6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61

Analysis

max time kernel
149s
max time network
132s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe
Size

136KB
MD5

5e4be45a486cb897eb08299d30165cc5
SHA1

eee529acf2bda485924a9af7d0a48cba6ac9b44d
SHA256

6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61
SHA512

a8e0992e51c59748d4a06b7ac857c9ce6d8866a6bffc751ebc282f5564b56638d0e5c2cb0b75c15e2cd2affbf30c658c40ac400193b9067514c702cbee7c0c00
SSDEEP

3072:RNrioZnIXNPfj7+wpqc7uZF4cK5BbRybFvJXztb3UNeIM:/riinId3+wpqquyT03UNW

Score

8^/10

discovery persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file
Executes dropped EXE 5 IoCs

Processes:

installer_2.20.6.exetmpA3BF.exetmpA3BF.tmpProxyVan.exeProxyVanUpdater.exe

pid process

112 installer_2.20.6.exe
592 tmpA3BF.exe
1948 tmpA3BF.tmp
1624 ProxyVan.exe
1440 ProxyVanUpdater.exe

pid	process
112	installer_2.20.6.exe
592	tmpA3BF.exe
1948	tmpA3BF.tmp
1624	ProxyVan.exe
1440	ProxyVanUpdater.exe

Loads dropped DLL 64 IoCs

Processes:

6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exeinstaller_2.20.6.exetmpA3BF.exetmpA3BF.tmpProxyVan.exeProxyVanUpdater.exe

pid	process
1380	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe
112	installer_2.20.6.exe
592	tmpA3BF.exe
1948	tmpA3BF.tmp
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe
1624	ProxyVan.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe
1624	ProxyVan.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1440	ProxyVanUpdater.exe
1440	ProxyVanUpdater.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 7 IoCs

Processes:

ProxyVanUpdater.exeProxyVan.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	ProxyVanUpdater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	ProxyVanUpdater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	ProxyVanUpdater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	ProxyVanUpdater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	ProxyVan.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	ProxyVan.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	ProxyVan.exe

Drops file in Program Files directory 64 IoCs

Processes:

tmpA3BF.tmpProxyVanUpdater.exe

description	ioc	process
File created	C:\Program Files (x86)\ProxyVan\Service\is-QR5UA.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-9TPVL.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-POD59.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-UBOUT.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-2MTRK.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-5LAEQ.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-2AE1G.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-02C0A.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-KT4O8.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-UTH68.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-ISEDQ.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-GN28L.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-3LTAG.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-8H33T.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-DN0NQ.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-74FLN.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-1EDQ0.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-O2BE9.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-E9FLB.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-SG601.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-69JEP.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-24FVH.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-IU0BD.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-QSI73.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-Q8T3R.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-OHL6A.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-4OCDI.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-V9FIJ.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-8ITTG.tmp	tmpA3BF.tmp
File opened for modification	C:\Program Files (x86)\ProxyVan\Updater\Log\log-20221125.txt	ProxyVanUpdater.exe
File created	C:\Program Files (x86)\ProxyVan\Updater\is-OCPH0.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-J60CT.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-G1BPO.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-GM9MN.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-F1E9T.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-1AARM.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-U04US.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-NV5OD.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-EKRQQ.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\unins000.dat	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-ESR50.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-FVNT7.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-HVA3E.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-01R89.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-7PNB6.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-BSMNL.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-8KOVS.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-A5IMH.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-MOTC0.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-0JKHV.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\ru\is-I442K.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-SFA54.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-5LVS8.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-5T79O.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-GO2D0.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-TKEOA.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-8M8R6.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Service\is-E4SV9.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-I4BFM.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-5B9HQ.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-Q1TDC.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-J5GGS.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-R1Q78.tmp	tmpA3BF.tmp
File created	C:\Program Files (x86)\ProxyVan\Updater\is-KFIFL.tmp	tmpA3BF.tmp

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

1852 sc.exe
2004 sc.exe
1636 sc.exe
1620 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1852	sc.exe
2004	sc.exe
1636	sc.exe
1620	sc.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

ProxyVanUpdater.exeProxyVan.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ProxyVanUpdater.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ProxyVan.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ProxyVanUpdater.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	ProxyVan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ProxyVanUpdater.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

ProxyVan.exe

pid	process
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe
1624	ProxyVan.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ProxyVanUpdater.exeProxyVan.exe

description pid process

Token: SeDebugPrivilege 1440 ProxyVanUpdater.exe
Token: SeDebugPrivilege 1624 ProxyVan.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

tmpA3BF.tmp

pid process

1948 tmpA3BF.tmp

description	pid	process
Token: SeDebugPrivilege	1440	ProxyVanUpdater.exe
Token: SeDebugPrivilege	1624	ProxyVan.exe

pid	process
1948	tmpA3BF.tmp

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exeinstaller_2.20.6.exetmpA3BF.exetmpA3BF.tmp

description	pid	process	target process
PID 1380 wrote to memory of 112	1380	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe	installer_2.20.6.exe
PID 1380 wrote to memory of 112	1380	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe	installer_2.20.6.exe
PID 1380 wrote to memory of 112	1380	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe	installer_2.20.6.exe
PID 1380 wrote to memory of 112	1380	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe	installer_2.20.6.exe
PID 1380 wrote to memory of 112	1380	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe	installer_2.20.6.exe
PID 1380 wrote to memory of 112	1380	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe	installer_2.20.6.exe
PID 1380 wrote to memory of 112	1380	6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe	installer_2.20.6.exe
PID 112 wrote to memory of 592	112	installer_2.20.6.exe	tmpA3BF.exe
PID 112 wrote to memory of 592	112	installer_2.20.6.exe	tmpA3BF.exe
PID 112 wrote to memory of 592	112	installer_2.20.6.exe	tmpA3BF.exe
PID 112 wrote to memory of 592	112	installer_2.20.6.exe	tmpA3BF.exe
PID 112 wrote to memory of 592	112	installer_2.20.6.exe	tmpA3BF.exe
PID 112 wrote to memory of 592	112	installer_2.20.6.exe	tmpA3BF.exe
PID 112 wrote to memory of 592	112	installer_2.20.6.exe	tmpA3BF.exe
PID 592 wrote to memory of 1948	592	tmpA3BF.exe	tmpA3BF.tmp
PID 592 wrote to memory of 1948	592	tmpA3BF.exe	tmpA3BF.tmp
PID 592 wrote to memory of 1948	592	tmpA3BF.exe	tmpA3BF.tmp
PID 592 wrote to memory of 1948	592	tmpA3BF.exe	tmpA3BF.tmp
PID 592 wrote to memory of 1948	592	tmpA3BF.exe	tmpA3BF.tmp
PID 592 wrote to memory of 1948	592	tmpA3BF.exe	tmpA3BF.tmp
PID 592 wrote to memory of 1948	592	tmpA3BF.exe	tmpA3BF.tmp
PID 1948 wrote to memory of 2004	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 2004	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 2004	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 2004	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 1636	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 1636	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 1636	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 1636	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 1620	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 1620	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 1620	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 1620	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 1852	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 1852	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 1852	1948	tmpA3BF.tmp	sc.exe
PID 1948 wrote to memory of 1852	1948	tmpA3BF.tmp	sc.exe

C:\Users\Admin\AppData\Local\Temp\6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe
"C:\Users\Admin\AppData\Local\Temp\6c9f67067a876c7c3397a455e410fb153915d092d20f07cc88aa77e9fddfee61.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1380

C:\Users\Admin\AppData\Local\Temp\installer_2.20.6.exe
C:\Users\Admin\AppData\Local\Temp\installer_2.20.6.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:112

C:\Users\Admin\AppData\Local\Temp\tmpA3BF.exe
"C:\Users\Admin\AppData\Local\Temp\tmpA3BF.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /UTM=
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:592

C:\Users\Admin\AppData\Local\Temp\is-9JOQK.tmp\tmpA3BF.tmp
"C:\Users\Admin\AppData\Local\Temp\is-9JOQK.tmp\tmpA3BF.tmp" /SL5="$7011C,1971045,721408,C:\Users\Admin\AppData\Local\Temp\tmpA3BF.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /UTM=
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\sc.exe
"C:\Windows\system32\sc.exe" create ProxyVan2 obj= "LocalSystem" start= auto binPath= "C:\Program Files (x86)\ProxyVan\Service\ProxyVan.exe"
5⤵
- Launches sc.exe
PID:2004

C:\Windows\SysWOW64\sc.exe
"C:\Windows\system32\sc.exe" create ProxyVanUpdater obj= "LocalSystem" start= auto binPath= "C:\Program Files (x86)\ProxyVan\Updater\ProxyVanUpdater.exe"
5⤵
- Launches sc.exe
PID:1636

C:\Windows\SysWOW64\sc.exe
"C:\Windows\system32\sc.exe" start ProxyVan2
5⤵
- Launches sc.exe
PID:1620

C:\Windows\SysWOW64\sc.exe
"C:\Windows\system32\sc.exe" start ProxyVanUpdater
5⤵
- Launches sc.exe
PID:1852

C:\Program Files (x86)\ProxyVan\Service\ProxyVan.exe
"C:\Program Files (x86)\ProxyVan\Service\ProxyVan.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Program Files (x86)\ProxyVan\Updater\ProxyVanUpdater.exe
"C:\Program Files (x86)\ProxyVan\Updater\ProxyVanUpdater.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

New Service

T1050

Privilege Escalation

New Service

T1050

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ProxyVan\Service\CommandLine.dll
Filesize
200KB

MD5
af2580e5be07d301ef803e3b6243422d

SHA1
959ab9ca00903322f2e4b8a9610b245679cf3d5c

SHA256
cdd1eea8dd04fbf463d9c6f5b65541abd0536fd7e79dcd4dae796a50048b5592

SHA512
77c43440cdb91de5b072b178b9f34942d23752701f148771dedac14a9022c806104f55190b4aa6197369f729d5d94852316990ad54612eb610107b0a01e34839

Download Submit
C:\Program Files (x86)\ProxyVan\Service\DanilovSoft.vRPC.dll
Filesize
112KB

MD5
cd10baa6a8c5803d3a1bc3fabb459dfa

SHA1
50576eb3546c6b087428502896a428f7f6d29aba

SHA256
e20dd6fbd48839d1b80468f67f1003cd328666b904b2e7bd5a08c6f1d7879048

SHA512
e69e34fb5b8670437d7de306a75d31a40e0370ba4167ee55f7290b3553e984c1650503fd4ec4bd7048a9b413a251b0e489285d2026caa81a6c92fb967f7399d7

Download Submit
C:\Program Files (x86)\ProxyVan\Service\Proxy.Common.dll
Filesize
26KB

MD5
9e50e96b74a534fd5501143d8d19a928

SHA1
bc4661452f19927f55113b3b54de1f440568ecc3

SHA256
585574abe6ace01f0e72d4ac8c7688619d42b7bd6d60dcc0dd9fe0050fee537d

SHA512
e7cb4ea03a756ad87fdc3914338e67de5e494a92044fb0d95eeb0df1b37e4ec33722c98e80f13a5a5f9cf3264242259aa3d794e5187e5006168d5b9b19c54118

Download Submit
C:\Program Files (x86)\ProxyVan\Service\ProxyVan.Common.dll
Filesize
18KB

MD5
476763e15175f7325a61243c4ed22f95

SHA1
f47d8dd7e2f05f75deed90ca6cd6a36e71385b10

SHA256
cbe4f51b8c231078df0bd3b126906f419d5530e4998f1a537668c9116b23e9c2

SHA512
e705a03e76347751501d1ae0b348028aa7e0f1573b808068ca61d189e7cc24ee9e534386f059bde419ea1661ecbccc8c930be081cb95c1e69699ce37d9db78cd

Download Submit
C:\Program Files (x86)\ProxyVan\Service\ProxyVan.exe
Filesize
64KB

MD5
3c6f15c66356401af87603f894bb4976

SHA1
e77b0b55da6a91121c405b3f460821de03f79758

SHA256
59dc64d4264d06242c7c5b9774e1b02844f44cbec0b821c71ecf98a43fe1a439

SHA512
def88a542a37c580a29ce64538fad04d0127bc95cf6974271f2e68872e59a8181647694feb455fa6fd5a38dfd52716fd58f09e45251efa5c024ab2d96115c4e2

Download Submit
C:\Program Files (x86)\ProxyVan\Service\ProxyVan.exe
Filesize
64KB

MD5
3c6f15c66356401af87603f894bb4976

SHA1
e77b0b55da6a91121c405b3f460821de03f79758

SHA256
59dc64d4264d06242c7c5b9774e1b02844f44cbec0b821c71ecf98a43fe1a439

SHA512
def88a542a37c580a29ce64538fad04d0127bc95cf6974271f2e68872e59a8181647694feb455fa6fd5a38dfd52716fd58f09e45251efa5c024ab2d96115c4e2

Download Submit
C:\Program Files (x86)\ProxyVan\Service\ProxyVan.exe.config
Filesize
5KB

MD5
0bcc8797a2d76bc6d25070959ed5c649

SHA1
008683e4c9517f280bf6a606d8c7316ce4e728a9

SHA256
9f7c259d27fafd51175327e5e3db7558f07011de839aed7ebd46f8ee323d2679

SHA512
5d84ca32a77be317fd0bc8cfa7f7c5102c229b9ca904bb83f4ace8460c2b90eff7d25bce9536fc3d47904e5271f9cb122a9980fde3ad35938a25f3287f0c74b6

Download Submit
C:\Program Files (x86)\ProxyVan\Service\Serilog.Sinks.Console.dll
Filesize
31KB

MD5
c48bf7030e583e273e94e2d32b752a83

SHA1
51666bcec96f529b1a28b72db54cc7fcdf68441d

SHA256
ded3b57b64eca479f2a659a244e4c403ebfb83a9a9b30ced893c145e77affd29

SHA512
475e61bbb4484f468548dd7590d1d0bcc19912b322eacf2960b32c2c3ff1084231ddf8e689735e385a1f43e9912f79a028eae136c7dc8e130f2d3dd1eaf1f004

Download Submit
C:\Program Files (x86)\ProxyVan\Service\Serilog.Sinks.File.dll
Filesize
27KB

MD5
4c2b0737d9a73da09172d3c210b0265d

SHA1
a35a98ec72154cc1d112f46bd177a7f043dbcd46

SHA256
6d8d84c9c14201674d9a309f51e952cf148ad33cdb66507d9677ebf1b1e4432b

SHA512
c605bef0a7caa12b0d7c47564c3a214ea1db40f901dfdc4c5b35bf73610a5d9030b67e495b409a79c76ad5ec6ef9962cd56c050c51883a3151d34931a8361aa8

Download Submit
C:\Program Files (x86)\ProxyVan\Service\Serilog.Sinks.RollingFile.dll
Filesize
18KB

MD5
1956aa1e1eb74ca4b70c8a0c7268236f

SHA1
653d77ad181a4ccf169db699a0c011e3ffe4b218

SHA256
82d6c16a6c178416b05577cbe668713a08ae9fc874342408d4339a147020bc10

SHA512
0815dc374855ea5753bd6ac624f5b8b7bfcaf9fac6155ca91e22e692611da6ac73dd42b5dbdd7631948de42ab91eb699b85da88aea13e4b688c91d8a82c03f0f

Download Submit
C:\Program Files (x86)\ProxyVan\Service\Serilog.dll
Filesize
123KB

MD5
5ad091f31cfe9d0e1eb325c09a6440cc

SHA1
8655ac00f4eb82dd0c9dc632b02642a3240633b9

SHA256
7344321f0385a0189d641d7a11371524b91327930bb8ebbef2dabd94bdac0ba8

SHA512
0030f47ca6cfc53a0c2038792839e969a7e80a80669b9498b86ce27a34d49b67f530c09e6a20c79ad2e1b5073135edc46cc0665acbb1c9e2327c5d18da0dc1e6

Download Submit
C:\Program Files (x86)\ProxyVan\Service\System.Memory.dll
Filesize
145KB

MD5
592a822d0136b14f8d661891ff17c33b

SHA1
f05ce2a5891b62c968d30fad13d37fbeb42a4389

SHA256
41b5e1a4c59abdb1ce1467f58c3d9fd06d39dff4fc61d500a2410fece8037f4b

SHA512
6071c4d30283c9cf9c25023240fca97b33efbe51e2e4d1fd1d3692354e7f85963d87f38512260b37e71d7a7f5ac7a61396c8eeb1f862fefeaac90c53fef9e6a6

Download Submit
C:\Program Files (x86)\ProxyVan\Service\System.Text.Json.dll
Filesize
286KB

MD5
627b156af1fd28fc66ea82e3357e0483

SHA1
a57a3779cacf84bbd4635e3f43c9666c139a2199

SHA256
3c2498a0fa85aca1956721db2c34690c2a64b0536e2506abfe63986771f84cb9

SHA512
910f2160cb30839c4a415d52a6a0c91fe24628846d9ed816e2415d6be66d4a3a5ec580389c0d64ed273decdf398cb82229facfa112e43daebdae087754878f61

Download Submit
C:\Program Files (x86)\ProxyVan\Service\System.ValueTuple.dll
Filesize
77KB

MD5
8c9424e37a28db7d70e7d52f0df33cf8

SHA1
81cd1acb53d493c54c8d56f379d790a901a355ac

SHA256
e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f

SHA512
cb6364c136f9d07191cf89ea2d3b89e08db0cd5911bf835c32ae81e4d51e0789ddc92d47e80b7ff7e24985890ed29a00b0a391834b43cf11db303cd980d834f4

Download Submit
C:\Program Files (x86)\ProxyVan\Updater\ProxyVan.Common.dll
Filesize
18KB

MD5
476763e15175f7325a61243c4ed22f95

SHA1
f47d8dd7e2f05f75deed90ca6cd6a36e71385b10

SHA256
cbe4f51b8c231078df0bd3b126906f419d5530e4998f1a537668c9116b23e9c2

SHA512
e705a03e76347751501d1ae0b348028aa7e0f1573b808068ca61d189e7cc24ee9e534386f059bde419ea1661ecbccc8c930be081cb95c1e69699ce37d9db78cd

Download Submit
C:\Program Files (x86)\ProxyVan\Updater\ProxyVanUpdater.exe
Filesize
40KB

MD5
27fdadcc680374bb9886ba9e79c21fb3

SHA1
8d9527a1f6c71a2a7cecdbc05c792f1c7753dc4f

SHA256
b9e6cab16e74a51b99af06b4555fc3d48117b52ab50a8b0f5d2fa22fb92475af

SHA512
d868b4c59c7cadacdad52501e87642bf6341ba4e4df4b50c7cef66c577cafa19cdaa89ed9f2953e2e50ffe18880053a9fbfcf739e8e5907aee8b0cc137008700

Download Submit
C:\Program Files (x86)\ProxyVan\Updater\ProxyVanUpdater.exe
Filesize
40KB

MD5
27fdadcc680374bb9886ba9e79c21fb3

SHA1
8d9527a1f6c71a2a7cecdbc05c792f1c7753dc4f

SHA256
b9e6cab16e74a51b99af06b4555fc3d48117b52ab50a8b0f5d2fa22fb92475af

SHA512
d868b4c59c7cadacdad52501e87642bf6341ba4e4df4b50c7cef66c577cafa19cdaa89ed9f2953e2e50ffe18880053a9fbfcf739e8e5907aee8b0cc137008700

Download Submit
C:\Program Files (x86)\ProxyVan\Updater\ProxyVanUpdater.exe.config
Filesize
23KB

MD5
9c74292baba1948e7616e6c3b2408fd7

SHA1
a71b376ad474024152851af2f1d4dece0404bf9c

SHA256
54d382eb4143722d78cae81f27f2c5fbe701664afcb9f21bf467e844c2cd44c6

SHA512
c2d608e4f71895b904083a3f1b343686712ced9bfbd39986e4151aa307501aec0c05af8f0c2b16ff8eecc4b968c16bd4008b4f5c6a6c7a2f55373efaac57e7e8

Download Submit
C:\Program Files (x86)\ProxyVan\Updater\Serilog.Sinks.Console.dll
Filesize
31KB

MD5
c48bf7030e583e273e94e2d32b752a83

SHA1
51666bcec96f529b1a28b72db54cc7fcdf68441d

SHA256
ded3b57b64eca479f2a659a244e4c403ebfb83a9a9b30ced893c145e77affd29

SHA512
475e61bbb4484f468548dd7590d1d0bcc19912b322eacf2960b32c2c3ff1084231ddf8e689735e385a1f43e9912f79a028eae136c7dc8e130f2d3dd1eaf1f004

Download Submit
C:\Program Files (x86)\ProxyVan\Updater\Serilog.Sinks.File.dll
Filesize
27KB

MD5
4c2b0737d9a73da09172d3c210b0265d

SHA1
a35a98ec72154cc1d112f46bd177a7f043dbcd46

SHA256
6d8d84c9c14201674d9a309f51e952cf148ad33cdb66507d9677ebf1b1e4432b

SHA512
c605bef0a7caa12b0d7c47564c3a214ea1db40f901dfdc4c5b35bf73610a5d9030b67e495b409a79c76ad5ec6ef9962cd56c050c51883a3151d34931a8361aa8

Download Submit
C:\Program Files (x86)\ProxyVan\Updater\Serilog.Sinks.RollingFile.dll
Filesize
18KB

MD5
1956aa1e1eb74ca4b70c8a0c7268236f

SHA1
653d77ad181a4ccf169db699a0c011e3ffe4b218

SHA256
82d6c16a6c178416b05577cbe668713a08ae9fc874342408d4339a147020bc10

SHA512
0815dc374855ea5753bd6ac624f5b8b7bfcaf9fac6155ca91e22e692611da6ac73dd42b5dbdd7631948de42ab91eb699b85da88aea13e4b688c91d8a82c03f0f

Download Submit
C:\Program Files (x86)\ProxyVan\Updater\Serilog.dll
Filesize
123KB

MD5
5ad091f31cfe9d0e1eb325c09a6440cc

SHA1
8655ac00f4eb82dd0c9dc632b02642a3240633b9

SHA256
7344321f0385a0189d641d7a11371524b91327930bb8ebbef2dabd94bdac0ba8

SHA512
0030f47ca6cfc53a0c2038792839e969a7e80a80669b9498b86ce27a34d49b67f530c09e6a20c79ad2e1b5073135edc46cc0665acbb1c9e2327c5d18da0dc1e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\installer_2.20.6.exe
Filesize
2.6MB

MD5
d7f95e9e9a755adc5af39a34321b7a46

SHA1
de079eeaf630d994ac463a85c59a2abecf500c60

SHA256
928c26f80c0562d3af4f49c3a8fc8193d0bdcf17b4f44532009bceb9d84628c6

SHA512
e050d2efaf9474e568cccbcafe0c493785b44e128fa7b6e229996cd402f4f9ecd9c6cb5f3157c1ebeb175d0595a7b3b517add74283f98f8cb8c1941431eaf33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\installer_2.20.6.exe
Filesize
2.6MB

MD5
d7f95e9e9a755adc5af39a34321b7a46

SHA1
de079eeaf630d994ac463a85c59a2abecf500c60

SHA256
928c26f80c0562d3af4f49c3a8fc8193d0bdcf17b4f44532009bceb9d84628c6

SHA512
e050d2efaf9474e568cccbcafe0c493785b44e128fa7b6e229996cd402f4f9ecd9c6cb5f3157c1ebeb175d0595a7b3b517add74283f98f8cb8c1941431eaf33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9JOQK.tmp\tmpA3BF.tmp
Filesize
2.4MB

MD5
e14bbe9b410ff9c73da715b293dd47c4

SHA1
ea4092753d1f596534caf74350a13770074afcb6

SHA256
32b0e31bccf8b5d4eabefd6e1f0b7db3cfdd8bc0364c18daa92d8ba60415640d

SHA512
a9bbc92fc1bba041646df79bab2253ffe68be2af31f976c7ed6c302294d59bab06304f096d2876e23fab1ff7571cf4cc1c1e2b63ad7f8d66038f457d15f7b75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9JOQK.tmp\tmpA3BF.tmp
Filesize
2.4MB

MD5
e14bbe9b410ff9c73da715b293dd47c4

SHA1
ea4092753d1f596534caf74350a13770074afcb6

SHA256
32b0e31bccf8b5d4eabefd6e1f0b7db3cfdd8bc0364c18daa92d8ba60415640d

SHA512
a9bbc92fc1bba041646df79bab2253ffe68be2af31f976c7ed6c302294d59bab06304f096d2876e23fab1ff7571cf4cc1c1e2b63ad7f8d66038f457d15f7b75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA3BF.exe
Filesize
2.6MB

MD5
a41586e828d97f5f0bcbac5b0a604e80

SHA1
114292bf99ae576181b3a4f1c255677dda93eff2

SHA256
9e162d04ce9427bc1dedb4dec70e1b503c32a2221ba93a2f6b460dbec1212808

SHA512
98363440367d412ed7c4087459ef300cf1d1f965f9a7331ec70e7b18eb79f19a2aa73b97e48ebad16d1389ec902a1884c6e5a6208ed2ec835c27536245cebcd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA3BF.exe
Filesize
2.6MB

MD5
a41586e828d97f5f0bcbac5b0a604e80

SHA1
114292bf99ae576181b3a4f1c255677dda93eff2

SHA256
9e162d04ce9427bc1dedb4dec70e1b503c32a2221ba93a2f6b460dbec1212808

SHA512
98363440367d412ed7c4087459ef300cf1d1f965f9a7331ec70e7b18eb79f19a2aa73b97e48ebad16d1389ec902a1884c6e5a6208ed2ec835c27536245cebcd3

Download Submit
\Program Files (x86)\ProxyVan\Service\CommandLine.dll
Filesize
200KB

MD5
af2580e5be07d301ef803e3b6243422d

SHA1
959ab9ca00903322f2e4b8a9610b245679cf3d5c

SHA256
cdd1eea8dd04fbf463d9c6f5b65541abd0536fd7e79dcd4dae796a50048b5592

SHA512
77c43440cdb91de5b072b178b9f34942d23752701f148771dedac14a9022c806104f55190b4aa6197369f729d5d94852316990ad54612eb610107b0a01e34839

Download Submit
\Program Files (x86)\ProxyVan\Service\CommandLine.dll
Filesize
200KB

MD5
af2580e5be07d301ef803e3b6243422d

SHA1
959ab9ca00903322f2e4b8a9610b245679cf3d5c

SHA256
cdd1eea8dd04fbf463d9c6f5b65541abd0536fd7e79dcd4dae796a50048b5592

SHA512
77c43440cdb91de5b072b178b9f34942d23752701f148771dedac14a9022c806104f55190b4aa6197369f729d5d94852316990ad54612eb610107b0a01e34839

Download Submit
\Program Files (x86)\ProxyVan\Service\Proxy.Common.dll
Filesize
26KB

MD5
9e50e96b74a534fd5501143d8d19a928

SHA1
bc4661452f19927f55113b3b54de1f440568ecc3

SHA256
585574abe6ace01f0e72d4ac8c7688619d42b7bd6d60dcc0dd9fe0050fee537d

SHA512
e7cb4ea03a756ad87fdc3914338e67de5e494a92044fb0d95eeb0df1b37e4ec33722c98e80f13a5a5f9cf3264242259aa3d794e5187e5006168d5b9b19c54118

Download Submit
\Program Files (x86)\ProxyVan\Service\Proxy.Common.dll
Filesize
26KB

MD5
9e50e96b74a534fd5501143d8d19a928

SHA1
bc4661452f19927f55113b3b54de1f440568ecc3

SHA256
585574abe6ace01f0e72d4ac8c7688619d42b7bd6d60dcc0dd9fe0050fee537d

SHA512
e7cb4ea03a756ad87fdc3914338e67de5e494a92044fb0d95eeb0df1b37e4ec33722c98e80f13a5a5f9cf3264242259aa3d794e5187e5006168d5b9b19c54118

Download Submit
\Program Files (x86)\ProxyVan\Service\ProxyVan.Common.dll
Filesize
18KB

MD5
476763e15175f7325a61243c4ed22f95

SHA1
f47d8dd7e2f05f75deed90ca6cd6a36e71385b10

SHA256
cbe4f51b8c231078df0bd3b126906f419d5530e4998f1a537668c9116b23e9c2

SHA512
e705a03e76347751501d1ae0b348028aa7e0f1573b808068ca61d189e7cc24ee9e534386f059bde419ea1661ecbccc8c930be081cb95c1e69699ce37d9db78cd

Download Submit
\Program Files (x86)\ProxyVan\Service\ProxyVan.Common.dll
Filesize
18KB

MD5
476763e15175f7325a61243c4ed22f95

SHA1
f47d8dd7e2f05f75deed90ca6cd6a36e71385b10

SHA256
cbe4f51b8c231078df0bd3b126906f419d5530e4998f1a537668c9116b23e9c2

SHA512
e705a03e76347751501d1ae0b348028aa7e0f1573b808068ca61d189e7cc24ee9e534386f059bde419ea1661ecbccc8c930be081cb95c1e69699ce37d9db78cd

Download Submit
\Program Files (x86)\ProxyVan\Service\Serilog.Sinks.Console.dll
Filesize
31KB

MD5
c48bf7030e583e273e94e2d32b752a83

SHA1
51666bcec96f529b1a28b72db54cc7fcdf68441d

SHA256
ded3b57b64eca479f2a659a244e4c403ebfb83a9a9b30ced893c145e77affd29

SHA512
475e61bbb4484f468548dd7590d1d0bcc19912b322eacf2960b32c2c3ff1084231ddf8e689735e385a1f43e9912f79a028eae136c7dc8e130f2d3dd1eaf1f004

Download Submit
\Program Files (x86)\ProxyVan\Service\Serilog.Sinks.Console.dll
Filesize
31KB

MD5
c48bf7030e583e273e94e2d32b752a83

SHA1
51666bcec96f529b1a28b72db54cc7fcdf68441d

SHA256
ded3b57b64eca479f2a659a244e4c403ebfb83a9a9b30ced893c145e77affd29

SHA512
475e61bbb4484f468548dd7590d1d0bcc19912b322eacf2960b32c2c3ff1084231ddf8e689735e385a1f43e9912f79a028eae136c7dc8e130f2d3dd1eaf1f004

Download Submit
\Program Files (x86)\ProxyVan\Service\Serilog.Sinks.File.dll
Filesize
27KB

MD5
4c2b0737d9a73da09172d3c210b0265d

SHA1
a35a98ec72154cc1d112f46bd177a7f043dbcd46

SHA256
6d8d84c9c14201674d9a309f51e952cf148ad33cdb66507d9677ebf1b1e4432b

SHA512
c605bef0a7caa12b0d7c47564c3a214ea1db40f901dfdc4c5b35bf73610a5d9030b67e495b409a79c76ad5ec6ef9962cd56c050c51883a3151d34931a8361aa8

Download Submit
\Program Files (x86)\ProxyVan\Service\Serilog.Sinks.File.dll
Filesize
27KB

MD5
4c2b0737d9a73da09172d3c210b0265d

SHA1
a35a98ec72154cc1d112f46bd177a7f043dbcd46

SHA256
6d8d84c9c14201674d9a309f51e952cf148ad33cdb66507d9677ebf1b1e4432b

SHA512
c605bef0a7caa12b0d7c47564c3a214ea1db40f901dfdc4c5b35bf73610a5d9030b67e495b409a79c76ad5ec6ef9962cd56c050c51883a3151d34931a8361aa8

Download Submit
\Program Files (x86)\ProxyVan\Service\Serilog.Sinks.RollingFile.dll
Filesize
18KB

MD5
1956aa1e1eb74ca4b70c8a0c7268236f

SHA1
653d77ad181a4ccf169db699a0c011e3ffe4b218

SHA256
82d6c16a6c178416b05577cbe668713a08ae9fc874342408d4339a147020bc10

SHA512
0815dc374855ea5753bd6ac624f5b8b7bfcaf9fac6155ca91e22e692611da6ac73dd42b5dbdd7631948de42ab91eb699b85da88aea13e4b688c91d8a82c03f0f

Download Submit
\Program Files (x86)\ProxyVan\Service\Serilog.Sinks.RollingFile.dll
Filesize
18KB

MD5
1956aa1e1eb74ca4b70c8a0c7268236f

SHA1
653d77ad181a4ccf169db699a0c011e3ffe4b218

SHA256
82d6c16a6c178416b05577cbe668713a08ae9fc874342408d4339a147020bc10

SHA512
0815dc374855ea5753bd6ac624f5b8b7bfcaf9fac6155ca91e22e692611da6ac73dd42b5dbdd7631948de42ab91eb699b85da88aea13e4b688c91d8a82c03f0f

Download Submit
\Program Files (x86)\ProxyVan\Service\Serilog.dll
Filesize
123KB

MD5
5ad091f31cfe9d0e1eb325c09a6440cc

SHA1
8655ac00f4eb82dd0c9dc632b02642a3240633b9

SHA256
7344321f0385a0189d641d7a11371524b91327930bb8ebbef2dabd94bdac0ba8

SHA512
0030f47ca6cfc53a0c2038792839e969a7e80a80669b9498b86ce27a34d49b67f530c09e6a20c79ad2e1b5073135edc46cc0665acbb1c9e2327c5d18da0dc1e6

Download Submit
\Program Files (x86)\ProxyVan\Service\Serilog.dll
Filesize
123KB

MD5
5ad091f31cfe9d0e1eb325c09a6440cc

SHA1
8655ac00f4eb82dd0c9dc632b02642a3240633b9

SHA256
7344321f0385a0189d641d7a11371524b91327930bb8ebbef2dabd94bdac0ba8

SHA512
0030f47ca6cfc53a0c2038792839e969a7e80a80669b9498b86ce27a34d49b67f530c09e6a20c79ad2e1b5073135edc46cc0665acbb1c9e2327c5d18da0dc1e6

Download Submit
\Program Files (x86)\ProxyVan\Service\System.Memory.dll
Filesize
145KB

MD5
592a822d0136b14f8d661891ff17c33b

SHA1
f05ce2a5891b62c968d30fad13d37fbeb42a4389

SHA256
41b5e1a4c59abdb1ce1467f58c3d9fd06d39dff4fc61d500a2410fece8037f4b

SHA512
6071c4d30283c9cf9c25023240fca97b33efbe51e2e4d1fd1d3692354e7f85963d87f38512260b37e71d7a7f5ac7a61396c8eeb1f862fefeaac90c53fef9e6a6

Download Submit
\Program Files (x86)\ProxyVan\Service\System.Memory.dll
Filesize
145KB

MD5
592a822d0136b14f8d661891ff17c33b

SHA1
f05ce2a5891b62c968d30fad13d37fbeb42a4389

SHA256
41b5e1a4c59abdb1ce1467f58c3d9fd06d39dff4fc61d500a2410fece8037f4b

SHA512
6071c4d30283c9cf9c25023240fca97b33efbe51e2e4d1fd1d3692354e7f85963d87f38512260b37e71d7a7f5ac7a61396c8eeb1f862fefeaac90c53fef9e6a6

Download Submit
\Program Files (x86)\ProxyVan\Service\System.Text.Json.dll
Filesize
286KB

MD5
627b156af1fd28fc66ea82e3357e0483

SHA1
a57a3779cacf84bbd4635e3f43c9666c139a2199

SHA256
3c2498a0fa85aca1956721db2c34690c2a64b0536e2506abfe63986771f84cb9

SHA512
910f2160cb30839c4a415d52a6a0c91fe24628846d9ed816e2415d6be66d4a3a5ec580389c0d64ed273decdf398cb82229facfa112e43daebdae087754878f61

Download Submit
\Program Files (x86)\ProxyVan\Service\System.Text.Json.dll
Filesize
286KB

MD5
627b156af1fd28fc66ea82e3357e0483

SHA1
a57a3779cacf84bbd4635e3f43c9666c139a2199

SHA256
3c2498a0fa85aca1956721db2c34690c2a64b0536e2506abfe63986771f84cb9

SHA512
910f2160cb30839c4a415d52a6a0c91fe24628846d9ed816e2415d6be66d4a3a5ec580389c0d64ed273decdf398cb82229facfa112e43daebdae087754878f61

Download Submit
\Program Files (x86)\ProxyVan\Service\System.ValueTuple.dll
Filesize
77KB

MD5
8c9424e37a28db7d70e7d52f0df33cf8

SHA1
81cd1acb53d493c54c8d56f379d790a901a355ac

SHA256
e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f

SHA512
cb6364c136f9d07191cf89ea2d3b89e08db0cd5911bf835c32ae81e4d51e0789ddc92d47e80b7ff7e24985890ed29a00b0a391834b43cf11db303cd980d834f4

Download Submit
\Program Files (x86)\ProxyVan\Service\System.ValueTuple.dll
Filesize
77KB

MD5
8c9424e37a28db7d70e7d52f0df33cf8

SHA1
81cd1acb53d493c54c8d56f379d790a901a355ac

SHA256
e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f

SHA512
cb6364c136f9d07191cf89ea2d3b89e08db0cd5911bf835c32ae81e4d51e0789ddc92d47e80b7ff7e24985890ed29a00b0a391834b43cf11db303cd980d834f4

Download Submit
\Program Files (x86)\ProxyVan\Service\System.ValueTuple.dll
Filesize
77KB

MD5
8c9424e37a28db7d70e7d52f0df33cf8

SHA1
81cd1acb53d493c54c8d56f379d790a901a355ac

SHA256
e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f

SHA512
cb6364c136f9d07191cf89ea2d3b89e08db0cd5911bf835c32ae81e4d51e0789ddc92d47e80b7ff7e24985890ed29a00b0a391834b43cf11db303cd980d834f4

Download Submit
\Program Files (x86)\ProxyVan\Service\System.ValueTuple.dll
Filesize
77KB

MD5
8c9424e37a28db7d70e7d52f0df33cf8

SHA1
81cd1acb53d493c54c8d56f379d790a901a355ac

SHA256
e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f

SHA512
cb6364c136f9d07191cf89ea2d3b89e08db0cd5911bf835c32ae81e4d51e0789ddc92d47e80b7ff7e24985890ed29a00b0a391834b43cf11db303cd980d834f4

Download Submit
\Program Files (x86)\ProxyVan\Updater\ProxyVan.Common.dll
Filesize
18KB

MD5
476763e15175f7325a61243c4ed22f95

SHA1
f47d8dd7e2f05f75deed90ca6cd6a36e71385b10

SHA256
cbe4f51b8c231078df0bd3b126906f419d5530e4998f1a537668c9116b23e9c2

SHA512
e705a03e76347751501d1ae0b348028aa7e0f1573b808068ca61d189e7cc24ee9e534386f059bde419ea1661ecbccc8c930be081cb95c1e69699ce37d9db78cd

Download Submit
\Program Files (x86)\ProxyVan\Updater\ProxyVan.Common.dll
Filesize
18KB

MD5
476763e15175f7325a61243c4ed22f95

SHA1
f47d8dd7e2f05f75deed90ca6cd6a36e71385b10

SHA256
cbe4f51b8c231078df0bd3b126906f419d5530e4998f1a537668c9116b23e9c2

SHA512
e705a03e76347751501d1ae0b348028aa7e0f1573b808068ca61d189e7cc24ee9e534386f059bde419ea1661ecbccc8c930be081cb95c1e69699ce37d9db78cd

Download Submit
\Program Files (x86)\ProxyVan\Updater\Serilog.Sinks.Console.dll
Filesize
31KB

MD5
c48bf7030e583e273e94e2d32b752a83

SHA1
51666bcec96f529b1a28b72db54cc7fcdf68441d

SHA256
ded3b57b64eca479f2a659a244e4c403ebfb83a9a9b30ced893c145e77affd29

SHA512
475e61bbb4484f468548dd7590d1d0bcc19912b322eacf2960b32c2c3ff1084231ddf8e689735e385a1f43e9912f79a028eae136c7dc8e130f2d3dd1eaf1f004

Download Submit
\Program Files (x86)\ProxyVan\Updater\Serilog.Sinks.Console.dll
Filesize
31KB

MD5
c48bf7030e583e273e94e2d32b752a83

SHA1
51666bcec96f529b1a28b72db54cc7fcdf68441d

SHA256
ded3b57b64eca479f2a659a244e4c403ebfb83a9a9b30ced893c145e77affd29

SHA512
475e61bbb4484f468548dd7590d1d0bcc19912b322eacf2960b32c2c3ff1084231ddf8e689735e385a1f43e9912f79a028eae136c7dc8e130f2d3dd1eaf1f004

Download Submit
\Program Files (x86)\ProxyVan\Updater\Serilog.Sinks.File.dll
Filesize
27KB

MD5
4c2b0737d9a73da09172d3c210b0265d

SHA1
a35a98ec72154cc1d112f46bd177a7f043dbcd46

SHA256
6d8d84c9c14201674d9a309f51e952cf148ad33cdb66507d9677ebf1b1e4432b

SHA512
c605bef0a7caa12b0d7c47564c3a214ea1db40f901dfdc4c5b35bf73610a5d9030b67e495b409a79c76ad5ec6ef9962cd56c050c51883a3151d34931a8361aa8

Download Submit
\Program Files (x86)\ProxyVan\Updater\Serilog.Sinks.File.dll
Filesize
27KB

MD5
4c2b0737d9a73da09172d3c210b0265d

SHA1
a35a98ec72154cc1d112f46bd177a7f043dbcd46

SHA256
6d8d84c9c14201674d9a309f51e952cf148ad33cdb66507d9677ebf1b1e4432b

SHA512
c605bef0a7caa12b0d7c47564c3a214ea1db40f901dfdc4c5b35bf73610a5d9030b67e495b409a79c76ad5ec6ef9962cd56c050c51883a3151d34931a8361aa8

Download Submit
\Program Files (x86)\ProxyVan\Updater\Serilog.Sinks.RollingFile.dll
Filesize
18KB

MD5
1956aa1e1eb74ca4b70c8a0c7268236f

SHA1
653d77ad181a4ccf169db699a0c011e3ffe4b218

SHA256
82d6c16a6c178416b05577cbe668713a08ae9fc874342408d4339a147020bc10

SHA512
0815dc374855ea5753bd6ac624f5b8b7bfcaf9fac6155ca91e22e692611da6ac73dd42b5dbdd7631948de42ab91eb699b85da88aea13e4b688c91d8a82c03f0f

Download Submit
\Program Files (x86)\ProxyVan\Updater\Serilog.Sinks.RollingFile.dll
Filesize
18KB

MD5
1956aa1e1eb74ca4b70c8a0c7268236f

SHA1
653d77ad181a4ccf169db699a0c011e3ffe4b218

SHA256
82d6c16a6c178416b05577cbe668713a08ae9fc874342408d4339a147020bc10

SHA512
0815dc374855ea5753bd6ac624f5b8b7bfcaf9fac6155ca91e22e692611da6ac73dd42b5dbdd7631948de42ab91eb699b85da88aea13e4b688c91d8a82c03f0f

Download Submit
\Program Files (x86)\ProxyVan\Updater\Serilog.dll
Filesize
123KB

MD5
5ad091f31cfe9d0e1eb325c09a6440cc

SHA1
8655ac00f4eb82dd0c9dc632b02642a3240633b9

SHA256
7344321f0385a0189d641d7a11371524b91327930bb8ebbef2dabd94bdac0ba8

SHA512
0030f47ca6cfc53a0c2038792839e969a7e80a80669b9498b86ce27a34d49b67f530c09e6a20c79ad2e1b5073135edc46cc0665acbb1c9e2327c5d18da0dc1e6

Download Submit
\Program Files (x86)\ProxyVan\Updater\Serilog.dll
Filesize
123KB

MD5
5ad091f31cfe9d0e1eb325c09a6440cc

SHA1
8655ac00f4eb82dd0c9dc632b02642a3240633b9

SHA256
7344321f0385a0189d641d7a11371524b91327930bb8ebbef2dabd94bdac0ba8

SHA512
0030f47ca6cfc53a0c2038792839e969a7e80a80669b9498b86ce27a34d49b67f530c09e6a20c79ad2e1b5073135edc46cc0665acbb1c9e2327c5d18da0dc1e6

Download Submit
\Program Files (x86)\ProxyVan\unins000.exe
Filesize
2.4MB

MD5
e14bbe9b410ff9c73da715b293dd47c4

SHA1
ea4092753d1f596534caf74350a13770074afcb6

SHA256
32b0e31bccf8b5d4eabefd6e1f0b7db3cfdd8bc0364c18daa92d8ba60415640d

SHA512
a9bbc92fc1bba041646df79bab2253ffe68be2af31f976c7ed6c302294d59bab06304f096d2876e23fab1ff7571cf4cc1c1e2b63ad7f8d66038f457d15f7b75e

Download Submit
\Users\Admin\AppData\Local\Temp\installer_2.20.6.exe
Filesize
2.6MB

MD5
d7f95e9e9a755adc5af39a34321b7a46

SHA1
de079eeaf630d994ac463a85c59a2abecf500c60

SHA256
928c26f80c0562d3af4f49c3a8fc8193d0bdcf17b4f44532009bceb9d84628c6

SHA512
e050d2efaf9474e568cccbcafe0c493785b44e128fa7b6e229996cd402f4f9ecd9c6cb5f3157c1ebeb175d0595a7b3b517add74283f98f8cb8c1941431eaf33f

Download Submit
\Users\Admin\AppData\Local\Temp\is-9JOQK.tmp\tmpA3BF.tmp
Filesize
2.4MB

MD5
e14bbe9b410ff9c73da715b293dd47c4

SHA1
ea4092753d1f596534caf74350a13770074afcb6

SHA256
32b0e31bccf8b5d4eabefd6e1f0b7db3cfdd8bc0364c18daa92d8ba60415640d

SHA512
a9bbc92fc1bba041646df79bab2253ffe68be2af31f976c7ed6c302294d59bab06304f096d2876e23fab1ff7571cf4cc1c1e2b63ad7f8d66038f457d15f7b75e

Download Submit
\Users\Admin\AppData\Local\Temp\tmpA3BF.exe
Filesize
2.6MB

MD5
a41586e828d97f5f0bcbac5b0a604e80

SHA1
114292bf99ae576181b3a4f1c255677dda93eff2

SHA256
9e162d04ce9427bc1dedb4dec70e1b503c32a2221ba93a2f6b460dbec1212808

SHA512
98363440367d412ed7c4087459ef300cf1d1f965f9a7331ec70e7b18eb79f19a2aa73b97e48ebad16d1389ec902a1884c6e5a6208ed2ec835c27536245cebcd3

Download Submit
memory/112-56-0x0000000000000000-mapping.dmp

Download
memory/112-59-0x00000000011A0000-0x0000000001436000-memory.dmp

Filesize
2.6MB

Download
memory/592-157-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/592-65-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/592-74-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/592-62-0x0000000000000000-mapping.dmp

Download
memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1440-186-0x0000000003B20000-0x0000000003B2C000-memory.dmp

Filesize
48KB

Download
memory/1440-193-0x0000000003D70000-0x0000000003D7A000-memory.dmp

Filesize
40KB

Download
memory/1440-125-0x0000000000270000-0x0000000000296000-memory.dmp

Filesize
152KB

Download
memory/1440-165-0x0000000000D90000-0x0000000000DDC000-memory.dmp

Filesize
304KB

Download
memory/1440-195-0x0000000003DE0000-0x0000000003DFE000-memory.dmp

Filesize
120KB

Download
memory/1440-135-0x0000000000580000-0x000000000058E000-memory.dmp

Filesize
56KB

Download
memory/1440-194-0x0000000003D80000-0x0000000003D9E000-memory.dmp

Filesize
120KB

Download
memory/1440-180-0x0000000003B10000-0x0000000003B18000-memory.dmp

Filesize
32KB

Download
memory/1440-121-0x0000000000D80000-0x0000000000D90000-memory.dmp

Filesize
64KB

Download
memory/1440-142-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/1440-192-0x0000000003D50000-0x0000000003D5C000-memory.dmp

Filesize
48KB

Download
memory/1440-191-0x0000000003BD0000-0x0000000003BF0000-memory.dmp

Filesize
128KB

Download
memory/1440-189-0x0000000003B60000-0x0000000003B6A000-memory.dmp

Filesize
40KB

Download
memory/1440-179-0x00000000039A0000-0x00000000039B0000-memory.dmp

Filesize
64KB

Download
memory/1440-187-0x0000000003B30000-0x0000000003B40000-memory.dmp

Filesize
64KB

Download
memory/1440-166-0x0000000000DE0000-0x0000000000DF2000-memory.dmp

Filesize
72KB

Download
memory/1440-196-0x0000000003E40000-0x0000000003E4A000-memory.dmp

Filesize
40KB

Download
memory/1440-130-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/1440-188-0x0000000003B40000-0x0000000003B50000-memory.dmp

Filesize
64KB

Download
memory/1440-178-0x0000000003990000-0x0000000003998000-memory.dmp

Filesize
32KB

Download
memory/1440-176-0x0000000003950000-0x0000000003982000-memory.dmp

Filesize
200KB

Download
memory/1440-151-0x00000000005B0000-0x00000000005BC000-memory.dmp

Filesize
48KB

Download
memory/1440-175-0x00000000034A0000-0x00000000034AA000-memory.dmp

Filesize
40KB

Download
memory/1440-173-0x0000000000E10000-0x0000000000E18000-memory.dmp

Filesize
32KB

Download
memory/1440-154-0x0000000000B70000-0x0000000000B92000-memory.dmp

Filesize
136KB

Download
memory/1440-171-0x00000000030B0000-0x00000000030C6000-memory.dmp

Filesize
88KB

Download
memory/1440-170-0x0000000002F20000-0x0000000002F46000-memory.dmp

Filesize
152KB

Download
memory/1440-158-0x0000000000C20000-0x0000000000C36000-memory.dmp

Filesize
88KB

Download
memory/1440-160-0x0000000000670000-0x000000000067E000-memory.dmp

Filesize
56KB

Download
memory/1440-169-0x0000000000E00000-0x0000000000E0A000-memory.dmp

Filesize
40KB

Download
memory/1440-161-0x0000000000C40000-0x0000000000C8A000-memory.dmp

Filesize
296KB

Download
memory/1440-168-0x0000000000D60000-0x0000000000D6A000-memory.dmp

Filesize
40KB

Download
memory/1620-78-0x0000000000000000-mapping.dmp

Download
memory/1624-111-0x0000000000A10000-0x0000000000A1E000-memory.dmp

Filesize
56KB

Download
memory/1624-82-0x0000000000A30000-0x0000000000A46000-memory.dmp

Filesize
88KB

Download
memory/1624-167-0x0000000003F00000-0x0000000003F0A000-memory.dmp

Filesize
40KB

Download
memory/1624-163-0x0000000003ED0000-0x0000000003EE2000-memory.dmp

Filesize
72KB

Download
memory/1624-162-0x0000000003D00000-0x0000000003D4A000-memory.dmp

Filesize
296KB

Download
memory/1624-159-0x0000000003000000-0x000000000300E000-memory.dmp

Filesize
56KB

Download
memory/1624-156-0x0000000003750000-0x0000000003766000-memory.dmp

Filesize
88KB

Download
memory/1624-102-0x00000000007E0000-0x00000000007EC000-memory.dmp

Filesize
48KB

Download
memory/1624-172-0x0000000004040000-0x0000000004048000-memory.dmp

Filesize
32KB

Download
memory/1624-155-0x0000000003720000-0x0000000003742000-memory.dmp

Filesize
136KB

Download
memory/1624-174-0x00000000040F0000-0x00000000040FA000-memory.dmp

Filesize
40KB

Download
memory/1624-94-0x0000000000240000-0x000000000024E000-memory.dmp

Filesize
56KB

Download
memory/1624-90-0x0000000000230000-0x000000000023A000-memory.dmp

Filesize
40KB

Download
memory/1624-177-0x0000000004160000-0x0000000004168000-memory.dmp

Filesize
32KB

Download
memory/1624-86-0x0000000000570000-0x0000000000596000-memory.dmp

Filesize
152KB

Download
memory/1624-106-0x0000000000800000-0x0000000000838000-memory.dmp

Filesize
224KB

Download
memory/1624-181-0x0000000004180000-0x0000000004190000-memory.dmp

Filesize
64KB

Download
memory/1624-164-0x0000000003BF0000-0x0000000003BFA000-memory.dmp

Filesize
40KB

Download
memory/1624-182-0x00000000041A0000-0x00000000041AC000-memory.dmp

Filesize
48KB

Download
memory/1624-183-0x00000000042B0000-0x00000000042C0000-memory.dmp

Filesize
64KB

Download
memory/1624-184-0x00000000042C0000-0x00000000042D0000-memory.dmp

Filesize
64KB

Download
memory/1624-185-0x0000000004460000-0x000000000446A000-memory.dmp

Filesize
40KB

Download
memory/1624-98-0x00000000005B0000-0x00000000005BE000-memory.dmp

Filesize
56KB

Download
memory/1624-146-0x0000000000D70000-0x0000000000D86000-memory.dmp

Filesize
88KB

Download
memory/1624-137-0x0000000002ED0000-0x0000000002EF6000-memory.dmp

Filesize
152KB

Download
memory/1624-113-0x0000000000B30000-0x0000000000B4A000-memory.dmp

Filesize
104KB

Download
memory/1624-190-0x0000000004520000-0x0000000004540000-memory.dmp

Filesize
128KB

Download
memory/1624-119-0x0000000000BE0000-0x0000000000C2C000-memory.dmp

Filesize
304KB

Download
memory/1636-77-0x0000000000000000-mapping.dmp

Download
memory/1852-112-0x0000000000000000-mapping.dmp

Download
memory/1948-72-0x0000000073F81000-0x0000000073F83000-memory.dmp

Filesize
8KB

Download
memory/1948-69-0x0000000000000000-mapping.dmp

Download
memory/2004-76-0x0000000000000000-mapping.dmp

Download