gh0strat | 4f5a8b7ca30c757f4cfcbd338d79dd06ebb6db62451845d7b53f38c54ad7da7a

Analysis

max time kernel
100s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2022 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f5a8b7ca30c757f4cfcbd338d79dd06ebb6db62451845d7b53f38c54ad7da7a.msi
Size

13.7MB
MD5

afb73daab97a1a8fb156ed34715a01ca
SHA1

ecb0ea164d1d1ceea4a0fb0d06f61345f4a65ac3
SHA256

4f5a8b7ca30c757f4cfcbd338d79dd06ebb6db62451845d7b53f38c54ad7da7a
SHA512

35dec58a6525f91f6edb2cd9ef3e53f76cbee700ac7e489cda85a443835d210cbef4d369eb3084cb4ad8f5a06a281ea35908249ff6a4f566623c99d7c94487e9
SSDEEP

393216:w3Bp4yJDyaxkvEIeg/sczcezXEbpFS+zYeOPuet:WBy0Gax2fbDlzEbpFfzYeO

Score

10^/10

gh0strat purplefox discovery evasion rat rootkit trojan vmprotect

Malware Config

Signatures

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/1884-212-0x0000000000400000-0x00000000006A8000-memory.dmp	purplefox_rootkit
behavioral2/memory/1884-213-0x0000000010000000-0x0000000010192000-memory.dmp	purplefox_rootkit
behavioral2/memory/1884-219-0x0000000000400000-0x00000000006A8000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1884-212-0x0000000000400000-0x00000000006A8000-memory.dmp	family_gh0strat
behavioral2/memory/1884-213-0x0000000010000000-0x0000000010192000-memory.dmp	family_gh0strat
behavioral2/memory/1884-219-0x0000000000400000-0x00000000006A8000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

Processes:

DrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\SETA180.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SETA180.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe

Executes dropped EXE 7 IoCs

Processes:

MSIF5B0.tmpkk.exeletsvpn.exetapinstall.exetapinstall.exetapinstall.exelsp.exe

pid process

524 MSIF5B0.tmp
1036 kk.exe
3524 letsvpn.exe
4168 tapinstall.exe
2432 tapinstall.exe
3556 tapinstall.exe
1884 lsp.exe
Modifies Windows Firewall 1 TTPs 4 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exenetsh.exenetsh.exe

pid process

3008 netsh.exe
240 netsh.exe
5088 netsh.exe
2232 netsh.exe

pid	process
524	MSIF5B0.tmp
1036	kk.exe
3524	letsvpn.exe
4168	tapinstall.exe
2432	tapinstall.exe
3556	tapinstall.exe
1884	lsp.exe

pid	process
3008	netsh.exe
240	netsh.exe
5088	netsh.exe
2232	netsh.exe

VMProtect packed file 14 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Windows\Installer\MSIF5B0.tmp	vmprotect
C:\Windows\Installer\MSIF5B0.tmp	vmprotect
behavioral2/memory/524-136-0x0000000000400000-0x0000000001DFA000-memory.dmp	vmprotect
behavioral2/memory/524-137-0x0000000000400000-0x0000000001DFA000-memory.dmp	vmprotect
C:\Users\Admin\AppData\Local\Temp\kk.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\kk.exe	vmprotect
behavioral2/memory/1036-143-0x0000000000400000-0x0000000000437000-memory.dmp	vmprotect
behavioral2/memory/1036-144-0x0000000000400000-0x0000000000437000-memory.dmp	vmprotect
behavioral2/memory/524-147-0x0000000000400000-0x0000000001DFA000-memory.dmp	vmprotect
C:\Users\Public\Videos\lsp.exe	vmprotect
C:\Users\Public\Videos\lsp.exe	vmprotect
behavioral2/memory/1884-211-0x0000000000400000-0x00000000006A8000-memory.dmp	vmprotect
behavioral2/memory/1884-212-0x0000000000400000-0x00000000006A8000-memory.dmp	vmprotect
behavioral2/memory/1884-219-0x0000000000400000-0x00000000006A8000-memory.dmp	vmprotect

Loads dropped DLL 12 IoCs

Processes:

letsvpn.exe

pid	process
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in System32 directory 16 IoCs

Processes:

DrvInst.exetapinstall.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}\SET71A6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}\SET71B6.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF	tapinstall.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}\SET71B6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}\SET71B7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}\SET71A6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}\oemvista.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}\SET71B7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}\tap0901.sys	DrvInst.exe

Drops file in Program Files directory 64 IoCs

Processes:

letsvpn.exe

description	ioc	process
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Linq.Expressions.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Net.Security.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Reflection.Primitives.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Security.SecureString.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Threading.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\View\Assets\notification_icon.png	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\Mono.Cecil.Pdb.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.IO.MemoryMappedFiles.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Net.Primitives.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Runtime.InteropServices.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Text.Encoding.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\runtimes\win-x86\native\e_sqlite3.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.AppCenter.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.Web.WebView2.Wpf.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Buffers.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\WebSocket4Net.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\x86\WebView2Loader.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.AppCenter.Analytics.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\SQLiteNetExtensionsAsync.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Numerics.Vectors.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\arm64\WebView2Loader.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\ru	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.AppCenter.Analytics.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Runtime.Handles.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\zh-CN\LetsPRO.resources.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.IO.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Numerics.Vectors.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Runtime.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Threading.Thread.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Xml.XmlSerializer.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\SQLiteNetExtensions.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Dynamic.Runtime.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.IO.Pipes.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Net.IPNetwork.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Threading.Overlapped.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\Hardcodet.Wpf.TaskbarNotification.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\Mono.Cecil.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\SQLitePCLRaw.provider.dynamic_cdecl.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.IO.FileSystem.Primitives.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.IO.FileSystem.Watcher.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Threading.ThreadPool.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\arm64\WebView2Loader.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\x86	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\MdXaml.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\zh-TW	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\ICSharpCode.AvalonEdit.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\SharpCompress.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Data.Common.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.IO.Compression.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\ru\LetsPRO.resources.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\zh-MO\LetsPRO.resources.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\driver\tap0901.sys	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.IO.FileSystem.DriveInfo.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.IO.UnmanagedMemoryStream.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.ObjectModel.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Reflection.Extensions.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\zh-TW\LetsPRO.resources.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\ndp462-web.exe	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Collections.Concurrent.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\NuGet.Squirrel.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Buffers.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Net.Requests.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Text.Encoding.Extensions.dll	letsvpn.exe

Drops file in Windows directory 14 IoCs

Processes:

msiexec.exeDrvInst.exetapinstall.exesvchost.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\Installer\SourceHash{D0D5A8D4-2C54-41FD-A0C3-50CC56973D60}	msiexec.exe
File created	C:\Windows\Installer\e56f30f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e56f30f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF4F4.tmp	msiexec.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tapinstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF5B0.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2344 1884 WerFault.exe lsp.exe

pid	pid_target	process	target process
2344	1884	WerFault.exe	lsp.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exeDrvInst.exeDrvInst.exetapinstall.exevssvc.exetapinstall.exetapinstall.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000789d96067ff55f5b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000789d96060000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900789d9606000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

SCHTASKS.exe

pid process

5092 SCHTASKS.exe

pid	process
5092	SCHTASKS.exe

Modifies data under HKEY_USERS 42 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

tapinstall.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	tapinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	rundll32.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

msiexec.exekk.exeletsvpn.exepowershell.exe

pid	process
3208	msiexec.exe
3208	msiexec.exe
1036	kk.exe
1036	kk.exe
1036	kk.exe
1036	kk.exe
1036	kk.exe
1036	kk.exe
1036	kk.exe
1036	kk.exe
1036	kk.exe
1036	kk.exe
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe
4152	powershell.exe
4152	powershell.exe
1036	kk.exe
1036	kk.exe
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe
3524	letsvpn.exe
1036	kk.exe
1036	kk.exe
1036	kk.exe
1036	kk.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exepowershell.exesvchost.exetapinstall.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	636	msiexec.exe
Token: SeSecurityPrivilege	3208	msiexec.exe
Token: SeCreateTokenPrivilege	636	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	636	msiexec.exe
Token: SeLockMemoryPrivilege	636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	636	msiexec.exe
Token: SeMachineAccountPrivilege	636	msiexec.exe
Token: SeTcbPrivilege	636	msiexec.exe
Token: SeSecurityPrivilege	636	msiexec.exe
Token: SeTakeOwnershipPrivilege	636	msiexec.exe
Token: SeLoadDriverPrivilege	636	msiexec.exe
Token: SeSystemProfilePrivilege	636	msiexec.exe
Token: SeSystemtimePrivilege	636	msiexec.exe
Token: SeProfSingleProcessPrivilege	636	msiexec.exe
Token: SeIncBasePriorityPrivilege	636	msiexec.exe
Token: SeCreatePagefilePrivilege	636	msiexec.exe
Token: SeCreatePermanentPrivilege	636	msiexec.exe
Token: SeBackupPrivilege	636	msiexec.exe
Token: SeRestorePrivilege	636	msiexec.exe
Token: SeShutdownPrivilege	636	msiexec.exe
Token: SeDebugPrivilege	636	msiexec.exe
Token: SeAuditPrivilege	636	msiexec.exe
Token: SeSystemEnvironmentPrivilege	636	msiexec.exe
Token: SeChangeNotifyPrivilege	636	msiexec.exe
Token: SeRemoteShutdownPrivilege	636	msiexec.exe
Token: SeUndockPrivilege	636	msiexec.exe
Token: SeSyncAgentPrivilege	636	msiexec.exe
Token: SeEnableDelegationPrivilege	636	msiexec.exe
Token: SeManageVolumePrivilege	636	msiexec.exe
Token: SeImpersonatePrivilege	636	msiexec.exe
Token: SeCreateGlobalPrivilege	636	msiexec.exe
Token: SeBackupPrivilege	844	vssvc.exe
Token: SeRestorePrivilege	844	vssvc.exe
Token: SeAuditPrivilege	844	vssvc.exe
Token: SeBackupPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeRestorePrivilege	3208	msiexec.exe
Token: SeTakeOwnershipPrivilege	3208	msiexec.exe
Token: SeBackupPrivilege	3784	srtasks.exe
Token: SeRestorePrivilege	3784	srtasks.exe
Token: SeSecurityPrivilege	3784	srtasks.exe
Token: SeTakeOwnershipPrivilege	3784	srtasks.exe
Token: SeBackupPrivilege	3784	srtasks.exe
Token: SeRestorePrivilege	3784	srtasks.exe
Token: SeSecurityPrivilege	3784	srtasks.exe
Token: SeTakeOwnershipPrivilege	3784	srtasks.exe
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeAuditPrivilege	3560	svchost.exe
Token: SeSecurityPrivilege	3560	svchost.exe
Token: SeLoadDriverPrivilege	2432	tapinstall.exe
Token: SeRestorePrivilege	2960	DrvInst.exe
Token: SeBackupPrivilege	2960	DrvInst.exe
Token: SeLoadDriverPrivilege	2960	DrvInst.exe
Token: SeLoadDriverPrivilege	2960	DrvInst.exe
Token: SeLoadDriverPrivilege	2960	DrvInst.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

636 msiexec.exe
636 msiexec.exe

pid	process
636	msiexec.exe
636	msiexec.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

msiexec.exeMSIF5B0.tmpletsvpn.exesvchost.exeDrvInst.execmd.execmd.execmd.execmd.exekk.exe

description	pid	process	target process
PID 3208 wrote to memory of 3784	3208	msiexec.exe	srtasks.exe
PID 3208 wrote to memory of 3784	3208	msiexec.exe	srtasks.exe
PID 3208 wrote to memory of 524	3208	msiexec.exe	MSIF5B0.tmp
PID 3208 wrote to memory of 524	3208	msiexec.exe	MSIF5B0.tmp
PID 3208 wrote to memory of 524	3208	msiexec.exe	MSIF5B0.tmp
PID 524 wrote to memory of 1036	524	MSIF5B0.tmp	kk.exe
PID 524 wrote to memory of 1036	524	MSIF5B0.tmp	kk.exe
PID 524 wrote to memory of 1036	524	MSIF5B0.tmp	kk.exe
PID 524 wrote to memory of 3524	524	MSIF5B0.tmp	letsvpn.exe
PID 524 wrote to memory of 3524	524	MSIF5B0.tmp	letsvpn.exe
PID 524 wrote to memory of 3524	524	MSIF5B0.tmp	letsvpn.exe
PID 3524 wrote to memory of 4152	3524	letsvpn.exe	powershell.exe
PID 3524 wrote to memory of 4152	3524	letsvpn.exe	powershell.exe
PID 3524 wrote to memory of 4152	3524	letsvpn.exe	powershell.exe
PID 3524 wrote to memory of 4168	3524	letsvpn.exe	tapinstall.exe
PID 3524 wrote to memory of 4168	3524	letsvpn.exe	tapinstall.exe
PID 3524 wrote to memory of 2432	3524	letsvpn.exe	tapinstall.exe
PID 3524 wrote to memory of 2432	3524	letsvpn.exe	tapinstall.exe
PID 3560 wrote to memory of 2400	3560	svchost.exe	DrvInst.exe
PID 3560 wrote to memory of 2400	3560	svchost.exe	DrvInst.exe
PID 2400 wrote to memory of 5000	2400	DrvInst.exe	rundll32.exe
PID 2400 wrote to memory of 5000	2400	DrvInst.exe	rundll32.exe
PID 3560 wrote to memory of 2960	3560	svchost.exe	DrvInst.exe
PID 3560 wrote to memory of 2960	3560	svchost.exe	DrvInst.exe
PID 3524 wrote to memory of 3084	3524	letsvpn.exe	cmd.exe
PID 3524 wrote to memory of 3084	3524	letsvpn.exe	cmd.exe
PID 3524 wrote to memory of 3084	3524	letsvpn.exe	cmd.exe
PID 3084 wrote to memory of 3008	3084	cmd.exe	netsh.exe
PID 3084 wrote to memory of 3008	3084	cmd.exe	netsh.exe
PID 3084 wrote to memory of 3008	3084	cmd.exe	netsh.exe
PID 3524 wrote to memory of 1752	3524	letsvpn.exe	cmd.exe
PID 3524 wrote to memory of 1752	3524	letsvpn.exe	cmd.exe
PID 3524 wrote to memory of 1752	3524	letsvpn.exe	cmd.exe
PID 1752 wrote to memory of 240	1752	cmd.exe	netsh.exe
PID 1752 wrote to memory of 240	1752	cmd.exe	netsh.exe
PID 1752 wrote to memory of 240	1752	cmd.exe	netsh.exe
PID 3524 wrote to memory of 5112	3524	letsvpn.exe	cmd.exe
PID 3524 wrote to memory of 5112	3524	letsvpn.exe	cmd.exe
PID 3524 wrote to memory of 5112	3524	letsvpn.exe	cmd.exe
PID 5112 wrote to memory of 5088	5112	cmd.exe	netsh.exe
PID 5112 wrote to memory of 5088	5112	cmd.exe	netsh.exe
PID 5112 wrote to memory of 5088	5112	cmd.exe	netsh.exe
PID 3524 wrote to memory of 448	3524	letsvpn.exe	cmd.exe
PID 3524 wrote to memory of 448	3524	letsvpn.exe	cmd.exe
PID 3524 wrote to memory of 448	3524	letsvpn.exe	cmd.exe
PID 448 wrote to memory of 2232	448	cmd.exe	netsh.exe
PID 448 wrote to memory of 2232	448	cmd.exe	netsh.exe
PID 448 wrote to memory of 2232	448	cmd.exe	netsh.exe
PID 3524 wrote to memory of 3556	3524	letsvpn.exe	tapinstall.exe
PID 3524 wrote to memory of 3556	3524	letsvpn.exe	tapinstall.exe
PID 1036 wrote to memory of 1884	1036	kk.exe	lsp.exe
PID 1036 wrote to memory of 1884	1036	kk.exe	lsp.exe
PID 1036 wrote to memory of 1884	1036	kk.exe	lsp.exe
PID 1036 wrote to memory of 5092	1036	kk.exe	SCHTASKS.exe
PID 1036 wrote to memory of 5092	1036	kk.exe	SCHTASKS.exe
PID 1036 wrote to memory of 5092	1036	kk.exe	SCHTASKS.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4f5a8b7ca30c757f4cfcbd338d79dd06ebb6db62451845d7b53f38c54ad7da7a.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:636

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\Windows\Installer\MSIF5B0.tmp
"C:\Windows\Installer\MSIF5B0.tmp"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524

C:\Users\Admin\AppData\Local\Temp\kk.exe
C:\Users\Admin\AppData\Local\Temp\kk.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1036

C:\Users\Public\Videos\lsp.exe
C:\Users\Public\Videos\lsp.exe
4⤵
- Executes dropped EXE
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 252
5⤵
- Program crash
PID:2344

C:\Windows\SysWOW64\SCHTASKS.exe
SCHTASKS /Create /SC ONLOGON /TN active /F /RL HIGHEST /TR C:\Users\Public\Pictures\15824\ttvip.exe
4⤵
- Creates scheduled task(s)
PID:5092

C:\Users\Admin\AppData\Local\Temp\letsvpn.exe
C:\Users\Admin\AppData\Local\Temp\letsvpn.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3524

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4168

C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\SysWOW64\cmd.exe
cmd /c netsh advfirewall firewall Delete rule name=lets
4⤵
- Suspicious use of WriteProcessMemory
PID:3084

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall Delete rule name=lets
5⤵
- Modifies Windows Firewall
PID:3008

C:\Windows\SysWOW64\cmd.exe
cmd /c netsh advfirewall firewall Delete rule name=lets.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall Delete rule name=lets.exe
5⤵
- Modifies Windows Firewall
PID:240

C:\Windows\SysWOW64\cmd.exe
cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:5112

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall Delete rule name=LetsPRO.exe
5⤵
- Modifies Windows Firewall
PID:5088

C:\Windows\SysWOW64\cmd.exe
cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
4⤵
- Suspicious use of WriteProcessMemory
PID:448

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall Delete rule name=LetsPRO
5⤵
- Modifies Windows Firewall
PID:2232

C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2e76d02f-2719-d54f-b957-3cce2235a8eb}\oemvista.inf" "9" "4d14a44ff" "0000000000000144" "WinSta0\Default" "0000000000000154" "208" "c:\program files (x86)\letsvpn\driver"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2400

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{d6926b38-e8bd-4f4e-bf14-39bb4b80f65a} Global\{503854c5-a3f5-be4e-963c-53aeba5f4f24} C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}\tap0901.cat
3⤵
- Modifies system certificate store
PID:5000

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000015C"
2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1884 -ip 1884
1⤵
PID:3980

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
Filesize
318B

MD5
b34636a4e04de02d079ba7325e7565f0

SHA1
f32c1211eac22409bb195415cb5a8063431f75cd

SHA256
a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df

SHA512
6eb3255e3c89e2894f0085095fb5f6ab97349f0ed63c267820c82916f43a0ac014a94f98c186ff5d54806469a00c3c700a34d26de90afb090b80ac824a05aa2f

Download Submit
C:\Program Files (x86)\letsvpn\driver\OemVista.inf
Filesize
7KB

MD5
87868193626dc756d10885f46d76f42e

SHA1
94a5ce8ed7633ed77531b6cb14ceb1927c5cae1f

SHA256
b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41

SHA512
79751330bed5c16d66baf3e5212be0950f312ffd5b80b78be66eaea3cc7115f8a9472d2a43b5ce702aa044f3b45fd572775ff86572150df91cc27866f88f8277

Download Submit
C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Filesize
90KB

MD5
d10f74d86cd350732657f542df533f82

SHA1
c54074f8f162a780819175e7169c43f6706ad46c

SHA256
c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67

SHA512
0d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e

Download Submit
C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Filesize
90KB

MD5
d10f74d86cd350732657f542df533f82

SHA1
c54074f8f162a780819175e7169c43f6706ad46c

SHA256
c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67

SHA512
0d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e

Download Submit
C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Filesize
90KB

MD5
d10f74d86cd350732657f542df533f82

SHA1
c54074f8f162a780819175e7169c43f6706ad46c

SHA256
c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67

SHA512
0d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e

Download Submit
C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Filesize
90KB

MD5
d10f74d86cd350732657f542df533f82

SHA1
c54074f8f162a780819175e7169c43f6706ad46c

SHA256
c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67

SHA512
0d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\kk.exe
Filesize
75KB

MD5
6050e96866489fe27ed9babad1857036

SHA1
64f2bbb3e24a665b119fed0aea149eda7723ca24

SHA256
7b1e8fe7a9f17c6225df8151506724c6ad2d7e469593bb4095427ee430b617ad

SHA512
ce528812778066db7323e0ebce59ec350574713260abd8e9cfbabbff94ec6dad2c6beeb8998c2e7fcb62938a57a3e13596ea23407551563ab22624f7a89cd809

Download Submit
C:\Users\Admin\AppData\Local\Temp\kk.exe
Filesize
75KB

MD5
6050e96866489fe27ed9babad1857036

SHA1
64f2bbb3e24a665b119fed0aea149eda7723ca24

SHA256
7b1e8fe7a9f17c6225df8151506724c6ad2d7e469593bb4095427ee430b617ad

SHA512
ce528812778066db7323e0ebce59ec350574713260abd8e9cfbabbff94ec6dad2c6beeb8998c2e7fcb62938a57a3e13596ea23407551563ab22624f7a89cd809

Download Submit
C:\Users\Admin\AppData\Local\Temp\letsvpn.exe
Filesize
12.3MB

MD5
8834ec8d35669dd623ba5c6986ff2748

SHA1
1a475633f1ea1ab47edb1c030ce2ea933c0a934c

SHA256
addd2cd8d45632e65f49b6ce71614af32332741307be5a02f16015af13090cf2

SHA512
00b3578f4e79a5af041dc2364b2cbcc73930c5d1893b3646d8eb652c89573773abc9dc9bf1de2aff05053942a1615cbe17c0ed6ce0e019b649f0b11301cbcf4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\letsvpn.exe
Filesize
12.3MB

MD5
8834ec8d35669dd623ba5c6986ff2748

SHA1
1a475633f1ea1ab47edb1c030ce2ea933c0a934c

SHA256
addd2cd8d45632e65f49b6ce71614af32332741307be5a02f16015af13090cf2

SHA512
00b3578f4e79a5af041dc2364b2cbcc73930c5d1893b3646d8eb652c89573773abc9dc9bf1de2aff05053942a1615cbe17c0ed6ce0e019b649f0b11301cbcf4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxD7E.tmp\System.dll
Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxD7E.tmp\nsDialogs.dll
Filesize
9KB

MD5
ca95c9da8cef7062813b989ab9486201

SHA1
c555af25df3de51aa18d487d47408d5245dba2d1

SHA256
feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be

SHA512
a30d94910204d1419c803dc12d90a9d22f63117e4709b1a131d8c4d5ead7e4121150e2c8b004a546b33c40c294df0a74567013001f55f37147d86bb847d7bbc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxD7E.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxD7E.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxD7E.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxD7E.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxD7E.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxD7E.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxD7E.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxD7E.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxD7E.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxD7E.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{2E76D~1\tap0901.cat
Filesize
19KB

MD5
c757503bc0c5a6679e07fe15b93324d6

SHA1
6a81aa87e4b07c7fea176c8adf1b27ddcdd44573

SHA256
91ebea8ad199e97832cf91ea77328ed7ff49a1b5c06ddaacb0e420097a9b079e

SHA512
efd1507bc7aa0cd335b0e82cddde5f75c4d1e35490608d32f24a2bed0d0fbcac88919728e3b3312665bd1e60d3f13a325bdcef4acfddab0f8c2d9f4fb2454d99

Download Submit
C:\Users\Admin\AppData\Local\Temp\{2E76D~1\tap0901.sys
Filesize
26KB

MD5
d765f43cbea72d14c04af3d2b9c8e54b

SHA1
daebe266073616e5fc931c319470fcf42a06867a

SHA256
89c5ca1440df186497ce158eb71c0c6bf570a75b6bc1880eac7c87a0250201c0

SHA512
ff83225ed348aa8558fb3055ceb43863bad5cf775e410ed8acda7316b56cd5c9360e63ed71abbc8929f7dcf51fd9a948b16d58242a7a2b16108e696c11d548b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{2e76d02f-2719-d54f-b957-3cce2235a8eb}\oemvista.inf
Filesize
7KB

MD5
87868193626dc756d10885f46d76f42e

SHA1
94a5ce8ed7633ed77531b6cb14ceb1927c5cae1f

SHA256
b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41

SHA512
79751330bed5c16d66baf3e5212be0950f312ffd5b80b78be66eaea3cc7115f8a9472d2a43b5ce702aa044f3b45fd572775ff86572150df91cc27866f88f8277

Download Submit
C:\Users\Public\Videos\lsp.exe
Filesize
1.0MB

MD5
95f15e5ca91150a6caf86ada3023cc58

SHA1
6254bb5d18d7ccff4c698ec771c9bed56653d117

SHA256
2a013ff275babc22d4a7041cb52dbd641aa918227cf4943a6ec927d89f9fccad

SHA512
bcf827c2aae0bb58f2c10e25767b89b957d4ef00f4f83ef73d02609d6359037f3f11f683838319f6d39e0db6eadea9ae7f4f5f08f0fd8efa1bf52c77094f7f40

Download Submit
C:\Users\Public\Videos\lsp.exe
Filesize
1.0MB

MD5
95f15e5ca91150a6caf86ada3023cc58

SHA1
6254bb5d18d7ccff4c698ec771c9bed56653d117

SHA256
2a013ff275babc22d4a7041cb52dbd641aa918227cf4943a6ec927d89f9fccad

SHA512
bcf827c2aae0bb58f2c10e25767b89b957d4ef00f4f83ef73d02609d6359037f3f11f683838319f6d39e0db6eadea9ae7f4f5f08f0fd8efa1bf52c77094f7f40

Download Submit
C:\Windows\INF\oem2.inf
Filesize
7KB

MD5
87868193626dc756d10885f46d76f42e

SHA1
94a5ce8ed7633ed77531b6cb14ceb1927c5cae1f

SHA256
b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41

SHA512
79751330bed5c16d66baf3e5212be0950f312ffd5b80b78be66eaea3cc7115f8a9472d2a43b5ce702aa044f3b45fd572775ff86572150df91cc27866f88f8277

Download Submit
C:\Windows\Installer\MSIF5B0.tmp
Filesize
13.5MB

MD5
527111c6ff1bed78302d2a59a772bebe

SHA1
94dcdb1aa606356a613584e016d201fe9246e0f3

SHA256
97935af097104cb5cbafefb482f1e748613eeb6dadf80bc95c88fcc2aac6580c

SHA512
12c30789892746c02478ac9f920f3b6eeb37de2d36b432ba3aa4e13980eeffa869cf0be381c9a50f80dabbdfdd5d61a0a36c53dcf55ecf37b6b50690f4dae6e8

Download Submit
C:\Windows\Installer\MSIF5B0.tmp
Filesize
13.5MB

MD5
527111c6ff1bed78302d2a59a772bebe

SHA1
94dcdb1aa606356a613584e016d201fe9246e0f3

SHA256
97935af097104cb5cbafefb482f1e748613eeb6dadf80bc95c88fcc2aac6580c

SHA512
12c30789892746c02478ac9f920f3b6eeb37de2d36b432ba3aa4e13980eeffa869cf0be381c9a50f80dabbdfdd5d61a0a36c53dcf55ecf37b6b50690f4dae6e8

Download Submit
C:\Windows\System32\DriverStore\FileRepository\OEMVIS~1.INF\tap0901.sys
Filesize
26KB

MD5
d765f43cbea72d14c04af3d2b9c8e54b

SHA1
daebe266073616e5fc931c319470fcf42a06867a

SHA256
89c5ca1440df186497ce158eb71c0c6bf570a75b6bc1880eac7c87a0250201c0

SHA512
ff83225ed348aa8558fb3055ceb43863bad5cf775e410ed8acda7316b56cd5c9360e63ed71abbc8929f7dcf51fd9a948b16d58242a7a2b16108e696c11d548b2

Download Submit
C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}\oemvista.inf
Filesize
7KB

MD5
87868193626dc756d10885f46d76f42e

SHA1
94a5ce8ed7633ed77531b6cb14ceb1927c5cae1f

SHA256
b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41

SHA512
79751330bed5c16d66baf3e5212be0950f312ffd5b80b78be66eaea3cc7115f8a9472d2a43b5ce702aa044f3b45fd572775ff86572150df91cc27866f88f8277

Download Submit
C:\Windows\System32\DriverStore\Temp\{676f2d88-19de-6944-9f1f-268718216395}\tap0901.cat
Filesize
19KB

MD5
c757503bc0c5a6679e07fe15b93324d6

SHA1
6a81aa87e4b07c7fea176c8adf1b27ddcdd44573

SHA256
91ebea8ad199e97832cf91ea77328ed7ff49a1b5c06ddaacb0e420097a9b079e

SHA512
efd1507bc7aa0cd335b0e82cddde5f75c4d1e35490608d32f24a2bed0d0fbcac88919728e3b3312665bd1e60d3f13a325bdcef4acfddab0f8c2d9f4fb2454d99

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.0MB

MD5
7c28c6142d289c94069f57b619c7b33d

SHA1
189aba121b3c34f0f5b21775e96d3eff43132843

SHA256
ca70d406431a95d25af2a62a5a79eb2f7bf235d2b43c546f6a33c85615b91d06

SHA512
a20e34c222aaded5445d4233fc6439eefade1d183541525491a7a68aa0ee8a3cb3bb8922782adc7a14f3bacbaffebf5997869380407e09cdb2df61064190c557

Download Submit
\??\Volume{06969d78-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{06f47427-3634-48d4-9523-24acb0877ee3}_OnDiskSnapshotProp
Filesize
5KB

MD5
ac52ba82ea5d255850bfc24c4c0ae40f

SHA1
aa7738f2d678e590f1e3b34b0544ee1310f1b4b8

SHA256
f7b123db9588a60101eb610f1afa2fc4d5ca8faa874e1bb1d62599c0f7ff902d

SHA512
777de8f58e9b26e1235929e8faa2562515efdfd9e9700bba8df46f0888196fa0a393c61ecffa96d1719324c77137fa6c7e88044bdc451b74e317c47f3dfbca62

Download Submit
\??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
Filesize
26KB

MD5
d765f43cbea72d14c04af3d2b9c8e54b

SHA1
daebe266073616e5fc931c319470fcf42a06867a

SHA256
89c5ca1440df186497ce158eb71c0c6bf570a75b6bc1880eac7c87a0250201c0

SHA512
ff83225ed348aa8558fb3055ceb43863bad5cf775e410ed8acda7316b56cd5c9360e63ed71abbc8929f7dcf51fd9a948b16d58242a7a2b16108e696c11d548b2

Download Submit
\??\c:\program files (x86)\letsvpn\driver\tap0901.cat
Filesize
19KB

MD5
c757503bc0c5a6679e07fe15b93324d6

SHA1
6a81aa87e4b07c7fea176c8adf1b27ddcdd44573

SHA256
91ebea8ad199e97832cf91ea77328ed7ff49a1b5c06ddaacb0e420097a9b079e

SHA512
efd1507bc7aa0cd335b0e82cddde5f75c4d1e35490608d32f24a2bed0d0fbcac88919728e3b3312665bd1e60d3f13a325bdcef4acfddab0f8c2d9f4fb2454d99

Download Submit
memory/240-196-0x0000000000000000-mapping.dmp

Download
memory/448-201-0x0000000000000000-mapping.dmp

Download
memory/524-137-0x0000000000400000-0x0000000001DFA000-memory.dmp

Filesize
26.0MB

Download
memory/524-133-0x0000000000000000-mapping.dmp

Download
memory/524-147-0x0000000000400000-0x0000000001DFA000-memory.dmp

Filesize
26.0MB

Download
memory/524-136-0x0000000000400000-0x0000000001DFA000-memory.dmp

Filesize
26.0MB

Download
memory/1036-138-0x0000000000000000-mapping.dmp

Download
memory/1036-144-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1036-143-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1752-195-0x0000000000000000-mapping.dmp

Download
memory/1884-212-0x0000000000400000-0x00000000006A8000-memory.dmp

Filesize
2.7MB

Download
memory/1884-211-0x0000000000400000-0x00000000006A8000-memory.dmp

Filesize
2.7MB

Download
memory/1884-219-0x0000000000400000-0x00000000006A8000-memory.dmp

Filesize
2.7MB

Download
memory/1884-213-0x0000000010000000-0x0000000010192000-memory.dmp

Filesize
1.6MB

Download
memory/1884-207-0x0000000000000000-mapping.dmp

Download
memory/2232-202-0x0000000000000000-mapping.dmp

Download
memory/2400-181-0x0000000000000000-mapping.dmp

Download
memory/2432-176-0x0000000000000000-mapping.dmp

Download
memory/2960-188-0x0000000000000000-mapping.dmp

Download
memory/3008-193-0x0000000000000000-mapping.dmp

Download
memory/3084-192-0x0000000000000000-mapping.dmp

Download
memory/3524-141-0x0000000000000000-mapping.dmp

Download
memory/3556-204-0x0000000000000000-mapping.dmp

Download
memory/3784-132-0x0000000000000000-mapping.dmp

Download
memory/4152-168-0x00000000074B0000-0x00000000074BE000-memory.dmp

Filesize
56KB

Download
memory/4152-158-0x0000000005920000-0x0000000005986000-memory.dmp

Filesize
408KB

Download
memory/4152-154-0x00000000049F0000-0x0000000004A26000-memory.dmp

Filesize
216KB

Download
memory/4152-170-0x00000000074F0000-0x00000000074F8000-memory.dmp

Filesize
32KB

Download
memory/4152-169-0x00000000075B0000-0x00000000075CA000-memory.dmp

Filesize
104KB

Download
memory/4152-155-0x0000000005060000-0x0000000005688000-memory.dmp

Filesize
6.2MB

Download
memory/4152-156-0x0000000004FB0000-0x0000000004FD2000-memory.dmp

Filesize
136KB

Download
memory/4152-153-0x0000000000000000-mapping.dmp

Download
memory/4152-167-0x0000000007510000-0x00000000075A6000-memory.dmp

Filesize
600KB

Download
memory/4152-166-0x00000000072E0000-0x00000000072EA000-memory.dmp

Filesize
40KB

Download
memory/4152-165-0x0000000007290000-0x00000000072AA000-memory.dmp

Filesize
104KB

Download
memory/4152-164-0x0000000007910000-0x0000000007F8A000-memory.dmp

Filesize
6.5MB

Download
memory/4152-163-0x0000000006520000-0x000000000653E000-memory.dmp

Filesize
120KB

Download
memory/4152-162-0x000000006FE70000-0x000000006FEBC000-memory.dmp

Filesize
304KB

Download
memory/4152-161-0x0000000006F20000-0x0000000006F52000-memory.dmp

Filesize
200KB

Download
memory/4152-159-0x0000000005F60000-0x0000000005F7E000-memory.dmp

Filesize
120KB

Download
memory/4152-157-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/4168-172-0x0000000000000000-mapping.dmp

Download
memory/5000-185-0x0000000000000000-mapping.dmp

Download
memory/5088-199-0x0000000000000000-mapping.dmp

Download
memory/5092-209-0x0000000000000000-mapping.dmp

Download
memory/5112-198-0x0000000000000000-mapping.dmp

Download