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b - SHA256=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790 - SHA256=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22 - SHA256=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44 - SHA256=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8 - SHA256=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009 - SHA256=39937d239220c1b779d7d55613de2c0a48bd6e12e0214da4c65992b96cf591df - SHA256=7ed26a593524a2a92ffcfb075a42bb4fa4775ffbf83af98525244a4710886ead - SHA256=aa717e9ab4d614497df19f602d289a6eddcdba8027c71bcc807780a219347d16 - SHA256=ff5f6048a3d6f6738b60e911e3876fcbdc9a02ec9862f909345c8a50fd4cc0a7 - SHA256=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 - SHA256=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495 - SHA256=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd - SHA256=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c - SHA256=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427 - - SHA256=952199C28332BC90CFD74530A77EE237967ED32B3C71322559C59F7A42187DC4 - SHA256=9529EFB1837B1005E5E8F477773752078E0A46500C748BC30C9B5084D04082E6 - SHA256=A7B000ABBCC344444A9B00CFADE7AA22AB92CE0CADEC196C30EB1851AE4FA062 - SHA256=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b - SHA256=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece - SHA256=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374 - SHA256=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50 - SHA256=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6 - SHA256=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e - - SHA256=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc - SHA256=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d - SHA256=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65 - SHA256=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347 - SHA256=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9 - SHA256=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219 - SHA256=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8 - SHA256=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813 - SHA256=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a - SHA256=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f - SHA256=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc - SHA256=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de - SHA256=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073 - SHA256=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890 - SHA256=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0 - SHA256=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200 - SHA256=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf - SHA256=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2 - SHA256=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173 - SHA256=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6 - SHA256=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8 - SHA256=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508 - SHA256=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3 - SHA256=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52 - SHA256=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129 - SHA256=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993 - SHA256=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d - SHA256=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd - SHA256=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35 - SHA256=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33 - SHA256=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29 - - - SHA256=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838 - SHA256=3c5bf92c26398695f9ced7ce647a7e9f6ddcc89eea66b45aa3607196a187431b - SHA256=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82 - SHA256=4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7 - SHA256=b205835b818d8a50903cf76936fcf8160060762725bd74a523320cfbd091c038 - SHA256=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89 - SHA256=73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e - SHA256=87e38e7aeaaaa96efe1a74f59fca8371de93544b7af22862eb0e574cec49c7c3 - SHA256=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6 - SHA256=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89 - SHA256=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf - SHA256=1dadd707c55413a16320dc70d2ca7784b94c6658331a753b3424ae696c5d93ea - SHA256=d84e3e250a86227c64a96f6d5ac2b447674ba93d399160850acb2339da43eae5 - SHA256=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a - SHA256=0f726d8ce21c0c9e01ebe6b55913c519ad6086bcaec1a89f8308f3effacd435f - SHA256=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3 - SHA256=0e14a4401011a9f4e444028ac5b1595da34bbbf9af04a00670f15ff839734003 - SHA256=26c86227d3f387897c1efd77dc711eef748eb90be84149cb306e3d4c45cc71c7 - SHA256=42d926cfb3794f9b1e3cb397498696cb687f505e15feb9df11b419c49c9af498 - SHA256=1684e24dae20ab83ab5462aa1ff6473110ec53f52a32cfb8c1fe95a2642c6d22 - SHA256=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4 - SHA256=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c - SHA256=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53 - SHA256=3a364a7a3f6c0f2f925a060e84fb18b16c118125165b5ea6c94363221dc1b6de - SHA256=fda506e2aa85dc41a4cbc23d3ecc71ab34e06f1def736e58862dc449acbc2330 - SHA256=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46 - SHA256=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347 - SHA256=8596ea3952d84eeef8f5dc5b0b83014feb101ec295b2d80910f21508a95aa026 - SHA256=52a90fd1546c068b92add52c29fbb8a87d472a57e609146bbcb34862f9dcec15 - SHA256=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91 - SHA256=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf - SHA256=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c - SHA256=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64 - SHA256=3ed15a390d8dfbd8a8fb99e8367e19bfd1cced0e629dfe43ccdb46c863394b59 - SHA256=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6 - SHA256=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b - SHA256=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9 - SHA256=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351 - SHA256=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5 - SHA256=ff803017d1acafde6149fe7d463aee23b1c4f6f3b97c698c05f3ca6f07e4df6c - SHA256=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b - SHA256=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05 - SHA256=a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433 - - - - - - - - - - - - - - - msdt.exe - sdiageng.dll - - - WINWORD.exe;EXCEL.EXE - VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wshom.ocx - wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - - - ntkrnlmp.exe - - - \spool\drivers\x64\3\;\spool\drivers\W32X86\3\;\spool\drivers\IA64\3\ - spoolsv.exe;printisolationhost.exe - Valid - Brother Industries;Canon;Sharp;Microsoft Corporation;DYMO;Euro Plus d.o.o;HP Inc;Hewlett-Packard - - - C:\Windows\ - \Users\Public\;\Desktop\;\Downloads\;\AppData\Local\Temp\;\PerfLogs\;$Recycle;\Fonts\ - \Program Files - - - EQNEDT32.EXE - EQNEDT32.EXE - - - ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll - C:\Users;\Temp\;\ProgramData\ - - - ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll - \wscript.exe;\cscript.exe;\powershell.exe;\powershell_ise.exe;\rundll32.exe;\msbuild.exe;\csc.exe - - - WINWORD.exe;EXCEL.EXE - VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wshom.ocx - wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll;fastprox.dll - - - WINWORD.exe;EXCEL.EXE - VBE7.DLL;VBE7INTL.DLL;VBEUI.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - - - WINWORD.exe;EXCEL.EXE - VBEUI.DLL;VBE6.DLL;VBE6INTL.DLL;wbemdisp.dll;wbemcomn.dll;wbemprox.dll;wmiutils.dll;wbemsvc.dll - - - WINWORD.exe;EXCEL.EXE - taskschd.dll - - - wscript.exe;cscript.exe - taskschd.dll - - - wmiprvse.exe - taskschd.dll - - - powershell.exe - msi.dll - - - powershell - amsi.dll - - - powershell - amsi.dll - - - logoncli.dll - C:\Windows\System32\wbem\WmiPrvSE.exe - - - WINWORD.exe;EXCEL.EXE - clr.dll - - - clr.dll;System.Management.ni.dll;Microsoft.Build.Utilities - - - wscript.exe;cscript.exe - msxml;wshom.ocx - - - wscript.exe;cscript.exe - winhttp.dll;mswsock.dll;IPHLPAPI.DLL - - - installutil.exe - CustomMarshalers.dll;CustomMarshalers.ni.dll;System.Management.ni.dll;WMINet_Utils.dll;mswsock.dll - - - System.Management.Automation.ni.dll - C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ - - - System.Management.Automation.dll - C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ - Lenovo.Vantage.AddinHost;\Microsoft.Sara.exe;C:\Program Files\CONEXANT - - - C:\Windows\System32\vaultcli.dll - \svchost.exe;\GameBar.exe;C:\Program Files\WindowsApps;\Microsoft\Teams\current\Teams.exe - - - \\ - - - \Microsoft\Word\Startup\ - .wll - - - \Microsoft\Excel\Startup\ - .xll - - - \Microsoft\Addins\ - .xla - - - tor-lib.dll - - - C:\Windows\System32\WinSCard.dll;C:\Windows\System32\cryptdll.dll;C:\Windows\System32\hid.dll;C:\Windows\System32\samlib.dll;C:\Windows\System32\vaultcli.dll - - - rundll32.exe - vaultcli.dll;wlanapi.dll - combase.dll - cryptdll.dll - imm32.dll - logoncli.dll - netapi32.dll - ntasn1.dll - ntdsapi.dll - samlib.dll - shcore.dll - srvcli.dll - - - odbc32.dll;winhttp.dll;netapi32.dll;SHLWAPI.dll - - - C:\Windows\Explorer.EXE - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - - - C:\ProgramData\ - C:\ProgramData\ - .exe - Adobe - C:\ProgramData\Lenovo\ - C:\ProgramData\Microsoft\Windows Defender\ - C:\ProgramData\sysmon\sysmon64.exe - - - C:\Users\Default\;C:\Users\Public\ - .exe - - - C:\Users\Default\;C:\Users\Public\ - .dll - - - 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - - - SHA256=074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 - SHA256=45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 - SHA256=9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 - SHA256=29b75f0db3006440651c6342dc3c0672210cfb339141c75e12f6c84d990931c3 - SHA256=c8c907a67955bcdf07dd11d35f2a23498fb5ffe5c6b5d7f36870cf07da47bff2 - SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e - - - C:\Windows\System32\svchost.exe - false - - - Revoked - - - Expired - - - jscript9.dll - mshta.exe - - scrobj.dll - crypt0.dll - - C:\Windows\System32\wlanapi.dll - C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe - C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe - C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\System32\AppHostRegistrationVerifier.exe - C:\Windows\System32\CompatTelRunner.exe - C:\Windows\System32\DeviceCensus.exe - C:\Windows\System32\DriverStore\FileRepository\ - C:\Windows\System32\LogonUI.exe - C:\Windows\System32\MoNotificationUx.exe - C:\Windows\System32\SystemSettingsBroker.exe - C:\Windows\System32\dxgiadaptercache.exe - C:\Windows\System32\netsh.exe - C:\Windows\System32\wlanext.exe - C:\Windows\UUS\amd64\MoUsoCoreWorker.exe - C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_ - C:\Windows\explorer.exe - - - python - - - C:\Windows\Microsoft.NET\assembly\GAC_MSIL - false - - - C:\Windows\Microsoft.NET\assembly\GAC_MSIL - true - - - - - - - \Microsoft Office\ - \mscorlib.ni.dll - - - \Microsoft Office\ - \sppc.dll - - - C:\Windows\System32\svchost.exe - true - - - - C:\Program Files (x86)\Kaspersky Lab - C:\Program Files\Kaspersky Lab - C:\Program Files (x86)\ESET - C:\Program Files\ESET - C:\ProgramData\Microsoft\Windows Defender\ - - Fortinet - Lenovo - Sophos - mscorsvw.exe - C:\Program Files (x86)\Microsoft Office\root\Office15\officebackgroundtaskhandler.exe - C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe - C:\Program Files\Microsoft Office\root\Office15\officebackgroundtaskhandler.exe - C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe - C:\Windows\SysWOW64\SearchProtocolHost.exe - C:\Windows\System32\InstallAgentUserBroker.exe - C:\Windows\System32\RuntimeBroker.exe - C:\Windows\System32\SearchIndexer.exe - C:\Windows\System32\SettingSyncHost.exe - C:\Windows\System32\backgroundTaskHost.exe - C:\Windows\System32\sppsvc.exe - C:\Windows\System32\taskhost.exe - C:\Windows\System32\taskhostw.exe - C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe - C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe - HxTsr.exe - SearchUI.exe - C:\Program Files (x86)\Common Files\BIExcelFunctions1.1\32bit\Sage. - C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Pfx. - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Adist64.dll - C:\Program Files (x86)\Microsoft Office\Office15\Library\Analysis\ANALYS32.XLL - C:\Program Files (x86)\Microsoft Office\Office16\Library\Analysis\ANALYS32.XLL - C:\Program Files\Microsoft Office\Office15\Library\Analysis\ANALYS32.XLL - C:\Program Files\Microsoft Office\Office16\Library\Analysis\ANALYS32.XLL - C:\Windows\SysWOW64\sppc.dll - Microsoft.Office.Interop.VisOcx.dll - Microsoft.Office.Interop.Word.dll - Microsoft.Vbe.Interop.dll - OFFICE.DLL - - - - - - - - 0x001A0000 - c:\windows\system32\lsass.exe - - - msiexec.exe - - - chrome.exe;firefox.exe;edge.exe;browser_broker.exe;iexplore.exe;opera.exe - - - 0x001A0000 - c:\windows\system32\lsass.exe - - - c:\windows\system32\lsass.exe - c:\windows\system32\rundll32.exe - - - DbgUiRemoteBreakin - nacl64.exe - - - QueryProcessDebugInformationRemote - nacl64.exe - - - isdebuggerpresent - nacl64.exe - - - DebugActiveProcess - nacl64.exe - - - LoadLibrary - C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\System32\DriverStore\FileRepository\ - C:\Windows\System32\igfxEM.exe - C:\Windows\System32\igfxHK.exe - Enterprise\Common7\IDE\devenv.exe - C:\Program Files (x86)\ASUS\ROG Live Service\FileOperator.exe - C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe - - - CreateFileMapping;MapViewOfFile - - - LdrLoadDll - - - CryptAcquireContextA;CryptDecodeObjectEx;CryptImportPublicKeyInfo;CryptEncrypt;CryptGenKey;CryptDecrypt;CryptStringToBinary;CryptBinaryToString;CryptImportKey - - - c:\windows\system32\csrss.exe - CrtlRoutine - - 0B80 - 0C7C - 0C88 - c:\windows\system32\mstsc.exe - - C:\WINDOWS\SYSTEM32\ntdll.dll - EtwEventWrite - - - - - - - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe - C:\Windows\system32\audiodg.exe - C:\Windows\system32\services.exe - C:\Windows\system32\svchost.exe - C:\Windows\system32\wbem\WmiPrvSE.exe - C:\Windows\system32\wininit.exe - C:\Windows\system32\winlogon.exe - - - - - - - - - - - - - C:\Windows\System32\SHELL32.dll+9b5bd - \LocalBridge.exe - - - C:\Windows\System32\wshom.ocx+c8a0;C:\Windows\System32\wshom.ocx+c39d - - - C:\Windows\SYSTEM32\framedynos.dll+2cb3e - C:\Windows\system32\SgrmBroker.exe;C:\Windows\system32\SecurityHealthService.exe;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Windows\system32\services.exe;C:\Windows\system32\wininit.exe;C:\Windows\system32\sppsvc.exe;C:\Windows\System32\smss.exe;C:\Windows\system32\csrss.exe;C:\Windows\System32\svchost.exe - - - C:\Windows\SYSTEM32\framedynos.dll+2b496 - - - C:\Windows\SYSTEM32\dbgcore.DLL+6cfb - - - C:\Windows\System32\KernelBase.dll+de67e - - - ntdll.dll+a0044 - - - clr.dll+6c23;clr.dll+6b38 - - - C:\Windows\\SYSTEM32\ntdll.dll+;|C:\Windows\System32\KERNELBASE.dll+;|UNKNOWN( - ) - - - "UNKNOWN(;)|UNKNOWN( - ) - - - "UNKNOWN - 0x1F0FFF;0x1F1FFF;0x143A;0x1410;0x1010;0x1F2FFF;0x1F3FFF;0x1FFFFF - - - C:\Program Files;\Microsoft Office\Root\Office - \Microsoft Shared\VBA - C:\Program Files (x86)\Intuit\ - - - C:\Windows\system32\lsass.exe - 0x1FFFFF - UNKNOWN - WmiPerfClass.dll - C:\Windows\sysWOW64\wbem\wmiprvse.exe;C:\Windows\system32\wbem\wmiprvse.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe;WmiPerfClass.dll;C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe;C:\Program Files (x86)\Common Files\Adobe - - - C:\Windows\system32\lsass.exe - C:\Windows\system32\wsmprovhost.exe - - - C:\Windows\system32\lsass.exe - 0x1FFFFF - python27.dll;_ctypes.pyd;KERNELBASE.dll;ntdll.dll - - - C:\Windows\system32\lsass.exe - C:\Windows\SYSTEM32\ntdll.dll+4595c|C:\Windows\system32\KERNELBASE.dll+8185 - - - C:\Windows\system32\lsass.exe - C:\WINDOWS\SYSTEM32\ntdll.dll+ - ) - |C:\WINDOWS\System32\KERNELBASE.dll+;|UNKNOWN( - wow64.dll;)|C;Exchange.Diagnostics;Microsoft.Exchange - C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe;c:\windows\system32\inetsrv\w3wp.exe;MSExchangeHMHost.exe;C:\Windows\sysWOW64\wbem\wmiprvse.exe - - - C:\Windows\system32\winlogon.exe - 0x1F3FFF - C:\Windows\Microsoft.NET;UNKNOWN - - - .exe - C:\Windows\sysmon64.exe;C:\Windows\sysmon64.exe - 0x1C00 - - - C:\Windows\system32\lsass.exe - 0x1F1FFF - UNKNOWN - - - C:\Windows\system32\lsass.exe - 0x1010 - UNKNOWN - - - C:\Windows\system32\lsass.exe - 0x143A - UNKNOWN - - - C:\Windows\system32\lsass.exe - 0x1fffff - dbghelp.dll;dbgcore.dll - - - dbghelp.dll;dbgcore.dll - C:\Windows\system32\lsass.exe - C:\wfx32\ - - - powershell.exe - C:\Programdata\sysmon\sysmon64.exe;C:\Programdata\sysmon\sysmon.exe;C:\Windows\sysmon.exe;C:\Windows\sysmon64.exe;\dismhost.exe - C:\WINDOWS\SYSTEM32\ntdll.dll+;|C:\WINDOWS\System32\KERNELBASE.dll+;|C:\ProgramData\Microsoft\Windows Defender\Platform\;\MPCLIENT.DLL;\MpOav.dll+;|C:\WINDOWS\SYSTEM32\amsi.dll - - - getasynckeystate - - - cmlua.dll - - - System.Management.Automation - C:\ProgramData\Microsoft\Windows Defender\platform\ - ctiuser.dll - C:\Program Files\Citrix\ConfigSync\ConfigSyncRun.exe - C:\Program Files\Microsoft\Exchange Server\V14\bin\ExSetupUI.exe - C:\Program Files\Microsoft\Exchange Server\V15\bin\ExSetupUI.exe - C:\Program Files\Microsoft\Exchange Server\V16\bin\ExSetupUI.exe - C:\Windows\SysWOW64\sdiagnhost.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\Temp\ExchangeSetup\ExSetupUI.exe - C:\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe - C:\Program Files\Microsoft Azure Active Directory Connect\AzureADConnect.exe - C:\Windows\system32\HOSTNAME.EXE - C:\Windows\system32\ROUTE.exe - C:\Windows\system32\query.exe - MsMpEng.exe - - - C:\Windows\system32\lsass.exe - comsvcs.dll - - - VBE7.dll;VBEUI.DLL;VBE7INTL.DLL - - - VBE6.dll;VBEUI.DLL;VBE6INTL.DLL - - - Office - verclsid.exe - VBE7.dll;VBEUI.DLL;VBE7INTL.DLL - |UNKNOWN( - 0x1FFFFF - - - C:\Program Files\Microsoft Office\Root\Office - C:\Windows\System32\KERNELBASE.dll+76516 - - - C:\Windows\System32\SHELL32.dll+ae3b9 - C:\WINDOWS\system32\sihost.exe - C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub - - UNKNOWN - - |UNKNOWN( - C:\WINDOWS\SYSTEM32\ntdll.dll+ - |C:\WINDOWS\System32\KERNELBASE.dll+ - ) - 0x1028;0x1fffff - C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git;\Intel\Driver and Support Assistant\DSAService.exe - C:\Windows\Microsoft.NET\Framework\;\NGenTask.exe - \Intel\Driver and Support Assistant\ - C:\Windows\Microsoft.NET\Framework\;\ngen.exe - - - winword.exe;excel.exe;powerpnt.exe - :\Windows\Microsoft.NET\Framework64\v2.;UNKNOWN - - - UNKNOWN - 0x147a - - - C:\Windows\Sysmon64.exe;C:\Windows\Sysmon.exe - C:\WINDOWS\system32\wbem\wmiprvse.exe - C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe - C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe - C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe;C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe;C:\Program Files (x86)\Google\Update\GoogleUpdate.exe - 0x1400 - - - 0x0800 - - 0x0810 - - 0x0820 - - 0x810 - - 0x820 - cscript.exe - wscript.exe - jjs.exe - dump - mimikatz - CorperfmontExt.dll - - - - - - wmiprvse.exe - lsass.exe - - - lsass.exe - winlogon.exe - - - - lsass.exe - C:\Windows\system32\w32tm.exe;C:\Windows\System32\ping.exe;C:\Windows\System32\net.exe;C:\Windows\System32\net1.exe;C:\Windows\SYSTEM32\HOSTNAME.EXE;C:\Programdata\sysmon\sysmon.exe;C:\Programdata\sysmon\sysmon64.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\Program Files (x86)\BeAnywhere Support Express\;C:\Program Files (x86)\CheckPoint\;C:\Program Files (x86)\Common Files\Intuit\QuickBooks\;C:\Program Files (x86)\Fortinet\;C:\Program Files (x86)\Trend Micro\;C:\Program Files\Adobe\Adobe Creative Cloud Experience\;C:\Program Files\CheckPoint\;C:\Program Files\Fortinet\;C:\Program Files\Realtek;C:\Program Files\Trend Micro\;C:\ProgramData\Microsoft\Windows Defender\platform\;C:\Program Files (x86)\Lenovo\;snmpd.exe;taskmgr;:\Windows\System32\smss.exe;:\Windows\system32\wininit.exe;\Bin\FMS.exe; \EMET_GUI.exe;\EMET_Service.exe;\Google\Update\GoogleUpdate.exe;\RAAGTAPP.EXE;\controls\cef\ConnectWise.exe;C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe;C:\Program Files\Hewlett-Packard\AMS\service\hpqams.exe;C:\Program Files\Intel\SUR\WILLAMETTE\ESRV\esrv_svc.exe;C:\Program Files\VMware\VMware Tools\vmtoolsd.exe;C:\Program Files\Windows Defender\MsMpEng.exe;C:\WINDOWS\system32\WerFault.exe;C:\WINDOWS\system32\taskkill.exe;C:\Windows\SysWOW64\WerFault.exe;C:\Windows\System32\snmp.exe;C:\Windows\system32\msiexec.exe;C:\Windows\system32\spoolsv.exe;C:\Windows\system32\svchost.exe - - - :\Windows\system32\sppsvc.exe - :\Windows\system32\sdiagnhost.exe - - UNKNOWN(00007F - - C:\Windows\SYSTEM32\ntdll.dll - C:\Windows\SYSTEM32\win32u.dll - C:\Windows\SYSTEM32\wow64win.dll - - - C:\Program Files (x86)\Kaspersky Lab - C:\Program Files\Kaspersky Lab - C:\Program Files (x86)\ESET - C:\Program Files\ESET - C:\ProgramData\Microsoft\Windows Defender\ - - - - - - - - - - \TEMP\nessus_ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - solarwinds.businesslayerhost - .exe;.dll;.ps1;.mz;.jpg;.png - - - C:\WINDOWS\SysWOW64\netsetupsvc.dll - - - C:\Windows\SoftwareDistribution - C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe - .exe - - - proj - .targets - .build - .props - .tasks - .sln - .cs - - - - - - - .bat - .btm - .cmd - .com - .cmdline - .bas - .bin - C:\Windows\SysWOW64\Wbem - C:\Windows\System32\Wbem - .ws - .wsc - .wsf - .wsh - .pif - - .hta - - IronPython - .py - .pyc - .pyd - - - .cdxml - .ps1 - .ps1xml - .psc1 - .psd1 - .psm1 - .pssc - - - powershell.exe;powershell_ise.exe - \Recent\CustomDestinations\ - - C:\Windows\SysWOW64\WindowsPowerShell - C:\Windows\System32\WindowsPowerShell - c:\Windows\System32\WindowsPowerShell\v1.0\profile - c:\Windows\Syswow64\WindowsPowerShell\v1.0\profile - \UsageLogs\powershell.exe.log - PSReadLine\ConsoleHost_history.txt - - .vbs - .oracle_jre_usage\ - .js - .jse - .vb - .vbe - .vbsript - - - - - Report.wer.tmp - \WER\ - C:\Windows\system32\wermgr.exe - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe - .exe - C:\Users - - - winword.exe;excel.exe;powerpnt.exe;outlook.exe;msaccess.exe;mspub.exe;visio.exe;notepad.exe;wordpad.exe;eqnedt32.exe;wordview.exe - .dll - C:\Users - - - - - - - - - - - !!!-WARNING-!!!.html;!!!-WARNING-!!!.txt;!!! HOW TO DECRYPT FILES !!!;!!!README!!!;!!!READ_TO_UNLOCK!!!.TXT;!!!_READ_ME_;!Recovery_;!Where_are_my_files!.html;!_HOW_TO_RESTORE_;!_RECOVERY_HELP_!.txt;!recover!;# DECRYPT MY FILES #.html;# DECRYPT MY FILES #.txt;# DECRYPT MY FILES #.vbs;# SATAN CRYPTOR #;+recover+;.8lock8;.31392E30362E32303136_;.ABCDEF;.CIop;.CR1;.CRAB;.CRYPTOSHIELD;.Cl0p;.Contact_Here_To_Recover_Your_Files.txt;.CryptoTorLocker2015!;.HERMES;.HakunaMatata;.How_To_Decrypt.txt;.How_To_Get_Back.txt;.KEYZ.KEYH0LES;.L0CKED;.LOL!;.MATRIX;.OMG!;.R.i.P;.RMCM1;.RSplited;.SUPERCRYPT;.SecureCrypted;.TheTrumpLocker;.VBRANSOM;.VforVendetta;.Where_my_files.txt;.XBTL;._AiraCropEncrypted!;.airacropencrypted!;.areyoulovemyrans;.berkshire;.bitpy;.bitx;.blocatto;.bomber;.braincrypt;.breakingbad;.breeding123;.cerber;.cifgksaffsfyghd;.country82000;.crypt;.crypted;.crypton;.cryptotorlocker;.decrypt2017;.deria;.dglnl;.disposed2017;.doomed;.encrypted.locked;.encrypted;.encryptedyourfiles;.enjey;.evillock;.filegofprencrp;.fileiscryptedhard;.firecrypt;.fuckyourdata;.gangbang;.gefickt;.googl;.happydayzz;.hceem;.helpdecrypt;.helpmeencedfiles;.hnumkhotep;.hydracrypt_ID;.iaufkakfhsaraf;.info.txt;.jimm;.kharma;.killedXXX;.lambda_l0cked;.letmetrydecfiles;.locked;.locker16;.loveransisgood;.lovewindows;.magic_software_syndicate;.mention9823;.moments2900;.myrandsext2017;.newlock;.no_more_ransom;.nochance;.noproblemwedecfiles;.notfoundrans;.ohwqg;.one-we_can-help_you;.oops;.osiris;.otherinformation;.paytounlock;.powerfulldecrypt;.powned;.pr0lock;.prolock;.prosperous666;.pwnd;.ransom;.readme2unlock;.righ;.roger;.ryk;.satan;.savethequeen;.sigaint.org;.skjdthghh;.skynet;.snatch;.stubbin;.supported2017;.suppose666;.theworldisyours;.txd0t;.warn_wallet;.weapologize;.weareyourfriends;.weencedufiles;.wowreadfordecryp;.wowwhereismyfiles;.wvtr0;.yourransom;.zzzzz ;.{CRYPTENDBLACKDC};-DECRYPT.txt;000-IF-YOU-WANT-DEC-FILES;000-No-PROBLEM-WE-DEC-FILES;000-PLEASE-READ-WE-HELP;001-READ-FOR-DECRYPT-FILES;1025-7152.exe;:\windows\update_collector.exe;=READ=THIS=PLEASE=;@cock.li;@countermail.com;@firemail.cc;@india.com;@mail.ru;@ukr.net;ASSISTANCE_IN_RECOVERY;ATTENTION!!!.txt;ATTENTION.url;Aescrypt.exe;AllFilesAreLocked;BTC_DECRYPT_FILES;BUYUNLOCKCODE.txt;BUYUNLOCKCODE;BitCryptorFileList.txt;C:\ProgramData\dtb.dat;C:\Programdata\WinMgr;C:\Programdata\clean.bat;C:\Programdata\run.bat;C:\Windows\svchost.exe;CEBER3;CHECK-IT-HELP-FILES;COME_RIPRISTINARE_I_FILE.;COMO_ABRIR_ARQUIVOS.txt;COMO_RESTAURAR_ARCHIVOS;Coin.Locker.txt;Comment débloquer mes fichiers.txt;Como descriptografar seus arquivos.txt;Corona-virus-Map;Corona.bat;Corona.sfx;CryptoRansomware;Crytp0l0cker;Cyber SpLiTTer Vbs.exe;Cyborg_DECRYPT;DALE_FILES.TXT;DECRYPT-FILES;DECRYPTION INSTRUCTIONS.;DECRYPTION_HOWTO.Notepad;DECRYPT_INFORMATION;DECRYPT_INSTRUCTION.HTML;DECRYPT_INSTRUCTION.URL;DECRYPT_INSTRUCTIONS.html;DECRYPT_INSTRUCTIONS;DECRYPT_ReadMe1.TXT;DECRYPT_Readme.TXT.ReadMe;DECRYPT_YOUR_FILES;DESIFROVANI_POKYNY.html;Decrypt All Files;DecryptAllFiles;DecryptFile;Decrypt_readme.txt;DesktopOsiris;ENTSCHLUSSELN_HINWEISE.html;EdgeLocker;FILESAREGONE.txt;FILES_BACK.txt;File Decrypt Help.html;GJENOPPRETTING_AV_FILER;GetYouFiles.txt;HAPPEN-ENCED-FILES;HELLOTHERE.TXT;HELP-ME-ENCED-FILES;HELPDECRYPT_YOUR_FILES.HTML;HELP_DECRYPT.HTML;HELP_DECRYPT.PNG;HELP_DECRYPT.URL;HELP_DECRYPT.lnk;HELP_ME_PLEASE.txt;HELP_RESTORE_FILES_;HELP_TO_SAVE_FILES.bmp;HELP_TO_SAVE_FILES;HELP_YOURFILES.HTML;HELP_YOUR_FILES.PNG;HELP_YOUR_FILES.html;HELP_YOUR_FILES;HOW-TO-DECRYPT-FILES.HTML;HOW-TO-RESTORE-FILES;HOW TO BACK YOUR FILES;HOW TO DECRYPT FILES.HTML;HOW TO DECRYPT FILES.txt;HOW TO RECOVER;HOWTO_RECOVER_FILES_;HOWTO_RESTORE_FILES;HOWTO_RESTORE_FILES_;HOW_DECRYPT.HTML;HOW_DECRYPT.TXT;HOW_DECRYPT.URL;HOW_OPEN_FILES;HOW_TO_DECRYPT.HTML;HOW_TO_DECRYPT_;HOW_TO_PAY_THE_RANSOM;HOW_TO_RESTORE_FILES.html;HOW_TO_RESTORE_FILES;HOW_TO_RESTORE_YOUR_DATA;HOW_TO_UNLOCK_FILES_README_;HWID Lock.exe;Hacked_Read_me_to_decrypt_files.html;Help Decrypt.html;How decrypt files.hta;How to decrypt LeChiffre files.html;How to decrypt your data.txt;HowDecrypt.gif;HowDecrypt.txt;How_to_decrypt_your_files.jpg;How_to_restore_files.hta;HowtoRestore_File;HowtoRestore_Files;Howto_RESTORE_FILES.html;Howto_Restore_FILES.TXT;IAMREADYTOPAY.TXT;IF-YOU-WANT-DEC-FILES;IF_WANT_FILES_BACK_PLS_READ.html;IHAVEYOURSECRET.KEY;IMPORTANT READ ME.txt;IMPORTANT.README;INSTALL_TOR.URL;INSTRUCCIONES;INSTRUCCIONES_DESCIFRADO.html;INSTRUCTION RESTORE FILE;INSTRUCTIONS_DE_DECRYPTAGE.html;INSTUCCIONES_DESCRIFRADO;ISTRUZIONI_DECRITTAZIONE.html;Important!.txt;Instructionaga.txt;KryptoLocker_README.txt;LEER_INMEDIATAMENTE;LET-ME-TRY-DEC-FILES;Locked-by-Mafia;MENSAGEM.txt;MERRY_I_LOVE_YOU_BRUCE.hta;No-PROBLEM-WE-DEC-FILES;OKSOWATHAPPENDTOYOURFILES.TXT;ONTSLEUTELINGS_INSTRUCTIES.html;OSIRIS-;PAYLOADBIN;PINGY@INDIA.COM;PLEASE-READ-WE-HELP.;PLEASE-READIT-IF_YOU-WANT.html;PLEASE-READIT-IF_YOU-WANT;PLEASE-README-AFFECTED-FILES;PLS-DEC-MY-FILES;PURELOCKER;Payment_Instructions.jpg;Please Read Me!!!;READ-FOR-DECCCC-FILESSS;READ-FOR-DECRYPT-FILES;READ-READ-READ;READ IF YOU WANT YOUR FILES BACK.html;READ ME FOR DECRYPT.txt;README HOW TO DECRYPT YOUR FILES.HTML;README!!!;README_DECRYPT_HYDRA_ID_;README_DECRYPT_HYRDA_ID_;README_DECRYPT_UMBRE_ID_;README_DONT_DELETE;README_HOW_TO_UNLOCK.HTML;README_HOW_TO_UNLOCK.TXT;README_RECOVER_FILES_;README_TO_RECURE_YOUR_FILES;READTHISNOW!!!.txt;READ_IT.txt;READ_ME_!.txt;READ_ME_TO_DECRYPT_YOU_INFORMA;READ_THIS_TO_DECRYPT.html;RECOVER-FILES;RECOVERY_FILE.;RECOVERY_FILES.TXT;RECOVER_MY_FILE;RESTORE_CORUPTED_FILES;RESTORE_FILES_;RETURN FILES.txt;RETURN YOUR FILES;RETURNFILES_.txt;RETURN_FILES.txt;RETURN_FILES_.txt;Rans0m_N0te_Read_ME;Read Me (How Decrypt) !!!!.txt;ReadDecryptFilesHere;Read_this_file.txt;Receipt.exe;RecoveryManual.html;Recovery_File_;Recovery_file_;Rooster865qq;SECRET.KEY;SECRETIDHERE.KEY;SHTODELATVAM.txt;SIFRE_COZME_TALIMATI.html;SORRY-FOR-FILES;Survey Locker.exe;TRY-READ-ME-TO-DEC;Temp\satan\satan;ThxForYurTyme;UNLOCK_FILES_INSTRUCTIONS.html;UNLOCK_FILES_INSTRUCTIONS.txt;UnblockFiles.vbs;VIP72.exe;Vape Launcher.exe;WANT_FILES_BACK;WE-MUST-DEC-FILES;WHERE-YOUR-FILES;WORMKILLER@INDIA.COM.XTBL;What happen to my files.txt;Whereisyourfiles;WindowsApplication1.exe;YOUGOTHACKED.TXT;YOUR_FILES.txt;YOUR_FILES.url;YOUR_FILES_ARE_DEAD;YOUR_FILES_ARE_ENCRYPTED.HTML;YOUR_FILES_ARE_ENCRYPTED.TXT;YOUR_FILES_ARE_LOCKED.txt;Your files are locked !!!!.txt;Your files are locked !!!.txt;Your files are locked !!.txt;Your files are locked !.txt;Your files encrypted by our friends !!! txt;Your files encrypted by our friends !!!.txt;[KASISKI];_Adatok_visszaallitasahoz_utasitasok;_DECRYPT_ASSISTANCE_;_DECRYPT_INFO_;_DECRYPT_INFO_szesnl;_DEC_FILES.;_FILES_WERE_ENCRYPTED_@.TXT;_HELP_HELP_HELP_;_HELP_Recover_Files_;_HELP_instructions.bmp;_HELP_instructions.txt;_HOWDO_text.bmp;_HOWDO_text.html;_HOW_TO_Decrypt;_H_e_l_p_RECOVER_INSTRUCTIONS+;_H_e_l_p_RECOVER_INSTRUCTIONS;_Locky_recover;_Locky_recover_instructions.bmp;_Locky_recover_instructions.txt;_README.hta;_README.jpg;_READ_ME!;_RECOVER_INSTRUCTIONS;_ReCoVeRy_+;_USE_TO_FIX_;_WHAT_is.html;_help_instruct;_how_recover.txt;_how_recover;_how_recover_;_recover_;_secret_code.txt;_steaveiwalker@india.com_;aeroware;confirmation.key;contains(to_string($message.file_created), "howrecover+;crjoker.html;cryptinfo.txt;cryptolocker.;cryptopp;de_crypt_readme.;de_crypt_readme.bmp;de_crypt_readme.html;de_crypt_readme.txt;decipher_ne;decrypt-instruct;decrypt explanations.;decrypt my file;decrypt your file;decrypt_Globe;decrypt_instruct;decrypted_files.dat;decryptional;decryptmyfiles;decypt_your_files.html;default32643264.bmp;default432643264.jpg;email-salazar_slytherin10;enc_files.txt;encryptor_raas_readme_liesmich;enigma.hta;enigma_encr.txt;exit.hhr.obleep;fattura_;file0locked;files_are_encrypted.;-filesencrypted;firemail.cc;firstransomware.exe;gmx.de;hacks.at.sigaint.org;help-file-decrypt.enc;help_decrypt;help_file_;help_instructions.;help_my_files;help_recover;help_recover_instructions;help_restore;help_restore_files;help_your_file;helpmeencedfiles;how to decrypt aes files.lnk;how to decrypt;how to get data.txt;how_decrypt.gif;how_recover;how_to_decrypt;how_to_recover;howrecover+ recoveryfile_;howrecover+;howto_recover_file;howto_restore;howtodecrypt;howtodecryptaesfiles.txt;inbox.ru;info@kraken.cc_worldcza@email.cz;install_tor;iran.ir;last_chance.txt;maestro@pizzacrypts.info;maxcrypt.bmp;only-we_can-help_you;openforyou@india.com;opensourcemail.org;padcrypt;paycrypt.bmp;popcorn_time.exe;powerfulldecrypt;protonmail.ch;qbmail.biz;randomname;readme_decrypt;readme_for_decrypt;readme_liesmich_encryptor_raas;recover_file;recover_file_;recover_instruction;recoverfile;recoverfile_;recovery+;recovery_file.txt;recovery_key.txt;recoveryfile;recover}-;restore_files.txt;restorefiles;restorefiles_;ryukreadme.html;tuta.io;tutanota.com;tutanota.de;unCrypte;vault.hta;vault.key;vault.txt;want your files back.;warning-!!;wie_zum_Wiederherstellen_von_Dateien.txt;wowreadfordecryp;wowwhereismyfiles;zXz.html;zycrypt.;zzzzzzzzzzzzzzzzzyyy - C:\Users\;\Google\Chrome Beta\User Data\;\IndexedDB\ - C:\Program Files\WindowsApps\Microsoft.YourPhone_;C:\Program Files\dotnet\shared\Microsoft.NETCore.App\;\Microsoft.NET\assembly\GAC_MSIL - - crackmapexec - \Crypto.Cipher._AES.pyd - \Crypto.Cipher._DES.pyd - \Crypto.Hash._SHA256.pyd - \Crypto.Random.OSRNG.winrandom.pyd - \Crypto.Util.strxor.pyd - \crackmapexec.exe.manifest - \greenlet.pyd - BootStrapDLL.dll - C:\windows\temp\wininit.exe - lazycat;powerkatz;mimikatz;mimidrv;mimilove;mimilib;mimikittenz;mimiauth;invoke-mimi - rdpwrap.dll - winspool.drv - - C:\Windows\System32\Wbem - C:\Windows\SysWOW64\Wbem - C:\WINDOWS\system32\wbem\scrcons.exe - - - - - \Programs\Startup\ - \Startup\ - - - - - - - - - - - - \Word\STARTUP\ - \Microsoft\Templates\ - \Excel\XLSTART\ - .dotm - .XLSB - - - C:\Windows\Tasks\ - - - RedirSuiteServiceProxy.aspx - - - w3wp.exe - .aspx - - - w3wp.exe - .asp - - - w3wp.exe - .ashx - - - w3wp.exe - .php - - - w3wp.exe - .aaa - - - \wwwroot\aspnet_client\;\FrontEnd\HttpProxy\owa\auth - .aspx;.php;.ashx - - - w3wp.exe - .ps1 - - - w3wp.exe - .bat - - - w3wp.exe - .dll - - - w3wp.exe - .vbs - - - w3wp.exe - .hta - - - \wwwroot\ - \wwwroot\aspnet_client\;jpg - - - .asp - \wwwroot\ - - - .aspx - \wwwroot\ - - \ecp\auth\ - \oab\auth\ - ClientAccess\Owa\ - \owa\auth\ - httpproxy\rpc\ - ClientAccess\ecp\ - \htdocs\ - - - - - - - - - - - - - - - .SPL - spoolsv.exe;printfilterpipelinesvc.exe;printisolationhost.exe;splwow64.exe;msiexec.exe;poqexec.exe - - - spoolsv.exe - .exe - C\:\Windows\System32\spool\;C\:\Windows\Temp\;C\:\Users\ - - - msiexec.exe - \Microsoft\Edge\Application - elevation_service.exe - - - - - - - - - - - - - - - - - - - - - - - - - \LocalState\rootfs\ - - - - C:\PerfLogs\ - C:\Temp\ - C:\Users\Default\ - C:\Users\Public\ - C:\Windows\Temp\ - \AppData\Temp\ - - $Recycle.Bin - $Recycle.Bin - - C:\Windows\ - \config\systemprofile\ - - - C:\Windows\ - \config\systemprofile\ - - - .exe - .7z.exe - .doc.exe - .doc.exe - .docx.exe - .ico.exe - .iso.exe - .lnk.exe - .pdf.exe - .ppt.exe - .pptx.exe - .rar.exe - .rtf.exe - .txt.exe - .xls.exe - .xlsx.exe - .zip.exe - ______.exe - - - - - - - - - - - - - - - - - .chm - - - - - - - proj - .sln - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - UMWorkerProcess.exe;UMService.exe - . - .log;.cfg;.txt;cleanup;.HealthCheck;\wp.active;.db - - - - - - - - - - - - - - .7z - .7zip - .arj - .s7z - .a - .ace - .ar - .arc - .bin - .cab - .pak - .gz - .img - .iso - .lzm - .lzma - Temp\Rar$ - .rar - RarSFX - .sfx - .sz - .tar - .tar.gz - .tgz - .xz - .zip - - - - - - - - - - - - - .ost - .eml - .msg - .pst - - - - - - - - - - Г;И;К;П;д;и;к;л;л;н;н;о;ф;ե;թ;յ;ն;ն;ն;ն;տ;ւ;ք - - - - - - - Teamviewer.exe - rundll32.exe - mstsc.exe - cmd.exe - ipy.exe - WScript.exe - cscript.exe - mshta.exe - python.exe - wmic.exe - - C:\Users\Default\;C:\Users\Public\ - .dll - - - C:\Users\Default\;C:\Users\Public\ - .exe - - - - - - - - HiddenService - torrc - \tor.exe - tor-gencert - - - - - - - - - - - - - - - - rclone - s3browser - grabff.exe - grabff.exe - - - - - - RESTORE_;_FILES.txt - - - DECRYPT_;_FILES.txt - - - \run.dat;\task.dat;\storage.dat - AppData - Symantec - BlueJeans - - - VBoxRT.dll;VboxC.dll - - - - - - - - - - - - - - Content.IE5;INetCache - .exe;.zip;.ps1;.bat;.rar;.dll - - - MSForms.exd - - - .exe - C:\windows\system32\ - - - .exe - C:\windows\ - \system32\ - - - .dll;.exe - C:\windows\ - C:\Users\ - - - .dll;.exe - C:\Users\ - - - \Microsoft\Word\Startup\ - .wll - - - C:\windows\system32\CodeIntegrity\ - - - \Microsoft\Excel\Startup\ - .xll - - - \Microsoft\Outlook\VbaProject.OTM - - - \Microsoft\Addins\ - .xla - - - .vsto - - - .bat - C:\Windows\ - C:\ProgramData\Lenovo\SystemUpdate\sessionSE\ - - - .dll - C:\Windows\ - - - .sys - C:\Windows\ - - - .exe - C:\Windows\ - C:\Windows\System32\;C:\windows\syswow64\ - - - .exe - C:\Windows\System32\ - - - .exe - C:\Windows\SysWow64\ - - - .theme - - - \Packages\oice_ - - - VirtualboxVM.exe - - notepad++.exe - .lnk:Zone.Identifier - \UsageLogs\cscript.exe.log - \UsageLogs\mshta.exe.log - \UsageLogs\msiexec.exe.log - \UsageLogs\regsvr32.exe.log - \UsageLogs\rundll32.exe.log - \UsageLogs\svchost.exe.log - \UsageLogs\wmic.exe.log - \UsageLogs\wscript.exe.log - \regsvr32.exe.log - \UsageLogs\wsmprovhost.exe.log - .lnk - .url - - .sys - .inf - C:\Windows\SysWOW64\Drivers - C:\Windows\System32\Drivers - \Drivers\ - .drv - - .xlam - .xlsm - .xla - .xll - .xls - .xlsb - .xlsx - .xlt - .xltm - .xlw - \Microsoft\Templates\ - .eml - .msg - .pptm - .potm - .pptm - .pptm - .sldm - \Microsoft\Office\Recent - oleObject - \Recent\CustomDestinations\ - \Downloads\ - \Content.Outlook\ - .docb - .wbk - .ped - .dot - .dotx - .doc - .docm - .docx - - .accdb - .accde - .accdr - .accdt - .mdb - .mde - .msc - .mst - .potx - .ppam - .ppsm - .ppsx - .ppt - .pptm - .pptx - .pub - .sldm - .sldx - .xls - .xps - - - - .pem - .crt - .ca-bundle - .cer - .csr - .der - .p7b - .p7r - .p7s - .pfx - .sto - .p12 - .crl - .sst - .key - - - - .hlp - ACLUI.DLL.UI - ACLUI.DLL - AFLogVw.exe - AShld.exe - AShldRes.DLL.asr - AShldRes.DLL - AhnI2.dll - CamMute.exe - CommFunc.dll - CommFunc.jax - DESqmWrapper.dll - DESqmWrapper.wrapper - FSPMAPI.dll.fsp - FSPMAPI.dll - Gadget.exe - LoLTWLauncher.exe - Mc.exe - McUtil.dll.ping - McUtil.dll.url - McUtil.dll - MpSvc.dll - MsMpEng.exe - NtUserEx.dat - NtUserEx.dat - NtUserEx.dll - NtUserEx.dll - NvSmart.exe - NvSmartMax.dll - NvSmartMax.dll - NvSmartMaxapp.dll - OInfo11.ISO - OInfo11.ocx - OInfoP11.exe - OleView.exe - OleView.exe - POETWLauncher.exe - RasTls.dll.config - RasTls.dll.msc - RasTls.dll - RasTls.exe - RunHelp.exe - Sidebar.dll.doc - Sidebar.dll - Ushata.dll - Ushata.exe - Ushata.fox - VeetlePlayer.exe - boot.ldr - chrome_frame_helper.dll.rom - chrome_frame_helper.dll - chrome_frame_helper.exe - dvcemumanager.exe - fsguidll.exe - fslapi.dll.gui - fslapi.dll - fsstm.exe - hccutils.dll.res - hccutils.dll - hha.dll.bak - hha.dll - hhc.exe - hkcmd.exe - iviewers.dll - jli.dll - libvlc.dll - mPclient.dll - mcf.ep - mcf.exe - mcupdui.exe - mcut.exe - mcutil.dll.bbc - mcvsmap.exe - msi.dll.dat - msi.dll - msseces.asm - msseces.exe - mtcReport.ktc - rc.dll - rc.exe - rc.hlp - sep_NE.exe - sep_NE.slf - tplcdclr.exe - winmm.dll - wts.chm - credwiz.exe - - ssMUIDLL.dll - aepic.dll - ftllib.dll - userenv.dll - \Terminal Server Client\Cache\ - C:\Windows\Prefetch - \\tsclient - C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\ - \Temp\debug.bin - Temp\7z - C:\Windows\AppPatch\Custom - .chm - .cpl - .mht - \Chrome\User Data\Default\Extensions\ - .crx - .appref-ms - .gadget - .JSE - .exe - .scf - Exchange Server\ClientAccess\Owa\ - \Device\HarddiskVolumeShadowCopy - .zip\ - .FON - .FOT - C:\Windows\System32\GroupPolicy\Machine\Scripts - C:\Windows\System32\GroupPolicy\User\Scripts - .iqy - .ico - .isp - .msc - .manifest - MEMORY.dmp - .msi - .cs - .customDestinations-ms - C:\Windows\Minidump - .PAF - .bmc - .rdp - .rtf - .reg - .SHS - .slk - .SCR - .set - .SettingContent-ms - .SHD - .SPL - .scr - HammerDrillStatus.dll - Microsoft\Windows\WER\ - .ICL - .sdb - .SCT - .SHB - Temp\Temp1_ - - \Microsoft\;CLR_v;\UsageLogs\ - .ade - .adp - .application - .appref-ms - .asc - .bmf - .cer - .dmp - .gpg - .htm - .html - .json - .jsp - .key - .mof - .ocx - .p7b - .p12 - .pem - .pfx - .pgp - .php - .ppk - .war - .xml - - - - - - - - - Software\Famatech\advanced_ip_scanner\State - LastRangeUsed - SetValue - - - - - - - - - - - - - - - - - - - - - - - - - - \Software\Microsoft\Terminal Server Client - DefaultPrinter - - - - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} - SetValue - - - HKLM\SYSTEM\CurrentControlSet\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da} - SetValue - - - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96f-e325-11ce-bfc1-08002be10318} - SetValue - - - HKLM\SYSTEM\CurrentControlSet\Control\Class\{36fc9e60-c465-11cf-8056-444553540000} - SetValue - - - HKLM\SYSTEM\CurrentControlSet\Control\Class\{e0cbf06c-cd8b-4647-bb8a-263b43f0f974 - SetValue - - - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} - SetValue - - - HKLM\SYSTEM\CurrentControlSet\Control\Class\{eec5ad98-8080-425f-922a-dabf3de3f69a} - SetValue - - - HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359} - SetValue - - - Root\InventoryDevicePnp;prod_virtual_dvd-rom - SetValue - - MountedDevices - Mountpoints2 - Active Setup\Installed Components - - - - - - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\ - LoggedOnUser - - LastLoggedOnUser - LastLoggedOnProvider - - - - - - - HKCR\ms-msdt\ - - - HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck -
DWORD (0x00000001)
- - - - - - - - - SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - \print\ - \AzureAttestService\CoInitializeSecurityParam - C:\$WINDOWS.~BT\ - - - - \AccessVBOM - C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe - - - Security\VBAWarnings - C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe - - - Security\VBAWarnings - C:\Windows\system32\svchost.exe;C:\WINDOWS\system32\mmc.exe;C:\Windows\system32\userinit.exe - - - EXCEL.exe;WINWORD.exe - {8BD21D32-EC42-11CE-9E0D-00AA006002F3};{5B9D8FC8-4A71-101B-97A6-00000B65C08B} - - - - HKCU\di - - - HKCU\� - - - HKLM\SOFTWARE\Microsoft\AMSI\Providers\ - hklm\software\microsoft\windows script\settings\amsienable - hkcu\software\microsoft\windows script\settings\amsienable - - - - - - Google\Chrome\Extensions - update_url - SetValue - - - - ForcePasswordReset - - - HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC\CurrVal - - - HKLM\SAM\SAM\DOMAINS\Account\Users\ - Last Password Change - - - HKLM\SAM\SAM\DOMAINS\Account\Users\ - Account Expiration - - - HKLM\SAM\SAM\DOMAINS\Account\Users\ - Last Failed Logon - - - HKLM\SAM\SAM\Domains\Builtin\Aliases\00000220\ - - - HKLM\SAM\SAM\Domains\Builtin\Aliases\0000022B\ - - - - SOFTWARE\Microsoft\Wow64\x86\ - - SetValue - \CurrentVersion\Run\ - Add_exclusions_here - - \Microsoft\System\Scripts - \Windows\System\Scripts - HKLM\SYSTEM\Setup\CmdLine - - \Start -
DWORD (0x00000000)
- - - \Start -
DWORD (0x00000001)
- - - \Start -
DWORD (0x00000002)
- - - \Start -
DWORD (0x00000003)
- - - \Start -
DWORD (0x00000004)
- - \ImagePath - \ServiceDll - \ServiceManifest - hkcu\software\microsoft\windows nt\currentversion\windows\run\ - hkcu\software\microsoft\windows\currentversion\explorer\shell folders\common startup - hkcu\software\microsoft\windows\currentversion\explorer\shell folders\startup - hklm\software\microsoft\command processor\autorun - hkcu\software\microsoft\windows nt\currentversion\accessibility\ATs\\*(1)\StartExe - Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup - - \Print\Monitors - - - - - - - HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ - $ - CreateKey - - - HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ - $ - CreateKey - - - - HKLM\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} - C:\WINDOWS\sysmon64.exe - C:\WINDOWS\sysmon.exe - C:\Programdata\sysmon\sysmon64.exe - - - - HKCR\ - (Default) - \shell\open\command\(Default) -
URL:
- - - HKCU\Software\Classes\ - (Default) - \shell\open\command\(Default) -
URL:
- - - HKCR\ - \shell\open\command\(Default) -
%1
- - - HKCU\Software\Classes\ - \shell\open\command\(Default) -
%1
- - - \shell\open\command\DelegateExecute - - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe - - - - Session Manager\KnownDlls - - - - - Outlook\Addins - - - Word\Addins - - - Excel\Addins - - - Powerpoint\Addins - - - Software\Microsoft\VSTO\Security\Inclusion\ - - - Software\Microsoft\VSTO\SolutionMetadata\ - - - - - - - - - - - cmmgr32.exe - - - - HKLU\Software\Microsoft\Command Processor\AutoRun - HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute - HKLM\System\CurrentControlSet\Control\Session Manager\Execute - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Wow6432Node\Microsoft\Command Processor\AutoRun - HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell - HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug - HKLM\Software\Microsoft\Command Processor\AutoRun - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup - UserInitMprLogonScript - HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath - - HKLM\System\CurrentControlSet\Control\Lsa\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Authentication Packages - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Notification Packages - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages - - - - - - - - \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default) -
C:\Users\Public\;$Recyclebin;\temp\;\Desktop\;\Downloads\;\Content.Outlook\;\Microsoft\Office\
-
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
- - - \InprocServer32\(Default);\LocalServer32\(Default);\ScriptletURL\(Default) -
C:\WINDOWS\SYSTEM32\UpdateDeploy.dll
- - - \ProgID\(Default);\TreatAs\(Default) - - - - \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ - Debugger;ReportingMode;MonitorProcess - - - \Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ - GlobalFlag -
DWORD (0x00000200)
- - - \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ - MonitorProcess - - - \Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ - ReportingMode -
DWORD (0x00000001)
- - - \Microsoft\Windows NT\CurrentVersion\SilentProcessExit - CreateKey - - - \Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules\ - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{;}\EDGEMITMP_;.tmp\setup.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe - C:\Program Files\Microsoft Office\root\integration\integrator.exe - C:\Program Files\Google\Chrome Beta\Application\;\Installer\setup.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\;\OfficeClickToRun.exe - - - - - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree - SD - Microsoft\Windows\UpdateOrchestrator - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\SD - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OneDrive Per-Machine Standalone Update Task\SD - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Feature Updates\SD - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Feature Updates Logon\SD - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Performance Monitor\SD - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\SnapshotCleanupTask\SD - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office ClickToRun Service Monitor\SD - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Automatic Updates 2.0\SD - Microsoft\Windows\UpdateOrchestrator - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree - ID - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks - Author - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks - Path - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks - Date - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot - - - - - - SetValue - \Environment\ - - - - - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA -
DWORD (0x00000000)
- - - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin -
DWORD (0x00000000)
- - - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop -
DWORD (0x00000000)
- - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy - \Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe - exefile\shell\runas\command\isolatedCommand - - - - - - - - - - - - - \Hidden - - SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\ - $ -
DWORD (0x00000000)
- - - - - HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Parameters - C:\WINDOWS\sysmon64.exe - C:\WINDOWS\sysmon.exe - C:\Programdata\sysmon\sysmon64.exe - - - - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel - MitigationOptions;MitigationAuditOptions - - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options - MitigationOptions;MitigationAuditOptions - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmcompute.exe\0\MitigationOptions - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmwp.exe\0\MitigationOptions - msiexec.exe - TiWorker.exe - - - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options - MitigationOptions;MitigationAuditOptions - C:\Program Files\Microsoft Office 15\root\integration\integrator.exe - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acro - - - - DisableTaskMgr - C:\WINDOWS\system32\svchost.exe - C:\windows\SysWOW64\svchost.exe - - - HKLM\SYSTEM\CurrentControlSet\ - \Instances\;Altitude - HKLM\System\CurrentControlSet\Services\CldFlt\Instances\CldFlt\Altitude - SetValue - - - - \Security\Level -
DWORD (0x00000001)
- - - \Security\Level -
DWORD (0x00000002)
- - - \Security\Level -
DWORD (0x00000003)
- - - \Security\Level -
DWORD (0x00000004)
- - - \Outlook\Security - - \Security\Level - - \Word\Security - \Excel\Security - \Security\Level1Remove - \HideSCAHealth - HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring - HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify - HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride - HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\RPSessionInterval - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SystemRestorePointCreationFrequency - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection - HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting - - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ - \Enabled -
DWORD (0x00000000)
- - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ - \Enabled -
DWORD (0x00000001)
- - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\ - \Enabled - - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\ - \ChannelAccess -
(A;;0x1;;;SY);(A;;0x5;;;BA);(A;;0x1;;;LA)
- C:\Windows\servicing\TrustedInstaller.exe;\TiWorker.exe - - - HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging - \EnableScriptBlockLogging -
DWORD (0x00000000)
- - - HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging - \EnableScriptBlockLogging - DeleteKey;DeleteValue - - - hklm\software\microsoft\windows\currentversion\policies\system\audit - \ProcessCreationIncludeCmdLine_Enabled -
DWORD (0x00000000)
- - - hklm\software\microsoft\windows\currentversion\policies\system\audit - \ProcessCreationIncludeCmdLine_Enabled - DeleteKey;DeleteValue - - - HKLM\System\CurrentControlSet\Services\Eventlog - \CustomSD - - - HKLM\System\CurrentControlSet\Services\Eventlog - \MaxSize - - - - globallyopenports - - EnableFirewall - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List - - - - \Microsoft\.NETFramework\ETWEnabled -
DWORD (0x00000000)
- - - \Microsoft\.NETFramework\NGenAssemblyUsageLog - - - SetValue - \Environment\NGenAssemblyUsageLog - - - SetValue - \Environment\COMPlus_ETWEnabled - - - - - - - - \LastKey - - - SymbolicLinkValue - - - \Software\Microsoft\Windows\CurrentVersion\Explorer - \AppData\;\ProgramData\;\Temp\;C:\users - - - ‮ - - HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg - - - - \Software\Policies\Microsoft\SystemCertificates\;\SOFTWARE\Microsoft\EnterpriseCertificates\;HKLM\SOFTWARE\Microsoft\SystemCertificates\;HKLM\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates\ - CreateKey - C:\WINDOWS\Sysmon64.exe - C:\WINDOWS\Sysmon.exe - C:\WINDOWS\system32\certsrv.exe - C:\WINDOWS\system32\CompatTelRunner.exe - C:\WINDOWS\system32\svchost.exe - C:\Windows\SysWOW64\SearchProtocolHost.exe - C:\Windows\system32\SearchProtocolHost.exe - C:\Windows\system32\taskhost.exe - C:\windows\SysWOW64\svchost.exe - C:\WINDOWS\System32\DriverStore\FileRepository\asus - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe - C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe - - fDenyTSConnections - Terminal Server\WinStations\RDP-Tcp - RDP-tcp\PortNumber - Control\Terminal Server\fSingleSessionPerUser - - - - � - - - Й;ќ;Л;я;К - - - - - - - - HKLM\HARDWARE\ACPI\DSDT - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Account Name - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Display Name - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Email - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP User - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP User - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\MAPI Provider - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 User - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP User - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 Password - SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP Password - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName - SecurityPasswordAES - OptionsPasswordAES - SecurityPasswordExported - PermanentPassword - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - HKLM\SOFTWARE\GitForWindows - - - - - - - - - - - - - - - - - - - - - - - - - HKLM\SAM\SAM\DOMAINS\Account\Users\Names\ - DeleteKey - - - - HKLM\SYSTEM\CurrentControlSet\Control\BitlockerStatus\BootStatus -
DWORD (0x00000001)
- - - HKLM\SYSTEM\CurrentControlSet\Control\BitlockerStatus\BootStatus -
DWORD (0x00000000)
- - - - - - - - - - \Services\VSS\Diag\(Default) - - - - - - - - HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters - - - HKLM\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters - - - \LastKey - - - \WinStationsDisabled - - - \TSServerDrainMode - - - \TypedURLs - - - HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\disabledcomponents - - - HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Linkage\Bind -
Binary Data
- - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards - - - services\http\parameters\urlaclinf - - - cRecentFiles\c1\ - tDIText - - - \File MRU\Item 1 - - - HKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHash - - - HKLM\SOFTWARE\Classes\ CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - HKLM\Software\Microsoft\Windows\CurrentVersion\RunService - HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - CurrentVersion\Windows\Load - CurrentVersion\Windows\Run - CurrentVersion\Winlogon\Shell - CurrentVersion\Winlogon\System - \Software\Microsoft\Windows NT\CurrentVersion\Windows\load - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - \Software\Microsoft\Windows\CurrentVersion\RunServicesOnce - SOFTWARE\Microsoft\.NETFramework\ETWEnabled - \Group Policy\Scripts - Terminal Server\Wds\rdpwd\StartupPrograms - Winlogon\AlternateShells\AvailableShells - Policies\System\Shell - Windows CE Services\AutoStartOnConnect - Windows CE Services\AutoStartOnDisconnect - PreferenceMACs\Default\extensions.settings - CurrentVersion\URL - \CurrentVersion\Font Drivers - HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown - CurrentVersion\Windows\IconServiceLib - Active Setup\Installed Components - NullSessionShares - NullSessionPipes - PasswordExpiryNotification - SafeBoot\AlternateShell - Desktop\Scrnsave.exe - \DisplayVersion - \ModifyPath - \Microsoft\Windows\CurrentVersion\Uninstall\ - \UninstallString - Terminal Server\WinStations\RDP-Tcp\InitialProgram - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman - - \Explorer\FileExts\ - \shell\install\command\ - \ProfileImagePath - - \Classes\AllFilesystemObjects\ - \Classes\*\ - \Software\Microsoft\Ctf\LangBarAddin - \ContextMenuHandlers\ - \CurrentVersion\Shell - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers - \Classes\Directory\ - \Classes\Drive\ - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - \Classes\Folder\ - \Hidden - \HideFileExt - \SOFTWARE\Microsoft\Internet Explorer\Desktop\Components - \SOFTWARE\Classes\Protocols\Filter - \SOFTWARE\Classes\Protocols\Handler - \SharedTaskScheduler - \ShowSuperHidden - \ColumnHandlers - \CopyHookHandlers - \ExtShellFolderViews - \PropertySheetHandlers - \ShellServiceObjectDelayLoad - \ShellServiceObjects - - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ - HKLM\System\CurrentControlSet\Control\Session Manager\S0InitialCommand - - HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ - - \3\1809 - \3\2500 - \3\1206 - \DisableSecuritySettingsCheck - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64 - HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries - HKLM\SYSTEM\CurrentControlSet\Services\WinSock\ - \ProxyServer - SavedLegacySettings - Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy - EnableConsoleTracing - EnableFileTracing - - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ - HKLM\SOFTWARE\Microsoft\Netsh - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders\ - - HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - - - Office Test\ - - \Internet Explorer\Toolbar\ - \Internet Explorer\Extensions\ - - \Browser Helper Objects\ - {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ - - \UrlUpdateInfo - \InstallSource - - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ - \Exclusions\Paths - \Exclusions\Extensions - \Exclusions\Processes - TamperProtection - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logoff - \Software\Policies\Microsoft\Windows\System\Scripts\Logoff - \Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon - \Software\Policies\Microsoft\Windows\System\Scripts\Logon - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup - HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup - - Domain - DHCPDefaultGateway - DhcpIPAddress - DhcpNameserver - Dhcpserver - DhcpSubnetMask - Nameserver - \DefaultGateway - PersistentRoutes - }\Category - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - SubnetMask - \Trusted Documents\TrustRecords - Software\Microsoft\VBA\7.1\Common - Software\Microsoft\VBA\7.1\Trusted - \Security\DontTrustInstalledFiles - \Security\Trusted Locations - Security\ProtectedView\DisableInternetFilesInPV - Security\ProtectedView\DisableAttachmentsInPV - Security\ProtectedView\DisableUnsafeLocationsInPV - Software\WinRAR\ArcHistory - WinZip\mru\ - Recent File List - Outlook\WebView\Inbox - Outlook\Today\UserDefinedUrl - Outlook\WebView\Calendar - \Place MRU - \LinkDate - \DriverVerVersion - \DriverVersion - \LowerCaseLongPath - \Publisher - Compatibility Assistant\Store\ - \BinProductVersion - Root\InventoryApplicationShortcut\ - Root\InventoryDriverBinary - Root\InventoryDriverPackage - Root\InventoryDevicePnp - Root\InventoryDeviceContainer - - Root\InventoryApplication\ - ProgramID;Name;Version;Publisher;Language;InstallDate;Source;RootDirPath;HiddenArp;UninstallString;RegistryKeyPath;UserSID;sha256 - - - Root\InventoryApplicationFile\ - ProgramId;FileId;LowerCaseLongPath;Name;OriginalFileName;Publisher;Version;binfileversion;LinkDate;Size;Language;USN;IsPeFile;IsOsComponent;sha256;AppxPackageFullName - - - Root\InventoryApplicationAppV\ - - - Root\InventoryMiscellaneousOfficeAddIn;Root\InventoryMiscellaneousOfficeIdentifiers;Root\InventoryMiscellaneousOfficeIESettings;Root\InventoryMiscellaneousOfficeInsights;Root\InventoryMiscellaneousOfficeProducts;Root\InventoryMiscellaneousOfficeSettings;Root\InventoryMiscellaneousOfficeVBA;Root\InventoryMiscellaneousOfficeVBARuleViolations - - - \Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives\Volume - Drive Type -
DWORD (0x00000011)
- - \Explorer\MountPoints2 - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices - - HKLM\System\CurrentControlSet\services\ - \DeleteFlag -
DWORD (0x00000001)
- - - HKLM\System\CurrentControlSet\services\ - \Type -
DWORD (0x00000001)
- - - HKLM\System\CurrentControlSet\services\ - \Type -
DWORD (0x00000002)
- - - HKLM\System\CurrentControlSet\services\ - \Type -
DWORD (0x00000004)
- - - HKLM\System\CurrentControlSet\services\ - \Type -
DWORD (0x00000020)
- - - HKLM\System\CurrentControlSet\services\ - \Type -
DWORD (0x00000020)
- - - HKLM\System\CurrentControlSet\services\ - \Type -
DWORD (0x00000100)
- - - HKLM\System\CurrentControlSet\services\ - \Group - - - HKLM\System\CurrentControlSet\services\ - \DependOnService - - - HKLM\System\CurrentControlSet\services\ - \BinaryPathName - - - HKLM\System\CurrentControlSet\services\ - \RequiredPrivileges - - - HKLM\System\CurrentControlSet\services\ - \Owners - - - HKLM\System\CurrentControlSet\services\ - \ObjectName - - - HKLM\System\CurrentControlSet\services\ - \ServiceStartName - - - HKLM\System\CurrentControlSet\services\ - \ErrorControl - - - - HKLM\System\CurrentControlSet\services\ - \DependOnGroup - - - HKLM\System\CurrentControlSet\services\ - \DisplayName - - - HKLM\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder - \List - - - HKLM\System\CurrentControlSet\services\ - \Type -
DWORD (0x00000001)
- - - \ConsentStore\bluetooth - \ConsentStore\contacts - \ConsentStore\hunmanInterfaceDevice - \ConsentStore\location - \ConsentStore\microphone - \ConsentStore\usb\ - \ConsentStore\webcam - \ConsentStore\humanInterfaceDevice - LastVisitedMRU - SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit - \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU - HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR - HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ - HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust - HKLM\SOFTWARE\Microsoft\Cryptography\OID - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID - HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll - Classes\exefile\shell\runas\command\isolatedCommand - \FriendlyName - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ - \Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB - HKLM\SOFTWARE\Microsoft\Tracing\ - - HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318} -
ndis;rndis
- - HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4 - - \Software\AppDataLow\Software\Microsoft\ -
.exe;.dll;powershell;wmic
- - - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\lmcompatibilitylevel -
DWORD (0x00000005)
- - Software\Microsoft\Office test\Special\Perf - \CurrentControlSet\Services\NTDS\LsaDbExtPt - \Services\NTDS\DirectoryServiceExtPt - GoToMyPc\FileTransfer\history - GoToMyPc\GuestInvite - Filesharing - DesktopSharing - LogIncomingConnections - LogOutgoingConnections - PermanentPasswordDate - Security_Adminrights - vncviewer\MRU - Autostart_GUI - Meeting_UserName - BuddyLoginName - BuddyLoginTokenID - Always_Online - HKLM\SOFTWARE\Microsoft\CurrentVersion\Policies\System\EnableLinkedConnections - Software\recfg - \Keyboard Layout\Preload\ - \Keyboard Layout\Substitutes\ - HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\ - \Client\Enabled - \Server\Enabled - Kitty\Sessions - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictSendingNTLMTraffic - PuTTY\Sessions - Terminal Server Client\Servers - WinSCP 2\Sessions - - C:\Program Files (x86)\Kaspersky Lab - C:\Program Files\Kaspersky Lab - C:\Program Files (x86)\ESET - C:\Program Files\ESET - - - - - - - - - Content.IE5;INetCache - .exe;.zip;.ps1;.bat;.rar;.vbs;.hta - - - :Zone.Identifier - blob:;about:internet - - - 56ceb6d0011d87b6e4d7023d7ef85676;4f2eb62fa529c0283b28d05ddd311fae;b91ce2fa41029f6955bff20079468448;b91ce2fa41029f6955bff20079468448;846e27a652a5e1bfbd0ddd38a16dc865;2c4a910a1299cdae2a4e55988a2f102e - - - SHA256=074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 - SHA256=45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 - SHA256=9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 - SHA256=29b75f0db3006440651c6342dc3c0672210cfb339141c75e12f6c84d990931c3 - SHA256=c8c907a67955bcdf07dd11d35f2a23498fb5ffe5c6b5d7f36870cf07da47bff2 - SHA256=76a2f2644cb372f540e179ca2baa110b71de3370bb560aca65dcddbd7da3701e - - - Content.Outlook;Downloads;Recycle;\Users\;\ProgramData\;\Windows\;Temp\7z;Temp\;Startup;.vb;.vbe;.vbs;.application;.appref-ms;.bat;.cmd;.cmdline;.docm;.exe;.lnk;.eml;.dll;.sys;.hta;.pptm;.ps1;.sys;.reg;.docm;.xlsm;.xlam;.pptm;.potm;.pptm;.sldm;.scf;.appref-ms;.rdp;.vbs;.js;.pem;.crt;.ca-bundle;.cer;.csr;.der;.p7b;.p7r;.p7s;.pfx;.sto;.p12;.crl;.sst;.key;:bin;.mht;.manifest;.cpl;.scr;.inf - - - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE - - - IMPHASH=19584675D94829987952432E018D5056 - - - IMPHASH=330768a4f172e10acb6287b87289d83b - - - - - - IMPHASH=00000000000000000000000000000000 - AppData\Local\Microsoft\Windows\AppCache\ - \Microsoft\Windows\INetCache\ - \Microsoft\Windows\Temporary Internet Files\Content.IE5 - \Mozilla\Firefox\Profiles\ - .default\prefs-1.js - Microsoft\Windows\Start Menu\Programs\Startup - - - - - - - - - - - - - - - - msagent_;\MSSE-;postex;\status_ - - - \atctl;\userpipe;\iehelper;\sdlrpc;\comnap - - - \PSEXESVC - -stdin - -stdout - - - RemCom_ - stdin;stdout;stderr;communication - - - \svcctl - - - \ntsvcs - ConnectPipe - - \lsadump;\cachedump;\wceservicepipe - \9f81f59bc58452127884ce513865ed20 - \46a676ab7f179e511e30dd2dc41bd388 - tssmp_endpoint - \NamePipe_MoreWindows - \WCEServicePipe - \ahexec - \cachedumppipe - \csexec - \e710f28d59aa529d6792ca6ff0ca1b34 - \isapi_dg - \isapi_http - \isapi_http - \lsadump - \lsassw - \paexec - \pcheap_reuse - \gruntsvc - \remcom - \rpchlp_3 - \sdlrpc - \winsession - \adschemerpc - \AnonymousPipe - \bc367 - \bc31a7 - \testPipe - msf-pipe - \atsvc - \isapi_http;\isapi_dg;\isapi_dg2;\sdlrpc;\ahexec;\winsession;\lsassw;\46a676ab7f179e511e30dd2dc41bd388;\9f81f59bc58452127884ce513865ed20;\e710f28d59aa529d6792ca6ff0ca1b34;\rpchlp_3;\NamePipe_MoreWindows;\pcheap_reuse;\gruntsvc;\583da945-62af-10e8-4902-a8f205c72b2e;\bizkaz;\Posh;\jaccdpqnvbrrxlaf;\csexecsvc - \atctl;\userpipe;\iehelper;\sdlrpc;\comnap - - \DserNamedPipe;\mypipe-;\windows.update.manager;\ntsvcs_;scerpc_;\demoagent;\PGMessagePipe;\MsFTeWds;\f4c3;\fullduplex_;\msrpc_;\f53f;\rpc_;\spoolss_;\win_svc;\SearchTextHarvester;demoagent_ - \wkssvc - \spoolss - \scerpc - \ntsvcs - \SearchTextHarvester - \PGMessagePipe - \MsFteWds - - - ConnectPipe - \MICROSOFT##WID\tsql\query - - - \Winsock2\CatalogChangeListener- - -0, - - - \pipe\ - CtxSharefilepipe0 - - - \winreg - Anonymous Pipe - - - - - - - ConnectPipe - - - - - lsass - \SQLLocal\RTCLOCAL - \spoolss - C:\Windows\system32\wbem\wmiprvse.exe - C:\Windows\System32\LxRun.exe - C:\Windows\System32\SearchIndexer.exe - C:\Windows\System32\smss.exe - C:\Windows\System32\spoolsv.exe - C:\Windows\System32\wininit.exe - C:\Windows\system32\DFSRs.exe - C:\Windows\SystemApps\Microsoft.Windows - - C:\Windows\Microsoft.NET\Framework - ngen.exe - - - C:\Windows\SystemApps\ShellExperienceHost_ - ShellExperienceHost.exe - - C:\Windows\system32\SearchProtocolHost.exe - \System - ProtectedPrefix\LocalService\FTHPIPE - - Exchange Server - - C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\BIN\OWSTIMER.EXE - C:\Windows\syswow64\snmp.exe - c:\windows\system32\inetsrv\w3wp.exe - \M.E.C.Core.WinRMDataCommunicator.NamedPipe. - - C:\Windows\system32\dns.exe - - \sql\query - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe - \TDLN- - vmware- - \InitShutdown - \MsFteWds - \W32TIME_ALT - \WiFiNetworkManagerTask - \Winsock2CatelogChangeListener - \browser - \epmapper - \eventlog - \scerpc - \wkssvc - \ntapvsrq - Anonymous Pipe - - - - - - - - - - Created - - - - - - - type: 16;type: 16 - powershell.exe - - - github - powershell.exe - - - powershell;cscript.exe;wscript.exe;mshta.exe;bitsadmin.exe;\cmd.exe - . - - - dropboxapi.com - \Dropbox\Client\Dropbox.exe;\Dropbox\bin\Dropbox.exe;\Oracle\Java\ - - - 1drv - \AppData\Local\Microsoft\OneDrive\OneDrive.exe;C:\Program Files (x86)\Google\Chrome\Application\chrome.exe;\Internet Explorer\iexplore.exe;C:\Windows\System32\AppHostRegistrationVerifier.exe;C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe;C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe;C:\Program Files\Mozilla Firefox\firefox.exe - - - .box.com;upload - - - mega.nz;mega.co.nz - - - privatlab.com - - - thedoccloud.com;deftsecurity.com;websitetheme.com;highdatabase.com;incomeupdate.com;zupertech.com;panhardware.com;databasegalore.com;avsvmcloud.com;freescanonline.com - - - tiktok;parler.com;gab.com;mewe.com;4chan;8chan;facebook;fbcdn;twitter;instagram;snapchat - - - efnet;undernet;freenode;ircnet;.rizon;quakenet;oftc.net;dalnet - - - .slack.com;discord.;telegram.;rocketchat.;mattermost.;flock.com - - - advanced-ip-scanner.com - - - kali.download - - - - 0x1f4b0.com;1q2w3.life;1q2w3.website;31.187.64.216;185.193.38.148;aalbbh84.info;adfreetv.ch;adless.io;adplusplus.fr;adrenali.gq;ajcryptominer.com;ajplugins.com;allfontshere.press;altavista.ovh;amhixwqagiz.ru;appelamule.com;arizona-miner.tk;aster18cdn.nl;aster18prx.nl;avero.xyz;averoconnector.com;bauersagtnein.myeffect.net;bhzejltg.info;blazepool;blockmasters;blockmasterscoins;bmnr.pw;bmst.pw;bohemianpool;carry.myeffect.net;cashbeet.com;cdn-code.host;cfceu.duckdns.org;cfcnet.gdn;cfcnet.top;cfcs1.duckdns.org;chainblock.science;cieh.mx;coin-hive.com;coin-service.com;coin-services.info;coiner.site;coinpirate.cf;coinrail.io;coinwebmining.com;cpu2cash.link;cryptaloot.pro;cryptmonero;crypto-loot.com;crypto-pool;crypto-webminer.com;cryptoloot.pro;d-ns.ga;dataservices.download;directprimal.com;dwarfpool;encoding.ovh;eth-pocket.com;eth-pocket.de;eth-pocket.eu;ethereum-pocket.de;ethereum-pocket.eu;ethtrader.de;eu.nimpool.io;eu.sushipool.com;f1tbit.com;flnqmin.org;freecontent.bid;freecontent.date;freecontent.loan;freecontent.racing;freecontent.stream;freecontent.win;gnrdomimplementation.com;graftpool.ovh;greenindex.dynamic-dns.net;gustaver.ddns.net;hashrefinery;hashvault.pro;herphemiste.com;hide.ovh;hk.rs;hlpidkr.ru;hodlers.party;hodling.faith;hostingcloud.win;hrfziiddxa.ru;ihdvilappuxpgiv.ru;imhvlhaelvvbrq.ru;insdrbot.com;irrrymucwxjl.ru;istlandoll.com;ivuovhsn.ru;iwanttoearn.money;ixvenhgwukn.ru;jqassets.download;jqr-cdn.download;jqrcdn.download;jquerrycdn.download;jqwww.download;jqxrrygqnagn.ru;jscoinminer.com;jwduahujge.ru;ksimdw.ru;l33tsite.info;laferia.cr;ledhenone.com;ltstyov.ru;mepirtedic.com;mine.bz;minercircle.com;minercry.pt;minergate;minero.cc;miners.pro;minescripts.info;mininghub.club;miningpoolhubcoins;minr.pw;mixpools.org;mmc.center;mollnia.com;monerise.com;monero.lindon-pool.win;monero;moriaxmr.com;munero.me;mxcdn1.now.sh;mxcdn2.now.sh;myadstats.com;mypool.online;nablabee.com;nanopool.org;nathetsof.com;nicehash;nimiqpool.com;node.philpool.com;npcdn1.now.sh;nunu-001.now.sh;ogondkskyahxa.ru;ogrid.org;oinkinns.tk;olecintri.com;omine.org;onvid.club;open-hive-server-1.pp.ua;oxwwoeukjispema.ru;pcejuyhjucmkiny.ru;pool.nimiq.watch;pool.nimiqchain.info;pool.porkypool.com;pool.xmr;poolto.be;prohash.net;prohash;proj2018.xyz;pzoifaum.info;ratchetmining.com;realnetwrk.com;reauthenticator.com;rove.cl;ruvuryua.ru;s7ven.com;scaleway.ovh;sentemanactri.com;sickrage.ca/ch;sighash.info;slushpool;soodatmish.com;sparechange.io;statdynamic.com;stati.bid;staticsfs.host;streamplay.to;suprnova.cc;svivqrhrh.ru;sxcdn02.now.sh;sxcdn3.now.sh;sxcdn4.now.sh;sxcdn6.now.sh;synconnector.com;teracycle.net;tercabilis.info;thelifeisbinary.ddns.net;thersprens.com;torrent.pw;ulnawoyyzbljc.ru;unrummaged.com;uoldid.ru;usxmrpool;viaxmr.com;vpzccwpyilvoyg.ru;vzzexalcirfgrf.ru;wbmwss.beetv.net;webmine.cz;webmine.pro;webminepool.tk;webminerpool.com;webwidgetz.duckdns.org;wmemsnhgldd.ru;wmtech.website;wmwmwwfmkvucbln.ru;wrxgandsfcz.ru;xmrm.pw;xmrminingproxy.com;xmrpool;yiimp;yuyyio.com;zavzlen.ru;zergpool;zergpoolcoins;ziykrgc.ru;zlx.com.br;zpool;analytics.blue;estream.to - - graph.microsoft.com - dl.dropboxusercontent.com - api.onedrive.com - zoom.us - teamviewer - Screenconnect - - - census - researchscan - scanhub - shadow - shodan - - .download - .kp - .su - .ss - .xn - .sy - .ve - .xxx - .cn - .click - .club - .ir - .ru - .host - .icu - .pw - .website - .ninja - .rocks - .top - .ua - .xyz - - - kuternull.com;rimrun.com;0ffice36o;asushotfix;infestexe;rahasn.webhop.org;rahasn.akamake.net;rahasn.homewealth.biz;winodwsupdates;israirairlines - - githubusercontent.com;github.com - - api.ipify.org;whatismyipaddress.com;edns.ip-api.com;checkip.dyndns.org;icanhazip.com;ifconfig.me;ifconfig.co;ipaddress.com;ipecho.net;ident.me;api.ip.sb;www.myexternalip.com;ip.anysrc.net;wtfismyip.com;myexternalip.com;ipecho.net;checkip.amazonaws.com;goo.gl;git.io;bit.ly;ow.ly;ip-api.com - - tiny-share.com;paste.ee;pastebin.com - - afraid.org;duckdns.org;changeip.com;ddns.net;hopto.org;zapto.org;servehttp.com;sytes.net;whoer.net;bravica.net;ip.webmasterhome.cn;whatsmyip.us;myip.kz;ip-addr.es;curlmyip;anysrc.net;anysrc.net;dlinkddns.com;no-ip.com;no-ip.org;no-ip.biz;no-ip.info;noip.com - darknet.to;hiddenservice.net;onion.cab;onion.city;onion.direct;onion.nu;onion.pet;onion.plus;onion.rip;onion.sh;onion.si;onion.to;onion.top;onion.ws;tor-gateways.de;tor2net.com;tor2web.blutmagie.de;tor2web.fi;tor2web.info;tor2web.io;tor2web.org - adblock.mydns.network;ibksturm.synology.me;jcdns.fun;ibuki.cgnat.net;dns.twnic.tw;commons.host;doh.dnswarden.com;dns-nyc.aaflalo.me;dns.aaflalo.me;doh.appliedprivacy.net;doh.captnemo.in;doh.tiar.app;doh.tiarap.org;doh.defaultroutes.de;doh.dns.sb;dns.oszx.co;2.dnscrypt-cert.oszx.co;dnscrypt;edns.233py.com;hk-dns.233py.com;hk2dns.233py.com;hkdns.233py.com;hkdns.233py.com;ndns.233py.com;sdns.233py.com;wdns.233py.com;pastebin.com;dns.adguard.com;dns-family.adguard.com;security-filter-dns.cleanbrowsing.org;family-filter-dns.cleanbrowsing.org;adult-filter-dns.cleanbrowsing.org;cloudflare-dns.com;mozilla.cloudflare-dns.com;dns.233py.com;dns.aaflalo.me;dns.google;doh.opendns.com;dns.quad9.net;dns9.quad9.net;dns10.quad9.net;dns11.quad9.net;doh.xfinity.com;dns.nextdns.io;dns.dnsoverhttps.net;doh.crypto.sx;doh.powerdns.org;doh-ch.blahdns.com;doh-de.blahdns.com;dns.rubyfish.cn;dns.containerpi.com;doh-2.seby.io;doh.seby.io;rdns.faelix.net;doh.li;doh.armadillodns.net;doh.netweaver.uk;doh.42l.fr;dns.aa.net.uk - gc._msdcs. - _kerberos._tcp.dc._msdcs. - _kerberos._udp.dc._msdcs. - _ldap._tcp.pdc._msdcs. - wpad - - _ldap. - C:\Windows\ - unknown process - C:\ProgramData\Microsoft\Windows Defender\Platform\;\Windows Defender\MsMpEng.exe;C:\Windows\ - - - System;svchost.exe;services.exe;unknown process;\;; - - - - - - C:\Program Files (x86)\Admin Arsenal\ - C:\Program Files (x86)\CheckPoint\ - C:\Program Files (x86)\Fortinet\ - C:\Program Files (x86)\OpenDNS\OpenDNS Connector - C:\Program Files (x86)\Razer\Razer Services\ - C:\Program Files (x86)\Trend Micro\ - C:\Program Files (x86)\VMware - C:\Program Files (x86)\Veeam\ - C:\Program Files\CheckPoint\ - C:\Program Files\Trend Micro\ - Slack.exe - ConnectWise.exe - git-remote-https.exe - C:\Program Files (x86)\Enpass\Enpass.exe - C:\Program Files (x86)\Fiserv\Vision\VisionGUI.NET.exe - C:\Program Files (x86)\Fortinet\FortiClient\update_task.exe - C:\Program Files (x86)\Lenovo\System Update\Tvsukernel.exe - C:\Program Files\VMware\vCenter Server\jre\bin\java.exe - C:\Program Files\VMware\vCenter Server\python\python.exe - C:\Windows\SysWOW64\SearchProtocolHost.exe - C:\Windows\System32\dsregcmd.exe - C:\Windows\sysmon64.exe - C:\Windows\sysmon.exe - brave-sync.s3.dualstack. - .salesforceliveagent.com - ads-serve.brave.com - - .msftncsi.com - ..localmachine - - -pushp.svc.ms - .b-msedge.net - .bing.com - .hotmail.com - .live.com - .live.net - .microsoft.com - .microsoftonline.com - .microsoftstore.com - .ms-acdc.office.com - .msedge.net - .msn.com - .msocdn.com - .s-microsoft.com - .skype.com - .skype.net - .windows.com - .windows.net.nsatc.net - .windowsupdate.com - .xboxlive.com - login.windows.net - - .activedirectory.windowsazure.com - .msauth.net - .msftauth.net - .opinsights.azure.com - management.azure.com - outlook.office365.com - portal.azure.com - - .mozaws.net - .mozilla.com - .mozilla.net - .mozilla.org - .spotify.com - .spotify.map.fastly.net - googleapis.com - clients1.google.com - clients2.google.com - clients3.google.com - clients4.google.com - clients5.google.com - clients6.google.com - cloudsearch.googleapis.com - id.google.com - safebrowsing.googleapis.com - www.googleapis.com - - .akadns.net - .netflix.com - .typekit.net - aspnetcdn.com - ajax.googleapis.com - cdnjs.cloudflare.com - cdnjs.cloudflare.com - fonts.googleapis.com - - .steamcontent.com - - .disqus.com - .fontawesome.com - disqus.com - - .1rx.io - .2mdn.net - .adadvisor.net - .adap.tv - .addthis.com - .adform.net - .adnxs.com - .adroll.com - .adrta.com - .adsafeprotected.com - .adsrvr.org - .advertising.com - .amazon-adsystem.com - .amazon-adsystem.com - .analytics.yahoo.com - .aol.com - .betrad.com - .bidswitch.net - .casalemedia.com - .chartbeat.net - .cnn.com - .convertro.com - .criteo.com - .criteo.net - .crwdcntrl.net - .demdex.net - .domdex.com - .dotomi.com - .doubleclick.net - .doubleverify.com - .emxdgt.com - .exelator.com - .google-analytics.com - .googleadservices.com - .googlesyndication.com - .googletagmanager.com - .googlevideo.com - .gstatic.com - .gvt1.com - .gvt2.com - .ib-ibi.com - .jivox.com - .mathtag.com - .moatads.com - .moatpixel.com - .mookie1.com - .myvisualiq.net - .netmng.com - .nexac.com - .nexac.com - .openx.net - .optimizely.com - .outbrain.com - .pardot.com - .phx.gbl - .pinterest.com - .pubmatic.com - .quantcount.com - .quantserve.com - .revsci.net - .rfihub.net - .rlcdn.com - .rubiconproject.com - .scdn.co - .scorecardresearch.com - .serving-sys.com - .sharethrough.com - .simpli.fi - .sitescout.com - .smartadserver.com - .snapads.com - .spotxchange.com - .taboola.com - .taboola.map.fastly.net - .tapad.com - .tidaltv.com - .trafficmanager.net - .tremorhub.com - .tribalfusion.com - .turn.com - .twimg.com - .tynt.com - .w55c.net - .ytimg.com - .zorosrv.com - ads.yahoo.com - 1rx.io - adservice.google.com - ampcid.google.com - clientservices.googleapis.com - d29x207vrinatv.cloudfront.net - googleadapis.l.google.com - imasdk.googleapis.com - l.google.com - ml314.com - mtalk.google.com - update.googleapis.com - www.googletagservices.com - - .pscp.tv - - adsniper.ru - cdnvideo.ru - chat.minergate.com - cwsa.minergate.com - forum.minergate.com - leadlab.click - mc.yandex.ru - pool.ntp.org - vmg.host - yandex.ru - .adobe.com - .autodesk.com - .avast.com - .avcdn.net - .cdn.bitdefender.net - .digicert.com - .eset.com - .globalsign.com - .globalsign.net - .intuit.com - .java.com - .macromedia.com - .oracle.com - .quickbooks.com - .usertrust.com - amazontrust.com - ocsp.identrust.com - pki.goog - ads.playground.xyz - citrixupdates.cloud.com - forticlient.fortinet.net - mft10.onbaseonline.com - msocsp.com - ocsp.comodoca.com - ocsp.cybertrust.ne.jp - ocsp.entrust.net - ocsp.entrust.net - ocsp.godaddy.com - ocsp.int-x3.letsencrypt.org - ocsp.intel.com - ocsp.msocsp.com - ocsp.quovadisglobal.com - ocsp.quovadisoffshore.com - ocsp.sectigo.com - ocsp.starfieldtech.com - ocsp.thawte.com - ocsp.trustwave.com - ocsp.verisign.com - pki-goog.l.google.com - pki.intel.com - scrootca1.ocsp.secomtrust.net - scrootca2.ocsp.secomtrust.net - stats.anchor.host - status.rapidssl.com - status.thawte.com - ts-ocsp.ws.symantec.com - upgrade.bitdefender.com - - - - - - - - - - - - - - - - - .;>;unknown;anonymous - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Symantec\ - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files\Symantec\ - - - - - - - \BHO\ie_to_edge_stub.exe;\Microsoft\Teams\;\Vivaldi\Application\;Google\Chrome\;Google\Update;BraveSoftware\Brave-Browser\;Edge\Application\;EdgeUpdate\Install\;Program Files\SmartGit\ - - - - - - - - - - - \appdata\local\google\chrome\user data\swreporter\;software_reporter_tool.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - NETWORK SERVICE; LOCAL SERVICE - - - - \ No newline at end of file From 98409cddd7f6ddb8bee609ce0276d8ffa1f20025 Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Fri, 8 Sep 2023 15:01:22 -0400 Subject: [PATCH 467/471] Add files via upload --- LICENSE.txt | 504 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 504 insertions(+) create mode 100644 LICENSE.txt diff --git a/LICENSE.txt b/LICENSE.txt new file mode 100644 index 00000000..8000a6fa --- /dev/null +++ b/LICENSE.txt @@ -0,0 +1,504 @@ + GNU LESSER GENERAL PUBLIC LICENSE + Version 2.1, February 1999 + + Copyright (C) 1991, 1999 Free Software Foundation, Inc. + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + +[This is the first released version of the Lesser GPL. It also counts + as the successor of the GNU Library Public License, version 2, hence + the version number 2.1.] + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +Licenses are intended to guarantee your freedom to share and change +free software--to make sure the software is free for all its users. + + This license, the Lesser General Public License, applies to some +specially designated software packages--typically libraries--of the +Free Software Foundation and other authors who decide to use it. You +can use it too, but we suggest you first think carefully about whether +this license or the ordinary General Public License is the better +strategy to use in any particular case, based on the explanations below. + + When we speak of free software, we are referring to freedom of use, +not price. Our General Public Licenses are designed to make sure that +you have the freedom to distribute copies of free software (and charge +for this service if you wish); that you receive source code or can get +it if you want it; that you can change the software and use pieces of +it in new free programs; and that you are informed that you can do +these things. + + To protect your rights, we need to make restrictions that forbid +distributors to deny you these rights or to ask you to surrender these +rights. These restrictions translate to certain responsibilities for +you if you distribute copies of the library or if you modify it. + + For example, if you distribute copies of the library, whether gratis +or for a fee, you must give the recipients all the rights that we gave +you. You must make sure that they, too, receive or can get the source +code. If you link other code with the library, you must provide +complete object files to the recipients, so that they can relink them +with the library after making changes to the library and recompiling +it. And you must show them these terms so they know their rights. + + We protect your rights with a two-step method: (1) we copyright the +library, and (2) we offer you this license, which gives you legal +permission to copy, distribute and/or modify the library. + + To protect each distributor, we want to make it very clear that +there is no warranty for the free library. Also, if the library is +modified by someone else and passed on, the recipients should know +that what they have is not the original version, so that the original +author's reputation will not be affected by problems that might be +introduced by others. + + Finally, software patents pose a constant threat to the existence of +any free program. We wish to make sure that a company cannot +effectively restrict the users of a free program by obtaining a +restrictive license from a patent holder. Therefore, we insist that +any patent license obtained for a version of the library must be +consistent with the full freedom of use specified in this license. + + Most GNU software, including some libraries, is covered by the +ordinary GNU General Public License. This license, the GNU Lesser +General Public License, applies to certain designated libraries, and +is quite different from the ordinary General Public License. We use +this license for certain libraries in order to permit linking those +libraries into non-free programs. + + When a program is linked with a library, whether statically or using +a shared library, the combination of the two is legally speaking a +combined work, a derivative of the original library. The ordinary +General Public License therefore permits such linking only if the +entire combination fits its criteria of freedom. The Lesser General +Public License permits more lax criteria for linking other code with +the library. + + We call this license the "Lesser" General Public License because it +does Less to protect the user's freedom than the ordinary General +Public License. It also provides other free software developers Less +of an advantage over competing non-free programs. These disadvantages +are the reason we use the ordinary General Public License for many +libraries. However, the Lesser license provides advantages in certain +special circumstances. + + For example, on rare occasions, there may be a special need to +encourage the widest possible use of a certain library, so that it becomes +a de-facto standard. To achieve this, non-free programs must be +allowed to use the library. A more frequent case is that a free +library does the same job as widely used non-free libraries. In this +case, there is little to gain by limiting the free library to free +software only, so we use the Lesser General Public License. + + In other cases, permission to use a particular library in non-free +programs enables a greater number of people to use a large body of +free software. For example, permission to use the GNU C Library in +non-free programs enables many more people to use the whole GNU +operating system, as well as its variant, the GNU/Linux operating +system. + + Although the Lesser General Public License is Less protective of the +users' freedom, it does ensure that the user of a program that is +linked with the Library has the freedom and the wherewithal to run +that program using a modified version of the Library. + + The precise terms and conditions for copying, distribution and +modification follow. Pay close attention to the difference between a +"work based on the library" and a "work that uses the library". The +former contains code derived from the library, whereas the latter must +be combined with the library in order to run. + + GNU LESSER GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License Agreement applies to any software library or other +program which contains a notice placed by the copyright holder or +other authorized party saying it may be distributed under the terms of +this Lesser General Public License (also called "this License"). +Each licensee is addressed as "you". + + A "library" means a collection of software functions and/or data +prepared so as to be conveniently linked with application programs +(which use some of those functions and data) to form executables. + + The "Library", below, refers to any such software library or work +which has been distributed under these terms. A "work based on the +Library" means either the Library or any derivative work under +copyright law: that is to say, a work containing the Library or a +portion of it, either verbatim or with modifications and/or translated +straightforwardly into another language. (Hereinafter, translation is +included without limitation in the term "modification".) + + "Source code" for a work means the preferred form of the work for +making modifications to it. For a library, complete source code means +all the source code for all modules it contains, plus any associated +interface definition files, plus the scripts used to control compilation +and installation of the library. + + Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running a program using the Library is not restricted, and output from +such a program is covered only if its contents constitute a work based +on the Library (independent of the use of the Library in a tool for +writing it). Whether that is true depends on what the Library does +and what the program that uses the Library does. + + 1. You may copy and distribute verbatim copies of the Library's +complete source code as you receive it, in any medium, provided that +you conspicuously and appropriately publish on each copy an +appropriate copyright notice and disclaimer of warranty; keep intact +all the notices that refer to this License and to the absence of any +warranty; and distribute a copy of this License along with the +Library. + + You may charge a fee for the physical act of transferring a copy, +and you may at your option offer warranty protection in exchange for a +fee. + + 2. You may modify your copy or copies of the Library or any portion +of it, thus forming a work based on the Library, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) The modified work must itself be a software library. + + b) You must cause the files modified to carry prominent notices + stating that you changed the files and the date of any change. + + c) You must cause the whole of the work to be licensed at no + charge to all third parties under the terms of this License. + + d) If a facility in the modified Library refers to a function or a + table of data to be supplied by an application program that uses + the facility, other than as an argument passed when the facility + is invoked, then you must make a good faith effort to ensure that, + in the event an application does not supply such function or + table, the facility still operates, and performs whatever part of + its purpose remains meaningful. + + (For example, a function in a library to compute square roots has + a purpose that is entirely well-defined independent of the + application. Therefore, Subsection 2d requires that any + application-supplied function or table used by this function must + be optional: if the application does not supply it, the square + root function must still compute square roots.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Library, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Library, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote +it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Library. + +In addition, mere aggregation of another work not based on the Library +with the Library (or with a work based on the Library) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may opt to apply the terms of the ordinary GNU General Public +License instead of this License to a given copy of the Library. To do +this, you must alter all the notices that refer to this License, so +that they refer to the ordinary GNU General Public License, version 2, +instead of to this License. (If a newer version than version 2 of the +ordinary GNU General Public License has appeared, then you can specify +that version instead if you wish.) Do not make any other change in +these notices. + + Once this change is made in a given copy, it is irreversible for +that copy, so the ordinary GNU General Public License applies to all +subsequent copies and derivative works made from that copy. + + This option is useful when you wish to copy part of the code of +the Library into a program that is not a library. + + 4. You may copy and distribute the Library (or a portion or +derivative of it, under Section 2) in object code or executable form +under the terms of Sections 1 and 2 above provided that you accompany +it with the complete corresponding machine-readable source code, which +must be distributed under the terms of Sections 1 and 2 above on a +medium customarily used for software interchange. + + If distribution of object code is made by offering access to copy +from a designated place, then offering equivalent access to copy the +source code from the same place satisfies the requirement to +distribute the source code, even though third parties are not +compelled to copy the source along with the object code. + + 5. A program that contains no derivative of any portion of the +Library, but is designed to work with the Library by being compiled or +linked with it, is called a "work that uses the Library". Such a +work, in isolation, is not a derivative work of the Library, and +therefore falls outside the scope of this License. + + However, linking a "work that uses the Library" with the Library +creates an executable that is a derivative of the Library (because it +contains portions of the Library), rather than a "work that uses the +library". The executable is therefore covered by this License. +Section 6 states terms for distribution of such executables. + + When a "work that uses the Library" uses material from a header file +that is part of the Library, the object code for the work may be a +derivative work of the Library even though the source code is not. +Whether this is true is especially significant if the work can be +linked without the Library, or if the work is itself a library. The +threshold for this to be true is not precisely defined by law. + + If such an object file uses only numerical parameters, data +structure layouts and accessors, and small macros and small inline +functions (ten lines or less in length), then the use of the object +file is unrestricted, regardless of whether it is legally a derivative +work. (Executables containing this object code plus portions of the +Library will still fall under Section 6.) + + Otherwise, if the work is a derivative of the Library, you may +distribute the object code for the work under the terms of Section 6. +Any executables containing that work also fall under Section 6, +whether or not they are linked directly with the Library itself. + + 6. As an exception to the Sections above, you may also combine or +link a "work that uses the Library" with the Library to produce a +work containing portions of the Library, and distribute that work +under terms of your choice, provided that the terms permit +modification of the work for the customer's own use and reverse +engineering for debugging such modifications. + + You must give prominent notice with each copy of the work that the +Library is used in it and that the Library and its use are covered by +this License. You must supply a copy of this License. If the work +during execution displays copyright notices, you must include the +copyright notice for the Library among them, as well as a reference +directing the user to the copy of this License. Also, you must do one +of these things: + + a) Accompany the work with the complete corresponding + machine-readable source code for the Library including whatever + changes were used in the work (which must be distributed under + Sections 1 and 2 above); and, if the work is an executable linked + with the Library, with the complete machine-readable "work that + uses the Library", as object code and/or source code, so that the + user can modify the Library and then relink to produce a modified + executable containing the modified Library. (It is understood + that the user who changes the contents of definitions files in the + Library will not necessarily be able to recompile the application + to use the modified definitions.) + + b) Use a suitable shared library mechanism for linking with the + Library. A suitable mechanism is one that (1) uses at run time a + copy of the library already present on the user's computer system, + rather than copying library functions into the executable, and (2) + will operate properly with a modified version of the library, if + the user installs one, as long as the modified version is + interface-compatible with the version that the work was made with. + + c) Accompany the work with a written offer, valid for at + least three years, to give the same user the materials + specified in Subsection 6a, above, for a charge no more + than the cost of performing this distribution. + + d) If distribution of the work is made by offering access to copy + from a designated place, offer equivalent access to copy the above + specified materials from the same place. + + e) Verify that the user has already received a copy of these + materials or that you have already sent this user a copy. + + For an executable, the required form of the "work that uses the +Library" must include any data and utility programs needed for +reproducing the executable from it. However, as a special exception, +the materials to be distributed need not include anything that is +normally distributed (in either source or binary form) with the major +components (compiler, kernel, and so on) of the operating system on +which the executable runs, unless that component itself accompanies +the executable. + + It may happen that this requirement contradicts the license +restrictions of other proprietary libraries that do not normally +accompany the operating system. Such a contradiction means you cannot +use both them and the Library together in an executable that you +distribute. + + 7. You may place library facilities that are a work based on the +Library side-by-side in a single library together with other library +facilities not covered by this License, and distribute such a combined +library, provided that the separate distribution of the work based on +the Library and of the other library facilities is otherwise +permitted, and provided that you do these two things: + + a) Accompany the combined library with a copy of the same work + based on the Library, uncombined with any other library + facilities. This must be distributed under the terms of the + Sections above. + + b) Give prominent notice with the combined library of the fact + that part of it is a work based on the Library, and explaining + where to find the accompanying uncombined form of the same work. + + 8. You may not copy, modify, sublicense, link with, or distribute +the Library except as expressly provided under this License. Any +attempt otherwise to copy, modify, sublicense, link with, or +distribute the Library is void, and will automatically terminate your +rights under this License. However, parties who have received copies, +or rights, from you under this License will not have their licenses +terminated so long as such parties remain in full compliance. + + 9. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Library or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Library (or any work based on the +Library), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Library or works based on it. + + 10. Each time you redistribute the Library (or any work based on the +Library), the recipient automatically receives a license from the +original licensor to copy, distribute, link with or modify the Library +subject to these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties with +this License. + + 11. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Library at all. For example, if a patent +license would not permit royalty-free redistribution of the Library by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Library. + +If any portion of this section is held invalid or unenforceable under any +particular circumstance, the balance of the section is intended to apply, +and the section as a whole is intended to apply in other circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 12. If the distribution and/or use of the Library is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Library under this License may add +an explicit geographical distribution limitation excluding those countries, +so that distribution is permitted only in or among countries not thus +excluded. In such case, this License incorporates the limitation as if +written in the body of this License. + + 13. The Free Software Foundation may publish revised and/or new +versions of the Lesser General Public License from time to time. +Such new versions will be similar in spirit to the present version, +but may differ in detail to address new problems or concerns. + +Each version is given a distinguishing version number. If the Library +specifies a version number of this License which applies to it and +"any later version", you have the option of following the terms and +conditions either of that version or of any later version published by +the Free Software Foundation. If the Library does not specify a +license version number, you may choose any version ever published by +the Free Software Foundation. + + 14. If you wish to incorporate parts of the Library into other free +programs whose distribution conditions are incompatible with these, +write to the author to ask for permission. For software which is +copyrighted by the Free Software Foundation, write to the Free +Software Foundation; we sometimes make exceptions for this. Our +decision will be guided by the two goals of preserving the free status +of all derivatives of our free software and of promoting the sharing +and reuse of software generally. + + NO WARRANTY + + 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO +WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. +EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR +OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY +KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE +LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME +THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN +WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY +AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU +FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR +CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE +LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING +RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A +FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF +SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH +DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Libraries + + If you develop a new library, and you want it to be of the greatest +possible use to the public, we recommend making it free software that +everyone can redistribute and change. You can do so by permitting +redistribution under these terms (or, alternatively, under the terms of the +ordinary General Public License). + + To apply these terms, attach the following notices to the library. It is +safest to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least the +"copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + This library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with this library; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 + USA + +Also add information on how to contact you by electronic and paper mail. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the library, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the + library `Frob' (a library for tweaking knobs) written by James Random + Hacker. + + , 1 April 1990 + Ty Coon, President of Vice + +That's all there is to it! From 6d3dedcceab6fd29b61a72f092ab457573d328ee Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Fri, 8 Sep 2023 16:15:37 -0400 Subject: [PATCH 468/471] Changed links Install.ps1 --- Sysmon Install.ps1 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Sysmon Install.ps1 b/Sysmon Install.ps1 index 48ae560a..fb3df6d2 100644 --- a/Sysmon Install.ps1 +++ b/Sysmon Install.ps1 @@ -3,8 +3,8 @@ # Define Sysmon URLs $sysmonURL = "https://live.sysinternals.com/sysmon.exe" -$sysmonConfigURL = "https://raw.githubusercontent.com/NerbalOne/sysmon-config/master/sysmonconfig-export.xml" -$sysmonUpdateConfig = "https://raw.githubusercontent.com/NerbalOne/sysmon-config/master/SysmonUpdateConfig.ps1" +$sysmonConfigURL = "https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml" +$sysmonUpdateConfig = "https://raw.githubusercontent.com/ion-storm/sysmon-config/master/SysmonUpdateConfig.ps1" # Define Local Path for Sysmon File and Sysmon Config $sysmonPath = "C:\Programdata\Sysmon\sysmon.exe" From c2220ef83343265fcc3a61f5ab9ef6dc62eaf8be Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Fri, 8 Sep 2023 16:16:04 -0400 Subject: [PATCH 469/471] Update SysmonUpdateConfig.ps1 --- SysmonUpdateConfig.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SysmonUpdateConfig.ps1 b/SysmonUpdateConfig.ps1 index c01ae1e5..57bde492 100644 --- a/SysmonUpdateConfig.ps1 +++ b/SysmonUpdateConfig.ps1 @@ -6,7 +6,7 @@ $sysmonPath = "C:\ProgramData\Sysmon\sysmon.exe" $sysmonConfigPath = "C:\ProgramData\Sysmon\sysmonconfig-export.xml" # Define Sysmon Config URL -$sysmonConfigURL = "https://raw.githubusercontent.com/NerbalOne/sysmon-config/master/sysmonconfig-export.xml" +$sysmonConfigURL = "https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml" # Download the Latest Sysmon Config [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 From b87e261677ce3bd857346d2ec9ae1de6dfc6fcdb Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Fri, 8 Sep 2023 16:16:41 -0400 Subject: [PATCH 470/471] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index b0bab9fc..3e63f089 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # Sysmon ATT&CK Configuration # The file provided should function as a great starting point for system monitoring in a self-contained package. This configuration and results should give you a good idea of what's possible for Sysmon. Please beware that you may need to fine tune and add exclusions depending on your environment. High CPU usage may be seen if exclusions are not added and one or more rules are firing off multiple times every second. -      **[sysmonconfig-export.xml](https://github.com/NerbalOne/sysmon-config/blob/master/sysmonconfig-export.xml)** +      **[sysmonconfig-export.xml](https://github.com/ion-storm/sysmon-config/blob/master/sysmonconfig-export.xml)** Pull requests and issue tickets are welcomed. Any new additions will be credited in-line or on Git. Tag your name with Author=YourName within the rulename field. From a656aef0d882fbcb4ca928e657d261aa207caf49 Mon Sep 17 00:00:00 2001 From: NerbalOne Date: Mon, 11 Sep 2023 09:40:42 -0400 Subject: [PATCH 471/471] Updated rules and added exclusions. --- sysmonconfig-export.xml | 1032 +-------------------------------------- 1 file changed, 13 insertions(+), 1019 deletions(-) diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml index edfa00f1..35ce7b98 100644 --- a/sysmonconfig-export.xml +++ b/sysmonconfig-export.xml @@ -683,6 +683,8 @@ ..\;\.. C:\Program Files;\Razer\Synapse3\Service\Razer Synapse Service.exe C:\Program Files;\Razer\;\UserProcess\Razer Synapse Service Process.exe + C:\ProgramData\MspPlatform\N-central Agent\PME\PMESetup.exe;C:\Program Files (x86)\MspPlatform\PME\Installers\FileCacheServiceAgentSetup.exe;C:\Program Files (x86)\MspPlatform\PME\Installers\RequestHandlerAgentSetup.exe;C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe + C:\ProgramData\MspPlatform\N-central Agent\PME\PMESetup.exe;C:\Program Files (x86)\MspPlatform\PME\Installers\FileCacheServiceAgentSetup.exe;C:\Program Files (x86)\MspPlatform\PME\Installers\RequestHandlerAgentSetup.exe;C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe \cmd.exe /c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe /c del "C:\Users\*\Desktop\*.exe;\cmd.exe -c del "C:\Users\*\AppData\Local\Temp\*.exe;\cmd.exe -c del "C:\Users\*\Desktop\*.exe @@ -923,6 +925,7 @@ MpCmdRun.exe Add-MpPreference;RemoveDefinitions;DisableIOAVProtection + C:\Program Files (x86)\MspPlatform\RequestHandlerAgent\RequestHandlerAgent.exe @@ -956,11 +959,13 @@ firewall delete ROGLiveService;C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe C:\Program Files\ASUS\ROG Live Service\RLSInstallAction.exe + C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe firewall add cmd.exe;ROGLiveService;C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe;enable=yes C:\Program Files\ASUS\ROG Live Service\RLSInstallAction.exe + C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe firewall set opmode disable @@ -3952,7 +3957,7 @@ C:\Windows\ - \System32\;Syswow64;sysmon.exe;sysmon64.exe + \System32\;Syswow64;sysmon.exe;sysmon64.exe C:\Windows\system32\ @@ -4601,6 +4606,7 @@ ACTIVEDS.DLL;Adsldpc.dll;Wldap32.dll;adsldp.dll \wscript.exe;\cscript.exe;\powershell.exe;\powershell_ise.exe;\rundll32.exe;\msbuild.exe;\csc.exe 6.3.9600.20566 (winblue_ltsb_escrow.220812-1741) + winblue WINWORD.exe;EXCEL.EXE @@ -5134,6 +5140,7 @@ 0x1028;0x1fffff C:\Program Files\SmartGit\bin\;C:\Program Files (x86)\ASUS\Update\;C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe;C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe;C:\WINDOWS\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\;C:\Program Files\Mozilla Firefox\firefox.exe;C:\Program Files\SmartGit\git;\Intel\Driver and Support Assistant\DSAService.exe;C:\Program Files (x86)\N-able Technologies\AutomationManagerAgent\;C:\Program Files (x86)\MspPlatform\RequestHandlerAgent\RequestHandlerAgent.exe;C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe;C:\ProgramData\Cavelo\jre\bin\java.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe;C:\Program Files\Cavelo\Cavelo Agent\parser.exe C:\Windows\Microsoft.NET\Framework\;\NGenTask.exe + C:\Program Files (x86)\Duo Device Health\Duo Device Health.exe \Intel\Driver and Support Assistant\ C:\Program Files\AMD\CNext\CNext\Radeonsoftware.exe;C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.UserSessionHelper.exe C:\Windows\Microsoft.NET\Framework\;\ngen.exe @@ -7167,6 +7174,8 @@
C:\Program Files\Google\Drive File Stream;\GoogleDriveFS.exe;startup_mode
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe;no-startup-window;win-session-start;prefetch
\Application\chrome.exe;no-startup-window;win-session-start;prefetch
+
\SentinelUI.exe" /minimized
+
C:\Program Files (x86)\Duo Device Health\Duo Device Health.exe
 \Microsoft\System\Scripts @@ -7458,8 +7467,6 @@ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Performance Monitor\SD HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\SnapshotCleanupTask\SD HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office ClickToRun Service Monitor\SD - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Automatic Updates 2.0\SD - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Office\Office Automatic Updates 2.0\SD Microsoft\Windows\UpdateOrchestrator;\AMDInstallLauncher\SD;\SD;ASUS Switch;\PowerToys\Autorun for @@ -7687,7 +7694,7 @@
DWORD (0x00000000)
C:\Program Files (x86)\N-able Technologies\AutomationManagerAgent\AutomationManager.AgentService.exe - + HKLM\SOFTWARE\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging \EnableScriptBlockLogging DeleteKey;DeleteValue @@ -8688,6 +8695,7 @@ HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ + C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe;C:\Program Files (x86)\N-able Technologies\Windows Software Probe\bin\wsp.exe;C:\Program Files (x86)\BeAnywhere Support Express\GetSupportService_N-Central\BASupSrvc.exe HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust @@ -9701,6 +9709,7 @@ .mui .ime .tsp + .tmp .ico C:\Windows\system32\MpSigStub.exe @@ -10717,1021 +10726,6 @@ SHA256=bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df SHA256=42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25 SHA256=f461414a2596555cece5cfee65a3c22648db0082ca211f6238af8230e41b3212 - SHA256=770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a - - - powershell.exe;powershell_ise.exe;pwsh.exe;Sqlps.exe - - - cmd.exe;conhost.exe - - - C:\Users\Public\ - C:\Perflogs\ - C:\Windows\Fonts\ - C:\Windows\debug\ - C:\Windows\Tasks\ - C:\Windows\tracing\ - C:\Windows\Help\ - C:\Windows\Logs\ - C:\Windows\System32\spool\SERVERS\ - C:\Windows\System32\spool\PRINTERS\ - C:\Windows\Help\ - C:\Windows\SysWOW64\Tasks - C:\ProgramData\Intel - C:\ProgramData\Mozilla - C:\ProgramData\chocolatey\ - C:\ProgramData\Microsoft\DeviceSync - C:\ProgramData\Microsoft\PlayReady - C:\ProgramData\Microsoft\User Account Pictures - C:\ProgramData\Microsoft\Office\Heartbeat - C:\ProgramData\Microsoft\Windows\WER - C:\Users\All Users\ - C:\Users\;\Music\ - C:\Users\;\Pictures\ - C:\Users\;\Videos\ - C:\Users\;\Contacts\ - - - .7z.exe - .doc.exe - .docm.exe - .docx.exe - .htm.exe - .html.exe - .iso.exe - .lnk.exe - .pdf.exe - .ppt.exe - .pptx.exe - .rar.exe - .rtf.exe - .txt.exe - .xls.exe - .xlsm.exe - .xlsx.exe - .zip.exe - - - \EntenLoader.exe - \SysmonQuiet.exe - \SharpEvtMute.exe - \EvtMuteHook.dll - \SysmonEOP.exe - - - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 - IMPHASH=3A19059BD7688CB88E70005F18EFC439 - IMPHASH=bf6223a49e45d99094406777eb6004ba - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF - IMPHASH=4C1B52A19748428E51B14C278D0F58E3 - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A - IMPHASH=672B13F4A0B6F27D29065123FE882DFC - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 - IMPHASH=D21BBC50DCC169D7B4D0F01962793154 - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC - IMPHASH=F9A28C458284584A93B14216308D31BD - IMPHASH=6118619783FC175BC7EBECFF0769B46E - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA - IMPHASH=563233BFA169ACC7892451F71AD5850A - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 - IMPHASH=13F08707F759AF6003837A150A371BA1 - IMPHASH=1781F06048A7E58B323F0B9259BE798B - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 - IMPHASH=713C29B396B907ED71A72482759ED757 - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E - IMPHASH=8B114550386E31895DFAB371E741123D - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 - IMPHASH=9D68781980370E00E0BD939EE5E6C141 - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE - IMPHASH=CB567F9498452721D77A451374955F5F - IMPHASH=730073214094CD328547BF1F72289752 - IMPHASH=17B461A082950FC6332228572138B80C - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 - IMPHASH=819B19D53CA6736448F9325A85736792 - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 - IMPHASH=0588081AB0E63BA785938467E1B10CCA - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 - IMPHASH=4DA924CF622D039D58BCE71CDF05D242 - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E - IMPHASH=E6F9D5152DA699934B30DAAB206471F6 - IMPHASH=3AD59991CCF1D67339B319B15A41B35D - IMPHASH=FFDD59E0318B85A3E480874D9796D872 - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 - IMPHASH=0E2216679CA6E1094D63322E3412D650 - IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB - IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 - IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 - IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 - IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F - IMPHASH=767637C23BB42CD5D7397CF58B0BE688 - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC - IMPHASH=7D010C6BB6A3726F327F7E239166D127 - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F - IMPHASH=5834ED4291BDEB928270428EBBAF7604 - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 - IMPHASH=3DE09703C8E79ED2CA3F01074719906B - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F - IMPHASH=E96A73C7BF33A464C510EDE582318BF2 - IMPHASH=32089B8851BBF8BC2D014E9F37288C83 - IMPHASH=09D278F9DE118EF09163C6140255C690 - IMPHASH=03866661686829d806989e2fc5a72606 - IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE - IMPHASH=19584675D94829987952432E018D5056 - IMPHASH=330768A4F172E10ACB6287B87289D83B - IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313 - IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC - IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28 - IMPHASH=96DF3A3731912449521F6F8D183279B1 - IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46 - IMPHASH=51791678F351C03A0EB4E2A7B05C6E17 - IMPHASH=25CE42B079282632708FC846129E98A5 - MD5=7B17F15713FCF13C764535AA2BDF52AA - SHA1=4E18320493042BCD7D21B53E258974BC460ACC78 - SHA256=477DFE485F5BD9540CC83E88FC04AAFB6DE49CF1ADC6BD857D5D6F4C1730A6D1 - - - winword.exe - excel.exe - powerpnt.exe - msaccess.exe - mspub.exe - eqnedt32.exe - visio.exe - wordpad.exe - wordview.exe - msohtmed.exe - - - onenote.exe - onenotem.exe - onenoteim.exe - - - - certutil.exe - certoc.exe - CertReq.exe - - Desktopimgdownldr.exe - esentutl.exe - - finger.exe - - notepad.exe - AcroRd32.exe - RdrCEF.exe - calc.exe - mspaint.exe - - - hh.exe - - - control.exe - - - CMSTP.exe - - - installutil.exe - - - mshta.exe - - - msiexec.exe - - - Odbcconf.exe - - - Regsvcs.exe;Regasm.exe - - - regsvr32.exe - - - Rundll32.exe - - - Verclsid.exe - - - mavinject.exe;mavinject64.exe - - - mmc.exe - - - Appvlp.exe;InfDefaultInstall.EXE;PresentationHost.exe;Register-cimprovider.exe;RegisterCimProvider2.exe;RegisterCimProvider.exe;ScriptRunner.exe;appcmd.exe;csi.exe;devtoolslauncher.exe;diskshadow.exe;extexport.exe;jjs.exe;msconfig.EXE;msdt.exe;rasautou.exe;rasdlui.exe;replace.exe;tttracer.exe;wab.exe;wsreset.exe - - - SHA256=7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed - SHA256=0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb - SHA256=0ae8d1dd56a8a000ced74a627052933d2e9bff31d251de185b3c0c5fc94a44db - SHA256=0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05 - SHA256=0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d - SHA256=0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917 - SHA256=0bc3685b0b8adc97931b5d31348da235cd7581a67edf6d79913e6a5709866135 - SHA256=0be4912bfd7a79f6ebfa1c06a59f0fb402bd4fe0158265780509edd0e562eac1 - SHA256=0c512b615eac374d4d494e3c36838d8e788b3dc2691bf27916f7f42694b14467 - SHA256=0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c - SHA256=0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c - SHA256=0cf6c6c2d231eaf67dfc87561cc9a56ecef89ab50baafee5a67962748d51faf3 - SHA256=0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f - SHA256=0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c - SHA256=0de4247e72d378713bcf22d5c5d3874d079203bb4364e25f67a90d5570bdcce8 - SHA256=0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b - SHA256=0ebaef662b14410c198395b13347e1d175334ec67919709ad37d65eba013adff - SHA256=0ee5067ce48883701824c5b1ad91695998916a3702cf8086962fbe58af74b2d6 - SHA256=0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8 - SHA256=0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf - SHA256=0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff - SHA256=0fd2df82341bf5ebb8a53682e60d08978100c01acb0bed7b6ce2876ada80f670 - SHA256=01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd - SHA256=01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece - SHA256=1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5 - SHA256=1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0 - SHA256=1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c - SHA256=1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b - SHA256=1afa03118f87b62c59a97617e595ebb26dde8dbdd16ee47ef3ddd1097c30ef6a - SHA256=1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e - SHA256=1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa - SHA256=1c8dfa14888bb58848b4792fb1d8a921976a9463be8334cff45cc96f1276049a - SHA256=1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687 - SHA256=1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8 - SHA256=1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219 - SHA256=1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe - SHA256=1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee - SHA256=1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961 - SHA256=1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512 - SHA256=1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c - SHA256=1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501 - SHA256=2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486 - SHA256=2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e - SHA256=2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a - SHA256=2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8 - SHA256=2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4 - SHA256=2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30 - SHA256=2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a - SHA256=2b120de80a5462f8395cfb7153c86dfd44f29f0776ea156ec4a34fa64e5c4797 - SHA256=2b186926ed815d87eaf72759a69095a11274f5d13c33b8cc2b8700a1f020be1d - SHA256=2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1 - SHA256=2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250 - SHA256=2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14 - SHA256=2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1 - SHA256=2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b - SHA256=2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d - SHA256=2d195cd4400754cc6f6c3f8ab1fe31627932c3c1bf8d5d0507c292232d1a2396 - SHA256=2da330a2088409efc351118445a824f11edbe51cf3d653b298053785097fe40e - SHA256=2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8 - SHA256=2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0 - SHA256=2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e - SHA256=2f60536b25ba8c9014e4a57d7a9a681bd3189fa414eea88c256d029750e15cae - SHA256=2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445 - SHA256=03e0581432f5c8cc727a8aa387f5b69ff84d38d0df6f1226c19c6e960a81e1e9 - SHA256=3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c25 - SHA256=3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0 - SHA256=3a95cc82173032b82a0ffc7d2e438df64c13bc16b4574214c9fe3be37250925e - SHA256=3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46 - SHA256=3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b - SHA256=3c5d7069f85ec1d6f58147431f88c4d7c48df73baf94ffdefd664f2606baf09c - SHA256=3c6f9917418e991ed41540d8d882c8ca51d582a82fd01bff6cdf26591454faf5 - SHA256=3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc - SHA256=3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b - SHA256=3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f - SHA256=3cb75429944e60f6c820c7638adbf688883ad44951bca3f8912428afe72bc134 - SHA256=3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3 - SHA256=3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4 - SHA256=3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272 - SHA256=3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf - SHA256=3e9b62d2ea2be50a2da670746c4dbe807db9601980af3a1014bcd72d0248d84c - SHA256=3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75 - SHA256=3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8 - SHA256=3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5 - SHA256=3f9530c94b689f39cc83377d76979d443275012e022782a600dcb5cad4cca6aa - SHA256=3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e - SHA256=3ff50c67d51553c08dcb7c98342f68a0f54ad6658c5346c428bdcd1f185569f6 - SHA256=3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa - SHA256=04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162 - SHA256=4a3d4db86f580b1680d6454baee1c1a139e2dde7d55e972ba7c92ec3f555dce2 - SHA256=4a9093e8dbcb867e1b97a0a67ce99a8511900658f5201c34ffb8035881f2dbbe - SHA256=4ab41816abbf14d59e75b7fad49e2cb1c1feb27a3cb27402297a2a4793ff9da7 - SHA256=4b4c925c3b8285aeeab9b954e8b2a0773b4d2d0e18d07d4a9d268f4be90f6cae - SHA256=4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1 - SHA256=4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4 - SHA256=4cff6e53430b81ecc4fae453e59a0353bcfe73dd5780abfc35f299c16a97998e - SHA256=4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036 - SHA256=4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee - SHA256=4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba - SHA256=4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80 - SHA256=4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69 - SHA256=05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748 - SHA256=5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a - SHA256=5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a - SHA256=5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe - SHA256=5b9623da9ba8e5c80c49473f40ffe7ad315dcadffc3230afdc9d9226d60a715a - SHA256=5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c - SHA256=5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921 - SHA256=5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a - SHA256=5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185 - SHA256=5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3 - SHA256=5ee292b605cd3751a24e5949aae615d472a3c72688632c3040dc311055b75a92 - SHA256=5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be - SHA256=5f7e47d728ac3301eb47b409801a0f4726a435f78f1ed02c30d2a926259c71f3 - SHA256=5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683 - SHA256=5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0 - SHA256=5f20541f859f21b3106e12d37182b1ea39bb75ffcfcddb2ece4f6edd42c0bab2 - SHA256=5f487829527802983d5c120e3b99f3cf89333ca14f5e49ac32df0798cfb1f7aa - SHA256=5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36 - SHA256=06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50 - SHA256=6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5 - SHA256=6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74 - SHA256=6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63 - SHA256=6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e - SHA256=6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44 - SHA256=6c64688444d3e004da77dcfb769d064bb38afceeef7ff915dfc71e60e19ff18a - SHA256=6cb6e23ba516570bbd158c32f7c7c99f19b24ca4437340ecb39253662afe4293 - SHA256=6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc - SHA256=6de84caa2ca18673e01b91af58220c60aecd5cccf269725ec3c7f226b2167492 - SHA256=6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf - SHA256=6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7 - SHA256=6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7 - SHA256=6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38 - SHA256=6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4 - SHA256=6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c - SHA256=6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d - SHA256=6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc - SHA256=07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357 - SHA256=7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf - SHA256=7aaf2aa194b936e48bc90f01ee854768c8383c0be50cfb41b346666aec0cf853 - SHA256=7b0f442ac0bb183906700097d65aed0b4b9d8678f9a01aca864854189fe368e7 - SHA256=7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b - SHA256=7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7 - SHA256=7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21 - SHA256=7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4 - SHA256=7cfa5e10dff8a99a5d544b011f676bc383991274c693e21e3af40cf6982adb8c - SHA256=7d8937c18d6e11a0952e53970a0934cf0e65515637ac24d6ca52ccf4b93d385f - SHA256=7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea - SHA256=7da6113183328d4fddf6937c0c85ef65ba69bfe133b1146193a25bcf6ae1f9dd - SHA256=7dfc2eb033d2e090540860b8853036f40736d02bd22099ff6cf665a90be659cd - SHA256=7e3b0b8d3e430074109d85729201d7c34bc5b918c0bcb9f64ce88c5e37e1a456 - SHA256=7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d - SHA256=7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7 - SHA256=7ec93f34eb323823eb199fbf8d06219086d517d0e8f4b9e348d7afd41ec9fd5d - SHA256=7f5dc63e5742096e4accaca39ae77a2a2142b438c10f97860dee4054b51d3b35 - SHA256=7f190f6e5ab0edafd63391506c2360230af4c2d56c45fc8996a168a1fc12d457 - SHA256=7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa - SHA256=08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6 - SHA256=8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2 - SHA256=8bda0108de82ebeae82f43108046c5feb6f042e312fa0115475a9e32274fae59 - SHA256=8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6 - SHA256=8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9 - SHA256=8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f - SHA256=8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775 - SHA256=8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9 - SHA256=8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2 - SHA256=8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126 - SHA256=8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c - SHA256=8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f - SHA256=8ef0ad86500094e8fa3d9e7d53163aa6feef67c09575c169873c494ed66f057f - SHA256=8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00 - SHA256=8f23313adb35782adb0ba97fefbfbb8bbc5fc40ae272e07f6d4629a5305a3fa2 - SHA256=8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a - SHA256=09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184 - SHA256=09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1 - SHA256=9a1d66036b0868bbb1b2823209fedea61a301d5dd245f8e7d390bd31e52d663e - SHA256=9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7 - SHA256=9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba - SHA256=9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c - SHA256=9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c - SHA256=9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194 - SHA256=9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285 - SHA256=9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4 - SHA256=9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449 - SHA256=9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2 - SHA256=9d58f640c7295952b71bdcb456cae37213baccdcd3032c1e3aeb54e79081f395 - SHA256=9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4 - SHA256=9ee33ffd80611a13779df6286c1e04d3c151f1e2f65e3d664a08997fcd098ef3 - SHA256=9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5 - SHA256=9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33 - SHA256=9f1025601d17945c3a47026814bdec353ee363966e62dba7fe2673da5ce50def - SHA256=9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374 - SHA256=11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 - SHA256=11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b - SHA256=12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56 - SHA256=14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8 - SHA256=15c53eb3a0ea44bbd2901a45a6ebeae29bb123f9c1115c38dfb2cdbec0642229 - SHA256=15fb486b6b8c2a2f1b067f48fba10c2f164638fe5e6cee618fb84463578ecac9 - SHA256=16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1 - SHA256=18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506 - SHA256=18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6 - SHA256=19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0 - SHA256=19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775 - SHA256=19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0 - SHA256=20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb - SHA256=21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21 - SHA256=22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c - SHA256=23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade - SHA256=025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4 - SHA256=26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097 - SHA256=26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43 - SHA256=26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712 - SHA256=27cd05527feb020084a4a76579c125458571da8843cdfc3733211760a11da970 - SHA256=29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6 - SHA256=29e0062a017a93b2f2f5207a608a96df4d554c5de976bd0276c2590a03bd3e94 - SHA256=30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb - SHA256=31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a - SHA256=31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427 - SHA256=31f4140c12ac31f5729a8de4dc051d3acd07783564604df831a2a6722c979192 - SHA256=32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351 - SHA256=32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993 - SHA256=34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3 - SHA256=34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf - SHA256=36aafa127736c7226c50061ea065f71e14f64ec60321f705bc52686d24117e0d - SHA256=36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb - SHA256=36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289 - SHA256=37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9 - SHA256=37dde6bd8a7a36111c3ac57e0ac20bbb93ce3374d0852bcacc9a2c8c8c30079e - SHA256=38b3eb8c86201d26353aab625cea672e60c2f66ce6f5e5eda673e8c3478bf305 - SHA256=38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7 - SHA256=38c18db050b0b2b07f657c03db1c9595febae0319c746c3eede677e21cd238b0 - SHA256=38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20 - SHA256=38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a - SHA256=39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e - SHA256=42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb - SHA256=42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f - SHA256=43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89 - SHA256=45abdbcd4c0916b7d9faaf1cd08543a3a5178871074628e0126a6eda890d26e0 - SHA256=45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a - SHA256=45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26 - SHA256=45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef - SHA256=47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84 - SHA256=47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005 - SHA256=47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc - SHA256=49ed27460730b62403c1d2e4930573121ab0c86c442854bc0a62415ca445a810 - SHA256=49f75746eebe14e5db11706b3e58accc62d4034d2f1c05c681ecef5d1ad933ba - SHA256=50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793 - SHA256=50db5480d0392a7dd6ab5df98389dc24d1ed1e9c98c9c35964b19dabcd6dc67f - SHA256=51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5 - SHA256=53eaefba7e7dca9ab74e385abf18762f9f1aa51594e7f7db5ba612d6c787dd7e - SHA256=55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9 - SHA256=55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a - SHA256=56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7 - SHA256=57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572 - SHA256=58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495 - SHA256=58c071cfe72e9ee867bba85cbd0abe72eb223d27978d6f0650d0103553839b59 - SHA256=59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879 - SHA256=60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289 - SHA256=60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813 - SHA256=61a1bdddd3c512e681818debb5bee94db701768fc25e674fcad46592a3259bd0 - SHA256=61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf - SHA256=61d6e40601fa368800980801a662a5b3b36e3c23296e8ae1c85726a56ef18cc8 - SHA256=62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0 - SHA256=64f9e664bc6d4b8f5f68616dd50ae819c3e60452efd5e589d6604b9356841b57 - SHA256=65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9 - SHA256=65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890 - SHA256=69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2 - SHA256=71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009 - SHA256=71ff60722231c7641ad593756108cf6779dbaad21c7b08065fb1d4e225eab14d - SHA256=72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1 - SHA256=72c0d2d699d0440db17cb7cbbc06a253eaafd21465f14bb0fed8b85ae73153d1 - SHA256=074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761 - SHA256=74a846c61adc53692d3040aff4c1916f32987ad72b07fe226e9e7dbeff1036c4 - SHA256=075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85 - SHA256=76b86543ce05540048f954fed37bdda66360c4a3ddb8328213d5aef7a960c184 - SHA256=76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524 - SHA256=76fb4deaee57ef30e56c382c92abffe2cf616d08dbecb3368c8ee6b02e59f303 - SHA256=077aa8ff5e01747723b6d24cc8af460a7a00f30cd3bc80e41cc245ceb8305356 - SHA256=77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9 - SHA256=79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57 - SHA256=79e87b93fbed84ec09261b3a0145c935f7dfe4d4805edfb563b2f971a0d51463 - SHA256=80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085 - SHA256=80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3 - SHA256=80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1 - SHA256=81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0 - SHA256=082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d - SHA256=82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989 - SHA256=83f7be0a13c1fccf024c31da5c68c0ea1decf4f48fc39d6e4fd324bbe789ae8a - SHA256=84bf1d0bcdf175cfe8aea2973e0373015793d43907410ae97e2071b2c4b8e2d4 - SHA256=84df20b1d9d87e305c92e5ffae21b10b325609d59d835a954dbd8750ef5dabf4 - SHA256=86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882 - SHA256=86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219 - SHA256=88df37ede18bea511f1782c1a6c4915690b29591cf2c1bf5f52201fbbb4fa2b9 - SHA256=88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc - SHA256=89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be - SHA256=89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7 - SHA256=092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0 - SHA256=93b266f38c3c3eaab475d81597abbd7cc07943035068bb6fd670dbbe15de0131 - SHA256=93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63 - SHA256=94be67c319a67de75ebed050d5537cfaa795d72bba52f3d8cf349e7bd075410e - SHA256=95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3 - SHA256=97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd - SHA256=98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb - SHA256=98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8 - SHA256=99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1 - SHA256=119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280 - SHA256=131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6 - SHA256=133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743 - SHA256=146d77e80ca70ea5cb17bfc9a5cea92334f809cbdc87a51c2d10b8579a4b9c88 - SHA256=159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980 - SHA256=175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347 - SHA256=221dfbc74bbb255b0879360ccc71a74b756b2e0f16e9386b38a9ce9d4e2e34f9 - SHA256=263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24 - SHA256=0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5 - SHA256=316a27e2bdb86222bc7c8af4e5472166b02aec7f3f526901ce939094e5861f6d - SHA256=358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69 - SHA256=362c4f3dadc9c393682664a139d65d80e32caa2a97b6e0361dfd713a73267ecc - SHA256=399effe75d32bdab6fa0a6bffe02dbf0a59219d940b654837c3be1c0bd02e9aa - SHA256=436ccab6f62fa2d29827916e054ade7acae485b3de1d3e5c6c62d3debf1480e7 - SHA256=453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233 - SHA256=455bc98ba32adab8b47d2d89bdbadca4910f91c182ab2fc3211ba07d3784537b - SHA256=0466dac557ee161503f5dfbd3549f81ec760c3d6c7c4363a21a03e7a3f66aca8 - SHA256=475e5016c9c0f5a127896f9179a1b1577a67b357f399ab5a1e68aab07134729a - SHA256=478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0 - SHA256=496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b - SHA256=506f953bbb285aeb8af0549eb24f52f3b7af36afe740afa36735bac70573ce28 - SHA256=523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba - SHA256=525d9b51a80ca0cd4c5889a96f857e73f3a80da1ffbae59851e0f51bdfb0b6cd - SHA256=552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9 - SHA256=591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52 - SHA256=592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c - SHA256=600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0 - SHA256=607dc4c75ac7aef82ae0616a453866b3b358c6cf5c8f9d29e4d37f844306b97c - SHA256=626fae47811450d080d08c3d9fd890aa64bfecdc45eacd42a40850c1833c8763 - SHA256=654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad - SHA256=673b63b67345773cd6d66f6adcf2c753e2d949232bff818d5bb6e05786538d92 - SHA256=673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b - SHA256=677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf - SHA256=727e8ba66a8ff07bdc778eacb463b65f2d7167a6616ca2f259ea32571cacf8af - SHA256=771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd - SHA256=818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01 - SHA256=823da894b2c73ffcd39e77366b6f1abf0ae9604d9b20140a54e6d55053aadeba - SHA256=845f1e228de249fc1ddf8dc28c39d03e8ad328a6277b6502d3932e83b879a65a - SHA256=862d0ff27bb086145a33b9261142838651b0d2e1403be321145e197600eb5015 - SHA256=881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461 - SHA256=900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88 - SHA256=904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a - SHA256=909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880 - SHA256=910aa4685c735d8c07662aa04fafec463185699ad1a0cd1967b892fc33ec6c3c - SHA256=916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677 - SHA256=923ebbe8111e73d5b8ecc2db10f8ea2629a3264c3a535d01c3c118a3b4c91782 - SHA256=927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a - SHA256=950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9 - SHA256=955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad - SHA256=984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7 - SHA256=1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4 - SHA256=1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c - SHA256=1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1 - SHA256=1766fd66f846d9a21e648d649ad35d1ff94f8ca17a40a9a738444d6b8e07aacb - SHA256=1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52 - SHA256=2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d - SHA256=2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22 - SHA256=2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109 - SHA256=2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6 - SHA256=2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f - SHA256=2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2 - SHA256=3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5 - SHA256=3243aab18e273a9b9c4280a57aecef278e10bfff19abb260d7a7820e41739099 - SHA256=3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5 - SHA256=3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de - SHA256=3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a - SHA256=3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b - SHA256=3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3 - SHA256=3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838 - SHA256=4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca - SHA256=4324f3d1e4007f6499a3d0f0102cd92ed9f554332bc0b633305cd7b957ff16c8 - SHA256=4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b - SHA256=4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6 - SHA256=4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8 - SHA256=4941c4298f4560fc1e59d0f16f84bab5c060793700b82be2fd7c63735f1657a8 - SHA256=5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48 - SHA256=5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02 - SHA256=5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b - SHA256=5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c - SHA256=6071db01b50c658cf78665c24f1d21f21b4a12d16bfcfaa6813bf6bbc4d0a1e8 - SHA256=6191c20426dd9b131122fb97e45be64a4d6ce98cc583406f38473434636ddedc - SHA256=06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf - SHA256=7049f3c939efe76a5556c2a2c04386db51daf61d56b679f4868bb0983c996ebb - SHA256=7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129 - SHA256=7236c8ff33c0e5cfa956778aa7303f1979f3bf709c361399fa1ce101b7e355b8 - SHA256=7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408 - SHA256=7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca - SHA256=8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60 - SHA256=8399e5afd8e3e97139dffb1a9fb00db2186321b427f164403282217cab067c38 - SHA256=8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b - SHA256=8797d9afc7a6bb0933f100a8acbb5d0666ec691779d522ac66c66817155b1c0d - SHA256=09043c51719d4bf6405c9a7a292bb9bb3bcc782f639b708ddcc4eedb5e5c9ce9 - SHA256=9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b - SHA256=9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6 - SHA256=9790a7b9d624b2b18768bb655dda4a05a9929633cef0b1521e79e40d7de0a05b - SHA256=17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca - SHA256=17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229 - SHA256=18712a063574bfec315d58577dfe413ab45b650e54747d1e18a56c3c7337a12c - SHA256=19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758 - SHA256=26453afb1f808f64bec87a2532a9361b696c0ed501d6b973a1f1b5ae152a4d40 - SHA256=28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7 - SHA256=30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab - SHA256=37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba - SHA256=40061b30b1243be76d5283cbc8abfe007e148097d4de7337670ff1536c4c7ba1 - SHA256=42579a759f3f95f20a2c51d5ac2047a2662a2675b3fb9f46c1ed7f23393a0f00 - SHA256=42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0 - SHA256=49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668 - SHA256=54841d9f89e195196e65aa881834804fe3678f1cf6b328cab8703edd15e3ec57 - SHA256=59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347 - SHA256=65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd - SHA256=67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc - SHA256=70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4 - SHA256=72288d4978ee87ea6c8b1566dbd906107357087cef7364fb3dd1e1896d00baeb - SHA256=72322fa8bba20df6966acbcf41e83747893fd173cd29de99b5ad1a5d3bf8f2de - SHA256=76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a - SHA256=76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22 - SHA256=77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c - SHA256=78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f - SHA256=81939e5c12bd627ff268e9887d6fb57e95e6049f28921f3437898757e7f21469 - SHA256=85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94 - SHA256=86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675 - SHA256=89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10 - SHA256=092349aebdac28294dbad1656759d8461f362d1a36b01054dccf861d97beadf0 - SHA256=94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5 - SHA256=101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558 - SHA256=238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4 - SHA256=258359a7fa3d975620c9810dab3a6493972876a024135feaf3ac8482179b2e79 - SHA256=314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073 - SHA256=385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039 - SHA256=405472a8f9400a54bb29d03b436ccd58cfd6442fe686f6d2ed4f63f002854659 - SHA256=440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c - SHA256=509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6 - SHA256=543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91 - SHA256=000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b - SHA256=708016fbe22c813a251098f8f992b177b476bd1bbc48c2ed4a122ff74910a965 - SHA256=771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c - SHA256=810513b3f4c8d29afb46f71816350088caacf46f1be361af55b26f3fee4662c3 - SHA256=841335eeb6af68dce5b8b24151776281a751b95056a894991b23afae80e9f33b - SHA256=0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06 - SHA256=952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4 - SHA256=2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c - SHA256=3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf - SHA256=3390919bb28d5c36cc348f9ef23be5fa49bfd81263eb7740826e4437cbe904cd - SHA256=4422851a0a102f654e95d3b79c357ae3af1b096d7d1576663c027cfbc04abaf9 - SHA256=7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d - SHA256=7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c - SHA256=7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504 - SHA256=8939116df1d6c8fd0ebd14b2d37b3dec38a8820aa666ecd487bc1bb794f2a587 - SHA256=9778136d2441439dc470861d15d96fa21dc9f16225232cd05b76791a5e0fde6f - SHA256=16768203a471a19ebb541c942f45716e9f432985abbfbe6b4b7d61a798cea354 - SHA256=18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805 - SHA256=22418016e980e0a4a2d01ca210a17059916a4208352c1018b0079ccb19aaf86a - SHA256=36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10 - SHA256=36875562e747136313ec5db58174e5fab870997a054ca8d3987d181599c7db6a - SHA256=0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3 - SHA256=55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa - SHA256=65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3 - SHA256=65025741ecd0ef516da01319b42c2d96e13cb8d78de53fb7e39cd53ea6d58c75 - SHA256=91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c - SHA256=478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82 - SHA256=696679114f6a106ec94c21e2a33fe17af86368bcf9a796aaea37ea6e8748ad6a - SHA256=910479467ef17b9591d8d42305e7f6f247ad41c60ec890a1ffbe331f495ed135 - SHA256=8111085022bda87e5f6aa4c195e743cc6dd6a3a6d41add475d267dc6b105a69f - SHA256=9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d - SHA256=46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7 - SHA256=48891874441c6fa69e5518d98c53d83b723573e280c6c65ccfbde9039a6458c9 - SHA256=6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa - SHA256=a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1 - SHA256=a3e507e713f11901017fc328186ae98e23de7cea5594687480229f77d45848d8 - SHA256=a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad - SHA256=a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062 - SHA256=a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc - SHA256=a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200 - SHA256=a56c2a2425eb3a4260cc7fc5c8d7bed7a3b4cd2af256185f24471c668853aee8 - SHA256=a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df - SHA256=a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d - SHA256=a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5 - SHA256=a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3 - SHA256=a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e - SHA256=a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499 - SHA256=a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9 - SHA256=a7860e110f7a292d621006b7208a634504fb5be417fd71e219060381b9a891e6 - SHA256=a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e - SHA256=a9706e320179993dade519a83061477ace195daa1b788662825484813001f526 - SHA256=a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433 - SHA256=a2353030d4ea3ad9e874a0f7ff35bbfa10562c98c949d88cabab27102bbb8e48 - SHA256=a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4 - SHA256=aa9ab1195dc866270e984f1bed5e1358d6ef24c515dfdb6c2a92d1e1b94bf608 - SHA256=aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c - SHA256=aafb95a443911e4c67d4e45ffa83cca103c91b42915b81100534dc439bec0c1b - SHA256=ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89 - SHA256=ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd - SHA256=ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a - SHA256=ac3f613d457fc4d44fa27b2e0b1baa62c09415705efb5a40a4756da39b3ac165 - SHA256=ac63c26ca43701dddaa7fb1aea535d42190f88752900a03040fd5aaa24991e25 - SHA256=ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833 - SHA256=ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b - SHA256=ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173 - SHA256=ad2477632b9b07588cfe0e692f244c05fa4202975c1fe91dd3b90fa911ac6058 - SHA256=ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47 - SHA256=adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee - SHA256=ae6fb53e4d8122dba3a65e5fa59185b36c3ac9df46e82fcfb6731ab55c6395aa - SHA256=ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471 - SHA256=ae79e760c739d6214c1e314728a78a6cb6060cce206fde2440a69735d639a0a2 - SHA256=aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399 - SHA256=af095de15a16255ca1b2c27dad365dff9ac32d2a75e8e288f5a1307680781685 - SHA256=af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a - SHA256=afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508 - SHA256=b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414 - SHA256=b2ba6efeff1860614b150916a77c9278f19d51e459e67a069ccd15f985cbc0e1 - SHA256=b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29 - SHA256=b4d47ea790920a4531e3df5a4b4b0721b7fea6b49a35679f0652f1e590422602 - SHA256=b6fd51e1f57a03006953e84fd56cc2821cc19e7c77c0474e1110aabaacaf03df - SHA256=b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d - SHA256=b8b94c2646b62f6ac08f16514b6efaa9866aa3c581e4c0435a7aeafe569b2418 - SHA256=b9a4e40a5d80fedd1037eaed958f9f9efed41eb01ada73d51b5dcd86e27e0cbf - SHA256=b9b3878ddc5dfb237d38f8d25067267870afd67d12a330397a8853209c4d889c - SHA256=b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a - SHA256=b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b - SHA256=b47be212352d407d0ef7458a7161c66b47c2aec8391dd101df11e65728337a6a - SHA256=b48a309ee0960da3caaaaf1e794e8c409993aeb3a2b64809f36b97aac8a1e62a - SHA256=b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e - SHA256=b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5 - SHA256=b95b2d9b29bd25659f1c7ba5a187f8d23cde01162d9b5b1a2c4aea8f64b38441 - SHA256=b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de - SHA256=b1334a71cc73b3d0c54f62d8011bec330dfc355a239bf94a121f6e4c86a30a2e - SHA256=b1867d13a4cab66a76f4d4448824ca0cb3a176064626f9618c0c103ee3cb4f47 - SHA256=b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0 - SHA256=b61869b7945be062630f1dd4bae919aecee8927f7e1bc3954a21ff763f4c0867 - SHA256=b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704 - SHA256=b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3 - SHA256=bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa - SHA256=bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc - SHA256=bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955 - SHA256=bb68552936a6b0a68fb53ce864a6387d2698332aac10a7adfdd5a48b97027ce3 - SHA256=bc7ebd191e0991fd0865a5c956a92e63792a0bb2ff888af43f7a63bb65a22248 - SHA256=bc13adeb6bf62b1e10ef41205ef92382e6c18d6a20669d288a0b11058e533d63 - SHA256=bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f - SHA256=bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f - SHA256=bda99629ec6c522c3efcbcc9ca33688d31903146f05b37d0d3b43db81bfb3961 - SHA256=bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c - SHA256=bdcacee3695583a0ca38b9a786b9f7334bf2a9a3387e4069c8e6ca378b2791d0 - SHA256=be03e9541f56ac6ed1e81407dcd7cc85c0ffc538c3c2c2c8a9c747edbcf13100 - SHA256=be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2 - SHA256=be54f7279e69fb7651f98e91d24069dbc7c4c67e65850e486622ccbdc44d9a57 - SHA256=c1c4310e5d467d24e864177bdbfc57cb5d29aac697481bfa9c11ddbeebfd4cc8 - SHA256=c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8 - SHA256=c2fcc0fec64d5647813b84b9049d430406c4c6a7b9f8b725da21bcae2ff12247 - SHA256=c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e - SHA256=c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9 - SHA256=c9b49b52b493b53cd49c12c3fa9553e57c5394555b64e32d1208f5b96a5b8c6e - SHA256=c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8 - SHA256=c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924 - SHA256=c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26 - SHA256=c60fcff9c8e5243bbb22ec94618b9dcb02c59bb49b90c04d7d6ab3ebbd58dc3a - SHA256=c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc - SHA256=c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa - SHA256=c344e92a6d06155a217a9af7b4b35e6653665eec6569292e7b2e70f3a3027646 - SHA256=c470c9db58840149ce002f3e6003382ecf740884a683bae8f9d10831be218fa2 - SHA256=c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2 - SHA256=c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5 - SHA256=c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada - SHA256=c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c - SHA256=c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d - SHA256=c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c - SHA256=c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd - SHA256=caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab - SHA256=cb57f3a7fe9e1f8e63332c563b0a319b26c944be839eabc03e9a3277756ba612 - SHA256=cb9890d4e303a4c03095d7bc176c42dee1b47d8aa58e2f442ec1514c8f9e3cec - SHA256=cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6 - SHA256=cc383ad11e9d06047a1558ed343f389492da3ac2b84b71462aee502a2fa616c8 - SHA256=cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64 - SHA256=cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b - SHA256=cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb - SHA256=cdd2a4575a46bada4837a6153a79c14d60ee3129830717ef09e0e3efd9d00812 - SHA256=cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc - SHA256=ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2 - SHA256=cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986 - SHA256=cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b - SHA256=cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190 - SHA256=cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb - SHA256=cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40 - SHA256=cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b - SHA256=cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab - SHA256=cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c - SHA256=d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889 - SHA256=d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605 - SHA256=d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f - SHA256=d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9 - SHA256=d7bc7306cb489fe4c285bbeddc6d1a09e814ef55cf30bd5b8daf87a52396f102 - SHA256=d7ddf874304556f8a10942a29b3d387cb5155a7419f87813557fe728cb14806d - SHA256=d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0 - SHA256=d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530 - SHA256=d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482 - SHA256=d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2 - SHA256=d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f - SHA256=d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3 - SHA256=d5562fb90b0b3deb633ab335bcbd82ce10953466a428b3f27cb5b226b453eaf3 - SHA256=d5586dc1e61796a9ae5e5d1ced397874753056c3df2eb963a8916287e1929a71 - SHA256=d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476 - SHA256=d8459f7d707c635e2c04d6d6d47b63f73ba3f6629702c7a6e0df0462f6478ae2 - SHA256=d25904fbf907e19f366d54962ff543d9f53b8fdfd2416c8b9796b6a8dd430e26 - SHA256=d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e - SHA256=d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d - SHA256=d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1 - SHA256=da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24 - SHA256=da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d - SHA256=db2a9247177e8cdd50fe9433d066b86ffd2a84301aa6b2eb60f361cfff077004 - SHA256=db90e554ad249c2bd888282ecf7d8da4d1538dd364129a3327b54f8242dd5653 - SHA256=dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98 - SHA256=dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed - SHA256=dbe9f17313e1164f06401234b875fbc7f71d41dc7271de643865af1358841fef - SHA256=dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258 - SHA256=dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097 - SHA256=dd573f23d656818036fc9ae1064eda31aca86acb9bc44a6e127db3ea112a9094 - SHA256=dde6f28b3f7f2abbee59d4864435108791631e9cb4cdfb1f178e5aa9859956d8 - SHA256=de6bf572d39e2611773e7a01f0388f84fb25da6cba2f1f8b9b36ffba467de6fa - SHA256=de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c - SHA256=de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5 - SHA256=dec8a933dba04463ed9bb7d53338ff87f2c23cfb79e0e988449fc631252c9dcc - SHA256=ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d - SHA256=deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578 - SHA256=df0cc4e5c9802f8edaefeb130e375cad56b2c5490d8ebd77d8dbdcc6fdc7ecb6 - SHA256=df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15 - SHA256=dfaefd06b680f9ea837e7815fc1cc7d1f4cc375641ac850667ab20739f46ad22 - SHA256=e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b - SHA256=e2d8dd5dacc24051709f55a35184f5f99aef957a83bd358b0608b4479e1ec24f - SHA256=e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6 - SHA256=e3b257357be41a18319332df7023c4407e2b93ac4c9e0c6754032e29f3763eac - SHA256=e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918 - SHA256=e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd - SHA256=e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb - SHA256=e4c154a0073bbad3c9f8ab7218e9b3be252ae705c20c568861dae4088f17ffcc - SHA256=e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036 - SHA256=e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148 - SHA256=e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1 - SHA256=e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53 - SHA256=e5b0772be02e2bc807804874cf669e97aa36f5aff1f12fa0a631a3c7b4dd0dc8 - SHA256=e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f - SHA256=e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48 - SHA256=e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f - SHA256=e50b25d94c1771937b2f632e10eea875ac6b19c57da703d52e23ad2b6299f0ae - SHA256=e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90 - SHA256=e61a54f6d3869b43c4eceac3016df73df67cce03878c5a6167166601c5d3f028 - SHA256=e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a - SHA256=e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4 - SHA256=e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f - SHA256=e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf - SHA256=e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2 - SHA256=e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9 - SHA256=e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf - SHA256=e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa - SHA256=e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06 - SHA256=e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790 - SHA256=e81230217988f3e7ec6f89a06d231ec66039bdba340fd8ebb2bbb586506e3293 - SHA256=ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3 - SHA256=ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41 - SHA256=ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3 - SHA256=ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5 - SHA256=ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566 - SHA256=ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c - SHA256=ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282 - SHA256=ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39 - SHA256=ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7 - SHA256=ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe - SHA256=eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b - SHA256=ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850 - SHA256=ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0 - SHA256=f1c8ca232789c2f11a511c8cd95a9f3830dd719cad5aa22cb7c3539ab8cb4dc3 - SHA256=f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b - SHA256=f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe - SHA256=f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f - SHA256=f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1 - SHA256=f37d609ea1f06660d970415dd3916c4c153bb5940bf7d2beb47fa34e8a8ffbfc - SHA256=f51bdb0ad924178131c21e39a8ccd191e46b5512b0f2e1cc8486f63e84e5d960 - SHA256=f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c - SHA256=f84f8173242b95f9f3c4fea99b5555b33f9ce37ca8188b643871d261cb081496 - SHA256=f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004 - SHA256=f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439 - SHA256=f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d - SHA256=f88ebb633406a086d9cca6bc8b66a4ea940c5476529f9033a9e0463512a23a57 - SHA256=f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af - SHA256=f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960 - SHA256=f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008 - SHA256=f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145 - SHA256=f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65 - SHA256=f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35 - SHA256=f8886a9c759e0426e08d55e410b02c5b05af3c287b15970175e4874316ffaf13 - SHA256=f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b - SHA256=f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478 - SHA256=f85784fa8e7a7ec86cb3fe76435802f6bb82256e1824ed7b5d61bf075f054573 - SHA256=f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54 - SHA256=f9895458e73d4b0ef01eda347fb695bb00e6598d9f5e2506161b70ad96bb7298 - SHA256=f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b - SHA256=fa875178ae2d7604d027510b0d0a7e2d9d675e10a4c9dda2d927ee891e0bcb91 - SHA256=fafa1bb36f0ac34b762a10e9f327dcab2152a6d0b16a19697362d49a31e7f566 - SHA256=fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22 - SHA256=fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f - SHA256=fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2 - SHA256=fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c - SHA256=fcdfe570e6dc6e768ef75138033d9961f78045adca53beb6fdb520f6417e0df1 - SHA256=fd33fb2735cc5ef466a54807d3436622407287e325276fcd3ed1290c98bd0533 - SHA256=fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c - SHA256=fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03 - SHA256=fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280 - SHA256=ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7 - SHA256=ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339 - SHA256=ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5 - SHA256=ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f - - - SHA256=56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c - SHA256=06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4 - SHA256=86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62 - SHA256=06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f - SHA256=8dafe5f3d0527b66f6857559e3c81872699003e0f2ffda9202a1b5e29db2002e - SHA256=81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1 - SHA256=6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724 - SHA256=ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620 - SHA256=0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc - SHA256=c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c - SHA256=e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d - SHA256=18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7 - SHA256=139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988 - SHA256=b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427 - SHA256=1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e - SHA256=6b5cf41512255237064e9274ca8f8a3fef820c45aa6067c9c6a0e6f5751a0421 - SHA256=0d10c4b2f56364b475b60bd2933273c8b1ed2176353e59e65f968c61e93b7d99 - SHA256=ad938d15ecfd70083c474e1642a88b078c3cea02cdbddf66d4fb1c01b9b29d9a - SHA256=89698cad598a56f9e45efffd15d1841e494a2409cc12279150a03842cd6bb7f3 - SHA256=5f6fec8f7890d032461b127332759c88a1b7360aa10c6bd38482572f59d2ba8b - SHA256=fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5 - SHA256=05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4 - SHA256=6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77 - SHA256=6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f - SHA256=32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d - SHA256=fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8 - SHA256=6839fcae985774427c65fe38e773aa96ec451a412caa5354ad9e2b9b54ffe6c1 - SHA256=f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a - SHA256=7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376 - SHA256=96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc - SHA256=b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3 - SHA256=e6a7b0bc01a627a7d0ffb07faddb3a4dd96b6f5208ac26107bdaeb3ab1ec8217 - SHA256=200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a - SHA256=8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce - SHA256=c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497 - SHA256=23e89fd30a1c7db37f3ea81b779ce9acf8a4294397cbb54cff350d54afcfd931 - SHA256=575e58b62afab094c20c296604dc3b7dd2e1a50f5978d8ee24b7dca028e97316 - SHA256=5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d - SHA256=e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12 - SHA256=9bb09752cf3a464455422909edef518ac18fe63cf5e1e8d9d6c2e68db62e0c87 - SHA256=f8236fc01d4efaa48f032e301be2ebba4036b2cd945982a29046eca03944d2ae - SHA256=e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e - SHA256=9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c - SHA256=f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280 - SHA256=9c2f3e9811f7d0c7463eaa1ee6f39c23f902f3797b80891590b43bbe0fdf0e51 - SHA256=b8807e365be2813b7eccd2e4c49afb0d1e131086715638b7a6307cd7d7e9556c - SHA256=50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76 - SHA256=52d5c35325ce701516f8b04380c9fbdb78ec6bcc13b444f758fdb03d545b0677 - SHA256=7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6 - SHA256=8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104 - SHA256=8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330 - SHA256=4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4 - SHA256=88076e98d45ed3adf0c5355411fe8ca793eb7cec1a1c61f5e1ec337eae267463 - SHA256=749b0e8c8c8b7dda8c2063c708047cfe95afa0a4d86886b31a12f3018396e67c - SHA256=49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530 - SHA256=d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c - SHA256=f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d - SHA256=5c1585b1a1c956c7755429544f3596515dfdf928373620c51b0606a520c6245a - SHA256=5bc3994612624da168750455b363f2964e1861dba4f1c305df01b970ac02a7ae - SHA256=bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df - SHA256=42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25 - SHA256=f461414a2596555cece5cfee65a3c22648db0082ca211f6238af8230e41b3212 SHA256=770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a