4c9fa87e72fe59cf15131bd2f3bd7baa7a9555ceec438c1df78dd5d5b8394910

Analysis

max time kernel
122s
max time network
156s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4c9fa87e72fe59cf15131bd2f3bd7baa7a9555ceec438c1df78dd5d5b8394910.msi
Size

8.2MB
MD5

768a93731171defa116ea054790a7580
SHA1

01e49353852f5b80793c97ee2fef112b8b666f3d
SHA256

4c9fa87e72fe59cf15131bd2f3bd7baa7a9555ceec438c1df78dd5d5b8394910
SHA512

4d691300b4786c21135b1620a01bb9a59bd4f53ce7c5ea81b1d796e10480f877e6cf26477a06dcf1d63296ccdbc9b36e354c8240c1a30dfefa8b31b2898ca496
SSDEEP

98304:eyU7dPukw6+yjEnQusW4PWxxRCAgTs7UHloh6K7jMy3Um:eyydWBsFsxUI7Uw6KXMyE

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\npcap.sys	NPFInstall.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET1239.tmp	NPFInstall.exe
File created	C:\Windows\system32\DRIVERS\SET1239.tmp	NPFInstall.exe

Executes dropped EXE 7 IoCs

pid	Process
3068	MSIE4C6.tmp
2928	chaospc.exe
296	chaospcap.exe
2876	NPFInstall.exe
2408	NPFInstall.exe
2976	NPFInstall.exe
2368	NPFInstall.exe

Loads dropped DLL 28 IoCs

pid	Process
3068	MSIE4C6.tmp
3068	MSIE4C6.tmp
2928	chaospc.exe
296	chaospcap.exe
296	chaospcap.exe
296	chaospcap.exe
296	chaospcap.exe
1172	Process not Found
296	chaospcap.exe
296	chaospcap.exe
296	chaospcap.exe
296	chaospcap.exe
2068	Process not Found
296	chaospcap.exe
296	chaospcap.exe
2948	Process not Found
296	chaospcap.exe
296	chaospcap.exe
3040	Process not Found
1232	Process not Found
1232	Process not Found
296	chaospcap.exe
296	chaospcap.exe
296	chaospcap.exe
296	chaospcap.exe
296	chaospcap.exe
3068	MSIE4C6.tmp
3068	MSIE4C6.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\Administrator = "C:\\ProgramData\\Microsoft\\csrss.exe"	MSIE4C6.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7112abd5-b47a-39a4-b6ea-2b3c31c7f108}\SET3C9.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	NPFInstall.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7112abd5-b47a-39a4-b6ea-2b3c31c7f108}\SET3CA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7112abd5-b47a-39a4-b6ea-2b3c31c7f108}\npcap.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_neutral_0392b728f6f73ae3\npcap.PNF	DrvInst.exe
File created	C:\Windows\SysWOW64\Packet.dll	chaospcap.exe
File created	C:\Windows\system32\NpcapHelper.exe	chaospcap.exe
File created	C:\Windows\system32\WlanHelper.exe	chaospcap.exe
File created	C:\Windows\system32\Npcap\Packet.dll	chaospcap.exe
File created	C:\Windows\system32\Npcap\WlanHelper.exe	chaospcap.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_neutral_0392b728f6f73ae3\NPCAP.PNF	DrvInst.exe
File created	C:\Windows\SysWOW64\Npcap\wpcap.dll	chaospcap.exe
File created	C:\Windows\system32\Npcap\wpcap.dll	chaospcap.exe
File created	C:\Windows\System32\DriverStore\Temp\{7112abd5-b47a-39a4-b6ea-2b3c31c7f108}\SET3B8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7112abd5-b47a-39a4-b6ea-2b3c31c7f108}\SET3C9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	NPFInstall.exe
File created	C:\Windows\SysWOW64\wpcap.dll	chaospcap.exe
File created	C:\Windows\SysWOW64\Npcap\NpcapHelper.exe	chaospcap.exe
File created	C:\Windows\SysWOW64\Npcap\WlanHelper.exe	chaospcap.exe
File created	C:\Windows\system32\Packet.dll	chaospcap.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7112abd5-b47a-39a4-b6ea-2b3c31c7f108}\NPCAP.inf	DrvInst.exe
File created	C:\Windows\SysWOW64\WlanHelper.exe	chaospcap.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7112abd5-b47a-39a4-b6ea-2b3c31c7f108}\SET3B8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_neutral_0392b728f6f73ae3\npcap.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7112abd5-b47a-39a4-b6ea-2b3c31c7f108}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	NPFInstall.exe
File created	C:\Windows\SysWOW64\chaospcap.exe	chaospc.exe
File created	C:\Windows\SysWOW64\NpcapHelper.exe	chaospcap.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7112abd5-b47a-39a4-b6ea-2b3c31c7f108}\npcap.cat	DrvInst.exe
File created	C:\Windows\SysWOW64\chaospc.exe	MSIE4C6.tmp
File created	C:\Windows\SysWOW64\Npcap\Packet.dll	chaospcap.exe
File created	C:\Windows\system32\wpcap.dll	chaospcap.exe
File created	C:\Windows\system32\Npcap\NpcapHelper.exe	chaospcap.exe
File created	C:\Windows\System32\DriverStore\Temp\{7112abd5-b47a-39a4-b6ea-2b3c31c7f108}\SET3CA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\Npcap\DiagReport.ps1	chaospcap.exe
File created	C:\Program Files\Npcap\FixInstall.bat	chaospcap.exe
File created	C:\Program Files\Npcap\NPFInstall.exe	chaospcap.exe
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File created	C:\Program Files\Npcap\CheckStatus.bat	chaospcap.exe
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File created	C:\Program Files\Npcap\DiagReport.bat	chaospcap.exe
File created	C:\Program Files\Npcap\Uninstall.exe	chaospcap.exe
File created	C:\Program Files\Npcap\npcap.cat	chaospcap.exe
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File created	C:\Program Files\Npcap\npcap.sys	chaospcap.exe
File created	C:\Program Files\Npcap\npcap.inf	chaospcap.exe
File opened for modification	C:\Program Files\Npcap\install.log	chaospcap.exe
File created	C:\Program Files\Npcap\LICENSE	chaospcap.exe
File created	C:\Program Files\Npcap\npcap_wfp.inf	chaospcap.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f76e044.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE428.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE4C6.tmp	msiexec.exe
File created	C:\Windows\INF\oem0.PNF	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	NPFInstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	NPFInstall.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\INF\oem1.PNF	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	NPFInstall.exe
File created	C:\Windows\INF\oem2.PNF	NPFInstall.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f76e041.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76e041.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 13 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000014505-12.dat	nsis_installer_2
behavioral1/files/0x0007000000014505-13.dat	nsis_installer_2
behavioral1/files/0x0007000000014505-14.dat	nsis_installer_2
behavioral1/files/0x0006000000014b9a-17.dat	nsis_installer_2
behavioral1/files/0x0006000000014b9a-19.dat	nsis_installer_2
behavioral1/files/0x0006000000014b9a-23.dat	nsis_installer_2
behavioral1/files/0x0006000000014b9a-22.dat	nsis_installer_2
behavioral1/files/0x0006000000014c3c-25.dat	nsis_installer_1
behavioral1/files/0x0006000000014c3c-25.dat	nsis_installer_2
behavioral1/files/0x0006000000014c3c-28.dat	nsis_installer_1
behavioral1/files/0x0006000000014c3c-28.dat	nsis_installer_2
behavioral1/files/0x0006000000014c3c-29.dat	nsis_installer_1
behavioral1/files/0x0006000000014c3c-29.dat	nsis_installer_2

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1716	SCHTASKS.EXE

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2024	msiexec.exe
2024	msiexec.exe
2876	NPFInstall.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
468	Process not Found
468	Process not Found
468	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2080	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeSecurityPrivilege	2024	msiexec.exe
Token: SeCreateTokenPrivilege	2080	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2080	msiexec.exe
Token: SeLockMemoryPrivilege	2080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2080	msiexec.exe
Token: SeMachineAccountPrivilege	2080	msiexec.exe
Token: SeTcbPrivilege	2080	msiexec.exe
Token: SeSecurityPrivilege	2080	msiexec.exe
Token: SeTakeOwnershipPrivilege	2080	msiexec.exe
Token: SeLoadDriverPrivilege	2080	msiexec.exe
Token: SeSystemProfilePrivilege	2080	msiexec.exe
Token: SeSystemtimePrivilege	2080	msiexec.exe
Token: SeProfSingleProcessPrivilege	2080	msiexec.exe
Token: SeIncBasePriorityPrivilege	2080	msiexec.exe
Token: SeCreatePagefilePrivilege	2080	msiexec.exe
Token: SeCreatePermanentPrivilege	2080	msiexec.exe
Token: SeBackupPrivilege	2080	msiexec.exe
Token: SeRestorePrivilege	2080	msiexec.exe
Token: SeShutdownPrivilege	2080	msiexec.exe
Token: SeDebugPrivilege	2080	msiexec.exe
Token: SeAuditPrivilege	2080	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2080	msiexec.exe
Token: SeChangeNotifyPrivilege	2080	msiexec.exe
Token: SeRemoteShutdownPrivilege	2080	msiexec.exe
Token: SeUndockPrivilege	2080	msiexec.exe
Token: SeSyncAgentPrivilege	2080	msiexec.exe
Token: SeEnableDelegationPrivilege	2080	msiexec.exe
Token: SeManageVolumePrivilege	2080	msiexec.exe
Token: SeImpersonatePrivilege	2080	msiexec.exe
Token: SeCreateGlobalPrivilege	2080	msiexec.exe
Token: SeBackupPrivilege	2020	vssvc.exe
Token: SeRestorePrivilege	2020	vssvc.exe
Token: SeAuditPrivilege	2020	vssvc.exe
Token: SeBackupPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2776	DrvInst.exe
Token: SeRestorePrivilege	2776	DrvInst.exe
Token: SeRestorePrivilege	2776	DrvInst.exe
Token: SeRestorePrivilege	2776	DrvInst.exe
Token: SeRestorePrivilege	2776	DrvInst.exe
Token: SeRestorePrivilege	2776	DrvInst.exe
Token: SeRestorePrivilege	2776	DrvInst.exe
Token: SeLoadDriverPrivilege	2776	DrvInst.exe
Token: SeLoadDriverPrivilege	2776	DrvInst.exe
Token: SeLoadDriverPrivilege	2776	DrvInst.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeDebugPrivilege	2876	NPFInstall.exe
Token: SeRestorePrivilege	2816	pnputil.exe
Token: SeRestorePrivilege	2816	pnputil.exe
Token: SeRestorePrivilege	2816	pnputil.exe
Token: SeRestorePrivilege	2816	pnputil.exe
Token: SeRestorePrivilege	2816	pnputil.exe
Token: SeRestorePrivilege	2816	pnputil.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 3068	2024	msiexec.exe	34
PID 2024 wrote to memory of 3068	2024	msiexec.exe	34
PID 2024 wrote to memory of 3068	2024	msiexec.exe	34
PID 2024 wrote to memory of 3068	2024	msiexec.exe	34
PID 3068 wrote to memory of 2912	3068	MSIE4C6.tmp	35
PID 3068 wrote to memory of 2912	3068	MSIE4C6.tmp	35
PID 3068 wrote to memory of 2912	3068	MSIE4C6.tmp	35
PID 3068 wrote to memory of 2912	3068	MSIE4C6.tmp	35
PID 3068 wrote to memory of 1072	3068	MSIE4C6.tmp	37
PID 3068 wrote to memory of 1072	3068	MSIE4C6.tmp	37
PID 3068 wrote to memory of 1072	3068	MSIE4C6.tmp	37
PID 3068 wrote to memory of 1072	3068	MSIE4C6.tmp	37
PID 3068 wrote to memory of 2928	3068	MSIE4C6.tmp	39
PID 3068 wrote to memory of 2928	3068	MSIE4C6.tmp	39
PID 3068 wrote to memory of 2928	3068	MSIE4C6.tmp	39
PID 3068 wrote to memory of 2928	3068	MSIE4C6.tmp	39
PID 2928 wrote to memory of 2904	2928	chaospc.exe	40
PID 2928 wrote to memory of 2904	2928	chaospc.exe	40
PID 2928 wrote to memory of 2904	2928	chaospc.exe	40
PID 2928 wrote to memory of 2904	2928	chaospc.exe	40
PID 2928 wrote to memory of 296	2928	chaospc.exe	42
PID 2928 wrote to memory of 296	2928	chaospc.exe	42
PID 2928 wrote to memory of 296	2928	chaospc.exe	42
PID 2928 wrote to memory of 296	2928	chaospc.exe	42
PID 2928 wrote to memory of 296	2928	chaospc.exe	42
PID 2928 wrote to memory of 296	2928	chaospc.exe	42
PID 2928 wrote to memory of 296	2928	chaospc.exe	42
PID 296 wrote to memory of 2876	296	chaospcap.exe	43
PID 296 wrote to memory of 2876	296	chaospcap.exe	43
PID 296 wrote to memory of 2876	296	chaospcap.exe	43
PID 296 wrote to memory of 2876	296	chaospcap.exe	43
PID 296 wrote to memory of 2876	296	chaospcap.exe	43
PID 296 wrote to memory of 2876	296	chaospcap.exe	43
PID 296 wrote to memory of 2876	296	chaospcap.exe	43
PID 296 wrote to memory of 1608	296	chaospcap.exe	45
PID 296 wrote to memory of 1608	296	chaospcap.exe	45
PID 296 wrote to memory of 1608	296	chaospcap.exe	45
PID 296 wrote to memory of 1608	296	chaospcap.exe	45
PID 296 wrote to memory of 1608	296	chaospcap.exe	45
PID 296 wrote to memory of 1608	296	chaospcap.exe	45
PID 296 wrote to memory of 1608	296	chaospcap.exe	45
PID 296 wrote to memory of 2796	296	chaospcap.exe	47
PID 296 wrote to memory of 2796	296	chaospcap.exe	47
PID 296 wrote to memory of 2796	296	chaospcap.exe	47
PID 296 wrote to memory of 2796	296	chaospcap.exe	47
PID 296 wrote to memory of 2796	296	chaospcap.exe	47
PID 296 wrote to memory of 2796	296	chaospcap.exe	47
PID 296 wrote to memory of 2796	296	chaospcap.exe	47
PID 296 wrote to memory of 2408	296	chaospcap.exe	49
PID 296 wrote to memory of 2408	296	chaospcap.exe	49
PID 296 wrote to memory of 2408	296	chaospcap.exe	49
PID 296 wrote to memory of 2408	296	chaospcap.exe	49
PID 296 wrote to memory of 2408	296	chaospcap.exe	49
PID 296 wrote to memory of 2408	296	chaospcap.exe	49
PID 296 wrote to memory of 2408	296	chaospcap.exe	49
PID 2408 wrote to memory of 2816	2408	NPFInstall.exe	51
PID 2408 wrote to memory of 2816	2408	NPFInstall.exe	51
PID 2408 wrote to memory of 2816	2408	NPFInstall.exe	51
PID 2408 wrote to memory of 2816	2408	NPFInstall.exe	51
PID 2408 wrote to memory of 2816	2408	NPFInstall.exe	51
PID 296 wrote to memory of 2976	296	chaospcap.exe	53
PID 296 wrote to memory of 2976	296	chaospcap.exe	53
PID 296 wrote to memory of 2976	296	chaospcap.exe	53
PID 296 wrote to memory of 2976	296	chaospcap.exe	53

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4c9fa87e72fe59cf15131bd2f3bd7baa7a9555ceec438c1df78dd5d5b8394910.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2080

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\Installer\MSIE4C6.tmp
  "C:\Windows\Installer\MSIE4C6.tmp"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\route.exe
    route print
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\arp.exe
    arp -a 10.127.0.1
    3⤵
    PID:1072
- - C:\Windows\SysWOW64\chaospc.exe
    ./chaospc.exe chaos
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\SysWOW64\reg.exe
      reg add " hkcu\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /t REG_SZ /v C:\Windows\SysWOW64\chaospcap.exe /d RunAsInvoker
      4⤵
      PID:2904
  - - C:\Windows\SysWOW64\chaospcap.exe
      C:\Windows\SysWOW64\chaospcap.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:296
    - - C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\NPFInstall.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\NPFInstall.exe" -n -check_dll
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
    - - C:\Windows\SysWOW64\certutil.exe
        
        certutil -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\Insecure-EV.cer"
        5⤵
        
        PID:1608
    - - C:\Windows\SysWOW64\certutil.exe
        
        certutil -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\Insecure-EV-sha1.cer"
        5⤵
        
        PID:2796
    - - C:\Program Files\Npcap\NPFInstall.exe
        
        "C:\Program Files\Npcap\NPFInstall.exe" -n -c
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2408
      - C:\Windows\system32\pnputil.exe
        
        pnputil.exe -e
        6⤵
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2816
    - - C:\Program Files\Npcap\NPFInstall.exe
        
        "C:\Program Files\Npcap\NPFInstall.exe" -n -iw
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:2976
    - - C:\Program Files\Npcap\NPFInstall.exe
        
        "C:\Program Files\Npcap\NPFInstall.exe" -n -i
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:2368
    - - C:\Windows\SysWOW64\SCHTASKS.EXE
        
        SCHTASKS.EXE /Create /F /RU SYSTEM /SC ONSTART /TN npcapwatchdog /TR "'C:\Program Files\Npcap\CheckStatus.bat'" /NP
        5⤵
        Creates scheduled task(s)
        
        PID:1716
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "hkcu\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v C:\Windows\SysWOW64\chaospcap.exe /f
      4⤵
      PID:1000

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000398" "00000000000004A8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6892dca3-80a3-6a65-3ff4-dc0466943227}\NPCAP.inf" "9" "605306be3" "00000000000003F4" "WinSta0\Default" "00000000000005A4" "208" "C:\Program Files\Npcap"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\Npcap\npcap.sys

Filesize
64KB

MD5
78f0b578a8c6d2141e0172f2458ae4f7

SHA1
acc3a363578556d5564689543d1e59e49da1eeae

SHA256
29229cc3bb89fa086320efe689f3117c233cf440fce59da57e160a2a7cfd5c55

SHA512
7319123d6cd9a1db915d6619e87049365904e8b42b8542cd50f552648302d4e660cd9fc6d546e9c3b43ad1091413652b463b7944ed2daae389eb81e357bbed9b

Download Submit
C:\Program Files\Npcap\NPCAP.inf

Filesize
8KB

MD5
99237dec17901e7a09b9cfc9c7e31608

SHA1
34b33fe24b350020b02fafe62c5849f0df114331

SHA256
79be1dba5c620ba6f7ddafaa915f10f7f388138d5d796d93575cfba45a485d10

SHA512
9ab23063f344adeede21bc49d260f41f77469c87c6bd76278317c216859e97b618accdad3590f145bd003f38bd0238138c0b3366e425b0317f4dd83fd450676b

Download Submit
C:\Program Files\Npcap\NPCAP_wfp.inf

Filesize
2KB

MD5
cfa882031d674ff0e92ce8fa0c2894b3

SHA1
86d62c5bead3684f4a638cdd506769cf95ecb4a4

SHA256
9103040803a8d100278a57543fbdb2cf1143ab2a691e8b87354e8e2faf16204c

SHA512
51f067fb350e90faa34e3e068b896966e15414cf6d99f36928eb380a41f252d2df56647e98f44e0d39cc805ae7aaa62845b991a410266ae3f6a383c31cee96b8

Download Submit
C:\Program Files\Npcap\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
C:\Program Files\Npcap\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
C:\Program Files\Npcap\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
C:\Program Files\Npcap\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
999B

MD5
cde737cbf7776693b55131544db50d20

SHA1
6fc731d6814df5b22da306a8c542ea7df9aeea13

SHA256
5262e960829562a7ae2df0d1003e5c7654f8ea886418cf6ed66cef2706a9bc30

SHA512
dc716af162b290f3ca36bd43491cf53175e02d70345600e84f0c4f1cc953656d055d01e93ab2090979c0cc1f75f5d75fbcf9dfa45938205518c80bab7192b388

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
1KB

MD5
90d3edca77b1afab449008c42c1a14de

SHA1
0498705525de7e78340ecfe50e3bf93213b25d92

SHA256
3770e15c2e1f283ad44a75533ac2c8713a048514754fb9377c1bc0ac94b7b38c

SHA512
724468acb1a59b3b29d8bf6f3efc77774f32b47e950e8335abdccfd4887e0e8bad9528ab67d294879109b5b57163d48b8b0a2f118418d7427d22bb9997fb48d1

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
2KB

MD5
e40a7248f90f88d5cf07466d361e3784

SHA1
0714068ebec61422b26886685571eb8543f465f4

SHA256
ab6bfcf16e684eccded6c6f495d5490870e6ef7ce771a4278968df65cefe3db2

SHA512
50b79cf66c72f348a1fc90dec785a7297dec19cd4742ebee6eb4b80c0803b5864ef5b35ea757afe22c90a15d88e83c587da3fcd2647b1dcef94d3c77d1fe52fa

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
2KB

MD5
e40a7248f90f88d5cf07466d361e3784

SHA1
0714068ebec61422b26886685571eb8543f465f4

SHA256
ab6bfcf16e684eccded6c6f495d5490870e6ef7ce771a4278968df65cefe3db2

SHA512
50b79cf66c72f348a1fc90dec785a7297dec19cd4742ebee6eb4b80c0803b5864ef5b35ea757afe22c90a15d88e83c587da3fcd2647b1dcef94d3c77d1fe52fa

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
2KB

MD5
7f0c11ae1785f1b84f70ca3cdf8ab33c

SHA1
848fbe3ad33253903a5e5d25eb77c55df63ee667

SHA256
bb92163f0d9a426573209780165a76fc124ee6b95635d334f3433757d58b8261

SHA512
e8e98c74b6924e25264c35d3fe44374adbe0467ffadce33d50c6c907634f45ae83f8d7023fb32dbf85467e23cc387b4501a0512b860ebee1c37f203de1d1de1b

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
3KB

MD5
a39ecd9afabcd609dba27467750a18e3

SHA1
2164a102a768f8998a91eef5f0e973cac521fd11

SHA256
826b2d61d979cbfda3c169b68ed63cd6093155d33780c44af0dccb471b7062d4

SHA512
04c7c8e8687eaf78e1776da65aedaf8974f8c7932e34a5ed90d74240de6bceefe708a6c90191b709530845c1e75e5a5808ca95646c1aa4d1d79956db80343999

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
3KB

MD5
b83f409acf4aa1b9342984dc744d65c7

SHA1
fdd9cd61833a6b5d9e067a9a20e0fd8621956f42

SHA256
d400a97c4ab3764921bf94ee872b4f2236409c55e97217b720cf2ea303404c8c

SHA512
8bca3cf738b0f79bc0459e5b83b20e448d41962a843314a1a770a59b087e0f88a87e8cc1d88425b269008bd13381588e6e53b839ba74267871dfa364c7c06eae

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
4KB

MD5
6839e5fcbbb39f421dc5c6e8c1d4fe64

SHA1
38b1aec86e9320bac00fb642b728d8bfb5f6370b

SHA256
5cb493e68fec0aeb64f7f7d42cb01b5be9374a8499b09f9acec85937d97da7f7

SHA512
8e8601134c62ce3d715c407022655a341c66dfbf5738404ba6d6a1c8eb84959353427b5f1e5ba5171ff1c4f30a8638ed569f9b202b326a060a860422494910a9

Download Submit
C:\Program Files\Npcap\npcap.cat

Filesize
10KB

MD5
63203752989a6cb2f2460b7762fa8258

SHA1
6affd42ca84c51bf68db2275864aba38b597406f

SHA256
283cca8dd06799b5839924a1adf1af3015a0b069fac0c3f4d03a34ad4a92abe1

SHA512
18153b7d5ad7d28c134619e8f27d133bb2da374e360774a6cdb9a8055abcd60182c0e3d5728eee8e870ede3784e5b027a10754cbe921cd717cf43f91d6158d14

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF8D.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFED.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\Insecure-EV-sha1.cer

Filesize
1KB

MD5
6e3a097ec254863a4a1a810ffcad253a

SHA1
29bacae898852aab0bb9162881053b703b9d1005

SHA256
8e1b4bcf0bb63d58165149af6b31f771c80b1064750ebb3c326483df3ab8ebf0

SHA512
dad466fe6e87d5834837c4f0145c85c852be9e4d8301b2eeb1d2af322829b9b2913647c4ea5e70293c35260265cebc02f4f017cbb319209556f4278afcd64ae1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\Insecure-EV.cer

Filesize
1KB

MD5
bb381ad7f010e2e2f2f63d01c7134805

SHA1
4ce89794fe2d2f7e30121f10bcf76ac3ccf77ca9

SHA256
ed81c57dc455569ced035211a11c74110bf820df0d8b09bf23024c6f0d9baf95

SHA512
da41931dac9c463ab066eaeb830f0e3d79c62f103f2eff4d5092e99e8292f30cc16d6ffd70071af353fa986b5874dd2cf8a4d44d9f2df479574bcdbf6f5b796c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\InstallOptions.dll

Filesize
23KB

MD5
d8bfba73978801ed5c291b847ae6ed0f

SHA1
afd973df6c0fd92372b787f2a06a02fa4c03b877

SHA256
75fca8af133756a0d36ad9b6177ef8ee01b6dd18ede216d82b2eb5f8092a84cd

SHA512
62b921725c727247b96622765caa4ddec1126980e677764f9bdb5e68eae50044747f0ee99744c44b7a7253a57e3c28a2fc19a99d479787aa4944499871db92f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\SimpleSC.dll

Filesize
70KB

MD5
4a2b58bd7cab29463d9e53fcb9a252b6

SHA1
4679ba66db7989a64c41892bbb3f7cec38fb5597

SHA256
18b17999996d73fe911a8eb676c231cb0bf002174954b552f880bdabf4c78124

SHA512
e6a69b5bb52467e7b8168a3e0ad45252b196b8eaea87b91f8d3b150545ce6bc7ee586ebe1d83da6c04203a9a9bab5f4af66759ba35b73306f7962ca5b6ff2fff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\System.dll

Filesize
19KB

MD5
6a2f80ed640b6c2458329c2d3f8d9e3f

SHA1
c6dba02a05dbf15aa5de3ac1464bc9dce995eb80

SHA256
1e981423fda8f74e9a7079675c1a6fe55c716d4c0d50fb03ea482ff7500db14b

SHA512
00d49b1874d76b150a646ac40032b34608e548cfd806642982e446619c9852a0ab5389791468651c4d51d118aad502174e7b887c2b5b6a7a3e35ddd9bd50d722

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\final.ini

Filesize
309B

MD5
77f34d38a83b17ae5b2dfaefa41269ec

SHA1
53aced630c1e8ed557556f70149fd5bb4ca85ddb

SHA256
93fdc16fa1714772efa578e651f8383f9bf84612d933026b0ea97297e648a6c7

SHA512
99dc7799c18f66c58b9e4720687dc5c37f19d76ffc67523ea07379f8657614bc90a398a985c1ef9bed990646660d956b6063c9cd357d00e4bf45b1c45850441c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\nsExec.dll

Filesize
15KB

MD5
78bda400d7b80858c014fc79bd8fc49b

SHA1
f5bb0e85ba892611cf79b3c2756e87a59e1e213c

SHA256
6bd24522cd139c978cc259d5612188053577ba9de46e2d77642bd4d19fc959d4

SHA512
95a1aced8deaad51ad7990b83f0e5768fab9e1c7aa64d9fd656baa850d81c0955b7989ce08a02fedbb8c9d77ec135b2a9d132effbfc0f8478a052095140c74cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\options.ini

Filesize
1KB

MD5
86695aa0bc873917c4aa9877891246d7

SHA1
f2118f75f5cfffef52fe7badb65d73aea09a1616

SHA256
6b674d1bf5c6fa83f4d3de8cb7d10597406a1b45234b250ff879b1fd8f645e1b

SHA512
0183cde25f213cbc8c3078f02bd15ee4ff87fd5540789acf6cdb2bee63c966a953f43760f4b5b3bcf3b55110677986aafaacb320616a7ded1a951ab53edebbe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\options.ini

Filesize
1KB

MD5
3cea5a69ddce77a52be312a1a66cc174

SHA1
7dec810bf69d5188e8fb63b5d9e529ef4c52034e

SHA256
178eb626be6008367a437c743d09489918feb7bbcebd57459b41a2596d7aa5d0

SHA512
6df6a55f99da8b5a917ea42c8a780ba216b517ed90eb93e04f90828965401ef9fc69feededbb6132e6b57b8ee00c17764b916762d1abe701860549ea4b8f83d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF807.tmp\options.ini

Filesize
1KB

MD5
b002d12368ddc8495970646800136f68

SHA1
6d9e228bc0fa0df12c9618d7faa5c809f9efc242

SHA256
a570199c2bc0d4230f7ec110b503d23bdc731a3504997f80e038cc406defd4a0

SHA512
a5b78390780a2ae4903e63698749a59c4d068a6ff804633bc5279a02483b479deb4affb6f8b497b74d0e9998fea2a83fdbf4e2e183c94c3b0e58d7f0c4974107

Download Submit
C:\Users\Admin\AppData\Local\Temp\{6892D~1\npcap.sys

Filesize
64KB

MD5
78f0b578a8c6d2141e0172f2458ae4f7

SHA1
acc3a363578556d5564689543d1e59e49da1eeae

SHA256
29229cc3bb89fa086320efe689f3117c233cf440fce59da57e160a2a7cfd5c55

SHA512
7319123d6cd9a1db915d6619e87049365904e8b42b8542cd50f552648302d4e660cd9fc6d546e9c3b43ad1091413652b463b7944ed2daae389eb81e357bbed9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{6892dca3-80a3-6a65-3ff4-dc0466943227}\NPCAP.inf

Filesize
8KB

MD5
99237dec17901e7a09b9cfc9c7e31608

SHA1
34b33fe24b350020b02fafe62c5849f0df114331

SHA256
79be1dba5c620ba6f7ddafaa915f10f7f388138d5d796d93575cfba45a485d10

SHA512
9ab23063f344adeede21bc49d260f41f77469c87c6bd76278317c216859e97b618accdad3590f145bd003f38bd0238138c0b3366e425b0317f4dd83fd450676b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{6892dca3-80a3-6a65-3ff4-dc0466943227}\npcap.cat

Filesize
10KB

MD5
63203752989a6cb2f2460b7762fa8258

SHA1
6affd42ca84c51bf68db2275864aba38b597406f

SHA256
283cca8dd06799b5839924a1adf1af3015a0b069fac0c3f4d03a34ad4a92abe1

SHA512
18153b7d5ad7d28c134619e8f27d133bb2da374e360774a6cdb9a8055abcd60182c0e3d5728eee8e870ede3784e5b027a10754cbe921cd717cf43f91d6158d14

Download Submit
C:\Windows\INF\oem2.inf

Filesize
8KB

MD5
99237dec17901e7a09b9cfc9c7e31608

SHA1
34b33fe24b350020b02fafe62c5849f0df114331

SHA256
79be1dba5c620ba6f7ddafaa915f10f7f388138d5d796d93575cfba45a485d10

SHA512
9ab23063f344adeede21bc49d260f41f77469c87c6bd76278317c216859e97b618accdad3590f145bd003f38bd0238138c0b3366e425b0317f4dd83fd450676b

Download Submit
C:\Windows\Installer\MSIE4C6.tmp

Filesize
8.1MB

MD5
09a6ad174b1037ffc2729aa5120f9d7b

SHA1
dec09c02824db627734232a849e2c67a299b04cd

SHA256
cf0137b4d2b97c970a2c5eb3e92bc7e8548a2ffd8633d0636c5a730490357b2e

SHA512
0ca38001aaf5d517d518f4126b5c288d870b950d10265f0d1490e97d1c574eb0b704f3d080323b56f5981b5a675cedff7d946b830c2bf658be148041cdce32c3

Download Submit
C:\Windows\Installer\MSIE4C6.tmp

Filesize
8.1MB

MD5
09a6ad174b1037ffc2729aa5120f9d7b

SHA1
dec09c02824db627734232a849e2c67a299b04cd

SHA256
cf0137b4d2b97c970a2c5eb3e92bc7e8548a2ffd8633d0636c5a730490357b2e

SHA512
0ca38001aaf5d517d518f4126b5c288d870b950d10265f0d1490e97d1c574eb0b704f3d080323b56f5981b5a675cedff7d946b830c2bf658be148041cdce32c3

Download Submit
C:\Windows\Installer\MSIE4C6.tmp

Filesize
8.1MB

MD5
09a6ad174b1037ffc2729aa5120f9d7b

SHA1
dec09c02824db627734232a849e2c67a299b04cd

SHA256
cf0137b4d2b97c970a2c5eb3e92bc7e8548a2ffd8633d0636c5a730490357b2e

SHA512
0ca38001aaf5d517d518f4126b5c288d870b950d10265f0d1490e97d1c574eb0b704f3d080323b56f5981b5a675cedff7d946b830c2bf658be148041cdce32c3

Download Submit
C:\Windows\SysWOW64\chaospc.exe

Filesize
1.9MB

MD5
e16fef8f8f9d64ccda412e749581c847

SHA1
dec31e41e8006fd4682344c91adfdf5e3d108ab9

SHA256
471ad500f690fa241a5fca425aeeb6a9af63ec1c450b835f2e1b870dc079d080

SHA512
be1f1a33a5ca73fda6317219b42442d5d2dd0185207df5c40f74505a5d4d8855caa036cfcc0cf85eee8578eeb5b1aa2ec8909c481dab86b210a8733bf32351bb

Download Submit
C:\Windows\SysWOW64\chaospc.exe

Filesize
1.9MB

MD5
e16fef8f8f9d64ccda412e749581c847

SHA1
dec31e41e8006fd4682344c91adfdf5e3d108ab9

SHA256
471ad500f690fa241a5fca425aeeb6a9af63ec1c450b835f2e1b870dc079d080

SHA512
be1f1a33a5ca73fda6317219b42442d5d2dd0185207df5c40f74505a5d4d8855caa036cfcc0cf85eee8578eeb5b1aa2ec8909c481dab86b210a8733bf32351bb

Download Submit
C:\Windows\SysWOW64\chaospcap.exe

Filesize
773KB

MD5
84f1a974bb04dafbe581c66ef875def0

SHA1
20c1af092ff3d98a8b5dce69ec28d833b06b741e

SHA256
bcfbc57d41c00e40298c5c3040264e694cc8fc7da55939729aedc1041c8e92dd

SHA512
312101506ce296065cf084245506f23b2bcda955e9bdbb1747bd5dcc65432c8bb5d8abea25b459917dec0adf168ad4b513f5db7f083b9d8f0b7c41a8f5b74661

Download Submit
C:\Windows\SysWOW64\chaospcap.exe

Filesize
773KB

MD5
84f1a974bb04dafbe581c66ef875def0

SHA1
20c1af092ff3d98a8b5dce69ec28d833b06b741e

SHA256
bcfbc57d41c00e40298c5c3040264e694cc8fc7da55939729aedc1041c8e92dd

SHA512
312101506ce296065cf084245506f23b2bcda955e9bdbb1747bd5dcc65432c8bb5d8abea25b459917dec0adf168ad4b513f5db7f083b9d8f0b7c41a8f5b74661

Download Submit
C:\Windows\SysWOW64\packet.dll

Filesize
171KB

MD5
fc5a4c1d57a9152c677f5cce7095662d

SHA1
454ff2c1c3e3b11652cf6a7e1beba49dd017a6e1

SHA256
8f7aa509cc980f031ab5b8666866420e33111d0f27eeb8f0a8dd33d92d4f58f7

SHA512
d9abefd761d4816efe180bac8d7a7d7bd6aef0d93c1ed946a98945693fa757387944ce75cb16dd11ef27efb70206c357beb10f79a73a081258caa14dfbd22fe7

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
376KB

MD5
8d52c81decbffb2e7f3ef8cc79c28a35

SHA1
db51968dcd91e3af59707cf4854f74d5147b722c

SHA256
a3a1a19f09a4f69bbee8656bab8886bcfd5a67902838e4b1bab391e4f2663a5d

SHA512
f15cb4416b23094a22dd57001a8968a7c1cb94f15776e972251d62223c0fb16feff0e5cf9c80eb6ea119376471848444de098647bbfeb780de9b8c4268cdf123

Download Submit
C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_neutral_0392b728f6f73ae3\npcap.PNF

Filesize
11KB

MD5
b8d8a6c94ddc378026f3e63a01f9dd71

SHA1
5e8131d511aade26d605027aeeeb574083a315a6

SHA256
416c14a29d3a978f4d08f71c5b3fb25d2f42f485393b35fe432c91ce6d45c4a6

SHA512
33a4b411f6513022a188c33b60a1773a474ad085c9207df8e40a1a846969df1e8b579fcf5184a373fe8ce547772c49bd98d547e88ab1bf3e8390b12cb6e0f311

Download Submit
C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_neutral_0392b728f6f73ae3\npcap.cat

Filesize
10KB

MD5
63203752989a6cb2f2460b7762fa8258

SHA1
6affd42ca84c51bf68db2275864aba38b597406f

SHA256
283cca8dd06799b5839924a1adf1af3015a0b069fac0c3f4d03a34ad4a92abe1

SHA512
18153b7d5ad7d28c134619e8f27d133bb2da374e360774a6cdb9a8055abcd60182c0e3d5728eee8e870ede3784e5b027a10754cbe921cd717cf43f91d6158d14

Download Submit
C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_neutral_0392b728f6f73ae3\npcap.inf

Filesize
8KB

MD5
99237dec17901e7a09b9cfc9c7e31608

SHA1
34b33fe24b350020b02fafe62c5849f0df114331

SHA256
79be1dba5c620ba6f7ddafaa915f10f7f388138d5d796d93575cfba45a485d10

SHA512
9ab23063f344adeede21bc49d260f41f77469c87c6bd76278317c216859e97b618accdad3590f145bd003f38bd0238138c0b3366e425b0317f4dd83fd450676b

Download Submit
C:\Windows\System32\DriverStore\INFCACHE.1

Filesize
1.4MB

MD5
8dd085fbc1161652fb87f6641497529e

SHA1
4e6653b7e6b92f5eeabe6bfeb5504e5cd95a43c6

SHA256
fe23acda0725406dd81bc1bc27a9883108dc6d01b9d8b61f1e4ee2049ecfa167

SHA512
4a500237c28b2e0a5344b157e0d479cdba47a34b60079c0453b4ba576984a5349373fa25a59b865507e3c2047c4a60e3e8bd83bb6892b67096830551507e372c

Download Submit
C:\Windows\System32\DriverStore\Temp\{7112abd5-b47a-39a4-b6ea-2b3c31c7f108}\SET3B8.tmp

Filesize
10KB

MD5
63203752989a6cb2f2460b7762fa8258

SHA1
6affd42ca84c51bf68db2275864aba38b597406f

SHA256
283cca8dd06799b5839924a1adf1af3015a0b069fac0c3f4d03a34ad4a92abe1

SHA512
18153b7d5ad7d28c134619e8f27d133bb2da374e360774a6cdb9a8055abcd60182c0e3d5728eee8e870ede3784e5b027a10754cbe921cd717cf43f91d6158d14

Download Submit
C:\Windows\System32\DriverStore\Temp\{7112abd5-b47a-39a4-b6ea-2b3c31c7f108}\SET3C9.tmp

Filesize
8KB

MD5
99237dec17901e7a09b9cfc9c7e31608

SHA1
34b33fe24b350020b02fafe62c5849f0df114331

SHA256
79be1dba5c620ba6f7ddafaa915f10f7f388138d5d796d93575cfba45a485d10

SHA512
9ab23063f344adeede21bc49d260f41f77469c87c6bd76278317c216859e97b618accdad3590f145bd003f38bd0238138c0b3366e425b0317f4dd83fd450676b

Download Submit
C:\Windows\System32\DriverStore\Temp\{7112abd5-b47a-39a4-b6ea-2b3c31c7f108}\SET3CA.tmp

Filesize
64KB

MD5
78f0b578a8c6d2141e0172f2458ae4f7

SHA1
acc3a363578556d5564689543d1e59e49da1eeae

SHA256
29229cc3bb89fa086320efe689f3117c233cf440fce59da57e160a2a7cfd5c55

SHA512
7319123d6cd9a1db915d6619e87049365904e8b42b8542cd50f552648302d4e660cd9fc6d546e9c3b43ad1091413652b463b7944ed2daae389eb81e357bbed9b

Download Submit
C:\Windows\Temp\Cab4C4.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\Tar4E6.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
\Program Files\Npcap\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
\Program Files\Npcap\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
\Program Files\Npcap\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
\Program Files\Npcap\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
\Program Files\Npcap\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\InstallOptions.dll

Filesize
23KB

MD5
d8bfba73978801ed5c291b847ae6ed0f

SHA1
afd973df6c0fd92372b787f2a06a02fa4c03b877

SHA256
75fca8af133756a0d36ad9b6177ef8ee01b6dd18ede216d82b2eb5f8092a84cd

SHA512
62b921725c727247b96622765caa4ddec1126980e677764f9bdb5e68eae50044747f0ee99744c44b7a7253a57e3c28a2fc19a99d479787aa4944499871db92f2

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\InstallOptions.dll

Filesize
23KB

MD5
d8bfba73978801ed5c291b847ae6ed0f

SHA1
afd973df6c0fd92372b787f2a06a02fa4c03b877

SHA256
75fca8af133756a0d36ad9b6177ef8ee01b6dd18ede216d82b2eb5f8092a84cd

SHA512
62b921725c727247b96622765caa4ddec1126980e677764f9bdb5e68eae50044747f0ee99744c44b7a7253a57e3c28a2fc19a99d479787aa4944499871db92f2

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\SimpleSC.dll

Filesize
70KB

MD5
4a2b58bd7cab29463d9e53fcb9a252b6

SHA1
4679ba66db7989a64c41892bbb3f7cec38fb5597

SHA256
18b17999996d73fe911a8eb676c231cb0bf002174954b552f880bdabf4c78124

SHA512
e6a69b5bb52467e7b8168a3e0ad45252b196b8eaea87b91f8d3b150545ce6bc7ee586ebe1d83da6c04203a9a9bab5f4af66759ba35b73306f7962ca5b6ff2fff

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\SimpleSC.dll

Filesize
70KB

MD5
4a2b58bd7cab29463d9e53fcb9a252b6

SHA1
4679ba66db7989a64c41892bbb3f7cec38fb5597

SHA256
18b17999996d73fe911a8eb676c231cb0bf002174954b552f880bdabf4c78124

SHA512
e6a69b5bb52467e7b8168a3e0ad45252b196b8eaea87b91f8d3b150545ce6bc7ee586ebe1d83da6c04203a9a9bab5f4af66759ba35b73306f7962ca5b6ff2fff

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\SimpleSC.dll

Filesize
70KB

MD5
4a2b58bd7cab29463d9e53fcb9a252b6

SHA1
4679ba66db7989a64c41892bbb3f7cec38fb5597

SHA256
18b17999996d73fe911a8eb676c231cb0bf002174954b552f880bdabf4c78124

SHA512
e6a69b5bb52467e7b8168a3e0ad45252b196b8eaea87b91f8d3b150545ce6bc7ee586ebe1d83da6c04203a9a9bab5f4af66759ba35b73306f7962ca5b6ff2fff

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\System.dll

Filesize
19KB

MD5
6a2f80ed640b6c2458329c2d3f8d9e3f

SHA1
c6dba02a05dbf15aa5de3ac1464bc9dce995eb80

SHA256
1e981423fda8f74e9a7079675c1a6fe55c716d4c0d50fb03ea482ff7500db14b

SHA512
00d49b1874d76b150a646ac40032b34608e548cfd806642982e446619c9852a0ab5389791468651c4d51d118aad502174e7b887c2b5b6a7a3e35ddd9bd50d722

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\nsExec.dll

Filesize
15KB

MD5
78bda400d7b80858c014fc79bd8fc49b

SHA1
f5bb0e85ba892611cf79b3c2756e87a59e1e213c

SHA256
6bd24522cd139c978cc259d5612188053577ba9de46e2d77642bd4d19fc959d4

SHA512
95a1aced8deaad51ad7990b83f0e5768fab9e1c7aa64d9fd656baa850d81c0955b7989ce08a02fedbb8c9d77ec135b2a9d132effbfc0f8478a052095140c74cc

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\nsExec.dll

Filesize
15KB

MD5
78bda400d7b80858c014fc79bd8fc49b

SHA1
f5bb0e85ba892611cf79b3c2756e87a59e1e213c

SHA256
6bd24522cd139c978cc259d5612188053577ba9de46e2d77642bd4d19fc959d4

SHA512
95a1aced8deaad51ad7990b83f0e5768fab9e1c7aa64d9fd656baa850d81c0955b7989ce08a02fedbb8c9d77ec135b2a9d132effbfc0f8478a052095140c74cc

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\nsExec.dll

Filesize
15KB

MD5
78bda400d7b80858c014fc79bd8fc49b

SHA1
f5bb0e85ba892611cf79b3c2756e87a59e1e213c

SHA256
6bd24522cd139c978cc259d5612188053577ba9de46e2d77642bd4d19fc959d4

SHA512
95a1aced8deaad51ad7990b83f0e5768fab9e1c7aa64d9fd656baa850d81c0955b7989ce08a02fedbb8c9d77ec135b2a9d132effbfc0f8478a052095140c74cc

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\nsExec.dll

Filesize
15KB

MD5
78bda400d7b80858c014fc79bd8fc49b

SHA1
f5bb0e85ba892611cf79b3c2756e87a59e1e213c

SHA256
6bd24522cd139c978cc259d5612188053577ba9de46e2d77642bd4d19fc959d4

SHA512
95a1aced8deaad51ad7990b83f0e5768fab9e1c7aa64d9fd656baa850d81c0955b7989ce08a02fedbb8c9d77ec135b2a9d132effbfc0f8478a052095140c74cc

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\nsExec.dll

Filesize
15KB

MD5
78bda400d7b80858c014fc79bd8fc49b

SHA1
f5bb0e85ba892611cf79b3c2756e87a59e1e213c

SHA256
6bd24522cd139c978cc259d5612188053577ba9de46e2d77642bd4d19fc959d4

SHA512
95a1aced8deaad51ad7990b83f0e5768fab9e1c7aa64d9fd656baa850d81c0955b7989ce08a02fedbb8c9d77ec135b2a9d132effbfc0f8478a052095140c74cc

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\nsExec.dll

Filesize
15KB

MD5
78bda400d7b80858c014fc79bd8fc49b

SHA1
f5bb0e85ba892611cf79b3c2756e87a59e1e213c

SHA256
6bd24522cd139c978cc259d5612188053577ba9de46e2d77642bd4d19fc959d4

SHA512
95a1aced8deaad51ad7990b83f0e5768fab9e1c7aa64d9fd656baa850d81c0955b7989ce08a02fedbb8c9d77ec135b2a9d132effbfc0f8478a052095140c74cc

Download Submit
\Users\Admin\AppData\Local\Temp\nstF807.tmp\nsExec.dll

Filesize
15KB

MD5
78bda400d7b80858c014fc79bd8fc49b

SHA1
f5bb0e85ba892611cf79b3c2756e87a59e1e213c

SHA256
6bd24522cd139c978cc259d5612188053577ba9de46e2d77642bd4d19fc959d4

SHA512
95a1aced8deaad51ad7990b83f0e5768fab9e1c7aa64d9fd656baa850d81c0955b7989ce08a02fedbb8c9d77ec135b2a9d132effbfc0f8478a052095140c74cc

Download Submit
\Windows\SysWOW64\Packet.dll

Filesize
171KB

MD5
fc5a4c1d57a9152c677f5cce7095662d

SHA1
454ff2c1c3e3b11652cf6a7e1beba49dd017a6e1

SHA256
8f7aa509cc980f031ab5b8666866420e33111d0f27eeb8f0a8dd33d92d4f58f7

SHA512
d9abefd761d4816efe180bac8d7a7d7bd6aef0d93c1ed946a98945693fa757387944ce75cb16dd11ef27efb70206c357beb10f79a73a081258caa14dfbd22fe7

Download Submit
\Windows\SysWOW64\chaospc.exe

Filesize
1.9MB

MD5
e16fef8f8f9d64ccda412e749581c847

SHA1
dec31e41e8006fd4682344c91adfdf5e3d108ab9

SHA256
471ad500f690fa241a5fca425aeeb6a9af63ec1c450b835f2e1b870dc079d080

SHA512
be1f1a33a5ca73fda6317219b42442d5d2dd0185207df5c40f74505a5d4d8855caa036cfcc0cf85eee8578eeb5b1aa2ec8909c481dab86b210a8733bf32351bb

Download Submit
\Windows\SysWOW64\chaospc.exe

Filesize
1.9MB

MD5
e16fef8f8f9d64ccda412e749581c847

SHA1
dec31e41e8006fd4682344c91adfdf5e3d108ab9

SHA256
471ad500f690fa241a5fca425aeeb6a9af63ec1c450b835f2e1b870dc079d080

SHA512
be1f1a33a5ca73fda6317219b42442d5d2dd0185207df5c40f74505a5d4d8855caa036cfcc0cf85eee8578eeb5b1aa2ec8909c481dab86b210a8733bf32351bb

Download Submit
\Windows\SysWOW64\chaospcap.exe

Filesize
773KB

MD5
84f1a974bb04dafbe581c66ef875def0

SHA1
20c1af092ff3d98a8b5dce69ec28d833b06b741e

SHA256
bcfbc57d41c00e40298c5c3040264e694cc8fc7da55939729aedc1041c8e92dd

SHA512
312101506ce296065cf084245506f23b2bcda955e9bdbb1747bd5dcc65432c8bb5d8abea25b459917dec0adf168ad4b513f5db7f083b9d8f0b7c41a8f5b74661

Download Submit
\Windows\SysWOW64\wpcap.dll

Filesize
376KB

MD5
8d52c81decbffb2e7f3ef8cc79c28a35

SHA1
db51968dcd91e3af59707cf4854f74d5147b722c

SHA256
a3a1a19f09a4f69bbee8656bab8886bcfd5a67902838e4b1bab391e4f2663a5d

SHA512
f15cb4416b23094a22dd57001a8968a7c1cb94f15776e972251d62223c0fb16feff0e5cf9c80eb6ea119376471848444de098647bbfeb780de9b8c4268cdf123

Download Submit
memory/296-547-0x0000000002C20000-0x0000000002C33000-memory.dmp

Filesize
76KB

Download