Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
12-03-2021 16:40
General
-
Target
fires_258452962.exe
-
Size
4.5MB
-
MD5
90ce8dd992c0393eb7621e1c773b8914
-
SHA1
118efa19dc43b23b76b7d558a3f66d40f0d1b4bc
-
SHA256
3efbdb687b9cbb20fb1c2b12e567a650584ddadc598a9e580a70fe0feb14a2bb
-
SHA512
014239b2cb990c8f26e8b038d58782a562a3a2489bf2c68e2d7cb9c84d29460b1c59b0ecf4045abd40e8ea6e864e3e507f1e33a2f5afd802926b0688e25b6c84
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Blocklisted process makes network request 6 IoCs
-
Drops file in Drivers directory 3 IoCs
-
Executes dropped EXE 27 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 64 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 21 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 30 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 3 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 7 IoCs
-
Modifies system certificate store 2 TTPs 29 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fires_258452962.exe"C:\Users\Admin\AppData\Local\Temp\fires_258452962.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6EDNA.tmp\fires_258452962.tmp"C:\Users\Admin\AppData\Local\Temp\is-6EDNA.tmp\fires_258452962.tmp" /SL5="$30104,4313631,119296,C:\Users\Admin\AppData\Local\Temp\fires_258452962.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Est\odit\Et.exe"C:\Program Files (x86)\Est/\odit\Et.exe" 31a9b403cadb2d356a3db6e4467af31a3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aPRK1Qj1\vpn.exeC:\Users\Admin\AppData\Local\Temp\aPRK1Qj1\vpn.exe /silent /subid=510x31a9b403cadb2d356a3db6e4467af31a4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-LULED.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-LULED.tmp\vpn.tmp" /SL5="$10252,15170975,270336,C:\Users\Admin\AppData\Local\Temp\aPRK1Qj1\vpn.exe" /silent /subid=510x31a9b403cadb2d356a3db6e4467af31a5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap09017⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "6⤵
- Loads dropped DLL
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap09017⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies system certificate store
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\aW3SFbVV\jCiDgIXeJwaAJrKkJj8L.exeC:\Users\Admin\AppData\Local\Temp\aW3SFbVV\jCiDgIXeJwaAJrKkJj8L.exe /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\1860006078.exeC:\Users\Admin\AppData\Local\Temp\1860006078.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1310769248.exeC:\Users\Admin\AppData\Local\Temp\1310769248.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\aW3SFbVV\jCiDgIXeJwaAJrKkJj8L.exe & exit5⤵
-
C:\Windows\SysWOW64\PING.EXEping 06⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\TlwWJwwZ\G7lKwvX.exeC:\Users\Admin\AppData\Local\Temp\TlwWJwwZ\G7lKwvX.exe /quiet SILENT=1 AF=721__31a9b403cadb2d356a3db6e4467af31a4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=721__31a9b403cadb2d356a3db6e4467af31a AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\TlwWJwwZ\G7lKwvX.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\TlwWJwwZ\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1615308191 /quiet SILENT=1 AF=721__31a9b403cadb2d356a3db6e4467af31a " AF="721__31a9b403cadb2d356a3db6e4467af31a" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"5⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7DB68186DFA35E4E12475320B18C24E1 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C11581C0E98EC099A4B22EA151DCABD02⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=721__31a9b403cadb2d356a3db6e4467af31a -BF=default -uncf=default3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--anbfs"4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exeC:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x7fef5889ec0,0x7fef5889ed0,0x7fef5889ee05⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exeC:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x108,0x10c,0x110,0xdc,0x114,0x13f364e60,0x13f364e70,0x13f364e806⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1060,16434196980449646997,13959676897618945978,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1992_136070697" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1096 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1060,16434196980449646997,13959676897618945978,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1992_136070697" --mojo-platform-channel-handle=1336 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1060,16434196980449646997,13959676897618945978,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1992_136070697" --mojo-platform-channel-handle=1584 /prefetch:85⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1060,16434196980449646997,13959676897618945978,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1992_136070697" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=1816 /prefetch:15⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1060,16434196980449646997,13959676897618945978,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1992_136070697" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1352 /prefetch:25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1060,16434196980449646997,13959676897618945978,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1992_136070697" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1156 /prefetch:25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1060,16434196980449646997,13959676897618945978,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1992_136070697" --mojo-platform-channel-handle=1952 /prefetch:85⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1060,16434196980449646997,13959676897618945978,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1992_136070697" --mojo-platform-channel-handle=1984 /prefetch:85⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EXEACD3.bat" "3⤵
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1\AIPACK~1.EXE"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" cls"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEACD3.bat" "4⤵
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXEACD3.bat"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EXEAD02.bat" "3⤵
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXEAD02.bat"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEAD02.bat" "4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" cls"4⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Documents\FireSkull Hack.rar.rar1⤵
- Modifies registry class
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5ba2fa9e-55dc-6d49-4ff1-e606a28a6e22}\oemvista.inf" "9" "6d14a44ff" "00000000000005A8" "WinSta0\Default" "00000000000005AC" "208" "c:\program files (x86)\maskvpn\driver\win764"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000005EC" "00000000000005E8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:tap0901.NTamd64:tap0901.ndi:9.0.0.21:tap0901" "6d14a44ff" "00000000000005C0" "00000000000005EC" "00000000000005E8"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Documents\FireSkull Hack.rar\" -ad -an -ai#7zMap7554:98:7zEvent158561⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Documents\" -an -ai#7zMap10920:98:7zEvent71781⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Est\odit\Et.exeMD5
7249e0f3529560fc42e651f28ab106fd
SHA127a616b4ded4b54139cfd51eab9ebeadf1e66b6f
SHA25605c08274684001e2822b82293939350a2ba44b0f18a2772bb5364bfc0e13a2b3
SHA512154921a42c24c81d28702537f1209ff9d8b96706ed0502705e6113ab8d90de5ee4c2847186520dec1a8d714e945af6d0da480c11765f34e1351c39a6401ba7df
-
C:\Program Files (x86)\Est\odit\Et.exeMD5
7249e0f3529560fc42e651f28ab106fd
SHA127a616b4ded4b54139cfd51eab9ebeadf1e66b6f
SHA25605c08274684001e2822b82293939350a2ba44b0f18a2772bb5364bfc0e13a2b3
SHA512154921a42c24c81d28702537f1209ff9d8b96706ed0502705e6113ab8d90de5ee4c2847186520dec1a8d714e945af6d0da480c11765f34e1351c39a6401ba7df
-
C:\Program Files (x86)\MaskVPN\driver\win764\OemVista.infMD5
87868193626dc756d10885f46d76f42e
SHA194a5ce8ed7633ed77531b6cb14ceb1927c5cae1f
SHA256b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41
SHA51279751330bed5c16d66baf3e5212be0950f312ffd5b80b78be66eaea3cc7115f8a9472d2a43b5ce702aa044f3b45fd572775ff86572150df91cc27866f88f8277
-
C:\Program Files (x86)\MaskVPN\driver\win764\install.batMD5
3a05ce392d84463b43858e26c48f9cbf
SHA178f624e2c81c3d745a45477d61749b8452c129f1
SHA2565b56d8b121fc9a7f2d4e90edb1b29373cd2d06bac1c54ada8f6cb559b411180b
SHA5128a31fda09f0fa7779c4fb0c0629d4d446957c8aaae0595759dd2b434e84a17ecb6ffe4beff973a245caf0452a0c04a488d2ae7b232d8559f3bd1bfd68fed7cf1
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exeMD5
d10f74d86cd350732657f542df533f82
SHA1c54074f8f162a780819175e7169c43f6706ad46c
SHA256c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67
SHA5120d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exeMD5
d10f74d86cd350732657f542df533f82
SHA1c54074f8f162a780819175e7169c43f6706ad46c
SHA256c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67
SHA5120d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exeMD5
d10f74d86cd350732657f542df533f82
SHA1c54074f8f162a780819175e7169c43f6706ad46c
SHA256c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67
SHA5120d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e
-
C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.batMD5
9133a44bfd841b8849bddead9957c2c3
SHA13c1d92aa3f6247a2e7ceeaf0b811cf584ae87591
SHA256b8109f63a788470925ea267f1b6032bba281b1ac3afdf0c56412cb753df58392
SHA512d7f5f99325b9c77939735df3a61097a24613f85e7acc2d84875f78f60b0b70e3504f34d9fff222c593e1daadd9db71080a23b588fe7009ce93b5a4cbe9785545
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_79CFD3DF2894C4BFDA2ADFD6675FA18BMD5
0f5cd725d7cbb3f09f80bd32441fe113
SHA1014b88b5cf3929acd31eee5863a2d705aa8720c7
SHA2564501e17c428e51902a669585415f646eaa933f5386f598629dd05117ef70fb51
SHA51206bd105d3e2ad3951287e91de3d77cdfb8e27eb00288fae961b0f47bfb0ee9ad81a1a846d92f4d216c9d69a1d155de5b2e87444a2ac62d04bcdc887085beed8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D11549FC90445E1CE90F96A21958A17_FB353789C9BBDA933068CD2920BDF3B7MD5
562512f6351fe76fb093932872a51d5e
SHA1f05042143fe221bed38fcdbdf50d9ef2f9ce3c14
SHA256a80f0b79a13a940a301f42525daab2673500a40066a4d3ca0126e0926b075197
SHA5125bae5b862fb7e48c0a15c71857d2f2d40a1791e2b14595bf6d99f29374f96e6ac1daa6eb58e289bf518e3a234a3683cdce19655fb594394069823efa8f546a3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015MD5
61a03d15cf62612f50b74867090dbe79
SHA115228f34067b4b107e917bebaf17cc7c3c1280a8
SHA256f9e23dc21553daa34c6eb778cd262831e466ce794f4bea48150e8d70d3e6af6d
SHA5125fece89ccbbf994e4f1e3ef89a502f25a72f359d445c034682758d26f01d9f3aa20a43010b9a87f2687da7ba201476922aa46d4906d442d56eb59b2b881259d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691MD5
cfeef8ec4f80b50ddb80d4fe9540aa76
SHA1cbdf0cefa6c6841dd3bdd6d5af28b642c7ffdcf5
SHA256414f3a831fffd27f768e023eaa404aea67833f042bf95840084d94822e968562
SHA51202bc825facbc519eb6bf444230551e92283af34ea0ba6d0bea89a8edab7fde5e3d696533965fd4700c1e3ac1aee6304148d2613e154702e073d35b5035716c73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_79CFD3DF2894C4BFDA2ADFD6675FA18BMD5
d761f29579f1d2cdb08912bf78015706
SHA103d31b821e092730362a112c6ed40d6d69bde8a1
SHA256514ba09be40a3aa19d580dfd65ce69135ee7fdea4b6553ac8e0c66cdb106e7a8
SHA5123f01cac9986664fa2cfda776d73d9c2538e26afe79c1e4918c31f88d54f30ba06a80189f98ce9951ff38ac3c7670de2e64affb27887968c542278879058a8f64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D11549FC90445E1CE90F96A21958A17_FB353789C9BBDA933068CD2920BDF3B7MD5
d3475baa3886fe6d9b0267712f5e9399
SHA1bbec13db3a0922e318e6cadabed997c2aecb1b1c
SHA256df460abecda4d327af9dcdb1f5e8d4e995746eb2e249d2183b6fb42db7293a56
SHA512cbbdbf8a0e7122bed1682aaa3cce50fdd4cd8a7ff80e7918573e18470fc05d75de13739b2c672e2dd5dbcd3eb7504447de96d0988f79b478acd19b6f442dcab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
2ee4277818b332121f1469852694a41e
SHA152b94709d2c8b8fba3d38ba80a019783fd7a361e
SHA256c3597a5c97039cbbe6078f8d2bf8fc8cf5149668ffc8bb4beb6966f3e7400816
SHA5125bfcd5e64465916627e23781953a4f1234d53e08ed5e402e43cab81429b7497ae03271292dbb965a30638a4d946fc2f8f2bf3b30280dd646c305781aeb79d2e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
e9d0593bfd142b5ec99f0a695fb86c41
SHA111cdfe368d798a89e38d3b046f7d88208085de45
SHA256c23e1611ce9976e8960a87d0ea47ef8e3d7f713dcdce4f3307df4b2490bc6ebf
SHA512900e529c29ec260eeac176360667ad0e7a6e52526806189516c5d15617314cf6e17d221bf99b4bcb2705405b9c5b057541472a93dcd8595418a14551f5629b24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691MD5
7f3255307ee8bcf7462efafd995ec697
SHA1cc7c6979acefd17a3dbba5049638d5ce90f4ce66
SHA25640eb04778c1f5bd0ede8e87bce12f16be16eb10c717866436e749f8b0d2e076a
SHA5126df0524f627c0531ca0d04b44352d3070ba74ca916b60beb70dad806f4a2b991dda2b8408ddf4661166e0acdba6e82900056053101b0a37ba15306a4fdf9f7d0
-
C:\Users\Admin\AppData\Local\Temp\1860006078.exeMD5
8f42d6ac2ff0bd507f77fc6f2077ecae
SHA13f6eb11f4dc112aed5aac9fe3feb78f77e068c93
SHA256cb1c124f7c5ee7ff7e260a15a4c8dcbce9dc4d3c3f4a1bbc54fda408970d045f
SHA5122de3ab74384d24ccc5ae083dda82956d722f87e5d0b06ee183a42b92c8a881758940b773e2aa19ecb0a0b22c0b5522e60700604011f12cb2e72c06722864daa7
-
C:\Users\Admin\AppData\Local\Temp\1860006078.exeMD5
8f42d6ac2ff0bd507f77fc6f2077ecae
SHA13f6eb11f4dc112aed5aac9fe3feb78f77e068c93
SHA256cb1c124f7c5ee7ff7e260a15a4c8dcbce9dc4d3c3f4a1bbc54fda408970d045f
SHA5122de3ab74384d24ccc5ae083dda82956d722f87e5d0b06ee183a42b92c8a881758940b773e2aa19ecb0a0b22c0b5522e60700604011f12cb2e72c06722864daa7
-
C:\Users\Admin\AppData\Local\Temp\MSIED51.tmpMD5
2160822ba37161cbacff695771afa2ed
SHA187b5fd899791d245b1ed7eb5a7f0f0e8ec5cf79f
SHA2566c7fa74530bb1140309ba0803cb240bc3e54e507c4abd790cf2dd49834435bcb
SHA512061454ee65ad95f19890f7336278a72538a805f565ae80a0fe5eabca546d401eae18cf08c2274733ccc755439b7c8d8925919d0131ec0a28789e6c3bc2614011
-
C:\Users\Admin\AppData\Local\Temp\MSIEF36.tmpMD5
2160822ba37161cbacff695771afa2ed
SHA187b5fd899791d245b1ed7eb5a7f0f0e8ec5cf79f
SHA2566c7fa74530bb1140309ba0803cb240bc3e54e507c4abd790cf2dd49834435bcb
SHA512061454ee65ad95f19890f7336278a72538a805f565ae80a0fe5eabca546d401eae18cf08c2274733ccc755439b7c8d8925919d0131ec0a28789e6c3bc2614011
-
C:\Users\Admin\AppData\Local\Temp\MSIF021.tmpMD5
e922ff8f49a4734f442bcd26b4a05ba8
SHA113e0dcc761282b31a9e21118035768cf75145045
SHA256f2fd2ccb8d8412753ca7aa3d402f29b8280bbd4f7170d53f613e05f742f13a22
SHA5120d395483f4ac9af3f011990612517641d4e6734e184faa0f17b4525aab729350ad5b9737a1c0f0164ec81775a41fb21dc90b72609a7ab25a37c4d2a19f253a0e
-
C:\Users\Admin\AppData\Local\Temp\TlwWJwwZ\G7lKwvX.exeMD5
208eb0912e5b6bcd0fa6f4f3d3b6f4f9
SHA1d9f80e863a0435a991f601da93fcec3d4a813405
SHA256e7d29e072c40ce7fbe34fbf7d32d38166c56299954d33c39acfbcafb1f18e93a
SHA512d1cafd13483724fae43b81e9889a44462f51b6b16c23a30750264c8d5c435665ddacf0b10df2659fb4a7ed79efa2e89480ee1102a3d798492ba5da9d3d36e796
-
C:\Users\Admin\AppData\Local\Temp\TlwWJwwZ\G7lKwvX.exeMD5
208eb0912e5b6bcd0fa6f4f3d3b6f4f9
SHA1d9f80e863a0435a991f601da93fcec3d4a813405
SHA256e7d29e072c40ce7fbe34fbf7d32d38166c56299954d33c39acfbcafb1f18e93a
SHA512d1cafd13483724fae43b81e9889a44462f51b6b16c23a30750264c8d5c435665ddacf0b10df2659fb4a7ed79efa2e89480ee1102a3d798492ba5da9d3d36e796
-
C:\Users\Admin\AppData\Local\Temp\aPRK1Qj1\vpn.exeMD5
a9487e1960820eb2ba0019491d3b08ce
SHA1349b4568ddf57b5c6c1e4a715b27029b287b3b4a
SHA256123c95cf9e3813be75fe6d337b6a66f8c06898ae2d4b0b3e69e2e14954ff4776
SHA512dab78aff75017f039f7fee67f3967ba9dd468430f9f1ecffde07de70964131931208ee6dd97a19399d5f44d3ab8b5d21abcd3d2766b1caaf970e1bd1d69ae0dc
-
C:\Users\Admin\AppData\Local\Temp\aPRK1Qj1\vpn.exeMD5
a9487e1960820eb2ba0019491d3b08ce
SHA1349b4568ddf57b5c6c1e4a715b27029b287b3b4a
SHA256123c95cf9e3813be75fe6d337b6a66f8c06898ae2d4b0b3e69e2e14954ff4776
SHA512dab78aff75017f039f7fee67f3967ba9dd468430f9f1ecffde07de70964131931208ee6dd97a19399d5f44d3ab8b5d21abcd3d2766b1caaf970e1bd1d69ae0dc
-
C:\Users\Admin\AppData\Local\Temp\aW3SFbVV\jCiDgIXeJwaAJrKkJj8L.exeMD5
8c03063314b0aa3d6a7d26c1f6db60b4
SHA16955952347314e7e19895778af232b14a15c736d
SHA2568378458c45be220207b12b7dbeeee4fcd9a4c4f51973d828834b418ded6e781f
SHA512d55407a63928afa38612e58fef7253452cc799f8659c4a78e93ba94b2d07feb7a2e47e1294b79879b440fe5bc8ad0d8c7563a6d4e1a0e2d31aa9424c009f9839
-
C:\Users\Admin\AppData\Local\Temp\aW3SFbVV\jCiDgIXeJwaAJrKkJj8L.exeMD5
8c03063314b0aa3d6a7d26c1f6db60b4
SHA16955952347314e7e19895778af232b14a15c736d
SHA2568378458c45be220207b12b7dbeeee4fcd9a4c4f51973d828834b418ded6e781f
SHA512d55407a63928afa38612e58fef7253452cc799f8659c4a78e93ba94b2d07feb7a2e47e1294b79879b440fe5bc8ad0d8c7563a6d4e1a0e2d31aa9424c009f9839
-
C:\Users\Admin\AppData\Local\Temp\is-6EDNA.tmp\fires_258452962.tmpMD5
ce9501d639d11ab993d448910aefe479
SHA10b411ca79303059eddc490d9cfda27c135bbd9d8
SHA256b97c3a288eeac5924616e5a0746f5608741d8428bfbbcaa7cd4b41026d6256fd
SHA512945f6a1e6de5ae03dcd1e76d39320fea95c0f9fad3181bfd18770793f34573eaca9659fc9b1f765efeaa64ef75c1d5dab06438628c646d993a1ab6b6f6a3ea02
-
C:\Users\Admin\AppData\Local\Temp\is-6EDNA.tmp\fires_258452962.tmpMD5
ce9501d639d11ab993d448910aefe479
SHA10b411ca79303059eddc490d9cfda27c135bbd9d8
SHA256b97c3a288eeac5924616e5a0746f5608741d8428bfbbcaa7cd4b41026d6256fd
SHA512945f6a1e6de5ae03dcd1e76d39320fea95c0f9fad3181bfd18770793f34573eaca9659fc9b1f765efeaa64ef75c1d5dab06438628c646d993a1ab6b6f6a3ea02
-
C:\Users\Admin\AppData\Local\Temp\is-LULED.tmp\vpn.tmpMD5
08ae6b558839412d71c7e63c2ccee469
SHA18864aada0d862a58bd94bcdaedb7cd5bb7747a00
SHA25645a8436696aeff3ffd6e502ee9709dcffd4ee6967c873b89c634233dbb3b9834
SHA5121b41a4be48ba8a3cd48b11085faf1124c220fc74cea76976ce52875954f3bcfa857954d3914805db4ffdc32b562b2afbed1ed58668ed4d6e5628bf6c67a9cf75
-
C:\Users\Admin\AppData\Local\Temp\is-LULED.tmp\vpn.tmpMD5
08ae6b558839412d71c7e63c2ccee469
SHA18864aada0d862a58bd94bcdaedb7cd5bb7747a00
SHA25645a8436696aeff3ffd6e502ee9709dcffd4ee6967c873b89c634233dbb3b9834
SHA5121b41a4be48ba8a3cd48b11085faf1124c220fc74cea76976ce52875954f3bcfa857954d3914805db4ffdc32b562b2afbed1ed58668ed4d6e5628bf6c67a9cf75
-
C:\Users\Admin\AppData\Local\Temp\{5BA2F~1\tap0901.sysMD5
d765f43cbea72d14c04af3d2b9c8e54b
SHA1daebe266073616e5fc931c319470fcf42a06867a
SHA25689c5ca1440df186497ce158eb71c0c6bf570a75b6bc1880eac7c87a0250201c0
SHA512ff83225ed348aa8558fb3055ceb43863bad5cf775e410ed8acda7316b56cd5c9360e63ed71abbc8929f7dcf51fd9a948b16d58242a7a2b16108e696c11d548b2
-
C:\Users\Admin\AppData\Local\Temp\{5ba2fa9e-55dc-6d49-4ff1-e606a28a6e22}\oemvista.infMD5
87868193626dc756d10885f46d76f42e
SHA194a5ce8ed7633ed77531b6cb14ceb1927c5cae1f
SHA256b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41
SHA51279751330bed5c16d66baf3e5212be0950f312ffd5b80b78be66eaea3cc7115f8a9472d2a43b5ce702aa044f3b45fd572775ff86572150df91cc27866f88f8277
-
C:\Users\Admin\AppData\Local\Temp\{5ba2fa9e-55dc-6d49-4ff1-e606a28a6e22}\tap0901.catMD5
c757503bc0c5a6679e07fe15b93324d6
SHA16a81aa87e4b07c7fea176c8adf1b27ddcdd44573
SHA25691ebea8ad199e97832cf91ea77328ed7ff49a1b5c06ddaacb0e420097a9b079e
SHA512efd1507bc7aa0cd335b0e82cddde5f75c4d1e35490608d32f24a2bed0d0fbcac88919728e3b3312665bd1e60d3f13a325bdcef4acfddab0f8c2d9f4fb2454d99
-
C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msiMD5
3af865e33a6e36a5032bbc1e90d3bd6c
SHA1e55a9015ebca7e35025ebdc45bcc66cb2a2d7517
SHA256aa331b692e66a8c0b7dc1f79ed02a550b583d47b19d749b4dbf942aecf75e5ae
SHA512bd9cb033b4ff767a2e8a93d089be57349a8240d3c42f716c46f6a78607636d198d65b4b58c308046806be0e42177f34324508ed12faaa71465f782617b5e7cc3
-
C:\Windows\Installer\MSIF4DC.tmpMD5
2160822ba37161cbacff695771afa2ed
SHA187b5fd899791d245b1ed7eb5a7f0f0e8ec5cf79f
SHA2566c7fa74530bb1140309ba0803cb240bc3e54e507c4abd790cf2dd49834435bcb
SHA512061454ee65ad95f19890f7336278a72538a805f565ae80a0fe5eabca546d401eae18cf08c2274733ccc755439b7c8d8925919d0131ec0a28789e6c3bc2614011
-
\??\c:\PROGRA~2\maskvpn\driver\win764\tap0901.sysMD5
d765f43cbea72d14c04af3d2b9c8e54b
SHA1daebe266073616e5fc931c319470fcf42a06867a
SHA25689c5ca1440df186497ce158eb71c0c6bf570a75b6bc1880eac7c87a0250201c0
SHA512ff83225ed348aa8558fb3055ceb43863bad5cf775e410ed8acda7316b56cd5c9360e63ed71abbc8929f7dcf51fd9a948b16d58242a7a2b16108e696c11d548b2
-
\??\c:\program files (x86)\maskvpn\driver\win764\tap0901.catMD5
c757503bc0c5a6679e07fe15b93324d6
SHA16a81aa87e4b07c7fea176c8adf1b27ddcdd44573
SHA25691ebea8ad199e97832cf91ea77328ed7ff49a1b5c06ddaacb0e420097a9b079e
SHA512efd1507bc7aa0cd335b0e82cddde5f75c4d1e35490608d32f24a2bed0d0fbcac88919728e3b3312665bd1e60d3f13a325bdcef4acfddab0f8c2d9f4fb2454d99
-
\Program Files (x86)\Est\odit\Et.exeMD5
7249e0f3529560fc42e651f28ab106fd
SHA127a616b4ded4b54139cfd51eab9ebeadf1e66b6f
SHA25605c08274684001e2822b82293939350a2ba44b0f18a2772bb5364bfc0e13a2b3
SHA512154921a42c24c81d28702537f1209ff9d8b96706ed0502705e6113ab8d90de5ee4c2847186520dec1a8d714e945af6d0da480c11765f34e1351c39a6401ba7df
-
\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exeMD5
d10f74d86cd350732657f542df533f82
SHA1c54074f8f162a780819175e7169c43f6706ad46c
SHA256c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67
SHA5120d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e
-
\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exeMD5
d10f74d86cd350732657f542df533f82
SHA1c54074f8f162a780819175e7169c43f6706ad46c
SHA256c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67
SHA5120d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e
-
\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exeMD5
d10f74d86cd350732657f542df533f82
SHA1c54074f8f162a780819175e7169c43f6706ad46c
SHA256c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67
SHA5120d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e
-
\Users\Admin\AppData\Local\Temp\1860006078.exeMD5
8f42d6ac2ff0bd507f77fc6f2077ecae
SHA13f6eb11f4dc112aed5aac9fe3feb78f77e068c93
SHA256cb1c124f7c5ee7ff7e260a15a4c8dcbce9dc4d3c3f4a1bbc54fda408970d045f
SHA5122de3ab74384d24ccc5ae083dda82956d722f87e5d0b06ee183a42b92c8a881758940b773e2aa19ecb0a0b22c0b5522e60700604011f12cb2e72c06722864daa7
-
\Users\Admin\AppData\Local\Temp\MSIED51.tmpMD5
2160822ba37161cbacff695771afa2ed
SHA187b5fd899791d245b1ed7eb5a7f0f0e8ec5cf79f
SHA2566c7fa74530bb1140309ba0803cb240bc3e54e507c4abd790cf2dd49834435bcb
SHA512061454ee65ad95f19890f7336278a72538a805f565ae80a0fe5eabca546d401eae18cf08c2274733ccc755439b7c8d8925919d0131ec0a28789e6c3bc2614011
-
\Users\Admin\AppData\Local\Temp\MSIEF36.tmpMD5
2160822ba37161cbacff695771afa2ed
SHA187b5fd899791d245b1ed7eb5a7f0f0e8ec5cf79f
SHA2566c7fa74530bb1140309ba0803cb240bc3e54e507c4abd790cf2dd49834435bcb
SHA512061454ee65ad95f19890f7336278a72538a805f565ae80a0fe5eabca546d401eae18cf08c2274733ccc755439b7c8d8925919d0131ec0a28789e6c3bc2614011
-
\Users\Admin\AppData\Local\Temp\MSIF021.tmpMD5
e922ff8f49a4734f442bcd26b4a05ba8
SHA113e0dcc761282b31a9e21118035768cf75145045
SHA256f2fd2ccb8d8412753ca7aa3d402f29b8280bbd4f7170d53f613e05f742f13a22
SHA5120d395483f4ac9af3f011990612517641d4e6734e184faa0f17b4525aab729350ad5b9737a1c0f0164ec81775a41fb21dc90b72609a7ab25a37c4d2a19f253a0e
-
\Users\Admin\AppData\Local\Temp\TlwWJwwZ\G7lKwvX.exeMD5
208eb0912e5b6bcd0fa6f4f3d3b6f4f9
SHA1d9f80e863a0435a991f601da93fcec3d4a813405
SHA256e7d29e072c40ce7fbe34fbf7d32d38166c56299954d33c39acfbcafb1f18e93a
SHA512d1cafd13483724fae43b81e9889a44462f51b6b16c23a30750264c8d5c435665ddacf0b10df2659fb4a7ed79efa2e89480ee1102a3d798492ba5da9d3d36e796
-
\Users\Admin\AppData\Local\Temp\aPRK1Qj1\vpn.exeMD5
a9487e1960820eb2ba0019491d3b08ce
SHA1349b4568ddf57b5c6c1e4a715b27029b287b3b4a
SHA256123c95cf9e3813be75fe6d337b6a66f8c06898ae2d4b0b3e69e2e14954ff4776
SHA512dab78aff75017f039f7fee67f3967ba9dd468430f9f1ecffde07de70964131931208ee6dd97a19399d5f44d3ab8b5d21abcd3d2766b1caaf970e1bd1d69ae0dc
-
\Users\Admin\AppData\Local\Temp\aW3SFbVV\jCiDgIXeJwaAJrKkJj8L.exeMD5
8c03063314b0aa3d6a7d26c1f6db60b4
SHA16955952347314e7e19895778af232b14a15c736d
SHA2568378458c45be220207b12b7dbeeee4fcd9a4c4f51973d828834b418ded6e781f
SHA512d55407a63928afa38612e58fef7253452cc799f8659c4a78e93ba94b2d07feb7a2e47e1294b79879b440fe5bc8ad0d8c7563a6d4e1a0e2d31aa9424c009f9839
-
\Users\Admin\AppData\Local\Temp\is-6EDNA.tmp\fires_258452962.tmpMD5
ce9501d639d11ab993d448910aefe479
SHA10b411ca79303059eddc490d9cfda27c135bbd9d8
SHA256b97c3a288eeac5924616e5a0746f5608741d8428bfbbcaa7cd4b41026d6256fd
SHA512945f6a1e6de5ae03dcd1e76d39320fea95c0f9fad3181bfd18770793f34573eaca9659fc9b1f765efeaa64ef75c1d5dab06438628c646d993a1ab6b6f6a3ea02
-
\Users\Admin\AppData\Local\Temp\is-E9CGV.tmp\ApiTool.dllMD5
b5e330f90e1bab5e5ee8ccb04e679687
SHA13360a68276a528e4b651c9019b6159315c3acca8
SHA2562900d536923740fe530891f481e35e37262db5283a4b98047fe5335eacaf3441
SHA51241ab8f239cfff8e5ddcff95cdf2ae11499d57b2ebe8f0786757a200047fd022bfd6975be95e9cfcc17c405e631f069b9951591cf74faf3e6a548191e63a8439c
-
\Users\Admin\AppData\Local\Temp\is-E9CGV.tmp\InnoCallback.dllMD5
1c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
\Users\Admin\AppData\Local\Temp\is-E9CGV.tmp\_isetup\_shfoldr.dllMD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-E9CGV.tmp\_isetup\_shfoldr.dllMD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-E9CGV.tmp\botva2.dllMD5
ef899fa243c07b7b82b3a45f6ec36771
SHA14a86313cc8766dcad1c2b00c2b8f9bbe0cf8bbbe
SHA256da7d0368712ee419952eb2640a65a7f24e39fb7872442ed4d2ee847ec4cfde77
SHA5123f98b5ad9adfad2111ebd1d8cbab9ae423d624d1668cc64c0bfcdbfedf30c1ce3ea6bc6bcf70f7dd1b01172a4349e7c84fb75d395ee5af73866574c1d734c6e8
-
\Users\Admin\AppData\Local\Temp\is-E9CGV.tmp\libMaskVPN.dllMD5
3d88c579199498b224033b6b66638fb8
SHA16f6303288e2206efbf18e4716095059fada96fc4
SHA2565bccb86319fc90210d065648937725b14b43fa0c96f9da56d9984e027adebbc3
SHA5129740c521ed38643201ed4c2574628454723b9213f12e193c11477e64a2c03daa58d2a48e70df1a7e9654c50a80049f3cf213fd01f2b74e585c3a86027db19ec9
-
\Users\Admin\AppData\Local\Temp\is-IKT60.tmp\_isetup\_iscrypt.dllMD5
a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-IKT60.tmp\_isetup\_isdecmp.dllMD5
a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
\Users\Admin\AppData\Local\Temp\is-IKT60.tmp\_isetup\_shfoldr.dllMD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-IKT60.tmp\_isetup\_shfoldr.dllMD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-LULED.tmp\vpn.tmpMD5
08ae6b558839412d71c7e63c2ccee469
SHA18864aada0d862a58bd94bcdaedb7cd5bb7747a00
SHA25645a8436696aeff3ffd6e502ee9709dcffd4ee6967c873b89c634233dbb3b9834
SHA5121b41a4be48ba8a3cd48b11085faf1124c220fc74cea76976ce52875954f3bcfa857954d3914805db4ffdc32b562b2afbed1ed58668ed4d6e5628bf6c67a9cf75
-
\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\decoder.dllMD5
fddee40c512e40f05ed565f1a00e85f1
SHA12f0096e7418d19d8df8515f9899e87ca6671b517
SHA256f7ab1e969edfece0c89bd4d79ce3cc70ff46e460da4d9d90b1ef91f3a0716265
SHA5126845cb0f841572e7c516b8401eab4aadcdd492613ffb09ccd07ce254d6748ddde4b3b566b3e8fb2ea841c8fd5977d6f1fddaadda81e0f39d8736323e750c8127
-
\Windows\Installer\MSIF4DC.tmpMD5
2160822ba37161cbacff695771afa2ed
SHA187b5fd899791d245b1ed7eb5a7f0f0e8ec5cf79f
SHA2566c7fa74530bb1140309ba0803cb240bc3e54e507c4abd790cf2dd49834435bcb
SHA512061454ee65ad95f19890f7336278a72538a805f565ae80a0fe5eabca546d401eae18cf08c2274733ccc755439b7c8d8925919d0131ec0a28789e6c3bc2614011
-
memory/272-25-0x0000000000000000-mapping.dmp
-
memory/272-40-0x0000000000401000-0x0000000000417000-memory.dmpFilesize
88KB
-
memory/760-647-0x00000000030E0000-0x00000000030F1000-memory.dmpFilesize
68KB
-
memory/760-646-0x0000000000000000-mapping.dmp
-
memory/844-617-0x0000000000000000-mapping.dmp
-
memory/848-1430-0x0000000000000000-mapping.dmp
-
memory/848-1431-0x0000000002FE0000-0x0000000002FF1000-memory.dmpFilesize
68KB
-
memory/848-1432-0x0000000002FE0000-0x0000000002FF1000-memory.dmpFilesize
68KB
-
memory/852-619-0x0000000000000000-mapping.dmp
-
memory/904-4-0x0000000000000000-mapping.dmp
-
memory/904-14-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/904-11-0x0000000074AF1000-0x0000000074AF3000-memory.dmpFilesize
8KB
-
memory/1032-73-0x0000000000000000-mapping.dmp
-
memory/1072-629-0x00000000030B0000-0x00000000030C1000-memory.dmpFilesize
68KB
-
memory/1072-626-0x0000000000000000-mapping.dmp
-
memory/1108-76-0x0000000000000000-mapping.dmp
-
memory/1120-618-0x0000000000000000-mapping.dmp
-
memory/1292-635-0x0000000000000000-mapping.dmp
-
memory/1344-33-0x0000000000000000-mapping.dmp
-
memory/1448-620-0x0000000000000000-mapping.dmp
-
memory/1452-61-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmpFilesize
8KB
-
memory/1516-41-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1516-46-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1516-31-0x0000000000000000-mapping.dmp
-
memory/1516-56-0x0000000002120000-0x0000000002121000-memory.dmpFilesize
4KB
-
memory/1528-69-0x0000000000000000-mapping.dmp
-
memory/1556-645-0x0000000000000000-mapping.dmp
-
memory/1740-13-0x0000000000401000-0x0000000000412000-memory.dmpFilesize
68KB
-
memory/1740-2-0x00000000766F1000-0x00000000766F3000-memory.dmpFilesize
8KB
-
memory/1816-1157-0x0000000004590000-0x00000000045A1000-memory.dmpFilesize
68KB
-
memory/1816-655-0x0000000004590000-0x00000000045A1000-memory.dmpFilesize
68KB
-
memory/1816-651-0x0000000000000000-mapping.dmp
-
memory/1816-653-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1816-656-0x0000000004180000-0x0000000004191000-memory.dmpFilesize
68KB
-
memory/1816-654-0x0000000004180000-0x0000000004191000-memory.dmpFilesize
68KB
-
memory/1816-1156-0x0000000004180000-0x0000000004191000-memory.dmpFilesize
68KB
-
memory/1816-1338-0x0000000004180000-0x0000000004191000-memory.dmpFilesize
68KB
-
memory/1816-1158-0x0000000004180000-0x0000000004191000-memory.dmpFilesize
68KB
-
memory/1824-641-0x0000000000000000-mapping.dmp
-
memory/1824-642-0x0000000003C90000-0x0000000003CA1000-memory.dmpFilesize
68KB
-
memory/1844-49-0x0000000000000000-mapping.dmp
-
memory/1844-57-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1844-58-0x0000000003AF0000-0x0000000003AF4000-memory.dmpFilesize
16KB
-
memory/1864-63-0x0000000000000000-mapping.dmp
-
memory/1964-42-0x000007FEF7730000-0x000007FEF79AA000-memory.dmpFilesize
2.5MB
-
memory/1980-20-0x00000000051A0000-0x00000000051B1000-memory.dmpFilesize
68KB
-
memory/1980-23-0x0000000004590000-0x0000000004591000-memory.dmpFilesize
4KB
-
memory/1980-21-0x00000000055B0000-0x00000000055C1000-memory.dmpFilesize
68KB
-
memory/1980-16-0x0000000000000000-mapping.dmp
-
memory/1980-22-0x0000000000400000-0x0000000001644000-memory.dmpFilesize
18.3MB
-
memory/1984-62-0x0000000000000000-mapping.dmp
-
memory/1992-640-0x0000000007380000-0x0000000007381000-memory.dmpFilesize
4KB
-
memory/1992-615-0x0000000000000000-mapping.dmp
-
memory/2084-86-0x0000000000000000-mapping.dmp
-
memory/2084-612-0x0000000002360000-0x0000000002364000-memory.dmpFilesize
16KB
-
memory/2104-643-0x0000000000000000-mapping.dmp
-
memory/2152-143-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2152-144-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/2152-150-0x00000000346C0000-0x00000000346D1000-memory.dmpFilesize
68KB
-
memory/2152-149-0x0000000034AD0000-0x0000000034AE1000-memory.dmpFilesize
68KB
-
memory/2152-148-0x00000000346C0000-0x00000000346D1000-memory.dmpFilesize
68KB
-
memory/2152-158-0x00000000346C0000-0x00000000346D1000-memory.dmpFilesize
68KB
-
memory/2152-159-0x00000000346C0000-0x00000000346D1000-memory.dmpFilesize
68KB
-
memory/2152-315-0x00000000346C0000-0x00000000346D1000-memory.dmpFilesize
68KB
-
memory/2152-316-0x0000000034CD0000-0x0000000034CE1000-memory.dmpFilesize
68KB
-
memory/2152-317-0x00000000346C0000-0x00000000346D1000-memory.dmpFilesize
68KB
-
memory/2152-649-0x0000000034CD0000-0x0000000034CE1000-memory.dmpFilesize
68KB
-
memory/2152-146-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2152-648-0x0000000034CD0000-0x0000000034CE1000-memory.dmpFilesize
68KB
-
memory/2172-636-0x0000000000000000-mapping.dmp
-
memory/2276-103-0x00000000719F0000-0x00000000720DE000-memory.dmpFilesize
6.9MB
-
memory/2276-100-0x0000000000000000-mapping.dmp
-
memory/2276-110-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/2276-108-0x0000000000870000-0x0000000000871000-memory.dmpFilesize
4KB
-
memory/2324-104-0x0000000000000000-mapping.dmp
-
memory/2332-610-0x0000000000000000-mapping.dmp
-
memory/2424-638-0x0000000000000000-mapping.dmp
-
memory/2424-639-0x0000000003CB0000-0x0000000003CC1000-memory.dmpFilesize
68KB
-
memory/2460-624-0x0000000000000000-mapping.dmp
-
memory/2480-127-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2480-128-0x000000000041F38A-mapping.dmp
-
memory/2480-129-0x00000000719F0000-0x00000000720DE000-memory.dmpFilesize
6.9MB
-
memory/2480-130-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2480-147-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB
-
memory/2480-634-0x0000000000000000-mapping.dmp
-
memory/2520-613-0x0000000000000000-mapping.dmp
-
memory/2560-621-0x0000000000000000-mapping.dmp
-
memory/2592-623-0x0000000000000000-mapping.dmp
-
memory/2604-633-0x0000000000000000-mapping.dmp
-
memory/2660-132-0x0000000000000000-mapping.dmp
-
memory/2672-616-0x0000000000000000-mapping.dmp
-
memory/2676-133-0x0000000000000000-mapping.dmp
-
memory/2756-136-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/2756-134-0x0000000000000000-mapping.dmp
-
memory/2844-631-0x0000000000000000-mapping.dmp
-
memory/2844-632-0x0000000002F00000-0x0000000002F11000-memory.dmpFilesize
68KB
-
memory/2864-627-0x0000000000000000-mapping.dmp
-
memory/2864-630-0x0000000002EA0000-0x0000000002EB1000-memory.dmpFilesize
68KB
-
memory/2892-628-0x0000000003AF0000-0x0000000003B01000-memory.dmpFilesize
68KB
-
memory/2892-625-0x0000000000000000-mapping.dmp
-
memory/2936-140-0x0000000004610000-0x0000000004611000-memory.dmpFilesize
4KB
-
memory/2936-111-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2936-112-0x000000000041F39E-mapping.dmp
-
memory/2936-113-0x00000000719F0000-0x00000000720DE000-memory.dmpFilesize
6.9MB
-
memory/2936-114-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2992-115-0x0000000000000000-mapping.dmp
-
memory/2992-126-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/2992-125-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/2992-124-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/3020-644-0x0000000000000000-mapping.dmp
-
memory/3064-117-0x0000000000000000-mapping.dmp
-
memory/3064-118-0x00000000719F0000-0x00000000720DE000-memory.dmpFilesize
6.9MB
-
memory/3064-119-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/3064-123-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB