b2a723c6e2309b4e1e32a3b22f5c2c3dfcd92c062f2b1e0aa00a9b6823fd2f2d

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wireguard-amd64-0.0.38.msi
Size

4.1MB
MD5

6b2ea1ceb4974a9b9a77f59c2fb1bc00
SHA1

53d6bac096652875d3524fd63ed4594875f75be4
SHA256

b2a723c6e2309b4e1e32a3b22f5c2c3dfcd92c062f2b1e0aa00a9b6823fd2f2d
SHA512

d9eb4b376f589ec347a66787c0a43c3a366fb8c283db6d9e74131b2a79e399d7ae1bcfad099efcca22902e75e5290c773fe7b1790ac4fb75643d13fba216ae33
SSDEEP

98304:uV5CKiz8xjHuUY0Nyvm3Rh7l0d/mmvfMdoTy:05+z6iENyO3D7Sd/9cdoO

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5072	wireguard.exe
3332	wireguard.exe
3924	wireguard.exe
4444	wireguard.exe

Loads dropped DLL 4 IoCs

pid	Process
404	MsiExec.exe
404	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
9	3200	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\netk57a.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\WireGuard\log.bin	wireguard.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\netl260a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\net7800-x64-n650f.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0ffe2e2c-6ae3-1744-bb59-36c06869f066}\wintun.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\netloop.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\rndiscmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\msdri.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_55014eff4ceefbdf\athw8x.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	wireguard.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_dba6eeaf0544a4e0\netwmbclass.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\net1ic64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\net819xp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\nete1e3e.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\netvwifimp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\netvwwanmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\netl1e64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\netwtw06.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\net8187bv64.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0ffe2e2c-6ae3-1744-bb59-36c06869f066}\SETA796.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	wireguard.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_be4ba6237d385e2e\netrndis.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\SysWOW64\wg.exe	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\netax88772.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\netavpna.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\netvchannel.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\netxex64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_07ad61d07466a58a\wceisvista.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\netbc64.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0ffe2e2c-6ae3-1744-bb59-36c06869f066}\SETA786.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_8984d8483eef476c\rt640x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{0ffe2e2c-6ae3-1744-bb59-36c06869f066}\SETA786.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\netnvma.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{0ffe2e2c-6ae3-1744-bb59-36c06869f066}\SETA796.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_b6748bc8bb8ccf4d\netax88179_178a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_0bbd8466b526ef26\ykinx64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_101a408e6cb1d8f8\netmlx5.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\netsstpa.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	wireguard.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8de1181bfd1f1628\ndisimplatformmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\netwtw02.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bcmwdidhdpcie.inf_amd64_977dcc915465b0e9\bcmwdidhdpcie.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\netr7364.PNF	MsiExec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\WireGuard\wireguard.exe	msiexec.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e587f2e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e587f2e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI855C.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\{00E2ADC9-073D-4CBE-8755-E115483FC8C2}\wireguard.ico	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI80C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{00E2ADC9-073D-4CBE-8755-E115483FC8C2}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8346.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI83E4.tmp	msiexec.exe
File created	C:\Windows\Installer\e587f30.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI81EE.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\{00E2ADC9-073D-4CBE-8755-E115483FC8C2}\wireguard.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIABB1.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 31 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002d5e0d994d17e0d40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002d5e0d990000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809002d5e0d99000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d2d5e0d99000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002d5e0d9900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	wireguard.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	wireguard.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	wireguard.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	wireguard.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	wireguard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\PackageCode = "430C50E56533C354CA6F9C7A782DC32E"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5AD1A5E563ABD40429CE1450D0C197C9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5AD1A5E563ABD40429CE1450D0C197C9\9CDA2E00D370EBC478551E5184F38C2C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CDA2E00D370EBC478551E5184F38C2C\WireGuardFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\ProductName = "WireGuard"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CDA2E00D370EBC478551E5184F38C2C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\ProductIcon = "C:\\Windows\\Installer\\{00E2ADC9-073D-4CBE-8755-E115483FC8C2}\\wireguard.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\SourceList\PackageName = "wireguard-amd64-0.0.38.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CDA2E00D370EBC478551E5184F38C2C\WintunFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CDA2E00D370EBC478551E5184F38C2C\Version = "38"	msiexec.exe

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	wireguard.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	wireguard.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	wireguard.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4444	wireguard.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2212	msiexec.exe
2212	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3200	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3200	msiexec.exe
Token: SeSecurityPrivilege	2212	msiexec.exe
Token: SeCreateTokenPrivilege	3200	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3200	msiexec.exe
Token: SeLockMemoryPrivilege	3200	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3200	msiexec.exe
Token: SeMachineAccountPrivilege	3200	msiexec.exe
Token: SeTcbPrivilege	3200	msiexec.exe
Token: SeSecurityPrivilege	3200	msiexec.exe
Token: SeTakeOwnershipPrivilege	3200	msiexec.exe
Token: SeLoadDriverPrivilege	3200	msiexec.exe
Token: SeSystemProfilePrivilege	3200	msiexec.exe
Token: SeSystemtimePrivilege	3200	msiexec.exe
Token: SeProfSingleProcessPrivilege	3200	msiexec.exe
Token: SeIncBasePriorityPrivilege	3200	msiexec.exe
Token: SeCreatePagefilePrivilege	3200	msiexec.exe
Token: SeCreatePermanentPrivilege	3200	msiexec.exe
Token: SeBackupPrivilege	3200	msiexec.exe
Token: SeRestorePrivilege	3200	msiexec.exe
Token: SeShutdownPrivilege	3200	msiexec.exe
Token: SeDebugPrivilege	3200	msiexec.exe
Token: SeAuditPrivilege	3200	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3200	msiexec.exe
Token: SeChangeNotifyPrivilege	3200	msiexec.exe
Token: SeRemoteShutdownPrivilege	3200	msiexec.exe
Token: SeUndockPrivilege	3200	msiexec.exe
Token: SeSyncAgentPrivilege	3200	msiexec.exe
Token: SeEnableDelegationPrivilege	3200	msiexec.exe
Token: SeManageVolumePrivilege	3200	msiexec.exe
Token: SeImpersonatePrivilege	3200	msiexec.exe
Token: SeCreateGlobalPrivilege	3200	msiexec.exe
Token: SeBackupPrivilege	4688	vssvc.exe
Token: SeRestorePrivilege	4688	vssvc.exe
Token: SeAuditPrivilege	4688	vssvc.exe
Token: SeBackupPrivilege	2212	msiexec.exe
Token: SeRestorePrivilege	2212	msiexec.exe
Token: SeRestorePrivilege	2212	msiexec.exe
Token: SeTakeOwnershipPrivilege	2212	msiexec.exe
Token: SeRestorePrivilege	2212	msiexec.exe
Token: SeTakeOwnershipPrivilege	2212	msiexec.exe
Token: SeRestorePrivilege	2212	msiexec.exe
Token: SeTakeOwnershipPrivilege	2212	msiexec.exe
Token: SeRestorePrivilege	2212	msiexec.exe
Token: SeTakeOwnershipPrivilege	2212	msiexec.exe
Token: SeRestorePrivilege	2212	msiexec.exe
Token: SeTakeOwnershipPrivilege	2212	msiexec.exe
Token: SeRestorePrivilege	2212	msiexec.exe
Token: SeTakeOwnershipPrivilege	2212	msiexec.exe
Token: SeAuditPrivilege	2724	svchost.exe
Token: SeSecurityPrivilege	2724	svchost.exe
Token: SeRestorePrivilege	2212	msiexec.exe
Token: SeTakeOwnershipPrivilege	2212	msiexec.exe
Token: SeRestorePrivilege	2212	msiexec.exe
Token: SeTakeOwnershipPrivilege	2212	msiexec.exe
Token: SeRestorePrivilege	2212	msiexec.exe
Token: SeTakeOwnershipPrivilege	2212	msiexec.exe
Token: SeRestorePrivilege	2212	msiexec.exe
Token: SeTakeOwnershipPrivilege	2212	msiexec.exe
Token: SeRestorePrivilege	2212	msiexec.exe
Token: SeTakeOwnershipPrivilege	2212	msiexec.exe
Token: SeRestorePrivilege	2212	msiexec.exe
Token: SeTakeOwnershipPrivilege	2212	msiexec.exe
Token: SeRestorePrivilege	2212	msiexec.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
3200	msiexec.exe
3200	msiexec.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe
4444	wireguard.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1296	2212	msiexec.exe	96
PID 2212 wrote to memory of 1296	2212	msiexec.exe	96
PID 2212 wrote to memory of 404	2212	msiexec.exe	98
PID 2212 wrote to memory of 404	2212	msiexec.exe	98
PID 2212 wrote to memory of 2220	2212	msiexec.exe	99
PID 2212 wrote to memory of 2220	2212	msiexec.exe	99
PID 2724 wrote to memory of 2620	2724	svchost.exe	101
PID 2724 wrote to memory of 2620	2724	svchost.exe	101
PID 2212 wrote to memory of 5072	2212	msiexec.exe	102
PID 2212 wrote to memory of 5072	2212	msiexec.exe	102
PID 5072 wrote to memory of 3332	5072	wireguard.exe	104
PID 5072 wrote to memory of 3332	5072	wireguard.exe	104
PID 3924 wrote to memory of 4444	3924	wireguard.exe	106
PID 3924 wrote to memory of 4444	3924	wireguard.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\wireguard-amd64-0.0.38.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3200

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1296
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B8367D8EE19270D8CF0CCB2A908E39ED
  2⤵
  - Loads dropped DLL
  PID:404
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8F318DAD11E44E3F1CA62BC8300DBDBF E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:2220
- C:\Program Files\WireGuard\wireguard.exe
  "C:\Program Files\WireGuard\wireguard.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Program Files\WireGuard\wireguard.exe
    "C:\Program Files\WireGuard\wireguard.exe" /installmanagerservice
    3⤵
    - Executes dropped EXE
    PID:3332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\Temp\1bfe051fb86972b9befa09c9c99801681b530aa365dcb5d3a78f185b7f7e3fb0\wintun.inf" "9" "47df9e2ab" "000000000000014C" "WinSta0\Default" "0000000000000160" "208" "C:\Windows\Temp\1bfe051fb86972b9befa09c9c99801681b530aa365dcb5d3a78f185b7f7e3fb0"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2620

C:\Program Files\WireGuard\wireguard.exe
"C:\Program Files\WireGuard\wireguard.exe" /managerservice
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files\WireGuard\wireguard.exe
  "C:\Program Files\WireGuard\wireguard.exe" /ui 968 964 976 984
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e587f2f.rbs

Filesize
9KB

MD5
56bdde9594a9e6410058fad076830805

SHA1
451d8d32e1873b67ace5b1c2bba808865f9f7d91

SHA256
081574dcde1917fd7259ac074343e1177b78f3b76961f480c78c5307e764ae46

SHA512
708ea6610a5dabcd4ef6c59d341c1760ac556979be885cefb9d2240f8f1f378654936f9353c1c36584f0fc90330c89e59240ecfbab4dca1eac5ff74cd54000dd

Download Submit
C:\Config.Msi\e587f31.rbs

Filesize
418B

MD5
3553deb882b38f22a39bbbd447672431

SHA1
8471fd32a71b92694f17f585d70537e3f412e0ce

SHA256
7a1ba6b11793f352ae19a2e95b319f73ef5324a6a6ec7f11c0d4dbd59d903675

SHA512
a6067c7d52c37caffd04049f467335a62348af618d670089c1fd4eba9646a69af1ca61f0da28ce6ddd704f55146466d8c358832ae56e8f85183fc4b9b14bfdc5

Download Submit
C:\Program Files\WireGuard\wireguard.exe

Filesize
12.1MB

MD5
03c54345a12a77fdfa4e65184f98eeeb

SHA1
ae9eed8ae1f8429341f4dd76bec49874d97c728f

SHA256
80d2fa7093da929f0fb5580dd28c23f1b2901cb80e15600d9b0cf82da4f3f9ab

SHA512
eb0a3e672370ed5f379d690b22662d1ee32fb9bf58bac8c66ec4060275240d72f69cc680413a3ac967bd66e13def0117653c42cb11f974a3387ea1ff7530b21b

Download Submit
C:\Program Files\WireGuard\wireguard.exe

Filesize
12.1MB

MD5
03c54345a12a77fdfa4e65184f98eeeb

SHA1
ae9eed8ae1f8429341f4dd76bec49874d97c728f

SHA256
80d2fa7093da929f0fb5580dd28c23f1b2901cb80e15600d9b0cf82da4f3f9ab

SHA512
eb0a3e672370ed5f379d690b22662d1ee32fb9bf58bac8c66ec4060275240d72f69cc680413a3ac967bd66e13def0117653c42cb11f974a3387ea1ff7530b21b

Download Submit
C:\Program Files\WireGuard\wireguard.exe

Filesize
12.1MB

MD5
03c54345a12a77fdfa4e65184f98eeeb

SHA1
ae9eed8ae1f8429341f4dd76bec49874d97c728f

SHA256
80d2fa7093da929f0fb5580dd28c23f1b2901cb80e15600d9b0cf82da4f3f9ab

SHA512
eb0a3e672370ed5f379d690b22662d1ee32fb9bf58bac8c66ec4060275240d72f69cc680413a3ac967bd66e13def0117653c42cb11f974a3387ea1ff7530b21b

Download Submit
C:\Program Files\WireGuard\wireguard.exe

Filesize
12.1MB

MD5
03c54345a12a77fdfa4e65184f98eeeb

SHA1
ae9eed8ae1f8429341f4dd76bec49874d97c728f

SHA256
80d2fa7093da929f0fb5580dd28c23f1b2901cb80e15600d9b0cf82da4f3f9ab

SHA512
eb0a3e672370ed5f379d690b22662d1ee32fb9bf58bac8c66ec4060275240d72f69cc680413a3ac967bd66e13def0117653c42cb11f974a3387ea1ff7530b21b

Download Submit
C:\Program Files\WireGuard\wireguard.exe

Filesize
12.1MB

MD5
03c54345a12a77fdfa4e65184f98eeeb

SHA1
ae9eed8ae1f8429341f4dd76bec49874d97c728f

SHA256
80d2fa7093da929f0fb5580dd28c23f1b2901cb80e15600d9b0cf82da4f3f9ab

SHA512
eb0a3e672370ed5f379d690b22662d1ee32fb9bf58bac8c66ec4060275240d72f69cc680413a3ac967bd66e13def0117653c42cb11f974a3387ea1ff7530b21b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D

Filesize
471B

MD5
7cccd0087427c47c2ffc1a44abdbaacd

SHA1
34ec0ca0e0e010cacab806f838db31d0d98a20a8

SHA256
8420d86c0a3fd6ad812bb278fed5a08522e2367d974042d5e4978f9bc4df979b

SHA512
000ced172de3cad8f1cbe1504034082413734ad2041a017394ebdfb3057a48840430ab5a71f7b205944291039107395a5f28c5bb4b206d524d73205018ccc6bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_94FAF4007D97DD988E34ECDCFF463840

Filesize
471B

MD5
0b5bee3f0b052048a8bf1e727f7a3e77

SHA1
d331e84eec38c9f3e0e2fc37f211f6dcf20de09e

SHA256
7bb7e6049c2cd596d4f394c8c84f3ecbc4b991bd40b297d13d4bacf96e55891c

SHA512
bc857a5516290857c1dbb33798fab0d8cdcde6f7cd8fe64466e7fd18f44387bb581601bff3f53435353ed68abc051f20e1da9459331cf2c37077404049eaf727

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D

Filesize
396B

MD5
1ec198938a90ffc7b79bba00e6b9d3c4

SHA1
5919d0f43c90174997132f0abe288f8ea39a34d8

SHA256
1bf7f23c6faf40cc349d749b9888bbf3b8cd1df563295a1e497b82c26cd0b9a3

SHA512
448d457f02630fa415f349488b98074d9c488c56ddd3f989b21592dfc295ac906aaca98955a2575d3e8e522dce1aaa40f1f5660923ad7ec9cc98ff94c2d08b27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_94FAF4007D97DD988E34ECDCFF463840

Filesize
408B

MD5
50aff3a200e2b982c82f53e74223ae94

SHA1
b4d7ebe6e45a36b6161199ba9fb7f45d1b901603

SHA256
842a4d37d461acebfb5dec797ef7d403770bd7849bf0dfe0bf30591ea18b1240

SHA512
3ddacbc7a0fe1085514feca91b53f9779e6b1410672fa1d4e66a1ca55ea0c823bc2ca8d3285d5d02baa886a549e3efd73c2f7d99215879ac1f652ae6f6da01b7

Download Submit
C:\Windows\Installer\MSI80C4.tmp

Filesize
103KB

MD5
124f15d8326edaa27a51d7a1d2242643

SHA1
ee7c14399f438b60bb2abbca053f9226fb1c9468

SHA256
5c2f81324d16042e40f235a3e03bad4dc03cef3eef1c58f69b88b22f082ec261

SHA512
c3ce96f790f2d8c82e8c95d5252388552bc159cf0c3d5df0eda3b59bc06659e71a4c1d24f63898af2626e2d98fc32db9f50327d066d4df6e719c251ff36c2271

Download Submit
C:\Windows\Installer\MSI80C4.tmp

Filesize
103KB

MD5
124f15d8326edaa27a51d7a1d2242643

SHA1
ee7c14399f438b60bb2abbca053f9226fb1c9468

SHA256
5c2f81324d16042e40f235a3e03bad4dc03cef3eef1c58f69b88b22f082ec261

SHA512
c3ce96f790f2d8c82e8c95d5252388552bc159cf0c3d5df0eda3b59bc06659e71a4c1d24f63898af2626e2d98fc32db9f50327d066d4df6e719c251ff36c2271

Download Submit
C:\Windows\Installer\MSI81EE.tmp

Filesize
275KB

MD5
2232c07e354364e0eb1dc80024593826

SHA1
65bb4232c0416cfb2c158bfc32a7732ad72cee72

SHA256
fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f

SHA512
f0d295565b209f4dedd2a79123fa54ff9b8cbb173f14463ab3d3707b8d87aad84b05c2898478ecc148e29d02fa07ddda9499795e0ceafc2982c0adbd570a3572

Download Submit
C:\Windows\Installer\MSI81EE.tmp

Filesize
275KB

MD5
2232c07e354364e0eb1dc80024593826

SHA1
65bb4232c0416cfb2c158bfc32a7732ad72cee72

SHA256
fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f

SHA512
f0d295565b209f4dedd2a79123fa54ff9b8cbb173f14463ab3d3707b8d87aad84b05c2898478ecc148e29d02fa07ddda9499795e0ceafc2982c0adbd570a3572

Download Submit
C:\Windows\Installer\MSI83E4.tmp

Filesize
103KB

MD5
124f15d8326edaa27a51d7a1d2242643

SHA1
ee7c14399f438b60bb2abbca053f9226fb1c9468

SHA256
5c2f81324d16042e40f235a3e03bad4dc03cef3eef1c58f69b88b22f082ec261

SHA512
c3ce96f790f2d8c82e8c95d5252388552bc159cf0c3d5df0eda3b59bc06659e71a4c1d24f63898af2626e2d98fc32db9f50327d066d4df6e719c251ff36c2271

Download Submit
C:\Windows\Installer\MSI83E4.tmp

Filesize
103KB

MD5
124f15d8326edaa27a51d7a1d2242643

SHA1
ee7c14399f438b60bb2abbca053f9226fb1c9468

SHA256
5c2f81324d16042e40f235a3e03bad4dc03cef3eef1c58f69b88b22f082ec261

SHA512
c3ce96f790f2d8c82e8c95d5252388552bc159cf0c3d5df0eda3b59bc06659e71a4c1d24f63898af2626e2d98fc32db9f50327d066d4df6e719c251ff36c2271

Download Submit
C:\Windows\Installer\MSI855C.tmp

Filesize
275KB

MD5
2232c07e354364e0eb1dc80024593826

SHA1
65bb4232c0416cfb2c158bfc32a7732ad72cee72

SHA256
fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f

SHA512
f0d295565b209f4dedd2a79123fa54ff9b8cbb173f14463ab3d3707b8d87aad84b05c2898478ecc148e29d02fa07ddda9499795e0ceafc2982c0adbd570a3572

Download Submit
C:\Windows\Installer\MSI855C.tmp

Filesize
275KB

MD5
2232c07e354364e0eb1dc80024593826

SHA1
65bb4232c0416cfb2c158bfc32a7732ad72cee72

SHA256
fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f

SHA512
f0d295565b209f4dedd2a79123fa54ff9b8cbb173f14463ab3d3707b8d87aad84b05c2898478ecc148e29d02fa07ddda9499795e0ceafc2982c0adbd570a3572

Download Submit
C:\Windows\Installer\e587f2e.msi

Filesize
4.1MB

MD5
6b2ea1ceb4974a9b9a77f59c2fb1bc00

SHA1
53d6bac096652875d3524fd63ed4594875f75be4

SHA256
b2a723c6e2309b4e1e32a3b22f5c2c3dfcd92c062f2b1e0aa00a9b6823fd2f2d

SHA512
d9eb4b376f589ec347a66787c0a43c3a366fb8c283db6d9e74131b2a79e399d7ae1bcfad099efcca22902e75e5290c773fe7b1790ac4fb75643d13fba216ae33

Download Submit
C:\Windows\System32\DriverStore\Temp\{0ffe2e2c-6ae3-1744-bb59-36c06869f066}\wintun.cat

Filesize
9KB

MD5
faba2ccb8fe366fd281ca6be6d2bb7c2

SHA1
bb7bd32a21f3eba652fde24146387ffc5278143e

SHA256
602187e5470ddbdf9421045bb0515f358c88bf88f59fd8a886fb6373da5d0f82

SHA512
ec424a545e2598f299706499dab07b4d12b0734a52f928216a53bca2b7f384b97bd4fc092d7d68de636a75daf79ac392c4b49b7251ec011236de1659253d6214

Download Submit
C:\Windows\System32\DriverStore\Temp\{0ffe2e2c-6ae3-1744-bb59-36c06869f066}\wintun.sys

Filesize
37KB

MD5
1945d7d1f56b67ae1cad6ffe13a01985

SHA1
2c1a369f9e12e5c6549439e60dd6c728bf1bffde

SHA256
eb58bf00df7b4f98334178e75df3348c609ea5c6c74cf7f185f363aa23976c8b

SHA512
09af87898528eaa657d46c79b7c4ebc0e415478a421b0b97355294c059878178eb32e172979ee9b7c59126861d51a5831e337a96666c43c96cb1cf8f11bc0a0f

Download Submit
C:\Windows\Temp\1BFE05~1\wintun.cat

Filesize
9KB

MD5
faba2ccb8fe366fd281ca6be6d2bb7c2

SHA1
bb7bd32a21f3eba652fde24146387ffc5278143e

SHA256
602187e5470ddbdf9421045bb0515f358c88bf88f59fd8a886fb6373da5d0f82

SHA512
ec424a545e2598f299706499dab07b4d12b0734a52f928216a53bca2b7f384b97bd4fc092d7d68de636a75daf79ac392c4b49b7251ec011236de1659253d6214

Download Submit
C:\Windows\Temp\1BFE05~1\wintun.sys

Filesize
37KB

MD5
1945d7d1f56b67ae1cad6ffe13a01985

SHA1
2c1a369f9e12e5c6549439e60dd6c728bf1bffde

SHA256
eb58bf00df7b4f98334178e75df3348c609ea5c6c74cf7f185f363aa23976c8b

SHA512
09af87898528eaa657d46c79b7c4ebc0e415478a421b0b97355294c059878178eb32e172979ee9b7c59126861d51a5831e337a96666c43c96cb1cf8f11bc0a0f

Download Submit
C:\Windows\Temp\1bfe051fb86972b9befa09c9c99801681b530aa365dcb5d3a78f185b7f7e3fb0\wintun.inf

Filesize
1KB

MD5
8480579050970b0812cc3d9a1bce1340

SHA1
edebebd090602f4eee375ad754c8566d4fda23cb

SHA256
44098408ab9611dd99a38e140c7fb1ca5dce6eb2d5f0d5e500547ac1ba5d235b

SHA512
46de9202c3cf0ddbf19f9e0e02ec17530f2722abfa08669fd30a6095ce2342fa89a2cc59c1d47afd82b48c915bb95f4c6d16e7c21129a9c8f09c2bf239566933

Download Submit
C:\Windows\Temp\1bfe051fb86972b9befa09c9c99801681b530aa365dcb5d3a78f185b7f7e3fb0\wintun.inf

Filesize
1KB

MD5
8480579050970b0812cc3d9a1bce1340

SHA1
edebebd090602f4eee375ad754c8566d4fda23cb

SHA256
44098408ab9611dd99a38e140c7fb1ca5dce6eb2d5f0d5e500547ac1ba5d235b

SHA512
46de9202c3cf0ddbf19f9e0e02ec17530f2722abfa08669fd30a6095ce2342fa89a2cc59c1d47afd82b48c915bb95f4c6d16e7c21129a9c8f09c2bf239566933

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
a2e027dcca4fce291e49b0576adde9c0

SHA1
f2795333fba3dd9d913759ae318456a814f81332

SHA256
57b5a7669bf866a429bd07d374e8ece20d97eabc3ca59a2a2f50de8c1b6ae9cb

SHA512
c1e0fdc811e5a6afd867cb35ebfb1dd93f30ff30e48b7b1ce989ab7106371ef082931fd3a7ed9ca3704a21c3e6b41803d29b1049ae1a53e3168e8d6a3b2de6f8

Download Submit
\??\Volume{990d5e2d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{78c78d63-25f1-41df-a135-062ffd0efd9c}_OnDiskSnapshotProp

Filesize
5KB

MD5
741610d627de1207ec8adcb5f56db952

SHA1
03354e923885bf05fe62efc97436454132e54372

SHA256
6e122d57bbe5dc47ebaac1f0ced342d36e925241458dbf7684ffa1e324fa9015

SHA512
a9c08e9434065c4a695d2c7d7af8f96b3dc3217c3bd5a95767133eea76bce6a6fda78737e7975cea790f49a28c2fe0eea6e0df6366dfae145a4c3789088cf332

Download Submit
memory/3332-229-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download
memory/3924-233-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download
memory/3924-235-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download
memory/3924-248-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download
memory/4444-234-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download
memory/4444-236-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download
memory/4444-238-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download
memory/4444-241-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download
memory/4444-243-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download
memory/4444-245-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download
memory/4444-247-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download
memory/4444-249-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download
memory/4444-251-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download
memory/5072-223-0x0000000000BB0000-0x00000000017F2000-memory.dmp

Filesize
12.3MB

Download