joker | 0f20af4a90fb5070fc602682a6117dd787d7d5a96a2645528b4fada310de06b7

Analysis

max time kernel
320s
max time network
352s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2022, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

goby-win-x64-2.0.5-redteam-cracked_by_hlop/Goby.exe
Size

133.2MB
MD5

27bd09efcf2746a98312f507d6d96f7e
SHA1

ae156478009b0c89ac132af3d63249c85cf2ce17
SHA256

ae12cfdb41c3dc3fc383ce5e4e2856b28cd8dee6352b047b9981b1dd51e55ce1
SHA512

6bb6823809cc407aa99f53a3d5acfe5bc8ce7503fbe87bfd5dee8349dc2679562c10ea9913c48cc9865c7320df8a7424d3abac7131462247750030e12bded3e6
SSDEEP

786432:vdWnQaBaRvHGYJKQSXPz9T/G2nXpf/EtBfamfrpcvFBJFoF2PScuNWqW:VxTRvHF8QS/z9zGud/ET3fcCWq

Score

10^/10

joker discovery infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SETD29D.tmp	NPFInstall.exe
File created	C:\Windows\system32\DRIVERS\SETD29D.tmp	NPFInstall.exe
File opened for modification	C:\Windows\system32\DRIVERS\npcap.sys	NPFInstall.exe

Executes dropped EXE 6 IoCs

pid	Process
2312	npcap-1.60.exe
1468	NPFInstall.exe
4056	NPFInstall.exe
2344	NPFInstall.exe
2484	NPFInstall.exe
4280	npcap-1.60 (1).exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Goby.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Goby.exe

Loads dropped DLL 20 IoCs

pid	Process
2312	npcap-1.60.exe
2312	npcap-1.60.exe
2312	npcap-1.60.exe
2312	npcap-1.60.exe
2312	npcap-1.60.exe
2312	npcap-1.60.exe
2312	npcap-1.60.exe
2312	npcap-1.60.exe
2312	npcap-1.60.exe
2312	npcap-1.60.exe
2312	npcap-1.60.exe
2312	npcap-1.60.exe
2312	npcap-1.60.exe
2480	goby-cmd.exe
2480	goby-cmd.exe
740	goby-cmd.exe
740	goby-cmd.exe
4280	npcap-1.60 (1).exe
4280	npcap-1.60 (1).exe
4280	npcap-1.60 (1).exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 42 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\Npcap\NpcapHelper.exe	npcap-1.60.exe
File created	C:\Windows\System32\DriverStore\Temp\{4e982cf2-d303-054d-9922-e59be79fe813}\SETC958.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e982cf2-d303-054d-9922-e59be79fe813}\SETC956.tmp	DrvInst.exe
File created	C:\Windows\system32\Npcap\wpcap.dll	npcap-1.60.exe
File created	C:\Windows\System32\DriverStore\Temp\{4e982cf2-d303-054d-9922-e59be79fe813}\SETC957.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_7abd107f8e2977e7\npcap.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_c5e19aab2305f37f\netvwififlt.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_9ab9cf10857f7349\c_netservice.PNF	NPFInstall.exe
File created	C:\Windows\SysWOW64\Packet.dll	npcap-1.60.exe
File created	C:\Windows\system32\Npcap\WlanHelper.exe	npcap-1.60.exe
File created	C:\Windows\System32\DriverStore\Temp\{4e982cf2-d303-054d-9922-e59be79fe813}\SETC956.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\WlanHelper.exe	npcap-1.60.exe
File created	C:\Windows\SysWOW64\Npcap\WlanHelper.exe	npcap-1.60.exe
File created	C:\Windows\system32\wpcap.dll	npcap-1.60.exe
File created	C:\Windows\system32\Npcap\Packet.dll	npcap-1.60.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e982cf2-d303-054d-9922-e59be79fe813}\npcap.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e982cf2-d303-054d-9922-e59be79fe813}\SETC957.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e982cf2-d303-054d-9922-e59be79fe813}\SETC958.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_a2bfd066656fe297\netnwifi.PNF	NPFInstall.exe
File created	C:\Windows\SysWOW64\Npcap\wpcap.dll	npcap-1.60.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_7abd107f8e2977e7\npcap.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e982cf2-d303-054d-9922-e59be79fe813}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_a009d240f9b4a192\ndiscap.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\wfpcapture.PNF	NPFInstall.exe
File created	C:\Windows\system32\WlanHelper.exe	npcap-1.60.exe
File created	C:\Windows\system32\NpcapHelper.exe	npcap-1.60.exe
File created	C:\Windows\system32\Npcap\NpcapHelper.exe	npcap-1.60.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_7abd107f8e2977e7\NPCAP.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\netbrdg.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_7f701cb29b5389d3\netrass.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_7d294c7fa012d315\netpacer.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_7abd107f8e2977e7\npcap.PNF	NPFInstall.exe
File created	C:\Windows\system32\Packet.dll	npcap-1.60.exe
File created	C:\Windows\SysWOW64\NpcapHelper.exe	npcap-1.60.exe
File created	C:\Windows\SysWOW64\Npcap\Packet.dll	npcap-1.60.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e982cf2-d303-054d-9922-e59be79fe813}\NPCAP.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e982cf2-d303-054d-9922-e59be79fe813}\npcap.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_73adce5afe861093\netserv.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_0dc913ad00b14824\netnb.PNF	NPFInstall.exe
File created	C:\Windows\SysWOW64\wpcap.dll	npcap-1.60.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\063ff6df-ec91-49e0-bea5-57aec4428011.tmp	setup.exe
File created	C:\Program Files\Npcap\LICENSE	npcap-1.60.exe
File created	C:\Program Files\Npcap\npcap.sys	npcap-1.60.exe
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File opened for modification	C:\Program Files\Npcap\install.log	npcap-1.60.exe
File created	C:\Program Files\Npcap\DiagReport.ps1	npcap-1.60.exe
File created	C:\Program Files\Npcap\Uninstall.exe	npcap-1.60.exe
File created	C:\Program Files\Npcap\NPFInstall.exe	npcap-1.60.exe
File created	C:\Program Files\Npcap\npcap.cat	npcap-1.60.exe
File created	C:\Program Files\Npcap\npcap.inf	npcap-1.60.exe
File created	C:\Program Files\Npcap\npcap_wfp.inf	npcap-1.60.exe
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220921060951.pma	setup.exe
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File created	C:\Program Files\Npcap\CheckStatus.bat	npcap-1.60.exe
File opened for modification	C:\Program Files\Npcap\install.log	npcap-1.60 (1).exe
File created	C:\Program Files\Npcap\DiagReport.bat	npcap-1.60.exe
File created	C:\Program Files\Npcap\FixInstall.bat	npcap-1.60.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\INF\oem2.PNF	NPFInstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	NPFInstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 9 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
2148	netstat.exe
3692	netstat.exe
1616	netstat.exe
3128	netstat.exe
3920	netstat.exe
2568	netstat.exe
2004	netstat.exe
1932	netstat.exe
4108	netstat.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
1676	taskkill.exe
4644	taskkill.exe
1080	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e0031000000000035558a31100054656d7000003a0009000400efbe0c55ec983555a6312e000000aee10100000001000000000000000000000000000000554ce800540065006d007000000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000000c556ba4100041646d696e003c0009000400efbe0c55ec983555fd302e0000008fe10100000001000000000000000000000000000000045ea000410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000000c55ec9812004170704461746100400009000400efbe0c55ec983555fd302e0000009ae1010000000100000000000000000000000000000031e600014100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = a2003100000000003555fc301000474f42592d577e312e352d520000860009000400efbe3555f9303555fc302e000000482e0200000008000000000000000000000000000000fdd4f70067006f00620079002d00770069006e002d007800360034002d0032002e0030002e0035002d007200650064007400650061006d002d0063007200610063006b00650064005f00620079005f0068006c006f00700000001c000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 965580.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 331139.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
3088	explorer.exe
4580	explorer.exe
3896	explorer.exe
4868	explorer.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
752	Goby.exe
752	Goby.exe
384	Goby.exe
384	Goby.exe
4720	Goby.exe
4720	Goby.exe
3180	msedge.exe
3180	msedge.exe
4836	msedge.exe
4836	msedge.exe
3080	msedge.exe
3080	msedge.exe
1736	identity_helper.exe
1736	identity_helper.exe
1468	NPFInstall.exe
1468	NPFInstall.exe
3084	Goby.exe
3084	Goby.exe
3084	Goby.exe
3084	Goby.exe
1700	powershell.exe
1700	powershell.exe
1700	powershell.exe
1404	powershell.exe
1404	powershell.exe
1404	powershell.exe
2480	goby-cmd.exe
2480	goby-cmd.exe
740	goby-cmd.exe
740	goby-cmd.exe
4488	msedge.exe
4488	msedge.exe
1524	msedge.exe
1524	msedge.exe
4924	identity_helper.exe
4924	identity_helper.exe
2080	msedge.exe
2080	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2312	npcap-1.60.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	taskkill.exe
Token: SeDebugPrivilege	1876	goby-cmd.exe
Token: SeDebugPrivilege	1468	NPFInstall.exe
Token: SeAuditPrivilege	5008	svchost.exe
Token: SeSecurityPrivilege	5008	svchost.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeIncreaseQuotaPrivilege	1404	powershell.exe
Token: SeSecurityPrivilege	1404	powershell.exe
Token: SeTakeOwnershipPrivilege	1404	powershell.exe
Token: SeLoadDriverPrivilege	1404	powershell.exe
Token: SeSystemProfilePrivilege	1404	powershell.exe
Token: SeSystemtimePrivilege	1404	powershell.exe
Token: SeProfSingleProcessPrivilege	1404	powershell.exe
Token: SeIncBasePriorityPrivilege	1404	powershell.exe
Token: SeCreatePagefilePrivilege	1404	powershell.exe
Token: SeBackupPrivilege	1404	powershell.exe
Token: SeRestorePrivilege	1404	powershell.exe
Token: SeShutdownPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeSystemEnvironmentPrivilege	1404	powershell.exe
Token: SeRemoteShutdownPrivilege	1404	powershell.exe
Token: SeUndockPrivilege	1404	powershell.exe
Token: SeManageVolumePrivilege	1404	powershell.exe
Token: 33	1404	powershell.exe
Token: 34	1404	powershell.exe
Token: 35	1404	powershell.exe
Token: 36	1404	powershell.exe
Token: SeIncreaseQuotaPrivilege	1404	powershell.exe
Token: SeSecurityPrivilege	1404	powershell.exe
Token: SeTakeOwnershipPrivilege	1404	powershell.exe
Token: SeLoadDriverPrivilege	1404	powershell.exe
Token: SeSystemProfilePrivilege	1404	powershell.exe
Token: SeSystemtimePrivilege	1404	powershell.exe
Token: SeProfSingleProcessPrivilege	1404	powershell.exe
Token: SeIncBasePriorityPrivilege	1404	powershell.exe
Token: SeCreatePagefilePrivilege	1404	powershell.exe
Token: SeBackupPrivilege	1404	powershell.exe
Token: SeRestorePrivilege	1404	powershell.exe
Token: SeShutdownPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeSystemEnvironmentPrivilege	1404	powershell.exe
Token: SeRemoteShutdownPrivilege	1404	powershell.exe
Token: SeUndockPrivilege	1404	powershell.exe
Token: SeManageVolumePrivilege	1404	powershell.exe
Token: 33	1404	powershell.exe
Token: 34	1404	powershell.exe
Token: 35	1404	powershell.exe
Token: 36	1404	powershell.exe
Token: SeIncreaseQuotaPrivilege	1404	powershell.exe
Token: SeSecurityPrivilege	1404	powershell.exe
Token: SeTakeOwnershipPrivilege	1404	powershell.exe
Token: SeLoadDriverPrivilege	1404	powershell.exe
Token: SeSystemProfilePrivilege	1404	powershell.exe
Token: SeSystemtimePrivilege	1404	powershell.exe
Token: SeProfSingleProcessPrivilege	1404	powershell.exe
Token: SeIncBasePriorityPrivilege	1404	powershell.exe
Token: SeCreatePagefilePrivilege	1404	powershell.exe
Token: SeBackupPrivilege	1404	powershell.exe
Token: SeRestorePrivilege	1404	powershell.exe
Token: SeShutdownPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeSystemEnvironmentPrivilege	1404	powershell.exe
Token: SeRemoteShutdownPrivilege	1404	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe

Suspicious use of SendNotifyMessage 55 IoCs

pid	Process
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe
1456	Goby.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2312	npcap-1.60.exe
1468	NPFInstall.exe
4056	NPFInstall.exe
2344	NPFInstall.exe
2484	NPFInstall.exe
4280	npcap-1.60 (1).exe
3088	explorer.exe
3088	explorer.exe
4580	explorer.exe
4580	explorer.exe
3896	explorer.exe
3896	explorer.exe
4868	explorer.exe
4868	explorer.exe
2388	explorer.exe
2388	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 752	1456	Goby.exe	81
PID 1456 wrote to memory of 752	1456	Goby.exe	81
PID 1456 wrote to memory of 384	1456	Goby.exe	82
PID 1456 wrote to memory of 384	1456	Goby.exe	82
PID 1456 wrote to memory of 4720	1456	Goby.exe	83
PID 1456 wrote to memory of 4720	1456	Goby.exe	83
PID 4720 wrote to memory of 628	4720	Goby.exe	84
PID 4720 wrote to memory of 628	4720	Goby.exe	84
PID 628 wrote to memory of 1676	628	cmd.exe	86
PID 628 wrote to memory of 1676	628	cmd.exe	86
PID 4720 wrote to memory of 1876	4720	Goby.exe	87
PID 4720 wrote to memory of 1876	4720	Goby.exe	87
PID 1876 wrote to memory of 1616	1876	goby-cmd.exe	91
PID 1876 wrote to memory of 1616	1876	goby-cmd.exe	91
PID 1616 wrote to memory of 988	1616	netstat.exe	94
PID 1616 wrote to memory of 988	1616	netstat.exe	94
PID 988 wrote to memory of 1692	988	cmd.exe	95
PID 988 wrote to memory of 1692	988	cmd.exe	95
PID 1876 wrote to memory of 3128	1876	goby-cmd.exe	96
PID 1876 wrote to memory of 3128	1876	goby-cmd.exe	96
PID 3128 wrote to memory of 3096	3128	netstat.exe	97
PID 3128 wrote to memory of 3096	3128	netstat.exe	97
PID 3096 wrote to memory of 4532	3096	cmd.exe	98
PID 3096 wrote to memory of 4532	3096	cmd.exe	98
PID 1876 wrote to memory of 3920	1876	goby-cmd.exe	100
PID 1876 wrote to memory of 3920	1876	goby-cmd.exe	100
PID 3920 wrote to memory of 2388	3920	netstat.exe	101
PID 3920 wrote to memory of 2388	3920	netstat.exe	101
PID 2388 wrote to memory of 4628	2388	cmd.exe	102
PID 2388 wrote to memory of 4628	2388	cmd.exe	102
PID 4720 wrote to memory of 4836	4720	Goby.exe	106
PID 4720 wrote to memory of 4836	4720	Goby.exe	106
PID 4836 wrote to memory of 1188	4836	msedge.exe	107
PID 4836 wrote to memory of 1188	4836	msedge.exe	107
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108
PID 4836 wrote to memory of 3408	4836	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\Goby.exe
"C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\Goby.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\Goby.exe
  "C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\Goby.exe" --type=gpu-process --field-trial-handle=1484,7276437405792593471,9657248040149123390,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --no-sandbox=true --user-data-dir="C:\Users\Admin\AppData\Roaming\Goby" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1564 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:752
- C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\Goby.exe
  "C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\Goby.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1484,7276437405792593471,9657248040149123390,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --no-sandbox=true --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\Goby" --mojo-platform-channel-handle=1880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\Goby.exe
  "C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\Goby.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Goby" --app-path="C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\resources\app.asar" --no-sandbox --no-zygote --no-sandbox=true --field-trial-handle=1484,7276437405792593471,9657248040149123390,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2144 /prefetch:1
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM goby-cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM goby-cmd.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1676
- - C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\golib\goby-cmd.exe
    C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop/golib/goby-cmd -mode api -bind 127.0.0.1:8361 -rate 100 -dns 8.8.8.8:53 -random true
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\system32\netstat.exe
      netstat -ran
      4⤵
      Gathers network information
      Suspicious use of WriteProcessMemory
      PID:1616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:988
      - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        
        PID:1692
  - - C:\Windows\system32\netstat.exe
      netstat -ran
      4⤵
      Gathers network information
      Suspicious use of WriteProcessMemory
      PID:3128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3096
      - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        
        PID:4532
  - - C:\Windows\system32\netstat.exe
      netstat -ran
      4⤵
      Gathers network information
      Suspicious use of WriteProcessMemory
      PID:3920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2388
      - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        
        PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nmap.org/npcap/dist/npcap-1.60.exe
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Modifies registry class
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb3f0c46f8,0x7ffb3f0c4708,0x7ffb3f0c4718
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4888 /prefetch:8
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5648 /prefetch:8
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5720 /prefetch:8
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
      4⤵
      PID:1068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6172 /prefetch:8
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:4808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff721e45460,0x7ff721e45470,0x7ff721e45480
        5⤵
        
        PID:4644
  - - C:\Users\Admin\Downloads\npcap-1.60.exe
      "C:\Users\Admin\Downloads\npcap-1.60.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\NPFInstall.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\NPFInstall.exe" -n -check_dll
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1468
    - - C:\Windows\SysWOW64\certutil.exe
        
        certutil -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\roots.p7b"
        5⤵
        
        PID:732
    - - C:\Windows\SysWOW64\certutil.exe
        
        certutil -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\signing.p7b"
        5⤵
        
        PID:4712
    - - C:\Program Files\Npcap\NPFInstall.exe
        
        "C:\Program Files\Npcap\NPFInstall.exe" -n -c
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:4056
      - C:\Windows\SYSTEM32\pnputil.exe
        
        pnputil.exe -e
        6⤵
        
        PID:116
    - - C:\Program Files\Npcap\NPFInstall.exe
        
        "C:\Program Files\Npcap\NPFInstall.exe" -n -iw
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:2344
    - - C:\Program Files\Npcap\NPFInstall.exe
        
        "C:\Program Files\Npcap\NPFInstall.exe" -n -i
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Suspicious use of SetWindowsHookEx
        
        PID:2484
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Start-Service -Name npcap -PassThru | Stop-Service -PassThru | Start-Service"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2332811322724990099,209616054917951723,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
      4⤵
      PID:3132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM goby-cmd.exe"
    3⤵
    PID:1760
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM goby-cmd.exe
      4⤵
      Kills process with taskkill
      PID:4644
- - C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\golib\goby-cmd.exe
    C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop/golib/goby-cmd -mode api -bind 127.0.0.1:8361 -rate 100 -dns 8.8.8.8:53 -random true
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2480
  - - C:\Windows\system32\netstat.exe
      netstat -ran
      4⤵
      Gathers network information
      PID:1932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        
        PID:3904
      - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        
        PID:1292
  - - C:\Windows\system32\netstat.exe
      netstat -ran
      4⤵
      Gathers network information
      PID:2568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        
        PID:4056
      - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        
        PID:4236
  - - C:\Windows\system32\netstat.exe
      netstat -ran
      4⤵
      Gathers network information
      PID:2004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        
        PID:2364
      - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        
        PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM goby-cmd.exe"
    3⤵
    PID:1600
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM goby-cmd.exe
      4⤵
      Kills process with taskkill
      PID:1080
- - C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\golib\goby-cmd.exe
    C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop/golib/goby-cmd -mode api -bind 127.0.0.1:8361 -rate 100 -dns 8.8.8.8:53 -random true
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:740
  - - C:\Windows\system32\netstat.exe
      netstat -ran
      4⤵
      Gathers network information
      PID:2148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        
        PID:1736
      - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        
        PID:4796
  - - C:\Windows\system32\netstat.exe
      netstat -ran
      4⤵
      Gathers network information
      PID:4108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        
        PID:4160
      - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        
        PID:3656
  - - C:\Windows\system32\netstat.exe
      netstat -ran
      4⤵
      Gathers network information
      PID:3692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        
        PID:4020
      - C:\Windows\system32\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        
        PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://npcap.com/dist/npcap-1.60.exe
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3f0c46f8,0x7ffb3f0c4708,0x7ffb3f0c4718
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16582279136566812482,2365129706992611952,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16582279136566812482,2365129706992611952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
      4⤵
      PID:400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16582279136566812482,2365129706992611952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16582279136566812482,2365129706992611952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16582279136566812482,2365129706992611952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,16582279136566812482,2365129706992611952,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4292 /prefetch:8
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,16582279136566812482,2365129706992611952,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4504 /prefetch:8
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,16582279136566812482,2365129706992611952,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5480 /prefetch:8
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16582279136566812482,2365129706992611952,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16582279136566812482,2365129706992611952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8
      4⤵
      PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16582279136566812482,2365129706992611952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,16582279136566812482,2365129706992611952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,16582279136566812482,2365129706992611952,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5876 /prefetch:8
      4⤵
      PID:1288
  - - C:\Users\Admin\Downloads\npcap-1.60 (1).exe
      "C:\Users\Admin\Downloads\npcap-1.60 (1).exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe /select,"C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\data\logs\scan_error.log""
    3⤵
    PID:548
  - - C:\Windows\explorer.exe
      explorer.exe /select,"C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\data\logs\scan_error.log"
      4⤵
      PID:1760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe /select,"C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\data\logs\scan_error.log""
    3⤵
    PID:4024
  - - C:\Windows\explorer.exe
      explorer.exe /select,"C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\data\logs\scan_error.log"
      4⤵
      PID:116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe /select,"C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\data\logs\scan_error.log""
    3⤵
    PID:1544
  - - C:\Windows\explorer.exe
      explorer.exe /select,"C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\data\logs\scan_error.log"
      4⤵
      PID:628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe /select,"C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\data\logs\scan_error.log""
    3⤵
    PID:1288
  - - C:\Windows\explorer.exe
      explorer.exe /select,"C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\data\logs\scan_error.log"
      4⤵
      PID:2480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe /select,"C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\data\logs\scan_error.log""
    3⤵
    PID:4148
  - - C:\Windows\explorer.exe
      explorer.exe /select,"C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\data\logs\scan_error.log"
      4⤵
      PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe /select,"C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\data\logs\scan_error.log""
    3⤵
    PID:3904
  - - C:\Windows\explorer.exe
      explorer.exe /select,"C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\data\logs\scan_error.log"
      4⤵
      PID:1120
- C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\Goby.exe
  "C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\Goby.exe" --type=gpu-process --field-trial-handle=1484,7276437405792593471,9657248040149123390,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox=true --user-data-dir="C:\Users\Admin\AppData\Roaming\Goby" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1556 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5008
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{de41f7a9-3f0a-e648-b98f-326626ff0374}\NPCAP.inf" "9" "405306be3" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\Npcap"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1224

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4580

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3896

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\Npcap\npcap.cat

Filesize
12KB

MD5
e3d66e1e2baff679677d469c606160a9

SHA1
5c93d82a269008200f69c074629b6069a15d5dc1

SHA256
439a357b97b5c5e8807a220417adf37ddb58ef9ef10967754e91c2d4c29554b6

SHA512
fa0930464324d870697a88ab84d3e7acc47c2141d6e2eb8dc68c80a6b93bbb71318e536e4f7e9f69b022b7edde6f2dfede011cbb98a6277157045bc1c1b5bc57

Download Submit
C:\PROGRA~1\Npcap\npcap.sys

Filesize
71KB

MD5
ca9ebb9a6cf542635a70c82164adb200

SHA1
08070f574378a0512c66a757301936959841e2e3

SHA256
3a73a86559a6fd6245a8c55cf677e6d3b09957156086da7f0636ebff4c61f7b9

SHA512
139666c0efa627307736c3903f6ab37647f0754876c1056757168136ad2f80b23da4b5f2cb6f1483b5b574d6fca0c05d5be6dfe256a2c2346f4abdbc81599a13

Download Submit
C:\Program Files\Npcap\NPCAP.inf

Filesize
8KB

MD5
33b22d723069338b774e31dfed393376

SHA1
7fcde54e03a4d2597c32219c3276333920add800

SHA256
fce275f2964e1dc93ede4c55e5d418a546603335397ed9da33303251892d8b48

SHA512
bb6c6eea8c4fa0d9320c185688d719c9e0f40b1b659dbcf2e33da9ff4d4011063717db8e569fdea22e239cab75b91dbda14bb5fb8ca21fb5817219340c392173

Download Submit
C:\Program Files\Npcap\NPCAP_wfp.inf

Filesize
2KB

MD5
268dfa274db647ec6c985d0aed993927

SHA1
359d39ab810bee74b4303146f4a2219ba6ba1b2b

SHA256
5ac11aa3c51ceaa620ea8463f6e36df13423472f5489b2addb7483974368701b

SHA512
64e7c0de9c2f589392c85bd6f779b24d8d57baf22e4006fd6281415ee783af9904e243b10207275fb395b5f3e36b27283b07a18baad3ccdf87adb0f812ca6026

Download Submit
C:\Program Files\Npcap\NPFInstall.exe

Filesize
288KB

MD5
00e02670e72c918dcd5656ecb083049c

SHA1
6ce8b5bb566ff9bca832187f53f57e8c1fcd3742

SHA256
b394d6508579449c63b9a220f62aedd9dff25e03afa1716c62c8d5dfd35ed114

SHA512
0cbbafae0bbe02ff6b2c96e69374f3e6df4b6f2393ccbb73cd460febee9e862c63cd3752828396648521632e24552e5411279f02247d63deedc3d8c856c298ea

Download Submit
C:\Program Files\Npcap\NPFInstall.exe

Filesize
288KB

MD5
00e02670e72c918dcd5656ecb083049c

SHA1
6ce8b5bb566ff9bca832187f53f57e8c1fcd3742

SHA256
b394d6508579449c63b9a220f62aedd9dff25e03afa1716c62c8d5dfd35ed114

SHA512
0cbbafae0bbe02ff6b2c96e69374f3e6df4b6f2393ccbb73cd460febee9e862c63cd3752828396648521632e24552e5411279f02247d63deedc3d8c856c298ea

Download Submit
C:\Program Files\Npcap\NPFInstall.exe

Filesize
288KB

MD5
00e02670e72c918dcd5656ecb083049c

SHA1
6ce8b5bb566ff9bca832187f53f57e8c1fcd3742

SHA256
b394d6508579449c63b9a220f62aedd9dff25e03afa1716c62c8d5dfd35ed114

SHA512
0cbbafae0bbe02ff6b2c96e69374f3e6df4b6f2393ccbb73cd460febee9e862c63cd3752828396648521632e24552e5411279f02247d63deedc3d8c856c298ea

Download Submit
C:\Program Files\Npcap\NPFInstall.exe

Filesize
288KB

MD5
00e02670e72c918dcd5656ecb083049c

SHA1
6ce8b5bb566ff9bca832187f53f57e8c1fcd3742

SHA256
b394d6508579449c63b9a220f62aedd9dff25e03afa1716c62c8d5dfd35ed114

SHA512
0cbbafae0bbe02ff6b2c96e69374f3e6df4b6f2393ccbb73cd460febee9e862c63cd3752828396648521632e24552e5411279f02247d63deedc3d8c856c298ea

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
2KB

MD5
d8839cb222941eb3aee80722d26eaed1

SHA1
a46053cdaf55911960e490d23b665181c6304dc1

SHA256
5fc609ed53f7d483c3ba39f6a7229036c975004186e7f505317464f43f6e2b20

SHA512
136ea444b080488ea1e3477d545c34cee15cc3a806fc9603d02979082bd8b9e8537b2559893d9f00e078bb41c0c5693c1f087aa4be7a33c9e55facc9875a883c

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
3KB

MD5
f4e166c25b163329d62b5c0d9bc8c6d8

SHA1
9c54b796099d5582933d1b6be31f2ebb0d06cc32

SHA256
daa81e1855c31696c2aa377ce735d60af68ae4a326ad1545e2787fc445ba1dcc

SHA512
2882bd3e0af119d261228badd6a0e38e3dcae2911ed0d2bd2f82000c59e8c11bd2fcfbd7bc8cc269596f59bb94d6a07d81487971a5f73b87f809902eeb9164e4

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
4KB

MD5
6875c43a31666755793d99c63f6db5a4

SHA1
f27e04165f139ea427232599fadb09ee1498191f

SHA256
e5173b70f72a2b3e4c82262d6a43a68040e96046283946204829d782d32ecf05

SHA512
8215461d256759462469b89b53e45a467b3505f53e438e5eeabb00d59a39fda1d34926059d420387dd63212f16588af89436c02ef48b56a07cbb803820ba40ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
def65711d78669d7f8e69313be4acf2e

SHA1
6522ebf1de09eeb981e270bd95114bc69a49cda6

SHA256
aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

SHA512
05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f647a9024e00f209b4882586b48a6d1c

SHA1
825a1e51260086c4261315dbc9704e1848fe5ff7

SHA256
77614c9d1cb42c41c0ce0415aecc9a20823ba79bdcdb8a27e90be7a16c57229b

SHA512
84961cc97defa398b0053b40453db58198b3e5bd2ad59770707ed11eb282eff479664253e616427826b40377e6486cdc1676369324617e5b5b0262b904f2ca9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
89fa224638f02cfe9a66bc7c46782720

SHA1
02a182ea5e2c3e9ac05dcf276a23c7722399f697

SHA256
25c83903ec97e63635b8fd183db6e6265708d9e69450add9bbc51916439130dd

SHA512
f7f00698780937e00a3e3ae09c1bfb332f90cf44a84bd374aa338a7b5058e35595a8192ec840b58bc704e6053a40ee57d000771fe5d62096e032f3f4087d4d01

Download Submit
C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\golib\scan.sqlite3

Filesize
4KB

MD5
52cd5dca0f8a19ec8a39f01af7a85a0a

SHA1
d9509ed05ea4a6ca8c3958f1954658894d40ceb2

SHA256
ec6a6ae6515666114f6463ab36ab1b410272795f4b7d9f19b667d56f0272c7e7

SHA512
e580571cdca9088a61f281b044014e949c0618623b23fbc84b083b0ef35c1642434c41eea839c44affe44e6043b3214a65abfd96bbed612901308b7c7a13a20e

Download Submit
C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\golib\scan.sqlite3

Filesize
456KB

MD5
d56c17ffb79d9013fe73fc1d62bc2fee

SHA1
8407f5090a957aacfd8af725d391bdd7e4f17d8c

SHA256
66892033677d7285955646966c218fa3ed98bf7f5abbe6067612c601006ccc6f

SHA512
68d3ff13e1bdca6c0c1b978bebc5a2bd0ed81c073cff091321c4b0520219dcca16a7018a23b7f7fe19f10bf173b802bd426a1ec4e21c00884c4323dc12b75396

Download Submit
C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\golib\scan.sqlite3-wal

Filesize
245KB

MD5
9e3be1a147f4ce0d61678a2c614e7907

SHA1
c472acd50b81683d1222be423db1b69d67d4ca7a

SHA256
34c3e5153e3b2a5013228069e26bd45ff2b00d4fc0a9f896e7430738a8fe7d0e

SHA512
c5ae490560522aa7aff265175bf888a0cdf269dde41b401c8b712c2d2d0a6f99d70aec524394015b97f78b5b80ed180c0dbcc6f001cdae655eb13bcfabeaabd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\goby-win-x64-2.0.5-redteam-cracked_by_hlop\golib\scan.sqlite3-wal

Filesize
3.9MB

MD5
3b37a439dc901681634895e932b298ee

SHA1
94cce856b508fcd1ee11244daa6dc747321d1c0f

SHA256
44f83e789c44aa131d3f18f7cff87bf79bb44a1c5dadc2637028143760118ec8

SHA512
3763803e98a105b1259e890aea2612b38703fb2e901e45890bbd7feaa7e7c368fd9f1af84eaa6ca9b93011d3bb7e2da74fa7760e942dc2fdf05bc60d6ad63b70

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\InstallOptions.dll

Filesize
22KB

MD5
170c17ac80215d0a377b42557252ae10

SHA1
4cbab6cc189d02170dd3ba7c25aa492031679411

SHA256
61ea114d9d0cd1e884535095aa3527a6c28df55a4ecee733c8c398f50b84cc3d

SHA512
0fd65cad0fcaa98083c2021de3d6429e79978658809c62ae9e4ed630c016915ced36aa52f2f692986c3b600c92325e79fd6d757634e8e02d5e582ff03679163f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\InstallOptions.dll

Filesize
22KB

MD5
170c17ac80215d0a377b42557252ae10

SHA1
4cbab6cc189d02170dd3ba7c25aa492031679411

SHA256
61ea114d9d0cd1e884535095aa3527a6c28df55a4ecee733c8c398f50b84cc3d

SHA512
0fd65cad0fcaa98083c2021de3d6429e79978658809c62ae9e4ed630c016915ced36aa52f2f692986c3b600c92325e79fd6d757634e8e02d5e582ff03679163f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\InstallOptions.dll

Filesize
22KB

MD5
170c17ac80215d0a377b42557252ae10

SHA1
4cbab6cc189d02170dd3ba7c25aa492031679411

SHA256
61ea114d9d0cd1e884535095aa3527a6c28df55a4ecee733c8c398f50b84cc3d

SHA512
0fd65cad0fcaa98083c2021de3d6429e79978658809c62ae9e4ed630c016915ced36aa52f2f692986c3b600c92325e79fd6d757634e8e02d5e582ff03679163f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\InstallOptions.dll

Filesize
22KB

MD5
170c17ac80215d0a377b42557252ae10

SHA1
4cbab6cc189d02170dd3ba7c25aa492031679411

SHA256
61ea114d9d0cd1e884535095aa3527a6c28df55a4ecee733c8c398f50b84cc3d

SHA512
0fd65cad0fcaa98083c2021de3d6429e79978658809c62ae9e4ed630c016915ced36aa52f2f692986c3b600c92325e79fd6d757634e8e02d5e582ff03679163f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\NPFInstall.exe

Filesize
288KB

MD5
00e02670e72c918dcd5656ecb083049c

SHA1
6ce8b5bb566ff9bca832187f53f57e8c1fcd3742

SHA256
b394d6508579449c63b9a220f62aedd9dff25e03afa1716c62c8d5dfd35ed114

SHA512
0cbbafae0bbe02ff6b2c96e69374f3e6df4b6f2393ccbb73cd460febee9e862c63cd3752828396648521632e24552e5411279f02247d63deedc3d8c856c298ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\NPFInstall.exe

Filesize
288KB

MD5
00e02670e72c918dcd5656ecb083049c

SHA1
6ce8b5bb566ff9bca832187f53f57e8c1fcd3742

SHA256
b394d6508579449c63b9a220f62aedd9dff25e03afa1716c62c8d5dfd35ed114

SHA512
0cbbafae0bbe02ff6b2c96e69374f3e6df4b6f2393ccbb73cd460febee9e862c63cd3752828396648521632e24552e5411279f02247d63deedc3d8c856c298ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\System.dll

Filesize
19KB

MD5
f020a8d9ede1fb2af3651ad6e0ac9cb1

SHA1
341f9345d669432b2a51d107cbd101e8b82e37b1

SHA256
7efe73a8d32ed1b01727ad4579e9eec49c9309f2cb7bf03c8afa80d70242d1c0

SHA512
408fa5a797d3ff4b917bb4107771687004ba507a33cb5944b1cc3155e0372cb3e04a147f73852b9134f138ff709af3b0fb493cd8fa816c59e9f3d9b5649c68c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\nsExec.dll

Filesize
14KB

MD5
f9e61a25016dcb49867477c1e71a704e

SHA1
c01dc1fa7475e4812d158d6c00533410c597b5d9

SHA256
274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

SHA512
b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\nsExec.dll

Filesize
14KB

MD5
f9e61a25016dcb49867477c1e71a704e

SHA1
c01dc1fa7475e4812d158d6c00533410c597b5d9

SHA256
274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

SHA512
b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\nsExec.dll

Filesize
14KB

MD5
f9e61a25016dcb49867477c1e71a704e

SHA1
c01dc1fa7475e4812d158d6c00533410c597b5d9

SHA256
274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

SHA512
b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\nsExec.dll

Filesize
14KB

MD5
f9e61a25016dcb49867477c1e71a704e

SHA1
c01dc1fa7475e4812d158d6c00533410c597b5d9

SHA256
274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

SHA512
b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\nsExec.dll

Filesize
14KB

MD5
f9e61a25016dcb49867477c1e71a704e

SHA1
c01dc1fa7475e4812d158d6c00533410c597b5d9

SHA256
274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

SHA512
b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\nsExec.dll

Filesize
14KB

MD5
f9e61a25016dcb49867477c1e71a704e

SHA1
c01dc1fa7475e4812d158d6c00533410c597b5d9

SHA256
274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

SHA512
b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\nsExec.dll

Filesize
14KB

MD5
f9e61a25016dcb49867477c1e71a704e

SHA1
c01dc1fa7475e4812d158d6c00533410c597b5d9

SHA256
274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

SHA512
b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\nsExec.dll

Filesize
14KB

MD5
f9e61a25016dcb49867477c1e71a704e

SHA1
c01dc1fa7475e4812d158d6c00533410c597b5d9

SHA256
274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

SHA512
b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\roots.p7b

Filesize
1KB

MD5
397a5848d3696fc6ba0823088fea83db

SHA1
9189985f027de80d4882ab5e01604c59d6fc1f16

SHA256
ad3bca6f2b0ec032c7f1fe1adb186bd73be6a332c868bf16c9765087fff1c1ca

SHA512
66129a206990753967cd98c14a0a3e0e2a73bc4cd10cf84a5a05da7bf20719376989d64c6c7880a3e4754fc74653dd49f2ffeffd55fc4ee5966f65beb857118c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB12C.tmp\signing.p7b

Filesize
7KB

MD5
dd4bc901ef817319791337fb345932e8

SHA1
f8a3454a09d90a09273935020c1418fdb7b7eb7c

SHA256
8e681692403c0f7c0b24160f4642daa1eb080ce5ec754b6f47cc56b43e731b71

SHA512
0a67cc346f9752e1c868b7dc60b25704255ab1e6ea745850c069212f2724eba62ffaaa48309d5eba6ae0235223518610fb4b60fc422e4babba4f33d331c71db5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{DE41F~1\npcap.cat

Filesize
12KB

MD5
e3d66e1e2baff679677d469c606160a9

SHA1
5c93d82a269008200f69c074629b6069a15d5dc1

SHA256
439a357b97b5c5e8807a220417adf37ddb58ef9ef10967754e91c2d4c29554b6

SHA512
fa0930464324d870697a88ab84d3e7acc47c2141d6e2eb8dc68c80a6b93bbb71318e536e4f7e9f69b022b7edde6f2dfede011cbb98a6277157045bc1c1b5bc57

Download Submit
C:\Users\Admin\AppData\Local\Temp\{DE41F~1\npcap.sys

Filesize
71KB

MD5
ca9ebb9a6cf542635a70c82164adb200

SHA1
08070f574378a0512c66a757301936959841e2e3

SHA256
3a73a86559a6fd6245a8c55cf677e6d3b09957156086da7f0636ebff4c61f7b9

SHA512
139666c0efa627307736c3903f6ab37647f0754876c1056757168136ad2f80b23da4b5f2cb6f1483b5b574d6fca0c05d5be6dfe256a2c2346f4abdbc81599a13

Download Submit
C:\Users\Admin\AppData\Local\Temp\{de41f7a9-3f0a-e648-b98f-326626ff0374}\NPCAP.inf

Filesize
8KB

MD5
33b22d723069338b774e31dfed393376

SHA1
7fcde54e03a4d2597c32219c3276333920add800

SHA256
fce275f2964e1dc93ede4c55e5d418a546603335397ed9da33303251892d8b48

SHA512
bb6c6eea8c4fa0d9320c185688d719c9e0f40b1b659dbcf2e33da9ff4d4011063717db8e569fdea22e239cab75b91dbda14bb5fb8ca21fb5817219340c392173

Download Submit
C:\Users\Admin\Downloads\npcap-1.60.exe

Filesize
1.0MB

MD5
3081d2266918768da067a99f767e2a0b

SHA1
c1844016b5e991449ee1e62d44a312065d83e354

SHA256
87d3624772b8272767a3a4ffcceecc3052489cd09e494a6c352dce5e5efa4070

SHA512
e4c09130ac0124770014c7224e543c93fe473836c28a03466f5130bbbd61f7ddad5106bc10f82036028aabb76c5c2a31d40296ae818ed9f178f6ac96d68fe448

Download Submit
C:\Users\Admin\Downloads\npcap-1.60.exe

Filesize
1.0MB

MD5
3081d2266918768da067a99f767e2a0b

SHA1
c1844016b5e991449ee1e62d44a312065d83e354

SHA256
87d3624772b8272767a3a4ffcceecc3052489cd09e494a6c352dce5e5efa4070

SHA512
e4c09130ac0124770014c7224e543c93fe473836c28a03466f5130bbbd61f7ddad5106bc10f82036028aabb76c5c2a31d40296ae818ed9f178f6ac96d68fe448

Download Submit
C:\Windows\INF\oem2.inf

Filesize
8KB

MD5
33b22d723069338b774e31dfed393376

SHA1
7fcde54e03a4d2597c32219c3276333920add800

SHA256
fce275f2964e1dc93ede4c55e5d418a546603335397ed9da33303251892d8b48

SHA512
bb6c6eea8c4fa0d9320c185688d719c9e0f40b1b659dbcf2e33da9ff4d4011063717db8e569fdea22e239cab75b91dbda14bb5fb8ca21fb5817219340c392173

Download Submit
C:\Windows\SYSTEM32\drivers\NPCAP.sys

Filesize
71KB

MD5
ca9ebb9a6cf542635a70c82164adb200

SHA1
08070f574378a0512c66a757301936959841e2e3

SHA256
3a73a86559a6fd6245a8c55cf677e6d3b09957156086da7f0636ebff4c61f7b9

SHA512
139666c0efa627307736c3903f6ab37647f0754876c1056757168136ad2f80b23da4b5f2cb6f1483b5b574d6fca0c05d5be6dfe256a2c2346f4abdbc81599a13

Download Submit
C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_7abd107f8e2977e7\npcap.inf

Filesize
8KB

MD5
33b22d723069338b774e31dfed393376

SHA1
7fcde54e03a4d2597c32219c3276333920add800

SHA256
fce275f2964e1dc93ede4c55e5d418a546603335397ed9da33303251892d8b48

SHA512
bb6c6eea8c4fa0d9320c185688d719c9e0f40b1b659dbcf2e33da9ff4d4011063717db8e569fdea22e239cab75b91dbda14bb5fb8ca21fb5817219340c392173

Download Submit
C:\Windows\System32\Npcap\Packet.dll

Filesize
201KB

MD5
5fc00659d63dc1f6d3ea47ad282ff3d2

SHA1
cf1c989875a1a98c3ff4af0b469ee863636d1f06

SHA256
3dec61995d23d603224c67c41a1f49fe39d9c7c174a92a387bc5507a3ceba863

SHA512
8a00bdd0730a1922c9d29f4a202592c4088798dd767c927ce50b8625c71afb0f3e350e0a6f8d880fb6900f2ff6c9ad8134d8e352cdda97915be4ff28c0778d33

Download Submit
C:\Windows\System32\Npcap\Packet.dll

Filesize
201KB

MD5
5fc00659d63dc1f6d3ea47ad282ff3d2

SHA1
cf1c989875a1a98c3ff4af0b469ee863636d1f06

SHA256
3dec61995d23d603224c67c41a1f49fe39d9c7c174a92a387bc5507a3ceba863

SHA512
8a00bdd0730a1922c9d29f4a202592c4088798dd767c927ce50b8625c71afb0f3e350e0a6f8d880fb6900f2ff6c9ad8134d8e352cdda97915be4ff28c0778d33

Download Submit
C:\Windows\System32\Npcap\wpcap.dll

Filesize
452KB

MD5
39473870c6054c3618a703123692aa39

SHA1
04ce393dec066328fd531ea76a414244a6f1c6c0

SHA256
678fc5516c47dd2518732818027bb481414be3627b59faf0d4e3dfc949b81811

SHA512
3224e1b13c5b531a84bb3cd72d802b07d36b24c11d4be4b89872c9c8391d14b2d79d9a409ea1bd0f11c70d471576fbd1b97c233ab46de184face1de3572f4dab

Download Submit
C:\Windows\System32\Npcap\wpcap.dll

Filesize
452KB

MD5
39473870c6054c3618a703123692aa39

SHA1
04ce393dec066328fd531ea76a414244a6f1c6c0

SHA256
678fc5516c47dd2518732818027bb481414be3627b59faf0d4e3dfc949b81811

SHA512
3224e1b13c5b531a84bb3cd72d802b07d36b24c11d4be4b89872c9c8391d14b2d79d9a409ea1bd0f11c70d471576fbd1b97c233ab46de184face1de3572f4dab

Download Submit
C:\Windows\system32\Npcap\packet.dll

Filesize
201KB

MD5
5fc00659d63dc1f6d3ea47ad282ff3d2

SHA1
cf1c989875a1a98c3ff4af0b469ee863636d1f06

SHA256
3dec61995d23d603224c67c41a1f49fe39d9c7c174a92a387bc5507a3ceba863

SHA512
8a00bdd0730a1922c9d29f4a202592c4088798dd767c927ce50b8625c71afb0f3e350e0a6f8d880fb6900f2ff6c9ad8134d8e352cdda97915be4ff28c0778d33

Download Submit
C:\Windows\system32\Npcap\wpcap.dll

Filesize
452KB

MD5
39473870c6054c3618a703123692aa39

SHA1
04ce393dec066328fd531ea76a414244a6f1c6c0

SHA256
678fc5516c47dd2518732818027bb481414be3627b59faf0d4e3dfc949b81811

SHA512
3224e1b13c5b531a84bb3cd72d802b07d36b24c11d4be4b89872c9c8391d14b2d79d9a409ea1bd0f11c70d471576fbd1b97c233ab46de184face1de3572f4dab

Download Submit
memory/1404-240-0x0000000006910000-0x000000000692E000-memory.dmp

Filesize
120KB

Download
memory/1404-238-0x0000000006930000-0x0000000006962000-memory.dmp

Filesize
200KB

Download
memory/1404-239-0x000000006FFA0000-0x000000006FFEC000-memory.dmp

Filesize
304KB

Download
memory/1404-242-0x00000000076F0000-0x00000000076FA000-memory.dmp

Filesize
40KB

Download
memory/1404-241-0x0000000007D10000-0x000000000838A000-memory.dmp

Filesize
6.5MB

Download
memory/1700-226-0x0000000004AB0000-0x0000000004AD2000-memory.dmp

Filesize
136KB

Download
memory/1700-228-0x0000000005420000-0x0000000005486000-memory.dmp

Filesize
408KB

Download
memory/1700-233-0x0000000007070000-0x0000000007614000-memory.dmp

Filesize
5.6MB

Download
memory/1700-225-0x0000000004C90000-0x00000000052B8000-memory.dmp

Filesize
6.2MB

Download
memory/1700-232-0x0000000005FB0000-0x0000000005FD2000-memory.dmp

Filesize
136KB

Download
memory/1700-227-0x00000000052C0000-0x0000000005326000-memory.dmp

Filesize
408KB

Download
memory/1700-220-0x00000000044D0000-0x0000000004506000-memory.dmp

Filesize
216KB

Download
memory/1700-229-0x0000000005A60000-0x0000000005A7E000-memory.dmp

Filesize
120KB

Download
memory/1700-230-0x0000000006A20000-0x0000000006AB6000-memory.dmp

Filesize
600KB

Download
memory/1700-231-0x0000000005F60000-0x0000000005F7A000-memory.dmp

Filesize
104KB

Download