ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9

Analysis

max time kernel
111s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-05-2022 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9.exe
Size

10.4MB
MD5

51fc6af2fca0debc1b2a9cd657c51f08
SHA1

717598e0090355ea6879466379672318f32f0338
SHA256

ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9
SHA512

b98935bfa8b76c503e41cd1040c95dde20b6cbd15ed1c90656725098c2d48afcf7ba65d19e6fe6287622dec9b5bb39c2a9e6dd2c0fab8136ad3dbc1874d122a4

Score

10^/10

discovery persistence ransomware

Malware Config

Extracted

Path

C:\Program Files\OpenVPN\doc\openvpn.8.html

Ransom Note

Content-type: text/html; charset=UTF-8 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <HTML><HEAD><TITLE>Man page of openvpn</TITLE> </HEAD><BODY> <H1>openvpn</H1> Section: Maintenance Commands (8) Updated: 28 February 2018 <A HREF="#index">Index</A> <A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR> <A NAME="lbAB"> </A> <H2>NAME</H2> openvpn - secure IP tunnel daemon. <A NAME="lbAC"> </A> <H2>SYNOPSIS</H2> openvpn [ options ... ] <A NAME="lbAD"> </A> <H2>INTRODUCTION</H2> OpenVPN is an open source VPN daemon by James Yonan. Because OpenVPN tries to be a universal VPN tool offering a great deal of flexibility, there are a lot of options on this manual page. If you're new to OpenVPN, you might want to skip ahead to the examples section where you will see how to construct simple VPNs on the command line without even needing a configuration file. Also note that there's more documentation and examples on the OpenVPN web site: <A HREF="http://openvpn.net/">http://openvpn.net/</A> And if you would like to see a shorter version of this manual, see the openvpn usage message which can be obtained by running openvpn without any parameters. <A NAME="lbAE"> </A> <H2>DESCRIPTION</H2> OpenVPN is a robust and highly flexible VPN daemon. OpenVPN supports SSL/TLS security, ethernet bridging, TCP or UDP tunnel transport through proxies or NAT, support for dynamic IP addresses and DHCP, scalability to hundreds or thousands of users, and portability to most major OS platforms. OpenVPN is tightly bound to the OpenSSL library, and derives much of its crypto capabilities from it. OpenVPN supports conventional encryption using a pre-shared secret key (Static Key mode) or public key security (SSL/TLS mode) using client & server certificates. OpenVPN also supports non-encrypted TCP/UDP tunnels. OpenVPN is designed to work with the TUN/TAP virtual networking interface that exists on most platforms. Overall, OpenVPN aims to offer many of the key features of IPSec but with a relatively lightweight footprint. <A NAME="lbAF"> </A> <H2>OPTIONS</H2> OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix can be removed when an option is placed in a configuration file. <DL COMPACT> <DT>--help <DD> Show options. <DT>--config file <DD> Load additional config options from file where each line corresponds to one command line option, but with the leading '--' removed. If --config file is the only option to the openvpn command, the --config can be removed, and the command can be given as openvpn file Note that configuration files can be nested to a reasonable depth. Double quotation or single quotation characters ("", '') can be used to enclose single parameters containing whitespace, and "#" or ";" characters in the first column can be used to denote comments. Note that OpenVPN 2.0 and higher performs backslash-based shell escaping for characters not in single quotations, so the following mappings should be observed: <PRE> \\ Maps to a single backslash character (\). \" Pass a literal doublequote character ("), don't interpret it as enclosing a parameter. \[SPACE] Pass a literal space or tab character, don't interpret it as a parameter delimiter. </PRE> For example on Windows, use double backslashes to represent pathnames: <PRE> secret "c:\\OpenVPN\\secret.key" </PRE> For examples of configuration files, see <A HREF="http://openvpn.net/examples.html">http://openvpn.net/examples.html</A> Here is an example configuration file: <PRE> # # Sample OpenVPN configuration file for # using a pre-shared static key. # # '#' or ';' may be used to delimit comments. # Use a dynamic tun device. dev tun # Our remote peer remote mypeer.mydomain # 10.1.0.1 is our local VPN endpoint # 10.1.0.2 is our remote VPN endpoint ifconfig 10.1.0.1 10.1.0.2 # Our pre-shared static key secret static.key </PRE> </DL> <A NAME="lbAG"> </A> <H3>Tunnel Options:</H3> <DL COMPACT> <DT>--mode m <DD> Set OpenVPN major mode. By default, OpenVPN runs in point-to-point mode ("p2p"). OpenVPN 2.0 introduces a new mode ("server") which implements a multi-client server capability. <DT>--local host <DD> Local host name or IP address for bind. If specified, OpenVPN will bind to this address only. If unspecified, OpenVPN will bind to all interfaces. <DT>--remote host [port] [proto] <DD> Remote host name or IP address. On the client, multiple --remote options may be specified for redundancy, each referring to a different OpenVPN server. Specifying multiple --remote options for this purpose is a special case of the more general connection-profile feature. See the <connection> documentation below. The OpenVPN client will try to connect to a server at host:port in the order specified by the list of --remote options. proto indicates the protocol to use when connecting with the remote, and may be "tcp" or "udp". For forcing IPv4 or IPv6 connection suffix tcp or udp with 4/6 like udp4/udp6/tcp4/tcp6. The client will move on to the next host in the list, in the event of connection failure. Note that at any given time, the OpenVPN client will at most be connected to one server. Note that since UDP is connectionless, connection failure is defined by the --ping and --ping-restart options. Note the following corner case: If you use multiple --remote options, AND you are dropping root privileges on the client with --user and/or --group, AND the client is running a non-Windows OS, if the client needs to switch to a different server, and that server pushes back different TUN/TAP or route settings, the client may lack the necessary privileges to close and reopen the TUN/TAP interface. This could cause the client to exit with a fatal error. If --remote is unspecified, OpenVPN will listen for packets from any IP address, but will not act on those packets unless they pass all authentication tests. This requirement for authentication is binding on all potential peers, even those from known and supposedly trusted IP addresses (it is very easy to forge a source IP address on a UDP packet). When used in TCP mode, --remote will act as a filter, rejecting connections from any host which does not match host. If host is a DNS name which resolves to multiple IP addresses, OpenVPN will try them in the order that the system getaddrinfo() presents them, so priorization and DNS randomization is done by the system library. Unless an IP version is forced by the protocol specification (4/6 suffix), OpenVPN will try both IPv4 and IPv6 addresses, in the order getaddrinfo() returns them. <DT>--remote-random-hostname <DD> Prepend a random string (6 bytes, 12 hex characters) to hostname to prevent DNS caching. For example, "foo.bar.gov" would be modified to "<random-chars>.foo.bar.gov". <DT><connection> <DD> Define a client connection profile. Client connection profiles are groups of OpenVPN options that describe how to connect to a given OpenVPN server. Client connection profiles are specified within an OpenVPN configuration file, and each profile is bracketed by <connection> and </connection>. An OpenVPN client will try each connection profile sequentially until it achieves a successful connection. --remote-random can be used to initially "scramble" the connection list. Here is an example of connection profile usage: <PRE> client dev tun <connection> remote 198.19.34.56 1194 udp </connection> <connection> remote 198.19.34.56 443 tcp </connection> <connection> remote 198.19.34.56 443 tcp http-proxy 192.168.0.8 8080 </connection> <connection> remote 198.19.36.99 443 tcp http-proxy 192.168.0.8 8080 </connection> persist-key persist-tun pkcs12 client.p12 remote-cert-tls server verb 3 </PRE> First we try to connect to a server at 198.19.34.56:1194 using UDP. If that fails, we then try to connect to 198.19.34.56:443 using TCP. If that also fails, then try connecting through an HTTP proxy at 192.168.0.8:8080 to 198.19.34.56:443 using TCP. Finally, try to connect through the same proxy to a server at 198.19.36.99:443 using TCP. The following OpenVPN options may be used inside of a <connection> block: bind, connect-retry, connect-retry-max, connect-timeout, explicit-exit-notify, float, fragment, http-proxy, http-proxy-option, link-mtu, local, lport, mssfix, mtu-disc, nobind, port, proto, remote, rport, socks-proxy, tun-mtu and tun-mtu-extra. A defaulting mechanism exists for specifying options to apply to all <connection> profiles. If any of the above options (with the exception of remote ) appear outside of a <connection> block, but in a configuration file which has one or more <connection> blocks, the option setting will be used as a default for <connection> blocks which follow it in the configuration file. For example, suppose the nobind option were placed in the sample configuration file above, near the top of the file, before the first <connection> block. The effect would be as if nobind were declared in all <connection> blocks below it. <DT>--proto-force p <DD> When iterating through connection profiles, only consider profiles using protocol p ('tcp'|'udp'). <DT>--remote-random <DD> When multiple --remote address/ports are specified, or if connection profiles are being used, initially randomize the order of the list as a kind of basic load-balancing measure. <DT>--proto p <DD> Use protocol p for communicating with remote host. p can be udp, tcp-client, or tcp-server. The default protocol is udp when --proto is not specified. For UDP operation, --proto udp should be specified on both peers. For TCP operation, one peer must use --proto tcp-server and the other must use --proto tcp-client. A peer started with tcp-server will wait indefinitely for an incoming connection. A peer started with tcp-client will attempt to connect, and if that fails, will sleep for 5 seconds (adjustable via the --connect-retry option) and try again infinite or up to N retries (adjustable via the --connect-retry-max option). Both TCP client and server will simulate a SIGUSR1 restart signal if either side resets the connection. OpenVPN is designed to operate optimally over UDP, but TCP capability is provided for situations where UDP cannot be used. In comparison with UDP, TCP will usually be somewhat less efficient and less robust when used over unreliable or congested networks. This article outlines some of problems with tunneling IP over TCP: <A HREF="http://sites.inka.de/sites/bigred/devel/tcp-tcp.html">http://sites.inka.de/sites/bigred/devel/tcp-tcp.html</A> There are certain cases, however, where using TCP may be advantageous from a security and robustness perspective, such as tunneling non-IP or application-level UDP protocols, or tunneling protocols which don't possess a built-in reliability layer. <DT>--connect-retry n [max] <DD> Wait n seconds between connection attempts (default=5). Repeated reconnection attempts are slowed down after 5 retries per remote by doubling the wait time after each unsuccessful attempt. The optional argument max specifies the maximum value of wait time in seconds at which it gets capped (default=300). <DT>--connect-retry-max n <DD> n specifies the number of times each --remote or <connection> entry is tried. Specifying n as one would try each entry exactly once. A successful connection resets the counter. (default=unlimited). <DT>--show-proxy-settings <DD> Show sensed HTTP or SOCKS proxy settings. Currently, only Windows clients support this option. <DT>--http-proxy server port [authfile|'auto'|'auto-nct'] [auth-method] <DD> Connect to remote host through an HTTP proxy at address server and port port. If HTTP Proxy-Authenticate is required, authfile is a file containing a username and password on 2 lines, or "stdin" to prompt from console. Its content can also be specified in the config file with the --http-proxy-user-pass option. (See section on inline files) auth-method should be one of "none", "basic", or "ntlm". HTTP Digest authentication is supported as well, but only via the auto or auto-nct flags (below). The auto flag causes OpenVPN to automatically determine the auth-method and query stdin or the management interface for username/password credentials, if required. This flag exists on OpenVPN 2.1 or higher. The auto-nct flag (no clear-text auth) instructs OpenVPN to automatically determine the authentication method, but to reject weak authentication protocols such as HTTP Basic Authentication. <DT>--http-proxy-option type [parm] <DD> Set extended HTTP proxy options. Repeat to set multiple options. VERSION version -- Set HTTP version number to version (default=1.0). AGENT user-agent -- Set HTTP "User-Agent" string to user-agent. CUSTOM-HEADER name content -- Adds the custom Header with name as name and content as the content of the custom HTTP header. <DT>--socks-proxy server [port] [authfile] <DD> Connect to remote host through a Socks5 proxy at address server and port port (default=1080). authfile (optional) is a file containing a username and password on 2 lines, or "stdin" to prompt from console. <DT>--resolv-retry n <DD> If hostname resolve fails for --remote, retry resolve for n seconds before failing. Set n to "infinite" to retry indefinitely. By default, --resolv-retry infinite is enabled. You can disable by setting n=0. <DT>--float <DD> Allow remote peer to change its IP address and/or port number, such as due to DHCP (this is the default if --remote is not used). --float when specified with --remote allows an OpenVPN session to initially connect to a peer at a known address, however if packets arrive from a new address and pass all authentication tests, the new address will take control of the session. This is useful when you are connecting to a peer which holds a dynamic address such as a dial-in user or DHCP client. Essentially, --float tells OpenVPN to accept authenticated packets from any address, not only the address which was specified in the --remote option. <DT>--ipchange cmd <DD> Run command cmd when our remote ip-address is initially authenticated or changes. cmd consists of a path to script (or executable program), optionally followed by arguments. The path and arguments may be single- or double-quoted and/or escaped using a backslash, and should be separated by one or more spaces. When cmd is executed two arguments are appended after any arguments specified in cmd , as follows: cmd ip_address port_number Don't use --ipchange in --mode server mode. Use a --client-connect script instead. See

Emails

HREF="mailto:[email protected]">[email protected]</A>

HREF="mailto:[email protected]">[email protected]</A>

HREF="mailto:[email protected]">[email protected]</A>&gt

URLs

http-proxy

Signatures

Drops file in Drivers directory 3 IoCs

Processes:

DrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SETA009.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SETA009.tmp	DrvInst.exe

Executes dropped EXE 8 IoCs

Processes:

hidec.exedevcon64.exedevcon64.exeopenvpn-install-2.4.8-I602-Win10.exetap-windows.exetapinstall.exetapinstall.exeopenvpnserv.exe

pid	process
4644	hidec.exe
3168	devcon64.exe
3292	devcon64.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
1128	tap-windows.exe
972	tapinstall.exe
4688	tapinstall.exe
3328	openvpnserv.exe

Modifies Installed Components in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9.exe

Loads dropped DLL 41 IoCs

Processes:

openvpn-install-2.4.8-I602-Win10.exetap-windows.exe

pid	process
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
1128	tap-windows.exe
1128	tap-windows.exe
1128	tap-windows.exe
1128	tap-windows.exe
1128	tap-windows.exe
1128	tap-windows.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 16 IoCs

Processes:

DrvInst.exetapinstall.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e87902c0-d9c4-7542-bbfc-7fa63d10ee4d}\tap0901.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\oemvista.PNF	tapinstall.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e87902c0-d9c4-7542-bbfc-7fa63d10ee4d}\SET90B7.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{e87902c0-d9c4-7542-bbfc-7fa63d10ee4d}\SET90B7.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{e87902c0-d9c4-7542-bbfc-7fa63d10ee4d}\SET90B8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e87902c0-d9c4-7542-bbfc-7fa63d10ee4d}\SET90B9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e87902c0-d9c4-7542-bbfc-7fa63d10ee4d}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e87902c0-d9c4-7542-bbfc-7fa63d10ee4d}\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\oemvista.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e87902c0-d9c4-7542-bbfc-7fa63d10ee4d}\oemvista.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e87902c0-d9c4-7542-bbfc-7fa63d10ee4d}\SET90B8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{e87902c0-d9c4-7542-bbfc-7fa63d10ee4d}\SET90B9.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe

Drops file in Program Files directory 64 IoCs

Processes:

openvpn-install-2.4.8-I602-Win10.exexcopy.exetap-windows.exe

description	ioc	process
File created	C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\bin\devcon32.exe	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\config	xcopy.exe
File created	C:\Program Files\OpenVPN\bin\openvpnserv.exe	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\config\README.txt	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\Uninstall.exe	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\bin\devcon64.exe	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\tap\x32\oemwin2k.inf	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\tap\x64\oemwin2k.inf	xcopy.exe
File created	C:\Program Files\TAP-Windows\bin\addtap.bat	tap-windows.exe
File opened for modification	C:\Program Files\OpenVPN\bin\devcon64.exe	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\tap\x32\tap0901.sys	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\tap\x64	xcopy.exe
File created	C:\Program Files\OpenVPN\sample-config\sample.ovpn	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\log\README.txt	openvpn-install-2.4.8-I602-Win10.exe
File opened for modification	C:\Program Files\OpenVPN\hidec.exe	xcopy.exe
File created	C:\Program Files\OpenVPN\sample-config\server.ovpn	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\TAP-Windows\Uninstall.exe	tap-windows.exe
File created	C:\Program Files\TAP-Windows\license.txt	tap-windows.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-gui.exe	openvpn-install-2.4.8-I602-Win10.exe
File opened for modification	C:\Program Files\OpenVPN\bin\tap\x32\tap0901.cat	xcopy.exe
File created	C:\Program Files\OpenVPN\bin\tap\x64\tap0901.cat	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\tap\x64\tap0901.cat	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\devcon32.exe	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\tapadd.au3	xcopy.exe
File created	C:\Program Files\OpenVPN\bin\openvpn.exe	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\doc\INSTALL-win32.txt	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\doc\openvpn.8.html	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\icon.ico	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\hidec.exe	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\autoit3.exe	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\tapdel.bat	xcopy.exe
File created	C:\Program Files\TAP-Windows\bin\deltapall.bat	tap-windows.exe
File created	C:\Program Files\TAP-Windows\icon.ico	tap-windows.exe
File opened for modification	C:\Program Files\OpenVPN	xcopy.exe
File created	C:\Program Files\OpenVPN\openvpn.ico	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\openvpn-run.exe	xcopy.exe
File created	C:\Program Files\TAP-Windows\bin\tapinstall.exe	tap-windows.exe
File created	C:\Program Files\OpenVPN\bin\tap\x32\tap0901.sys	xcopy.exe
File created	C:\Program Files\OpenVPN\bin\tap\x64\oemwin2k.inf	xcopy.exe
File created	C:\Program Files\OpenVPN\sample-config\client.ovpn	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\bin\openvpnserv2.exe	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\bin\liblzo2-2.dll	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-run.exe	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\tap	xcopy.exe
File created	C:\Program Files\OpenVPN\bin\tapadd.au3	xcopy.exe
File created	C:\Program Files\OpenVPN\bin\tapadd.cer	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\tap\x64\tap0901.sys	xcopy.exe
File created	C:\Program Files\TAP-Windows\driver\tap0901.sys	tap-windows.exe
File created	C:\Program Files\OpenVPN\bin\openssl.exe	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\bin\libcrypto-1_1-x64.dll	openvpn-install-2.4.8-I602-Win10.exe
File created	C:\Program Files\OpenVPN\doc\license.txt	openvpn-install-2.4.8-I602-Win10.exe
File opened for modification	C:\Program Files\OpenVPN\openvpn.ico	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\tapadd.bat	xcopy.exe
File created	C:\Program Files\TAP-Windows\driver\tap0901.cat	tap-windows.exe
File created	C:\Program Files\OpenVPN\bin\autoit3.exe	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\tapadd.cer	xcopy.exe
File opened for modification	C:\Program Files\OpenVPN\bin\tap\x32	xcopy.exe
File created	C:\Program Files\OpenVPN\bin\tap\x64\tap0901.sys	xcopy.exe
File created	C:\Program Files\OpenVPN\bin\tap\x32\tap0901.cat	xcopy.exe
File created	C:\Program Files\OpenVPN\config\asdushkin.ovpn	xcopy.exe
File created	C:\Program Files\TAP-Windows\driver\OemVista.inf	tap-windows.exe
File created	C:\Program Files\OpenVPN\bin\libssl-1_1-x64.dll	openvpn-install-2.4.8-I602-Win10.exe
File opened for modification	C:\Program Files\OpenVPN\bin	xcopy.exe

Drops file in Windows directory 6 IoCs

Processes:

DrvInst.exeDrvInst.exetapinstall.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tapinstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\OpenVPN\openvpn-install-2.4.8-I602-Win10.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\OpenVPN\openvpn-install-2.4.8-I602-Win10.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\tap-windows.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\tap-windows.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\tap-windows.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\tap-windows.exe	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

tapinstall.exeDrvInst.exesvchost.exedevcon64.exedevcon64.exeDrvInst.exetapinstall.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	devcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	devcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	devcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	devcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	devcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	devcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

xcopy.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3412 taskkill.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

pid	process
3412	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

Processes:

DrvInst.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe

Modifies registry class 15 IoCs

Processes:

openvpn-install-2.4.8-I602-Win10.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run	openvpn-install-2.4.8-I602-Win10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\ = "Start OpenVPN on this config file"	openvpn-install-2.4.8-I602-Win10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\command	openvpn-install-2.4.8-I602-Win10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\ = "OpenVPN Config File"	openvpn-install-2.4.8-I602-Win10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\DefaultIcon	openvpn-install-2.4.8-I602-Win10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell	openvpn-install-2.4.8-I602-Win10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ovpn	openvpn-install-2.4.8-I602-Win10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile	openvpn-install-2.4.8-I602-Win10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command	openvpn-install-2.4.8-I602-Win10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ovpn\ = "OpenVPNFile"	openvpn-install-2.4.8-I602-Win10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\DefaultIcon\ = "C:\\Program Files\\OpenVPN\\icon.ico,0"	openvpn-install-2.4.8-I602-Win10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command\ = "notepad.exe \"%1\""	openvpn-install-2.4.8-I602-Win10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn.exe\" --pause-exit --config \"%1\""	openvpn-install-2.4.8-I602-Win10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\ = "open"	openvpn-install-2.4.8-I602-Win10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open	openvpn-install-2.4.8-I602-Win10.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

1444 PING.EXE
3216 PING.EXE

pid	process
1444	PING.EXE
3216	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

openvpn-install-2.4.8-I602-Win10.exe

pid	process
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe
4732	openvpn-install-2.4.8-I602-Win10.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

taskkill.exesvchost.exetapinstall.exeDrvInst.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3412	taskkill.exe
Token: SeAuditPrivilege	3744	svchost.exe
Token: SeSecurityPrivilege	3744	svchost.exe
Token: SeLoadDriverPrivilege	4688	tapinstall.exe
Token: SeRestorePrivilege	1336	DrvInst.exe
Token: SeBackupPrivilege	1336	DrvInst.exe
Token: SeLoadDriverPrivilege	1336	DrvInst.exe
Token: SeLoadDriverPrivilege	1336	DrvInst.exe
Token: SeLoadDriverPrivilege	1336	DrvInst.exe
Token: SeShutdownPrivilege	1676	svchost.exe
Token: SeCreatePagefilePrivilege	1676	svchost.exe
Token: SeLoadDriverPrivilege	1676	svchost.exe
Token: SeLoadDriverPrivilege	1676	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9.exehidec.execmd.exeopenvpn-install-2.4.8-I602-Win10.exetap-windows.exe

description	pid	process	target process
PID 5028 wrote to memory of 4644	5028	ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9.exe	hidec.exe
PID 5028 wrote to memory of 4644	5028	ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9.exe	hidec.exe
PID 5028 wrote to memory of 4644	5028	ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9.exe	hidec.exe
PID 4644 wrote to memory of 4896	4644	hidec.exe	cmd.exe
PID 4644 wrote to memory of 4896	4644	hidec.exe	cmd.exe
PID 4644 wrote to memory of 4896	4644	hidec.exe	cmd.exe
PID 4896 wrote to memory of 4104	4896	cmd.exe	chcp.com
PID 4896 wrote to memory of 4104	4896	cmd.exe	chcp.com
PID 4896 wrote to memory of 4104	4896	cmd.exe	chcp.com
PID 4896 wrote to memory of 4984	4896	cmd.exe	cmd.exe
PID 4896 wrote to memory of 4984	4896	cmd.exe	cmd.exe
PID 4896 wrote to memory of 4984	4896	cmd.exe	cmd.exe
PID 4896 wrote to memory of 1152	4896	cmd.exe	find.exe
PID 4896 wrote to memory of 1152	4896	cmd.exe	find.exe
PID 4896 wrote to memory of 1152	4896	cmd.exe	find.exe
PID 4896 wrote to memory of 1568	4896	cmd.exe	cmd.exe
PID 4896 wrote to memory of 1568	4896	cmd.exe	cmd.exe
PID 4896 wrote to memory of 1568	4896	cmd.exe	cmd.exe
PID 4896 wrote to memory of 4184	4896	cmd.exe	find.exe
PID 4896 wrote to memory of 4184	4896	cmd.exe	find.exe
PID 4896 wrote to memory of 4184	4896	cmd.exe	find.exe
PID 4896 wrote to memory of 3412	4896	cmd.exe	taskkill.exe
PID 4896 wrote to memory of 3412	4896	cmd.exe	taskkill.exe
PID 4896 wrote to memory of 3412	4896	cmd.exe	taskkill.exe
PID 4896 wrote to memory of 3216	4896	cmd.exe	PING.EXE
PID 4896 wrote to memory of 3216	4896	cmd.exe	PING.EXE
PID 4896 wrote to memory of 3216	4896	cmd.exe	PING.EXE
PID 4896 wrote to memory of 3168	4896	cmd.exe	devcon64.exe
PID 4896 wrote to memory of 3168	4896	cmd.exe	devcon64.exe
PID 4896 wrote to memory of 3292	4896	cmd.exe	devcon64.exe
PID 4896 wrote to memory of 3292	4896	cmd.exe	devcon64.exe
PID 4896 wrote to memory of 4256	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4256	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4256	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4252	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4252	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4252	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4456	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4456	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4456	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 2212	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 2212	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 2212	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 2692	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 2692	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 2692	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 1360	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 1360	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 1360	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4232	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4232	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4232	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4196	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4196	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4196	4896	cmd.exe	reg.exe
PID 4896 wrote to memory of 4732	4896	cmd.exe	openvpn-install-2.4.8-I602-Win10.exe
PID 4896 wrote to memory of 4732	4896	cmd.exe	openvpn-install-2.4.8-I602-Win10.exe
PID 4896 wrote to memory of 4732	4896	cmd.exe	openvpn-install-2.4.8-I602-Win10.exe
PID 4732 wrote to memory of 1128	4732	openvpn-install-2.4.8-I602-Win10.exe	tap-windows.exe
PID 4732 wrote to memory of 1128	4732	openvpn-install-2.4.8-I602-Win10.exe	tap-windows.exe
PID 4732 wrote to memory of 1128	4732	openvpn-install-2.4.8-I602-Win10.exe	tap-windows.exe
PID 1128 wrote to memory of 972	1128	tap-windows.exe	tapinstall.exe
PID 1128 wrote to memory of 972	1128	tap-windows.exe	tapinstall.exe
PID 1128 wrote to memory of 4688	1128	tap-windows.exe	tapinstall.exe

C:\Users\Admin\AppData\Local\Temp\ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9.exe
"C:\Users\Admin\AppData\Local\Temp\ab4a399d20b831bbec26573ce82b72c6d71b7e978accd943cf26e3a75d3e87a9.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5028

C:\Users\Admin\AppData\Local\Temp\OpenVPN\Files\hidec.exe
"C:\Users\Admin\AppData\Local\Temp\OpenVPN\Files\hidec.exe" "C:\Windows\system32\cmd.exe" /C "install.bat %~1 & ping 127.0.0.1 -n 11 & cd .. && rmdir /S /Q "C:\Users\Admin\AppData\Local\Temp\OpenVPN""
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C "install.bat %~1 & ping 127.0.0.1 -n 11 & cd .. && rmdir /S /Q "C:\Users\Admin\AppData\Local\Temp\OpenVPN""
3⤵
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\SysWOW64\chcp.com
chcp.com 866
4⤵
PID:4104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" ver.exe 2>nul"
4⤵
PID:4984

C:\Windows\SysWOW64\find.exe
find.exe " 6."
4⤵
PID:1152

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" ver.exe 2>nul"
4⤵
PID:1568

C:\Windows\SysWOW64\find.exe
find.exe " 5."
4⤵
PID:4184

C:\Windows\SysWOW64\taskkill.exe
taskkill.exe /F /T /IM "openvpn*" /IM "openssl.exe" /IM "autoit3.exe" /IM "devcon.exe" /IM "devcon32.exe" /IM "devcon64.exe" /IM "tap-windows.exe" /IM "openvpn-run.exe"
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Windows\SysWOW64\PING.EXE
ping.exe 127.0.0.1 -n 2
4⤵
- Runs ping.exe
PID:3216

C:\Users\Admin\AppData\Local\Temp\OpenVPN\Files\bin\devcon64.exe
"C:\Users\Admin\AppData\Local\Temp\OpenVPN\Files\bin\devcon64.exe" remove "tap0901"
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3168

C:\Users\Admin\AppData\Local\Temp\OpenVPN\Files\bin\devcon64.exe
"C:\Users\Admin\AppData\Local\Temp\OpenVPN\Files\bin\devcon64.exe" remove "tap0801"
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3292

C:\Windows\SysWOW64\reg.exe
reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\tap0801" /F
4⤵
PID:4256

C:\Windows\SysWOW64\reg.exe
reg.exe delete "HKLM\SOFTWARE\OpenVPN" /F
4⤵
PID:4252

C:\Windows\SysWOW64\reg.exe
reg.exe delete "HKLM\SOFTWARE\OpenVPN-GUI" /F
4⤵
PID:4456

C:\Windows\SysWOW64\reg.exe
reg.exe delete "HKLM\SOFTWARE\Wow6432Node\OpenVPN" /F
4⤵
PID:2212

C:\Windows\SysWOW64\reg.exe
reg.exe delete "HKLM\SOFTWARE\Wow6432Node\OpenVPN-GUI" /F
4⤵
PID:2692

C:\Windows\SysWOW64\reg.exe
reg.exe delete "HKCR\.ovpn" /F
4⤵
PID:1360

C:\Windows\SysWOW64\reg.exe
reg.exe delete "HKCR\OpenVPN" /F
4⤵
PID:4232

C:\Windows\SysWOW64\reg.exe
reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ovpn" /F
4⤵
PID:4196

C:\Users\Admin\AppData\Local\Temp\OpenVPN\openvpn-install-2.4.8-I602-Win10.exe
"C:\Users\Admin\AppData\Local\Temp\OpenVPN\openvpn-install-2.4.8-I602-Win10.exe" /S
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4732

C:\Users\Admin\AppData\Local\Temp\tap-windows.exe
"C:\Users\Admin\AppData\Local\Temp\tap-windows.exe" /S /SELECT_UTILITIES=1
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1128

C:\Program Files\TAP-Windows\bin\tapinstall.exe
"C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901
6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:972

C:\Program Files\TAP-Windows\bin\tapinstall.exe
"C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\SysWOW64\xcopy.exe
xcopy.exe /E /C /Q /H /R /Y /Z "C:\Users\Admin\AppData\Local\Temp\OpenVPN\Files" "C:\Program Files\OpenVPN\"
4⤵
- Drops file in Program Files directory
- Enumerates system info in registry
PID:4036

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" ver.exe 2>nul"
4⤵
PID:4540

C:\Windows\SysWOW64\find.exe
find.exe " 6."
4⤵
PID:2596

C:\Windows\SysWOW64\forfiles.exe
forfiles.exe /C "C:\Windows\system32\cmd.exe /C if @isdir==TRUE ( rmdir /S /Q @path )" /M "OpenVPN"
4⤵
PID:5028

C:\Windows\SysWOW64\cmd.exe
/C if TRUE==TRUE ( rmdir /S /Q "C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\OpenVPN" )
5⤵
PID:860

C:\Windows\SysWOW64\forfiles.exe
forfiles.exe /C "C:\Windows\system32\cmd.exe /C if @isdir==FALSE ( del /A /F /Q @path )" /M "OpenVPN GUI.lnk"
4⤵
PID:2352

C:\Windows\SysWOW64\cmd.exe
/C if FALSE==FALSE ( del /A /F /Q "C:\Users\Public\Desktop\OpenVPN GUI.lnk" )
5⤵
PID:3468

C:\Windows\SysWOW64\forfiles.exe
forfiles.exe /C "C:\Windows\system32\cmd.exe /C if @isdir==TRUE ( rmdir /S /Q @path )" /M "TAP-Windows"
4⤵
PID:3920

C:\Windows\SysWOW64\cmd.exe
/C if TRUE==TRUE ( rmdir /S /Q "C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\TAP-Windows" )
5⤵
PID:3168

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\OpenVPN\shortcut.vbs" "C:\Program Files\OpenVPN\bin\openvpn-run.exe" "AllUsersPrograms" "OpenVPN" "VPN-клиент" "C:\Program Files\OpenVPN\openvpn.ico"
4⤵
PID:4504

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\OpenVPN\shortcut.vbs" "C:\Program Files\OpenVPN\bin\openvpn-run.exe" "AllUsersDesktop" "OpenVPN" "VPN-клиент" "C:\Program Files\OpenVPN\openvpn.ico"
4⤵
PID:4664

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 11
4⤵
- Runs ping.exe
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3744

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{56f364b8-0744-de49-bdc8-02fa4c1157d1}\oemvista.inf" "9" "4d14a44ff" "0000000000000140" "WinSta0\Default" "00000000000000B8" "208" "c:\program files\tap-windows\driver"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1756

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000170"
2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Program Files\OpenVPN\bin\openvpnserv.exe
"C:\Program Files\OpenVPN\bin\openvpnserv.exe"
1⤵
- Executes dropped EXE
PID:3328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\TAP-Windows\bin\tapinstall.exe
Filesize
495KB

MD5
e313336c82eb265542664cc7a360c5ff

SHA1
184211a456e09ac606db76f814332cc912c0f5eb

SHA256
b6b33f4cd19c606e4c616f08c11fd4ae775accb24b78ef66eb31c279ca403381

SHA512
f156f2f55af7026f5b3d2c5634806c5764fd230521d71969e80bbf6f6571730636dd5f6fe6c1138fa742e12003e5cc5f7d82e729ef7506057f8b510384e52386

Download Submit
C:\Program Files\TAP-Windows\bin\tapinstall.exe
Filesize
495KB

MD5
e313336c82eb265542664cc7a360c5ff

SHA1
184211a456e09ac606db76f814332cc912c0f5eb

SHA256
b6b33f4cd19c606e4c616f08c11fd4ae775accb24b78ef66eb31c279ca403381

SHA512
f156f2f55af7026f5b3d2c5634806c5764fd230521d71969e80bbf6f6571730636dd5f6fe6c1138fa742e12003e5cc5f7d82e729ef7506057f8b510384e52386

Download Submit
C:\Program Files\TAP-Windows\bin\tapinstall.exe
Filesize
495KB

MD5
e313336c82eb265542664cc7a360c5ff

SHA1
184211a456e09ac606db76f814332cc912c0f5eb

SHA256
b6b33f4cd19c606e4c616f08c11fd4ae775accb24b78ef66eb31c279ca403381

SHA512
f156f2f55af7026f5b3d2c5634806c5764fd230521d71969e80bbf6f6571730636dd5f6fe6c1138fa742e12003e5cc5f7d82e729ef7506057f8b510384e52386

Download Submit
C:\Program Files\TAP-Windows\driver\OemVista.inf
Filesize
7KB

MD5
50d29ca2e3ddb8a696923420ec2ac4fa

SHA1
d85f4e65fe10f13ded1780ddbd074edfc75f2d25

SHA256
817dff7f4944a255a0a33b8d74eb60a755d8d268cc7afd46fce41e102e0a004b

SHA512
03778a9cddd23639c88e24bb5d0446da3a400bb6b3321fb35887cd23d88d0f7ad3fe911642cc7f8d16d29cd9e42106851b0028379e8dbcb3c6721c238fc4a0d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenVPN\Files\bin\devcon64.exe
Filesize
80KB

MD5
3904d0698962e09da946046020cbcb17

SHA1
edae098e7e8452ca6c125cf6362dda3f4d78f0ae

SHA256
a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

SHA512
c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenVPN\Files\bin\devcon64.exe
Filesize
80KB

MD5
3904d0698962e09da946046020cbcb17

SHA1
edae098e7e8452ca6c125cf6362dda3f4d78f0ae

SHA256
a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

SHA512
c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenVPN\Files\bin\devcon64.exe
Filesize
80KB

MD5
3904d0698962e09da946046020cbcb17

SHA1
edae098e7e8452ca6c125cf6362dda3f4d78f0ae

SHA256
a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

SHA512
c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenVPN\Files\bin\tapdel.bat
Filesize
493B

MD5
20be78849f16f8008914d8146b5a06f3

SHA1
7025a9cf11277fcafb527a1b6bd72fa9e467d6e2

SHA256
fac6e63efe3b4fbf2013b68f8e420b4d6ab6dd820a1205f75cf774bf27c9d0b2

SHA512
0f8f5b7a7b678667bc263017df6b43b48451c8d6a9dd111103504943a81feba7da89d2eec0b1fc2fc3129e11f8037f4877aa41f5583afb2a2750e2dfd05deae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenVPN\Files\hidec.exe
Filesize
1KB

MD5
abc6379205de2618851c4fcbf72112eb

SHA1
1ed7b1e965eab56f55efda975f9f7ade95337267

SHA256
22e7528e56dffaa26cfe722994655686c90824b13eb51184abfe44d4e95d473f

SHA512
180c7f400dd13092b470e3a91bf02e98ef6247c1193bf349e3710e8d1e9003f3bc9b792bb776eacb746e9c67b3041f2333cc07f28c5f046d59274742230fb7c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenVPN\Files\hidec.exe
Filesize
1KB

MD5
abc6379205de2618851c4fcbf72112eb

SHA1
1ed7b1e965eab56f55efda975f9f7ade95337267

SHA256
22e7528e56dffaa26cfe722994655686c90824b13eb51184abfe44d4e95d473f

SHA512
180c7f400dd13092b470e3a91bf02e98ef6247c1193bf349e3710e8d1e9003f3bc9b792bb776eacb746e9c67b3041f2333cc07f28c5f046d59274742230fb7c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenVPN\install.bat
Filesize
7KB

MD5
f3016c2cb0997158a76b6d5c6f2c4aab

SHA1
654ebbde8cb295f79e265c4bcfe79fd2e5fcb335

SHA256
ccc338c1528ce628db9053bafc6c55c79d364f6ebd397e3057618ac73c5a8a6b

SHA512
7abb64fba592571e03b3ea62fa05256c317fd4cd759558866eb6494b2a8703e2fb41c5afd8ddc4fb8bef00f6a2b158471a4425edac6d21ec26ab4a42dd5545f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenVPN\openvpn-install-2.4.8-I602-Win10.exe
Filesize
4.1MB

MD5
6213c12277d643e14451a44a410d2688

SHA1
9c3fa39b6dc1ca9a02bf940c0509cf58a13fdf7d

SHA256
d8f861de1519c680c4e506b4e08b4d80db7c385a4ccc2fcc56e2278d41c1cabe

SHA512
6a2ef83c8d4f42cd39ad0e9c09c7a1deabb857f413243ddc18710f6128047e26d7bd0fba2a0b62414bd3aa8385dcb4af1fddc6c3494cf4a6c6696900dee4bea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenVPN\openvpn-install-2.4.8-I602-Win10.exe
Filesize
4.1MB

MD5
6213c12277d643e14451a44a410d2688

SHA1
9c3fa39b6dc1ca9a02bf940c0509cf58a13fdf7d

SHA256
d8f861de1519c680c4e506b4e08b4d80db7c385a4ccc2fcc56e2278d41c1cabe

SHA512
6a2ef83c8d4f42cd39ad0e9c09c7a1deabb857f413243ddc18710f6128047e26d7bd0fba2a0b62414bd3aa8385dcb4af1fddc6c3494cf4a6c6696900dee4bea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\System.dll
Filesize
23KB

MD5
2e025e2cee2953cce0160c3cd2e1a64e

SHA1
dec3da040ea72d63528240598bf14f344efb2a76

SHA256
d821a62802900b068dcf61ddc9fdff2f7ada04b706815ab6e5038b21543da8a5

SHA512
3cafce382b605a68e5a3f35f95b32761685112c5a9da9f87b0a06ec13da4155145bd06ffb63131bf87c3dc8bd61cb085884c5e78c832386d70397e3974854860

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\System.dll
Filesize
23KB

MD5
2e025e2cee2953cce0160c3cd2e1a64e

SHA1
dec3da040ea72d63528240598bf14f344efb2a76

SHA256
d821a62802900b068dcf61ddc9fdff2f7ada04b706815ab6e5038b21543da8a5

SHA512
3cafce382b605a68e5a3f35f95b32761685112c5a9da9f87b0a06ec13da4155145bd06ffb63131bf87c3dc8bd61cb085884c5e78c832386d70397e3974854860

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\UserInfo.dll
Filesize
6KB

MD5
9f0cb655a832fdecb9433dd781004637

SHA1
bea6b32a5d2d6d152a52847db1184fab956a9d3b

SHA256
a94fd67daf9137b26e2d98aa4cf46614439bd64263c5c211369a232c444862ea

SHA512
5fd32197a5d9bb7cc65e3917791023fbe2b80a34899d4363475a7fb05fb1051c0a17c72359f3c215d0fd41bbb2dfed0bb95c766131fc175c18ac91cf54b05551

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\nsExec.dll
Filesize
9KB

MD5
1139fb5cc942e668c8277f8b8f1e5f20

SHA1
94bbb2454dad420b70553c0fca4899f120d3ed43

SHA256
9cb71f00c19397723d39861ff809c70f9d2cdbcf91b3dd8021060714512a39cb

SHA512
08e8eb820801875208d9f28fb1416e0fc66abf5cc343e7ac973cc6736dbcd0f85b1bf42e8d110ad8c9a9ced204c00cf530099b8c411871762615051e1f7061d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6D14.tmp\nsProcess.dll
Filesize
4KB

MD5
05450face243b3a7472407b999b03a72

SHA1
ffd88af2e338ae606c444390f7eaaf5f4aef2cd9

SHA256
95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89

SHA512
f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\ShellLink.dll
Filesize
4KB

MD5
aad75be0bdd1f1bac758b521c9f1d022

SHA1
5d444b8432c8834f5b5cd29225101856cebb8ecf

SHA256
d1d1642f3e70386af125ec32f41734896427811770d617729d8d5ebdf18f8aa7

SHA512
4c6e155cdf62cc8b65f3d0699c73c9032accefaa0f51e8b9a5c2f340ec8c6f5fab0ea02aad0abed476b3537292ba22d898589812850968e105ac83680d2f87d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\ShellLink.dll
Filesize
4KB

MD5
aad75be0bdd1f1bac758b521c9f1d022

SHA1
5d444b8432c8834f5b5cd29225101856cebb8ecf

SHA256
d1d1642f3e70386af125ec32f41734896427811770d617729d8d5ebdf18f8aa7

SHA512
4c6e155cdf62cc8b65f3d0699c73c9032accefaa0f51e8b9a5c2f340ec8c6f5fab0ea02aad0abed476b3537292ba22d898589812850968e105ac83680d2f87d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\System.dll
Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\UserInfo.dll
Filesize
4KB

MD5
7836f464ae0102452e94a363b491b759

SHA1
59909a48448b99e2eb9cd336d81d60764da59f31

SHA256
11adf8916947b5a20a071b494fa034cf62769dcc6293a1340b29a5bb29ac8e87

SHA512
5ed63eefa1b3b3caad4cb762ccb8419c05bcad3da3a7415235cda2d2a1f79eb018503ca30a0a92d6b72160327decea9a70c48e0c28de94dd67303d4aea4a02db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll
Filesize
6KB

MD5
50ba20cad29399e2db9fa75a1324bd1d

SHA1
3850634bb15a112623222972ef554c8d1eca16f4

SHA256
e7b145abc7c519e6bd91dc06b7b83d1e73735ac1ac37d30a7889840a6eed38fc

SHA512
893e053fcb0a2d3742e2b13b869941a3a485b2bda3a92567f84190cb1be170b67d20cc71c6a2cb92f4202140c8afd9c40a358496947d709e0c4b68d43a368754

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk861A.tmp\nsExec.dll
Filesize
6KB

MD5
50ba20cad29399e2db9fa75a1324bd1d

SHA1
3850634bb15a112623222972ef554c8d1eca16f4

SHA256
e7b145abc7c519e6bd91dc06b7b83d1e73735ac1ac37d30a7889840a6eed38fc

SHA512
893e053fcb0a2d3742e2b13b869941a3a485b2bda3a92567f84190cb1be170b67d20cc71c6a2cb92f4202140c8afd9c40a358496947d709e0c4b68d43a368754

Download Submit
C:\Users\Admin\AppData\Local\Temp\tap-windows.exe
Filesize
574KB

MD5
ceaf53b33e459cd4d30db5dfca3455e1

SHA1
2dc03ec37fa11783f1d1965961a93237cde12f69

SHA256
1782d56568092e8fba575fe7e11b2e86f04518f40a18a4ce594bd1209e0cb547

SHA512
dc331bc2cca943985150b892cf9369da78c627c68b75bd883e08f2ffcfddb349ec864ff2195b9b85ade7d6474751b3e156c10d38b996441dad31e9e026adc17f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tap-windows.exe
Filesize
574KB

MD5
ceaf53b33e459cd4d30db5dfca3455e1

SHA1
2dc03ec37fa11783f1d1965961a93237cde12f69

SHA256
1782d56568092e8fba575fe7e11b2e86f04518f40a18a4ce594bd1209e0cb547

SHA512
dc331bc2cca943985150b892cf9369da78c627c68b75bd883e08f2ffcfddb349ec864ff2195b9b85ade7d6474751b3e156c10d38b996441dad31e9e026adc17f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{56F36~1\tap0901.cat
Filesize
10KB

MD5
225e7ba0e5e2d46813e5c858a4d0d5b0

SHA1
5dd49014764f634164520583fd0cec87ab1a1625

SHA256
b0baf5cb84fa4acb34b77a6231052061da6b8676d216833724b7a602622161fb

SHA512
9c77adf7e71aca94489dfeb536f796a017b7c05771962274bae2c614e2ae6799cceb36cc58ac470184c37f52deac75988bb14e6a329f432c6d7cedbca18272a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\{56F36~1\tap0901.sys
Filesize
38KB

MD5
059e578d456043a8c3b76ec365b375f3

SHA1
42189b6a1b8c736397113bfc2283f5e1e1a44e8e

SHA256
a0170cf78105ce757e0549d79e4ae7c412240e8b81d262a24d76a047f181f881

SHA512
99e6b6af018d0e3509d9dbe00301a7d5d6645a2070a8144acff04842f8bbaccd81e7651578d08f47639cd2b7d00eb64acddfa8725bce9a073580b7fcf7964e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{56f364b8-0744-de49-bdc8-02fa4c1157d1}\oemvista.inf
Filesize
7KB

MD5
50d29ca2e3ddb8a696923420ec2ac4fa

SHA1
d85f4e65fe10f13ded1780ddbd074edfc75f2d25

SHA256
817dff7f4944a255a0a33b8d74eb60a755d8d268cc7afd46fce41e102e0a004b

SHA512
03778a9cddd23639c88e24bb5d0446da3a400bb6b3321fb35887cd23d88d0f7ad3fe911642cc7f8d16d29cd9e42106851b0028379e8dbcb3c6721c238fc4a0d3

Download Submit
C:\Windows\INF\oem2.inf
Filesize
7KB

MD5
50d29ca2e3ddb8a696923420ec2ac4fa

SHA1
d85f4e65fe10f13ded1780ddbd074edfc75f2d25

SHA256
817dff7f4944a255a0a33b8d74eb60a755d8d268cc7afd46fce41e102e0a004b

SHA512
03778a9cddd23639c88e24bb5d0446da3a400bb6b3321fb35887cd23d88d0f7ad3fe911642cc7f8d16d29cd9e42106851b0028379e8dbcb3c6721c238fc4a0d3

Download Submit
C:\Windows\System32\DriverStore\FileRepository\OEMVIS~1.INF\tap0901.sys
Filesize
38KB

MD5
059e578d456043a8c3b76ec365b375f3

SHA1
42189b6a1b8c736397113bfc2283f5e1e1a44e8e

SHA256
a0170cf78105ce757e0549d79e4ae7c412240e8b81d262a24d76a047f181f881

SHA512
99e6b6af018d0e3509d9dbe00301a7d5d6645a2070a8144acff04842f8bbaccd81e7651578d08f47639cd2b7d00eb64acddfa8725bce9a073580b7fcf7964e6a

Download Submit
C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\oemvista.inf
Filesize
7KB

MD5
50d29ca2e3ddb8a696923420ec2ac4fa

SHA1
d85f4e65fe10f13ded1780ddbd074edfc75f2d25

SHA256
817dff7f4944a255a0a33b8d74eb60a755d8d268cc7afd46fce41e102e0a004b

SHA512
03778a9cddd23639c88e24bb5d0446da3a400bb6b3321fb35887cd23d88d0f7ad3fe911642cc7f8d16d29cd9e42106851b0028379e8dbcb3c6721c238fc4a0d3

Download Submit
\??\c:\PROGRA~1\TAP-WI~1\driver\tap0901.sys
Filesize
38KB

MD5
059e578d456043a8c3b76ec365b375f3

SHA1
42189b6a1b8c736397113bfc2283f5e1e1a44e8e

SHA256
a0170cf78105ce757e0549d79e4ae7c412240e8b81d262a24d76a047f181f881

SHA512
99e6b6af018d0e3509d9dbe00301a7d5d6645a2070a8144acff04842f8bbaccd81e7651578d08f47639cd2b7d00eb64acddfa8725bce9a073580b7fcf7964e6a

Download Submit
\??\c:\program files\tap-windows\driver\tap0901.cat
Filesize
10KB

MD5
225e7ba0e5e2d46813e5c858a4d0d5b0

SHA1
5dd49014764f634164520583fd0cec87ab1a1625

SHA256
b0baf5cb84fa4acb34b77a6231052061da6b8676d216833724b7a602622161fb

SHA512
9c77adf7e71aca94489dfeb536f796a017b7c05771962274bae2c614e2ae6799cceb36cc58ac470184c37f52deac75988bb14e6a329f432c6d7cedbca18272a8

Download Submit
memory/860-238-0x0000000000000000-mapping.dmp

Download
memory/972-214-0x0000000000000000-mapping.dmp

Download
memory/1128-206-0x0000000000000000-mapping.dmp

Download
memory/1152-137-0x0000000000000000-mapping.dmp

Download
memory/1336-228-0x0000000000000000-mapping.dmp

Download
memory/1360-153-0x0000000000000000-mapping.dmp

Download
memory/1444-245-0x0000000000000000-mapping.dmp

Download
memory/1568-138-0x0000000000000000-mapping.dmp

Download
memory/1756-223-0x0000000000000000-mapping.dmp

Download
memory/2212-151-0x0000000000000000-mapping.dmp

Download
memory/2352-239-0x0000000000000000-mapping.dmp

Download
memory/2596-236-0x0000000000000000-mapping.dmp

Download
memory/2692-152-0x0000000000000000-mapping.dmp

Download
memory/3168-143-0x0000000000000000-mapping.dmp

Download
memory/3168-242-0x0000000000000000-mapping.dmp

Download
memory/3216-141-0x0000000000000000-mapping.dmp

Download
memory/3292-146-0x0000000000000000-mapping.dmp

Download
memory/3412-140-0x0000000000000000-mapping.dmp

Download
memory/3468-240-0x0000000000000000-mapping.dmp

Download
memory/3920-241-0x0000000000000000-mapping.dmp

Download
memory/4036-234-0x0000000000000000-mapping.dmp

Download
memory/4104-135-0x0000000000000000-mapping.dmp

Download
memory/4184-139-0x0000000000000000-mapping.dmp

Download
memory/4196-155-0x0000000000000000-mapping.dmp

Download
memory/4232-154-0x0000000000000000-mapping.dmp

Download
memory/4252-149-0x0000000000000000-mapping.dmp

Download
memory/4256-148-0x0000000000000000-mapping.dmp

Download
memory/4456-150-0x0000000000000000-mapping.dmp

Download
memory/4504-243-0x0000000000000000-mapping.dmp

Download
memory/4540-235-0x0000000000000000-mapping.dmp

Download
memory/4644-130-0x0000000000000000-mapping.dmp

Download
memory/4664-244-0x0000000000000000-mapping.dmp

Download
memory/4688-218-0x0000000000000000-mapping.dmp

Download
memory/4732-164-0x00000000034E0000-0x00000000034F3000-memory.dmp

Filesize
76KB

Download
memory/4732-156-0x0000000000000000-mapping.dmp

Download
memory/4896-133-0x0000000000000000-mapping.dmp

Download
memory/4984-136-0x0000000000000000-mapping.dmp

Download
memory/5028-237-0x0000000000000000-mapping.dmp

Download