f1160a33fb79c764cdc4c023fa700054ae2945ed91880e37348a17c010ca716f

Analysis

max time kernel
92s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nmap-7.93-setup.exe
Size

27.8MB
MD5

f9e753cccea0ffae6871dc65f67d3f89
SHA1

ab2de49f90330cc3b305457a9a0f897f296e95f4
SHA256

f1160a33fb79c764cdc4c023fa700054ae2945ed91880e37348a17c010ca716f
SHA512

0c6f6c14ecf8ef028e6a556f58e720321a7808b0a1f602e019f6b21d9cef970424185c27e7647368d2fca256d47844310d76d626209d406a961d048063410d1d
SSDEEP

786432:eCw4jIIk4AN6o6JWCRCLz4NFMqt9+26UgRY5YYnDEWW:e/T4hJZRCgMkg+5HEv

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET2EEB.tmp	NPFInstall.exe
File created	C:\Windows\system32\DRIVERS\SET2EEB.tmp	NPFInstall.exe
File opened for modification	C:\Windows\system32\DRIVERS\npcap.sys	NPFInstall.exe

Manipulates Digital Signatures 1 TTPs 8 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4CE89794FE2D2F7E30121F10BCF76AC3CCF77CA9\Blob = 0300000001000000140000004ce89794fe2d2f7e30121f10bcf76ac3ccf77ca92000000001000000c7050000308205c3308204aba003020102021009256314069e7e6a88cb823075c0d9c9300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3230303530313030303030305a170d3231303530373132303030305a3081d231133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a88cd713346c50a5cd2a62900419f091330f9820b73b38785a8b5a25ceda8e11b71b2d11ff4b0c18cad405a2a195a6462619fa3ddf6d14466a350d1cf1c6ad48cce166fe6011a62ee62751046dd264b1cc145c4a4354537cec1ae615b6b8566a28ddf3b510fee92023dbe4190b44bb4174f94c4ec62256bd4aa5ba541ee833388db8cc411365e094ee6314eaff59ca6659bb6388300e7ffbd0f8b299889b8e3ea526f8ca926ded79eac89a6b068757ae428022e2602ec98babf5998216b0c28a709129a1300872878d9971e3130826a7d1ce894fe649a017003f07ee3c53ca0cba998fab097e573723fbd3e0ea1b742dd6d076b4c2284b93500021a7d27109630203010001a38201f8308201f4301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604140a9c208099309acdddf9c9909a03890dcd30c8ea30350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038201010042368fc33025a2a1338cf35a08d00e263958f825e79b6d3af23e0e4e4cf59bc8502022d452cbba14a53274e3a12a5b01f4aee16abfcb1b28d63484a0ae1995c9759c6f0970254da8902fb479f5f7869a566aa285f2c28e50096dfd2e14a9ecf0000963c570d2338def108dfe66b1e44d22182826749871a7f3977eba4976910f1f0de866fc75b918c1a9f466fcf96ae90df932071b9c770f0f3193f8ca500abe52cc316549403a5ca5b5422d1ebffffc3cbe3b926de552f493b53c6570fdd0736550f080c2db204b03bc00ff724241581b5dfb0dff7b8f2cc28f136c19cca8bd4b3c3d81404e69f4598e7b5458e41c6f2e6622a212d28c2615565782a1f66987	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL"	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3\Blob = 03000000010000001400000060ee3fc53d4bdfd1697ae5beae1cab1c0f3ad4e32000000001000000c0060000308206bc308205a4a003020102021003f1b4e15f3a82f1149678b3d7d8475c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3132303431383132303030305a170d3237303431383132303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e672043412028534841322930820122300d06092a864886f70d01010105000382010f003082010a0282010100a753fa0fb2b513f164cf8480fcae8035d1b6d7c7a32cac1a2cacf184ac3a35123a9291ba57e4c4c9f32fa8483cb7d66edc9722ba517961af432f0db79bb44931ae44583ea4a196a7874f237ec36c652490553ea1ca237cc542e9c47a62459b7dde6374cb9e6325f8849a9aad454fae7d1fc813cb759bc9e1e18af80b0c98f4ca3ed045aa7a1ea558933634be2b2e2b315866b432109f9df052a1efe83ed376f2405adcfa6a3d1b4bad76b08c5cee36ba83ea30a84cdef10b2a584188ae0089ab03d11682202276eb5e54381262e1d27024dbed1f70d26409802de2b69dce1ff2bb21f36cdbd8b3197b8a509fefec360a5c9ab74ad308a03979fdddbf3d3a09250203010001a38203583082035430120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307f06082b0601050507010104733071302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304906082b06010505073002863d687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63727430818f0603551d1f0481873081843040a03ea03c863a687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63726c3040a03ea03c863a687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0302308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e301d0603551d0e041604148fe87ef06d326a000523c770976a3a90ff6bead4301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d01010b0500038201010019334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3BA63A6E4841355772DEBEF9CDCF4D5AF353A297\Blob = 0300000001000000140000003ba63a6e4841355772debef9cdcf4d5af353a2972000000001000000350500003082053130820419a00302010202100aa125d6d6321b7e41e405da3697c215300d06092a864886f70d01010b05003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3136303130373132303030305a170d3331303130373132303030305a3072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f060355040313284469676943657274205348413220417373757265642049442054696d657374616d70696e6720434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bdd032ee4bcd8f7fdda9ba8299c539542857b6234ac40e07453351107dd0f97d4d687ee7b6a0f48db388e497bf63219098bf13bc57d3c3e17e08d66a140038f72e1e3beecca6f63259fe5f653fe09bebe34647061a557e0b277ec0a2f5a0e0de223f0eff7e95fbf3a3ba223e18ac11e4f099036d3b857c09d3ee5dc89a0b54e3a809716be0cf22100f75cf71724e0aaddf403a5cb751e1a17914c64d2423305dbcec3c606aac2f07ccfdf0ea47d988505efd666e56612729898451e682e74650fd942a2ca7e4753eba980f847f9f3114d6add5f264cb7b1e05d084197217f11706ef3dcdd64def0642fda2532a4f851dc41d3cafcfdaac10f5ddacace956ff930203010001a38201ce308201ca301d0603551d0e04160414f4b6e1201dfe29aed2e461a5b2a225b2c817356e301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f30120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070308307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e6372743081810603551d1f047a3078303aa038a0368634687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c303aa038a0368634687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c30500603551d20044930473038060a6086480186fd6c000204302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f435053300b06096086480186fd6c0701300d06092a864886f70d01010b05000382010100719512e951875669cdefddda7caa637ab378cf06374084ef4b84bfcacf0302fdc5a7c30e20422caf77f32b1f0c215a2ab705341d6aae99f827a266bf09aa60df76a43a930ff8b2d1d87c1962e85e82251ec4ba1c7b2c21e2d65b2c1435430468b2db7502e072c798d63c64e51f4810185f8938614d62462487638c91522caf2989e5781fd60b14a580d7124770b375d59385937eb69267fb536189a8f56b96c0f458690d7cc801b1b92875b7996385228c61ca79947e59fc8c0fe36fb50126b66ca5ee875121e458609bba0c2d2b6da2c47ebbc4252b4702087c49ae13b6e17c424228c61856cf4134b6665db6747bf55633222f2236b24ba24a95d8f5a68e52	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E1D782A8E191BEEF6BCA1691B5AAB494A6249BF3\Blob = 030000000100000014000000e1d782a8e191beef6bca1691b5aab494a6249bf3200000000100000002050000308204fe308203e6a00302010202100d424ae0be3a88ff604021ce1400f0dd300d06092a864886f70d01010b05003072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f060355040313284469676943657274205348413220417373757265642049442054696d657374616d70696e67204341301e170d3231303130313030303030305a170d3331303130363030303030305a3048310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3120301e0603550403131744696769436572742054696d657374616d70203230323130820122300d06092a864886f70d01010105000382010f003082010a0282010100c2e6618467c58af50d08a445ca636b51d73a1142bd0a75754d94b40c50b52610fe1dc86f916b0c96e71a5c48ef44e5bf9b61cd1591625ab8ff670b9c63fd366a81fa29f8dd2b7085de0218f3786dbc7df9c76d093dbe6a7687e98abdf8845d1e76c9e4c676763a53d1d1d35a368fc6a3e12f1b3ab761d673ec4e6d338a7c5d452d4bb150e6413a375686dc93238df75025e864e6ddd38f2f57b58720eb0e8e2cd523daf44d7846e3038331294a5c0c318a4a8c88c5f7305af914af155f6c434909fd262353f68d63e81aab5bb11d30c29b6982b4dbfc5654bc1fa187abbe7a5b0a202f4b09c995a78db2fad6638b4ea5721cee9f7a0173f819d6fe0d4984bd010203010001a38201b8308201b4300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030160603551d250101ff040c300a06082b0601050507030830410603551d20043a3038303606096086480186fd6c07013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f435053301f0603551d23041830168014f4b6e1201dfe29aed2e461a5b2a225b2c817356e301d0603551d0e041604143644868ea4bab066bebc282d1d4436dde36a7abc30710603551d1f046a30683032a030a02e862c687474703a2f2f63726c332e64696769636572742e636f6d2f736861322d617373757265642d74732e63726c3032a030a02e862c687474703a2f2f63726c342e64696769636572742e636f6d2f736861322d617373757265642d74732e63726c30818506082b0601050507010104793077302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304f06082b060105050730028643687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572745348413241737375726564494454696d657374616d70696e6743412e637274300d06092a864886f70d01010b05000382010100481cdcb5e99a23bce71ae7200e8e6746fd427251740a2347a3ab92d225c47059be14a0e52781a54d1415190779f0d104c386d93bbdfe4402664ded69a40ff6b870cf62e8f5514a7879367a27b7f3e7529f93a7ed439e7be7b4dd412289fb87a246034efcf4feb76477635f2352698382fa1a53ed90cc8da117730df4f36539704bf39cd67a7bda0cbc3d32d01bcbf561fc75080076bc810ef8c0e15ccfc41172e71b6449d8229a751542f52d323881daf460a2bab452fb5ce06124254fb2dfc929a8734351dabd63d61f5b9bf72e1b4f131df74a0d717e97b7f43f84ebc1e3a349a1facea7bf56cfba597661895f7ea7b48e6778f93698e1cb28da5b87a68a2f	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3C0D087ECDCC76D1084ABE00F1FEE5040400AE37\Blob = 0300000001000000140000003c0d087ecdcc76d1084abe00f1fee5040400ae372000000001000000c6050000308205c2308204aaa00302010202100aa60783ebb5076ebc2d12da9b04c290300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3231303530353030303030305a170d3234303631303233353935395a3081d2311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6ec814ee2c7075e2e29ac7ebd10b6188055929370a213b83fb6e337d82ed0756d15e267f6bc645e6db5bb1d586ef1098ead1595147d03897af04b666aa5a50def2b3af23974896c6fb4f5246baf3ec374dbfd90eeec7575ffb11a6efea7a0d7da0adb04eaf000b1ad520d9e9529b2a8cf420998d4c7a46c1f95e405e35f69ad8c05d62df0f9745017a6284134afba26f905d900da1c412200e6ca5c6b148f3f785aa0ebe35ea9160644bd6924b54625eb404ab39db981f6b216b6dd960930a1443b26aab08cdbcf1c5fd74dbb56c3e9df791f8429401dee5869e90c39f95000fc616b5ac8396b588e24407235ea074328c608112f6cb4f07347cd4d28d28ab90203010001a38201f7308201f3301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e04160414c5b210483c7598f90d32838cd0763d3cd85fef5130350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304a0603551d2004433041303606096086480186fd6c03023029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101008b2182887ada0e08e4afe89019ded16e88ff6ff1b12fd9b2994b945b8c76c63862ae35a1751672c474c8575a039250105e346bb7ce7ae1f2494e760de418b9453f1bbac9255b0dccafd296adb3cdb49d46d54c3413bfc34a3e640e244da7b1e1dbd1b04cea414ff64fe57f0ef28944a42e41065548e4834f2b05d4aae8516a1f154c5b09af25fe059a69a7dc75a7deb4cf3068c402614ece0509edf02b0968b5c8d1081cdafcfba3b7c1599256e6685ef7391f46746eaf829bc8fd40f55be70a3fc51142648b78a903e750158328cb80d54aaddce82df8fe983b0e36af4dafbdbdffe8896bee9a93c370e77f735fe9c42fc2259a3e5672e9f75f37ecf7104e53	certutil.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_a009d240f9b4a192\ndiscap.PNF	NPFInstall.exe
File created	C:\Windows\SysWOW64\wpcap.dll	npcap-1.71.exe
File created	C:\Windows\SysWOW64\Packet.dll	npcap-1.71.exe
File created	C:\Windows\SysWOW64\WlanHelper.exe	npcap-1.71.exe
File created	C:\Windows\system32\wpcap.dll	npcap-1.71.exe
File created	C:\Windows\system32\Packet.dll	npcap-1.71.exe
File created	C:\Windows\system32\WlanHelper.exe	npcap-1.71.exe
File created	C:\Windows\system32\Npcap\Packet.dll	npcap-1.71.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_7d294c7fa012d315\netpacer.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_0dc913ad00b14824\netnb.PNF	NPFInstall.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8c3cbb8d-b90f-ca41-bf6b-8d9f77220b1d}\NPCAP.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8c3cbb8d-b90f-ca41-bf6b-8d9f77220b1d}\SET2C2E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_7f701cb29b5389d3\netrass.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_b5b1a6e95c9e3ae5\npcap.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\wfpcapture.PNF	NPFInstall.exe
File created	C:\Windows\SysWOW64\Npcap\Packet.dll	npcap-1.71.exe
File created	C:\Windows\system32\NpcapHelper.exe	npcap-1.71.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8c3cbb8d-b90f-ca41-bf6b-8d9f77220b1d}\SET2BFD.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8c3cbb8d-b90f-ca41-bf6b-8d9f77220b1d}\SET2BFD.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8c3cbb8d-b90f-ca41-bf6b-8d9f77220b1d}\npcap.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_c5e19aab2305f37f\netvwififlt.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_9ab9cf10857f7349\c_netservice.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_73adce5afe861093\netserv.PNF	NPFInstall.exe
File created	C:\Windows\SysWOW64\NpcapHelper.exe	npcap-1.71.exe
File created	C:\Windows\system32\Npcap\wpcap.dll	npcap-1.71.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_b5b1a6e95c9e3ae5\npcap.cat	DrvInst.exe
File created	C:\Windows\SysWOW64\Npcap\wpcap.dll	npcap-1.71.exe
File created	C:\Windows\SysWOW64\Npcap\WlanHelper.exe	npcap-1.71.exe
File created	C:\Windows\system32\Npcap\WlanHelper.exe	npcap-1.71.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8c3cbb8d-b90f-ca41-bf6b-8d9f77220b1d}\SET2C1D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\netbrdg.PNF	NPFInstall.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8c3cbb8d-b90f-ca41-bf6b-8d9f77220b1d}\npcap.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_a2bfd066656fe297\netnwifi.PNF	NPFInstall.exe
File created	C:\Windows\SysWOW64\Npcap\NpcapHelper.exe	npcap-1.71.exe
File created	C:\Windows\system32\Npcap\NpcapHelper.exe	npcap-1.71.exe
File created	C:\Windows\System32\DriverStore\Temp\{8c3cbb8d-b90f-ca41-bf6b-8d9f77220b1d}\SET2C1D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8c3cbb8d-b90f-ca41-bf6b-8d9f77220b1d}\SET2C2E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_b5b1a6e95c9e3ae5\npcap.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_b5b1a6e95c9e3ae5\NPCAP.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8c3cbb8d-b90f-ca41-bf6b-8d9f77220b1d}	DrvInst.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Nmap\nselib\coap.lua	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\qscan.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\ssl-cert-intaddr.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\vmauthd-brute.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\nselib\ncp.lua	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\nselib\pppoe.lua	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\domino-enum-users.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\ssl-dh-params.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\broadcast-novell-locate.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\smb-enum-processes.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\sniffer-detect.nse	nmap-7.93-setup.exe
File created	C:\Program Files\Npcap\npcap_wfp.inf	npcap-1.71.exe
File created	C:\Program Files (x86)\Nmap\scripts\auth-spoof.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\http-vuln-cve2017-5689.nse	nmap-7.93-setup.exe
File created	C:\Program Files\Npcap\CheckStatus.bat	npcap-1.71.exe
File created	C:\Program Files (x86)\Nmap\nmap-os-db	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\ms-sql-query.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\lltd-discovery.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\snmp-netstat.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\libcrypto-3.dll	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\http-userdir-enum.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\smb-double-pulsar-backdoor.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\smb2-capabilities.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\http-majordomo2-dir-traversal.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\rlogin-brute.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\ssh-publickey-acceptance.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\smtp-ntlm-info.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\http-vuln-cve2014-2129.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\informix-query.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\http-vuln-cve2017-1001000.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\quake1-info.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\smtp-vuln-cve2010-4344.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\nselib\msrpcperformance.lua	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\http-form-fuzzer.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\http-vuln-cve2014-2126.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\nselib\data\http-default-accounts-fingerprints.lua	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\ftp-libopie.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\http-apache-server-status.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\broadcast-ripng-discover.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\iec-identify.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\sslv2.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\licenses\WinPcap-license.txt	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\afp-brute.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\http-auth.nse	nmap-7.93-setup.exe
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File created	C:\Program Files (x86)\Nmap\licenses\OpenSSL-license.txt	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\hbase-region-info.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\nselib\isns.lua	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\nselib\pop3.lua	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\http-google-malware.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\http-virustotal.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\dns-recursion.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\dns-zeustracker.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\nselib\data\mysql-cis.audit	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\http-domino-enum-passwords.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\pcworx-info.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\pop3-capabilities.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\nselib\gps.lua	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\nselib\ldap.lua	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\CHANGELOG	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\imap-capabilities.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\scripts\nfs-ls.nse	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\nselib\eap.lua	nmap-7.93-setup.exe
File created	C:\Program Files (x86)\Nmap\nselib\stringaux.lua	nmap-7.93-setup.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\INF\oem3.PNF	NPFInstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	NPFInstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe

Executes dropped EXE 5 IoCs

pid	Process
1364	npcap-1.71.exe
3684	NPFInstall.exe
1988	NPFInstall.exe
3980	NPFInstall.exe
3532	NPFInstall.exe

Loads dropped DLL 14 IoCs

pid	Process
1728	nmap-7.93-setup.exe
1728	nmap-7.93-setup.exe
1364	npcap-1.71.exe
1364	npcap-1.71.exe
1364	npcap-1.71.exe
1364	npcap-1.71.exe
1364	npcap-1.71.exe
1364	npcap-1.71.exe
1364	npcap-1.71.exe
1364	npcap-1.71.exe
1364	npcap-1.71.exe
1364	npcap-1.71.exe
1364	npcap-1.71.exe
1364	npcap-1.71.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	4568	WerFault.exe	115

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3684	NPFInstall.exe
3684	NPFInstall.exe
2260	powershell.exe
2260	powershell.exe
4568	powershell.exe
4568	powershell.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	NPFInstall.exe
Token: SeAuditPrivilege	4848	svchost.exe
Token: SeSecurityPrivilege	4848	svchost.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1364	1728	nmap-7.93-setup.exe	92
PID 1728 wrote to memory of 1364	1728	nmap-7.93-setup.exe	92
PID 1728 wrote to memory of 1364	1728	nmap-7.93-setup.exe	92
PID 1364 wrote to memory of 3684	1364	npcap-1.71.exe	96
PID 1364 wrote to memory of 3684	1364	npcap-1.71.exe	96
PID 1364 wrote to memory of 2336	1364	npcap-1.71.exe	98
PID 1364 wrote to memory of 2336	1364	npcap-1.71.exe	98
PID 1364 wrote to memory of 2336	1364	npcap-1.71.exe	98
PID 1364 wrote to memory of 4932	1364	npcap-1.71.exe	100
PID 1364 wrote to memory of 4932	1364	npcap-1.71.exe	100
PID 1364 wrote to memory of 4932	1364	npcap-1.71.exe	100
PID 1364 wrote to memory of 1988	1364	npcap-1.71.exe	102
PID 1364 wrote to memory of 1988	1364	npcap-1.71.exe	102
PID 1988 wrote to memory of 2324	1988	NPFInstall.exe	104
PID 1988 wrote to memory of 2324	1988	NPFInstall.exe	104
PID 1364 wrote to memory of 3980	1364	npcap-1.71.exe	106
PID 1364 wrote to memory of 3980	1364	npcap-1.71.exe	106
PID 1364 wrote to memory of 3532	1364	npcap-1.71.exe	108
PID 1364 wrote to memory of 3532	1364	npcap-1.71.exe	108
PID 4848 wrote to memory of 3008	4848	svchost.exe	112
PID 4848 wrote to memory of 3008	4848	svchost.exe	112
PID 1364 wrote to memory of 2260	1364	npcap-1.71.exe	114
PID 1364 wrote to memory of 2260	1364	npcap-1.71.exe	114
PID 1364 wrote to memory of 2260	1364	npcap-1.71.exe	114
PID 1364 wrote to memory of 4568	1364	npcap-1.71.exe	115
PID 1364 wrote to memory of 4568	1364	npcap-1.71.exe	115
PID 1364 wrote to memory of 4568	1364	npcap-1.71.exe	115

C:\Users\Admin\AppData\Local\Temp\nmap-7.93-setup.exe
"C:\Users\Admin\AppData\Local\Temp\nmap-7.93-setup.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\nsc6544.tmp\npcap-1.71.exe
  "C:\Users\Admin\AppData\Local\Temp\nsc6544.tmp\npcap-1.71.exe" /loopback_support=no
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Users\Admin\AppData\Local\Temp\nslD41B.tmp\NPFInstall.exe
    "C:\Users\Admin\AppData\Local\Temp\nslD41B.tmp\NPFInstall.exe" -n -check_dll
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- - C:\Windows\SysWOW64\certutil.exe
    certutil -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nslD41B.tmp\roots.p7b"
    3⤵
    - Manipulates Digital Signatures
    PID:2336
- - C:\Windows\SysWOW64\certutil.exe
    certutil -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nslD41B.tmp\signing.p7b"
    3⤵
    - Manipulates Digital Signatures
    PID:4932
- - C:\Program Files\Npcap\NPFInstall.exe
    "C:\Program Files\Npcap\NPFInstall.exe" -n -c
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\SYSTEM32\pnputil.exe
      pnputil.exe -e
      4⤵
      PID:2324
- - C:\Program Files\Npcap\NPFInstall.exe
    "C:\Program Files\Npcap\NPFInstall.exe" -n -iw
    3⤵
    - Executes dropped EXE
    PID:3980
- - C:\Program Files\Npcap\NPFInstall.exe
    "C:\Program Files\Npcap\NPFInstall.exe" -n -i2
    3⤵
    - Drops file in Drivers directory
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:3532
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Microsoft.PowerShell.Management\Start-Service -Name npcap -PassThru | Microsoft.PowerShell.Management\Stop-Service -PassThru | Microsoft.PowerShell.Management\Start-Service"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "ScheduledTasks\Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (ScheduledTasks\New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (ScheduledTasks\New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (ScheduledTasks\New-ScheduledTaskTrigger -AtStartup) -Settings (ScheduledTasks\New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 2212
      4⤵
      Program crash
      PID:3020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{892f3281-5914-1848-aef3-1ce6fe9b8af3}\NPCAP.inf" "9" "405306be3" "00000000000000E8" "WinSta0\Default" "0000000000000148" "208" "C:\Program Files\Npcap"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4568 -ip 4568
1⤵
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\Npcap\npcap.cat

Filesize
12KB

MD5
be2a59b225dace6a52b98f17678786c0

SHA1
abec30ea6b668f9ccff77209d54b971ce6a22711

SHA256
43d10d470320041e663a82439d79cfac78de99addd98e02c4d60171710d032b2

SHA512
9a9acfe84f822b7f20148725a4abaa51118759f5688d4a3841c4a9e73b59801128adf4df54a14078408fb14ad0acea068a2bdd1cf0f9ffc6c44e6e38721f79d6

Download Submit
C:\PROGRA~1\Npcap\npcap.sys

Filesize
75KB

MD5
08a2def8efc2619ddabe13a041703aea

SHA1
f9fd929c77d5a47766623abaa7490bcd98b3ad97

SHA256
a2039b552dfacd4edc2b8ed42bbe32cb0a481240fce18f78aeb1a68dbb747d39

SHA512
0afb5d2dd6747b37162494f4f90387160c5b90c58a71703d2ddd07256e848ee1f3e4237b660d511262255e54038ab11699808526a3574450c9407eb1e830dfac

Download Submit
C:\Program Files\Npcap\NPCAP.inf

Filesize
8KB

MD5
ff536154cf4932322ca818eda6712e49

SHA1
873bb1d640cdc9c41596f46fbc37b48a5d6b03cd

SHA256
4c1b4785d35a4828b98b7acacf8b18b0a4e4d0c9da683cd9294f6a6ae6cf7bf2

SHA512
164d9c7eca15fa83aa2645fd4eefbf2a562b49615978b72f6c9c1b072cbdd1bffdc3295d95b69d2cf26dba67f25d6fe82ddbfa6decda07fa855bfa3c2311d7b4

Download Submit
C:\Program Files\Npcap\NPCAP_wfp.inf

Filesize
2KB

MD5
4b72b37d904cbf298fb8351cc80a048e

SHA1
f77357bd263f88acdb1b5cad300e7b116a1c2ee7

SHA256
953b89b39c78dafb27a05f27bc8faa97c70f2a6ec3bc2f81070a46b85d305f08

SHA512
e63d013ca9badc2d40634c6bdc1629adbade70a65753f317c7e7ac09078ad299105ad6e37fb18a8a6a0b0d994a2ea01c32a55cbc9a19b53466cd49603ee81181

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
191B

MD5
8d3124a94753f3ef23da883ff59fee55

SHA1
137c953ce796fa5eee492b3640afed1dbe65ed7b

SHA256
2d840f2015593d4c9a9e4ba96fc4ed15ef1bd8cbf18524670dd8b0a17de21fbc

SHA512
8b3ca55e8a97f7c4e29c616d3cbc996ae16ccfdbfd507bceb04d2a3496a06ac89c174b2680e56aff59cb4d7376b250e8ea62b6fe044b2aa733214b855816da0e

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
393B

MD5
629634c9a3b22de3654266fe003529af

SHA1
45cfc4b5e67b690ad330a4f9abb8ff7d3d7e754f

SHA256
8295b8f74412adc78ba07d740c13f34f0201417bb76479b76d2ab4d48c3d6e7a

SHA512
ec5d5e2aeecf7a20f3f10e1a439d731b1c657532e7a26b4d4097009fe8e6755a2d28759ecdfee774316c528edb2dc0bb334378dd74f8ce9443eca43f6bae728d

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
790B

MD5
147535a3d0d3008ad4de2f1abe3b76bb

SHA1
5afa0ddccb10a3d1bea5248b41bc622861ab55e0

SHA256
2502eb3fa18dae1d99f7e919e4bf1975b83d663aa02afb51c502d8660bfeaee9

SHA512
25987857ed12fc65ebad23264d546e3df1691f80e9e9b0642fa6514a8ca0bfc4b51a9f1e70582bbaf4f3cbff258c7fd6dcea9389f773c73f1522972c3f2b4a7d

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
1KB

MD5
be4c00df8e5da6149730a9e6d2e815f1

SHA1
501562c31e633c6daa053f317eb1032e92a659a4

SHA256
bdce37c5eeb7397747e02b62c0ccddb47daa48938b9d9ed7b50974a21108d032

SHA512
7ead733668b9ab2dfb1031ec997ff76b0aa66ead1d552e3a94b56efefb0b5ba0f82efbaa80112bed8d8a260b1e9527d9b0a02bc4bacb133f7ecd7348237e5538

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
1KB

MD5
baf595d4c2494aacfec9f3820ce3c6e2

SHA1
ba17d91b2da3bd6e5b8fd7ba00cb69f3b528166c

SHA256
8795a039b7d9ff33df1f65f5f540b942c805199ef1ffd412045446c1546b58dd

SHA512
32d5200b55c0abfc28a6184acfd87eae78307b116673f307b83d67180f23a6b124f28464384f0d51f8330a88e10e55239bd319117d3118c7bd6de6123471a9bd

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
2KB

MD5
736e7594c68a15841941090b13cfe234

SHA1
692634ee0c6234ae40428c1bb914434742977e1d

SHA256
f8f04e6aa13192110c13792077c184f342896a118fb036a784c57c2b2bd80c31

SHA512
1eff7ab9a6f74d853935f5b881e771dad98913f9066f63b2cf55d67470f27d297ce315ce547cfb72be03a5aa908e33b41047fb6b85dd282f916687c439fbefa3

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
3KB

MD5
a95be85b996c5e941a502fb143acf186

SHA1
eba8ec3aa9e6c8cfcaa7c230ec6524dcee1cf573

SHA256
3fa2e08bd8cfe23b43bfb130c8c8e7d5f6e8c3401c5529783328ddddea28fde9

SHA512
66bbe7790f37a25a09e10d56a34ea21dee4ab0f263fc79be09f5345aaa8e542406d450bb9a611f09106afa0b1d34ae93f1085d0e8a23b89fa5ca4f2ef4d3728a

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
3KB

MD5
71d7f347e2942bf867d539ce05645157

SHA1
910f584ab9427bc133deff0233b309807ead6c20

SHA256
41d8ae15cb40ffd9e8296db82d56543b172b8a1f15a2967dd88553b41160c8df

SHA512
8817f35d0e5c9fdebf15914809d34fdc4c7ef0f06f04daf626d608bfbd0ddfd6ae8645f91b16b0240c9c91c4a005de5ac8e6a71c65e42238fe9a0556ffb1d4d5

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
4KB

MD5
a4c46fc18a3204dd7cf472928ced3cb6

SHA1
b8a9bca0cf297cdbdae2cef4295ce8c2120545d6

SHA256
4bfceb4e5e1085a980530161ca016ece8ef87fe2546c768d2aa901f721649979

SHA512
9dc8c08fcb621af67857a20775ecc94ea50bad21d1d91bd046c53660cb28f9228b146fca750c3eb9f13823d4a6320661d906f137f570c115a0490916ae4e3d22

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
4KB

MD5
6bd5cb2008041679091f0008454853e4

SHA1
4705b4d99fb949c0f513436af58ca4318a0c13b3

SHA256
f8187a54a17e49389553759e1a3c713bc66e9adbd40e009db228a13aad90ca7d

SHA512
c426439de70866cb7da499a6c048298e1302f9bd8ae576da6f709e370fcb52c5100c84dac11e60cc6f2c61214df89ecceca3c203b6305c2cfe4a1830a4c6ce58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
def65711d78669d7f8e69313be4acf2e

SHA1
6522ebf1de09eeb981e270bd95114bc69a49cda6

SHA256
aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

SHA512
05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
072396748bb06d974cd77463a90a105f

SHA1
87078cd4aebe2d871bf69884ccec6bf7a52a80ee

SHA256
57c60c45b2dd7c045090da21b31346daca0557a27544d7ba4026f5aaa647b836

SHA512
dad804fdd9a7d574fd6f60e99aae92d2c39f8e5ecd742d27469227e77c636ecc9ae0f7f12c0f927e43ccb083dcd2aba8e2a151409a0f2008d85cd107239b220e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n1rbxbpu.h04.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc6544.tmp\InstallOptions.dll

Filesize
22KB

MD5
17c877fec39fc8ce03b7f012ef25211f

SHA1
61adfa25cbd51375f0355aa9b895e1dc28389e19

SHA256
dbb0173bb09d64ca716b3fd9efb0222ecc7c13c11978d29f2b61cf550bcd7aba

SHA512
45c44c91bf72d058fcba93e7d96b45fcc3dc06855b86eca0f463aa4eeafc7e68493e33663c68fd3fdceed51dd0e76d3493c47da68a3efdc25af9e78c2643d29d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc6544.tmp\npcap-1.71.exe

Filesize
1.1MB

MD5
40cfea6d5a3ff15caf6dd4ae88a012b2

SHA1
287b229cecf54ea110a8b8422dcda20922bdf65e

SHA256
5ccb61296c48e3f8cd20db738784bd7bf0daf8fce630f89892678b6dda4e533c

SHA512
6ac4955286a4927ce43f7e85783631c9a801605c89a18ba95dde34d90eecbf4825b09e116890c8aca8defff767ad14843303dd557a67636bed1f1709b5399024

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD41B.tmp\InstallOptions.dll

Filesize
22KB

MD5
170c17ac80215d0a377b42557252ae10

SHA1
4cbab6cc189d02170dd3ba7c25aa492031679411

SHA256
61ea114d9d0cd1e884535095aa3527a6c28df55a4ecee733c8c398f50b84cc3d

SHA512
0fd65cad0fcaa98083c2021de3d6429e79978658809c62ae9e4ed630c016915ced36aa52f2f692986c3b600c92325e79fd6d757634e8e02d5e582ff03679163f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD41B.tmp\NPFInstall.exe

Filesize
300KB

MD5
36f0e125cb870ac28cdff861a684f844

SHA1
2e2cdeff8b14ef9146dddb9a659bcc6532c72421

SHA256
0560d98683343995d5f2dd5f2607f7298bd81be7746efa0d212481fbfa76788e

SHA512
144e014e1047ec0bcf96821207bb4138873557a1ff47843f34ee1c33b6ff1d8365de6177a14c5f8088d0a2087142b7a1f56bf7f7aba67bdd83bbb88f3a36507b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD41B.tmp\System.dll

Filesize
19KB

MD5
f020a8d9ede1fb2af3651ad6e0ac9cb1

SHA1
341f9345d669432b2a51d107cbd101e8b82e37b1

SHA256
7efe73a8d32ed1b01727ad4579e9eec49c9309f2cb7bf03c8afa80d70242d1c0

SHA512
408fa5a797d3ff4b917bb4107771687004ba507a33cb5944b1cc3155e0372cb3e04a147f73852b9134f138ff709af3b0fb493cd8fa816c59e9f3d9b5649c68c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD41B.tmp\nsExec.dll

Filesize
14KB

MD5
f9e61a25016dcb49867477c1e71a704e

SHA1
c01dc1fa7475e4812d158d6c00533410c597b5d9

SHA256
274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

SHA512
b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD41B.tmp\options.ini

Filesize
2KB

MD5
5c12cb2bec2ac5638afa58c50594efbf

SHA1
f7838c285482781b4b3470a917511e46b2f529a3

SHA256
6be0dbd9dae055bf41c260fa807241f5bd64e270978bc1c56ee133a8ace9ea97

SHA512
e2a67b32fce1aab31850a999842603197fa6a64deab28b1d090f18b2bb5bb3c01bae93fc97ba0edc0e1d45fb74878d55dfeef3d051d301bd079b4314003f7b70

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD41B.tmp\options.ini

Filesize
2KB

MD5
3c0fe580cacffcc32576b876310684ed

SHA1
5d7bec3eba1e4cb8247fdf469b0dff9fcf42b55f

SHA256
b260c658556d10fd33d726456a65bcf13b1c6d7d7f6b6a4889c85cb735e0f426

SHA512
928633cecc94e78b287b1b8ae4889044eb88373d1f61f6fa6b9f952f157835f05367ec41990acda8ba696322cbfbfc5911227615ca00ea044aa913df7dadafb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD41B.tmp\roots.p7b

Filesize
1KB

MD5
397a5848d3696fc6ba0823088fea83db

SHA1
9189985f027de80d4882ab5e01604c59d6fc1f16

SHA256
ad3bca6f2b0ec032c7f1fe1adb186bd73be6a332c868bf16c9765087fff1c1ca

SHA512
66129a206990753967cd98c14a0a3e0e2a73bc4cd10cf84a5a05da7bf20719376989d64c6c7880a3e4754fc74653dd49f2ffeffd55fc4ee5966f65beb857118c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD41B.tmp\signing.p7b

Filesize
7KB

MD5
dd4bc901ef817319791337fb345932e8

SHA1
f8a3454a09d90a09273935020c1418fdb7b7eb7c

SHA256
8e681692403c0f7c0b24160f4642daa1eb080ce5ec754b6f47cc56b43e731b71

SHA512
0a67cc346f9752e1c868b7dc60b25704255ab1e6ea745850c069212f2724eba62ffaaa48309d5eba6ae0235223518610fb4b60fc422e4babba4f33d331c71db5

Download Submit
memory/2260-1274-0x00000000046D0000-0x00000000046E0000-memory.dmp

Filesize
64KB

Download
memory/2260-1292-0x0000000006150000-0x00000000061E6000-memory.dmp

Filesize
600KB

Download
memory/2260-1277-0x0000000005380000-0x00000000053A2000-memory.dmp

Filesize
136KB

Download
memory/2260-1278-0x00000000054A0000-0x0000000005506000-memory.dmp

Filesize
408KB

Download
memory/2260-1284-0x00000000055C0000-0x0000000005626000-memory.dmp

Filesize
408KB

Download
memory/2260-1276-0x00000000046D0000-0x00000000046E0000-memory.dmp

Filesize
64KB

Download
memory/2260-1289-0x0000000005780000-0x0000000005AD4000-memory.dmp

Filesize
3.3MB

Download
memory/2260-1290-0x0000000005BF0000-0x0000000005C0E000-memory.dmp

Filesize
120KB

Download
memory/2260-1291-0x0000000005C30000-0x0000000005C7C000-memory.dmp

Filesize
304KB

Download
memory/2260-1275-0x0000000004D10000-0x0000000005338000-memory.dmp

Filesize
6.2MB

Download
memory/2260-1293-0x0000000005FF0000-0x000000000600A000-memory.dmp

Filesize
104KB

Download
memory/2260-1294-0x0000000006060000-0x0000000006082000-memory.dmp

Filesize
136KB

Download
memory/2260-1295-0x00000000071C0000-0x0000000007764000-memory.dmp

Filesize
5.6MB

Download
memory/2260-1298-0x0000000073360000-0x0000000073B10000-memory.dmp

Filesize
7.7MB

Download
memory/2260-1273-0x0000000073360000-0x0000000073B10000-memory.dmp

Filesize
7.7MB

Download
memory/2260-1272-0x0000000004630000-0x0000000004666000-memory.dmp

Filesize
216KB

Download
memory/4568-1305-0x00000000032C0000-0x00000000032D0000-memory.dmp

Filesize
64KB

Download
memory/4568-1306-0x00000000032C0000-0x00000000032D0000-memory.dmp

Filesize
64KB

Download
memory/4568-1304-0x0000000073360000-0x0000000073B10000-memory.dmp

Filesize
7.7MB

Download
memory/4568-1317-0x0000000073360000-0x0000000073B10000-memory.dmp

Filesize
7.7MB

Download