3d921ee584d0984f694f60a771a6581a6f32a9de995a5cd4bca1931185a4e618

Resubmissions

21-05-2024 15:45

240521-s6292sah6y 9

Analysis

max time kernel
496s
max time network
530s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wireshark-4.2.5-x64.exe
Size

82.5MB
MD5

2e23b0e7ef14dac31eb825a284fcbad8
SHA1

0e3c7b4dcd5c247c8f9726195a4d5a70b99f8b1b
SHA256

3d921ee584d0984f694f60a771a6581a6f32a9de995a5cd4bca1931185a4e618
SHA512

6242031538a46b6576885228d74b88705f5c3c3afa7ffae4ee218010f0db6d4e4ac0261a2005c3ca27dcf929de963d4693623d402d7239881b4bbdf792e944d6
SSDEEP

1572864:uvPlDWPYmmW5ttwcR3fp5LR5wsS9ZZdP6kA1YifYd2rJwzR088LYBDJkV:uvsAmmWjtDR3fTXwd9ZDPxA1bf07K88p

Score

9^/10

discovery evasion execution persistence

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

2012 powershell.exe
2404 powershell.exe
1516 powershell.exe
3348 powershell.exe
4168 powershell.exe
2964 powershell.exe

pid	process
2012	powershell.exe
2404	powershell.exe
1516	powershell.exe
3348	powershell.exe
4168	powershell.exe
2964	powershell.exe

Drops file in Drivers directory 3 IoCs

Processes:

NPFInstall.exe

description	ioc	process
File opened for modification	C:\Windows\system32\DRIVERS\SET5C6E.tmp	NPFInstall.exe
File created	C:\Windows\system32\DRIVERS\SET5C6E.tmp	NPFInstall.exe
File opened for modification	C:\Windows\system32\DRIVERS\npcap.sys	NPFInstall.exe

Manipulates Digital Signatures 1 TTPs 8 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

Processes:

certutil.execertutil.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4CE89794FE2D2F7E30121F10BCF76AC3CCF77CA9\Blob = 0300000001000000140000004ce89794fe2d2f7e30121f10bcf76ac3ccf77ca92000000001000000c7050000308205c3308204aba003020102021009256314069e7e6a88cb823075c0d9c9300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3230303530313030303030305a170d3231303530373132303030305a3081d231133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a88cd713346c50a5cd2a62900419f091330f9820b73b38785a8b5a25ceda8e11b71b2d11ff4b0c18cad405a2a195a6462619fa3ddf6d14466a350d1cf1c6ad48cce166fe6011a62ee62751046dd264b1cc145c4a4354537cec1ae615b6b8566a28ddf3b510fee92023dbe4190b44bb4174f94c4ec62256bd4aa5ba541ee833388db8cc411365e094ee6314eaff59ca6659bb6388300e7ffbd0f8b299889b8e3ea526f8ca926ded79eac89a6b068757ae428022e2602ec98babf5998216b0c28a709129a1300872878d9971e3130826a7d1ce894fe649a017003f07ee3c53ca0cba998fab097e573723fbd3e0ea1b742dd6d076b4c2284b93500021a7d27109630203010001a38201f8308201f4301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604140a9c208099309acdddf9c9909a03890dcd30c8ea30350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038201010042368fc33025a2a1338cf35a08d00e263958f825e79b6d3af23e0e4e4cf59bc8502022d452cbba14a53274e3a12a5b01f4aee16abfcb1b28d63484a0ae1995c9759c6f0970254da8902fb479f5f7869a566aa285f2c28e50096dfd2e14a9ecf0000963c570d2338def108dfe66b1e44d22182826749871a7f3977eba4976910f1f0de866fc75b918c1a9f466fcf96ae90df932071b9c770f0f3193f8ca500abe52cc316549403a5ca5b5422d1ebffffc3cbe3b926de552f493b53c6570fdd0736550f080c2db204b03bc00ff724241581b5dfb0dff7b8f2cc28f136c19cca8bd4b3c3d81404e69f4598e7b5458e41c6f2e6622a212d28c2615565782a1f66987	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL"	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3\Blob = 03000000010000001400000060ee3fc53d4bdfd1697ae5beae1cab1c0f3ad4e32000000001000000c0060000308206bc308205a4a003020102021003f1b4e15f3a82f1149678b3d7d8475c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3132303431383132303030305a170d3237303431383132303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e672043412028534841322930820122300d06092a864886f70d01010105000382010f003082010a0282010100a753fa0fb2b513f164cf8480fcae8035d1b6d7c7a32cac1a2cacf184ac3a35123a9291ba57e4c4c9f32fa8483cb7d66edc9722ba517961af432f0db79bb44931ae44583ea4a196a7874f237ec36c652490553ea1ca237cc542e9c47a62459b7dde6374cb9e6325f8849a9aad454fae7d1fc813cb759bc9e1e18af80b0c98f4ca3ed045aa7a1ea558933634be2b2e2b315866b432109f9df052a1efe83ed376f2405adcfa6a3d1b4bad76b08c5cee36ba83ea30a84cdef10b2a584188ae0089ab03d11682202276eb5e54381262e1d27024dbed1f70d26409802de2b69dce1ff2bb21f36cdbd8b3197b8a509fefec360a5c9ab74ad308a03979fdddbf3d3a09250203010001a38203583082035430120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307f06082b0601050507010104733071302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304906082b06010505073002863d687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63727430818f0603551d1f0481873081843040a03ea03c863a687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63726c3040a03ea03c863a687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0302308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e301d0603551d0e041604148fe87ef06d326a000523c770976a3a90ff6bead4301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d01010b0500038201010019334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3BA63A6E4841355772DEBEF9CDCF4D5AF353A297\Blob = 0300000001000000140000003ba63a6e4841355772debef9cdcf4d5af353a2972000000001000000350500003082053130820419a00302010202100aa125d6d6321b7e41e405da3697c215300d06092a864886f70d01010b05003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3136303130373132303030305a170d3331303130373132303030305a3072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f060355040313284469676943657274205348413220417373757265642049442054696d657374616d70696e6720434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bdd032ee4bcd8f7fdda9ba8299c539542857b6234ac40e07453351107dd0f97d4d687ee7b6a0f48db388e497bf63219098bf13bc57d3c3e17e08d66a140038f72e1e3beecca6f63259fe5f653fe09bebe34647061a557e0b277ec0a2f5a0e0de223f0eff7e95fbf3a3ba223e18ac11e4f099036d3b857c09d3ee5dc89a0b54e3a809716be0cf22100f75cf71724e0aaddf403a5cb751e1a17914c64d2423305dbcec3c606aac2f07ccfdf0ea47d988505efd666e56612729898451e682e74650fd942a2ca7e4753eba980f847f9f3114d6add5f264cb7b1e05d084197217f11706ef3dcdd64def0642fda2532a4f851dc41d3cafcfdaac10f5ddacace956ff930203010001a38201ce308201ca301d0603551d0e04160414f4b6e1201dfe29aed2e461a5b2a225b2c817356e301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f30120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070308307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e6372743081810603551d1f047a3078303aa038a0368634687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c303aa038a0368634687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c30500603551d20044930473038060a6086480186fd6c000204302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f435053300b06096086480186fd6c0701300d06092a864886f70d01010b05000382010100719512e951875669cdefddda7caa637ab378cf06374084ef4b84bfcacf0302fdc5a7c30e20422caf77f32b1f0c215a2ab705341d6aae99f827a266bf09aa60df76a43a930ff8b2d1d87c1962e85e82251ec4ba1c7b2c21e2d65b2c1435430468b2db7502e072c798d63c64e51f4810185f8938614d62462487638c91522caf2989e5781fd60b14a580d7124770b375d59385937eb69267fb536189a8f56b96c0f458690d7cc801b1b92875b7996385228c61ca79947e59fc8c0fe36fb50126b66ca5ee875121e458609bba0c2d2b6da2c47ebbc4252b4702087c49ae13b6e17c424228c61856cf4134b6665db6747bf55633222f2236b24ba24a95d8f5a68e52	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E1D782A8E191BEEF6BCA1691B5AAB494A6249BF3\Blob = 030000000100000014000000e1d782a8e191beef6bca1691b5aab494a6249bf3200000000100000002050000308204fe308203e6a00302010202100d424ae0be3a88ff604021ce1400f0dd300d06092a864886f70d01010b05003072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f060355040313284469676943657274205348413220417373757265642049442054696d657374616d70696e67204341301e170d3231303130313030303030305a170d3331303130363030303030305a3048310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3120301e0603550403131744696769436572742054696d657374616d70203230323130820122300d06092a864886f70d01010105000382010f003082010a0282010100c2e6618467c58af50d08a445ca636b51d73a1142bd0a75754d94b40c50b52610fe1dc86f916b0c96e71a5c48ef44e5bf9b61cd1591625ab8ff670b9c63fd366a81fa29f8dd2b7085de0218f3786dbc7df9c76d093dbe6a7687e98abdf8845d1e76c9e4c676763a53d1d1d35a368fc6a3e12f1b3ab761d673ec4e6d338a7c5d452d4bb150e6413a375686dc93238df75025e864e6ddd38f2f57b58720eb0e8e2cd523daf44d7846e3038331294a5c0c318a4a8c88c5f7305af914af155f6c434909fd262353f68d63e81aab5bb11d30c29b6982b4dbfc5654bc1fa187abbe7a5b0a202f4b09c995a78db2fad6638b4ea5721cee9f7a0173f819d6fe0d4984bd010203010001a38201b8308201b4300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030160603551d250101ff040c300a06082b0601050507030830410603551d20043a3038303606096086480186fd6c07013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f435053301f0603551d23041830168014f4b6e1201dfe29aed2e461a5b2a225b2c817356e301d0603551d0e041604143644868ea4bab066bebc282d1d4436dde36a7abc30710603551d1f046a30683032a030a02e862c687474703a2f2f63726c332e64696769636572742e636f6d2f736861322d617373757265642d74732e63726c3032a030a02e862c687474703a2f2f63726c342e64696769636572742e636f6d2f736861322d617373757265642d74732e63726c30818506082b0601050507010104793077302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304f06082b060105050730028643687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572745348413241737375726564494454696d657374616d70696e6743412e637274300d06092a864886f70d01010b05000382010100481cdcb5e99a23bce71ae7200e8e6746fd427251740a2347a3ab92d225c47059be14a0e52781a54d1415190779f0d104c386d93bbdfe4402664ded69a40ff6b870cf62e8f5514a7879367a27b7f3e7529f93a7ed439e7be7b4dd412289fb87a246034efcf4feb76477635f2352698382fa1a53ed90cc8da117730df4f36539704bf39cd67a7bda0cbc3d32d01bcbf561fc75080076bc810ef8c0e15ccfc41172e71b6449d8229a751542f52d323881daf460a2bab452fb5ce06124254fb2dfc929a8734351dabd63d61f5b9bf72e1b4f131df74a0d717e97b7f43f84ebc1e3a349a1facea7bf56cfba597661895f7ea7b48e6778f93698e1cb28da5b87a68a2f	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3C0D087ECDCC76D1084ABE00F1FEE5040400AE37\Blob = 0300000001000000140000003c0d087ecdcc76d1084abe00f1fee5040400ae372000000001000000c6050000308205c2308204aaa00302010202100aa60783ebb5076ebc2d12da9b04c290300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3231303530353030303030305a170d3234303631303233353935395a3081d2311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6ec814ee2c7075e2e29ac7ebd10b6188055929370a213b83fb6e337d82ed0756d15e267f6bc645e6db5bb1d586ef1098ead1595147d03897af04b666aa5a50def2b3af23974896c6fb4f5246baf3ec374dbfd90eeec7575ffb11a6efea7a0d7da0adb04eaf000b1ad520d9e9529b2a8cf420998d4c7a46c1f95e405e35f69ad8c05d62df0f9745017a6284134afba26f905d900da1c412200e6ca5c6b148f3f785aa0ebe35ea9160644bd6924b54625eb404ab39db981f6b216b6dd960930a1443b26aab08cdbcf1c5fd74dbb56c3e9df791f8429401dee5869e90c39f95000fc616b5ac8396b588e24407235ea074328c608112f6cb4f07347cd4d28d28ab90203010001a38201f7308201f3301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e04160414c5b210483c7598f90d32838cd0763d3cd85fef5130350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304a0603551d2004433041303606096086480186fd6c03023029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101008b2182887ada0e08e4afe89019ded16e88ff6ff1b12fd9b2994b945b8c76c63862ae35a1751672c474c8575a039250105e346bb7ce7ae1f2494e760de418b9453f1bbac9255b0dccafd296adb3cdb49d46d54c3413bfc34a3e640e244da7b1e1dbd1b04cea414ff64fe57f0ef28944a42e41065548e4834f2b05d4aae8516a1f154c5b09af25fe059a69a7dc75a7deb4cf3068c402614ece0509edf02b0968b5c8d1081cdafcfba3b7c1599256e6685ef7391f46746eaf829bc8fd40f55be70a3fc51142648b78a903e750158328cb80d54aaddce82df8fe983b0e36af4dafbdbdffe8896bee9a93c370e77f735fe9c42fc2259a3e5672e9f75f37ecf7104e53	certutil.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

VC_redist.x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{8bdfe669-9705-4184-9368-db9ce581e0e7} = "\"C:\\ProgramData\\Package Cache\\{8bdfe669-9705-4184-9368-db9ce581e0e7}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

vc_redist.x64.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	vc_redist.x64.exe

Drops file in System32 directory 64 IoCs

Processes:

msiexec.exeDrvInst.exeNPFInstall.exenpcap-1.78.exe

description	ioc	process
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{91b31f31-9b23-b34e-8778-90363ad8da47}\npcap.sys	DrvInst.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{91b31f31-9b23-b34e-8778-90363ad8da47}\SET59F0.tmp	DrvInst.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{91b31f31-9b23-b34e-8778-90363ad8da47}\SET59EF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_8bd33bba90c49bc9\npcap.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_a009d240f9b4a192\ndiscap.PNF	NPFInstall.exe
File created	C:\Windows\system32\Npcap\Packet.dll	npcap-1.78.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_a2bfd066656fe297\netnwifi.PNF	NPFInstall.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{91b31f31-9b23-b34e-8778-90363ad8da47}\NPCAP.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{91b31f31-9b23-b34e-8778-90363ad8da47}	DrvInst.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{91b31f31-9b23-b34e-8778-90363ad8da47}\npcap.cat	DrvInst.exe
File created	C:\Windows\SysWOW64\Npcap\NpcapHelper.exe	npcap-1.78.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_c5e19aab2305f37f\netvwififlt.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_7f701cb29b5389d3\netrass.PNF	NPFInstall.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\wfpcapture.PNF	NPFInstall.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\Npcap\WlanHelper.exe	npcap-1.78.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\netbrdg.PNF	NPFInstall.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{91b31f31-9b23-b34e-8778-90363ad8da47}\SET59EF.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_8bd33bba90c49bc9\npcap.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_0dc913ad00b14824\netnb.PNF	NPFInstall.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\Npcap\wpcap.dll	npcap-1.78.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Npcap\wpcap.dll	npcap-1.78.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

Wireshark-4.2.5-x64.exe

description	ioc	process
File created	C:\Program Files\Wireshark\radius\dictionary.brocade	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.microsoft	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.iana	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\FLOW-METER-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\[email protected]	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChUseMainWindowSection.html	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChStatistics.html	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\plugins\4.2\codecs\opus_dec.dll	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\plugins\4.2\epan\profinet.dll	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\APPN-DLUR-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\DISMAN-SCRIPT-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\RADIUS-AUTH-CLIENT-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\TRIP-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\[email protected]	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\PrefaceTypographicConventions.html	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-pingpongprotocol-statistics.png	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\translations\qt_pt_BR.qm	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\FEEDBACK-FRAMEWORK-PIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChTelWAPWSPPacketCounter.html	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\RADIUS-DYNAUTH-CLIENT-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-fgp-statistics.png	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\iconv-2.dll	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\translations\qt_hu.qm	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\SNMP-VIEW-BASED-ACM-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\TUBS-IBR-PROC-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-file-import.png	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\DOT3-OAM-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\mmdbresolve.exe	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\toolbar\x-capture-stop.png	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.meraki	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\GSMP-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChIKEv2DecryptionSection.html	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-packet-range.png	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\toolbar\filter-toolbar-bookmark.png	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.aptilo	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.juniper	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\translations\qt_uk.qm	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\TUNNEL-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\important.svg	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\lz4.dll	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.lucent	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\RFC1381-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\TRIP-TC-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\IP-TE-PIB-orig	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-gui-config-profiles.png	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.foundry	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.packeteer	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\translations\wireshark_en.qm	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\FIBRE-CHANNEL-FE-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\AppProtocols.html	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChWorkMarkPacketSection.html	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-tel-rtpstream-analysis_1.png	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.identity_engines	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.rfc6929	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\imageformats\qico.dll	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\translations\qt_ko.qm	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\translations\wireshark_es.qm	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\BFD-TC-STD-MIB	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\snmp\mibs\ETHER-WIS	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-time-shift.png	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ws.css	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.epygi	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.purewave	Wireshark-4.2.5-x64.exe
File created	C:\Program Files\Wireshark\radius\dictionary.rfc4849	Wireshark-4.2.5-x64.exe

Drops file in Windows directory 21 IoCs

Processes:

msiexec.exeNPFInstall.exesvchost.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI702.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E7.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	NPFInstall.exe
File created	C:\Windows\Installer\e57fed2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57fed2.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e57fee4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57fee5.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\MSI182.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI396.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\INF\oem3.PNF	NPFInstall.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D5D19E2F-7189-42FE-8103-92CD1FA457C2}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0025DD72-A959-45B5-A0A3-7EFEB15A8050}	msiexec.exe
File created	C:\Windows\Installer\e57fefa.msi	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e57fee5.msi	msiexec.exe

Executes dropped EXE 8 IoCs

Processes:

vc_redist.x64.exevc_redist.x64.exeVC_redist.x64.exenpcap-1.78.exeNPFInstall.exeNPFInstall.exeNPFInstall.exeNPFInstall.exe

pid	process
4460	vc_redist.x64.exe
4052	vc_redist.x64.exe
4208	VC_redist.x64.exe
2704	npcap-1.78.exe
1344	NPFInstall.exe
1060	NPFInstall.exe
1188	NPFInstall.exe
2160	NPFInstall.exe

Loads dropped DLL 30 IoCs

Processes:

Wireshark-4.2.5-x64.exevc_redist.x64.exeVC_redist.x64.exenpcap-1.78.exe

pid	process
3544	Wireshark-4.2.5-x64.exe
3544	Wireshark-4.2.5-x64.exe
3544	Wireshark-4.2.5-x64.exe
3544	Wireshark-4.2.5-x64.exe
3544	Wireshark-4.2.5-x64.exe
3544	Wireshark-4.2.5-x64.exe
3544	Wireshark-4.2.5-x64.exe
3544	Wireshark-4.2.5-x64.exe
4052	vc_redist.x64.exe
4076	VC_redist.x64.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe
2704	npcap-1.78.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 43 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

DrvInst.exeNPFInstall.exesvchost.exevssvc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000081a0e6b9f9d406b40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000081a0e6b90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090081a0e6b9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d81a0e6b9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000081a0e6b900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	NPFInstall.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe

Modifies data under HKEY_USERS 59 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeWireshark-4.2.5-x64.exeVC_redist.x64.exeVC_redist.x64.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\DefaultIcon\ = "\"C:\\Program Files\\Wireshark\\Wireshark.exe\",1"	Wireshark-4.2.5-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pcapng	Wireshark-4.2.5-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{D5D19E2F-7189-42FE-8103-92CD1FA457C2}v14.36.32532\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.cap	Wireshark-4.2.5-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vwr	Wireshark-4.2.5-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\Version = "237272852"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\DefaultIcon	Wireshark-4.2.5-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ipfix	Wireshark-4.2.5-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ntar	Wireshark-4.2.5-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.apc\ = "wireshark-capture-file"	Wireshark-4.2.5-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27DD5200959A5B540A3AE7EF1BA50805\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\Dependents\{8bdfe669-9705-4184-9368-db9ce581e0e7}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.5vw\ = "wireshark-capture-file"	Wireshark-4.2.5-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\ = "{8bdfe669-9705-4184-9368-db9ce581e0e7}"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.atc\ = "wireshark-capture-file"	Wireshark-4.2.5-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.trace	Wireshark-4.2.5-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rtp\ = "wireshark-capture-file"	Wireshark-4.2.5-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rf5	Wireshark-4.2.5-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tr1\ = "wireshark-capture-file"	Wireshark-4.2.5-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\Dependents	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{8bdfe669-9705-4184-9368-db9ce581e0e7}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.out	Wireshark-4.2.5-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tpc\ = "wireshark-capture-file"	Wireshark-4.2.5-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27DD5200959A5B540A3AE7EF1BA50805\VC_Runtime_Additional	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bfr\ = "wireshark-capture-file"	Wireshark-4.2.5-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\Version = "237272852"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file	Wireshark-4.2.5-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.enc\ = "wireshark-capture-file"	Wireshark-4.2.5-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lcap\ = "wireshark-capture-file"	Wireshark-4.2.5-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pkt\ = "wireshark-capture-file"	Wireshark-4.2.5-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.36.32532"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\PackageCode = "73C8C8E4844B0BB4A8B86F043B32F917"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rf5\ = "wireshark-capture-file"	Wireshark-4.2.5-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

msiexec.exeNPFInstall.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
3456	msiexec.exe
3456	msiexec.exe
3456	msiexec.exe
3456	msiexec.exe
3456	msiexec.exe
3456	msiexec.exe
3456	msiexec.exe
3456	msiexec.exe
1344	NPFInstall.exe
1344	NPFInstall.exe
3348	powershell.exe
3348	powershell.exe
4168	powershell.exe
4168	powershell.exe
2964	powershell.exe
2964	powershell.exe
2012	powershell.exe
2012	powershell.exe
2404	powershell.exe
2404	powershell.exe
1516	powershell.exe
1516	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

652
652

pid	process
652
652

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeVC_redist.x64.exemsiexec.exe

description	pid	process
Token: SeBackupPrivilege	2384	vssvc.exe
Token: SeRestorePrivilege	2384	vssvc.exe
Token: SeAuditPrivilege	2384	vssvc.exe
Token: SeShutdownPrivilege	4208	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	4208	VC_redist.x64.exe
Token: SeSecurityPrivilege	3456	msiexec.exe
Token: SeCreateTokenPrivilege	4208	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	4208	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	4208	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	4208	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	4208	VC_redist.x64.exe
Token: SeTcbPrivilege	4208	VC_redist.x64.exe
Token: SeSecurityPrivilege	4208	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	4208	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	4208	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	4208	VC_redist.x64.exe
Token: SeSystemtimePrivilege	4208	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	4208	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	4208	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	4208	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	4208	VC_redist.x64.exe
Token: SeBackupPrivilege	4208	VC_redist.x64.exe
Token: SeRestorePrivilege	4208	VC_redist.x64.exe
Token: SeShutdownPrivilege	4208	VC_redist.x64.exe
Token: SeDebugPrivilege	4208	VC_redist.x64.exe
Token: SeAuditPrivilege	4208	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	4208	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	4208	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	4208	VC_redist.x64.exe
Token: SeUndockPrivilege	4208	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	4208	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	4208	VC_redist.x64.exe
Token: SeManageVolumePrivilege	4208	VC_redist.x64.exe
Token: SeImpersonatePrivilege	4208	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	4208	VC_redist.x64.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe
Token: SeTakeOwnershipPrivilege	3456	msiexec.exe
Token: SeRestorePrivilege	3456	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Wireshark-4.2.5-x64.exevc_redist.x64.exevc_redist.x64.exeVC_redist.x64.exeVC_redist.x64.exeVC_redist.x64.exenpcap-1.78.exepowershell.exepowershell.exeNPFInstall.exe

description	pid	process	target process
PID 3544 wrote to memory of 4460	3544	Wireshark-4.2.5-x64.exe	vc_redist.x64.exe
PID 3544 wrote to memory of 4460	3544	Wireshark-4.2.5-x64.exe	vc_redist.x64.exe
PID 3544 wrote to memory of 4460	3544	Wireshark-4.2.5-x64.exe	vc_redist.x64.exe
PID 4460 wrote to memory of 4052	4460	vc_redist.x64.exe	vc_redist.x64.exe
PID 4460 wrote to memory of 4052	4460	vc_redist.x64.exe	vc_redist.x64.exe
PID 4460 wrote to memory of 4052	4460	vc_redist.x64.exe	vc_redist.x64.exe
PID 4052 wrote to memory of 4208	4052	vc_redist.x64.exe	VC_redist.x64.exe
PID 4052 wrote to memory of 4208	4052	vc_redist.x64.exe	VC_redist.x64.exe
PID 4052 wrote to memory of 4208	4052	vc_redist.x64.exe	VC_redist.x64.exe
PID 4208 wrote to memory of 3964	4208	VC_redist.x64.exe	VC_redist.x64.exe
PID 4208 wrote to memory of 3964	4208	VC_redist.x64.exe	VC_redist.x64.exe
PID 4208 wrote to memory of 3964	4208	VC_redist.x64.exe	VC_redist.x64.exe
PID 3964 wrote to memory of 4076	3964	VC_redist.x64.exe	VC_redist.x64.exe
PID 3964 wrote to memory of 4076	3964	VC_redist.x64.exe	VC_redist.x64.exe
PID 3964 wrote to memory of 4076	3964	VC_redist.x64.exe	VC_redist.x64.exe
PID 4076 wrote to memory of 5060	4076	VC_redist.x64.exe	VC_redist.x64.exe
PID 4076 wrote to memory of 5060	4076	VC_redist.x64.exe	VC_redist.x64.exe
PID 4076 wrote to memory of 5060	4076	VC_redist.x64.exe	VC_redist.x64.exe
PID 3544 wrote to memory of 2704	3544	Wireshark-4.2.5-x64.exe	npcap-1.78.exe
PID 3544 wrote to memory of 2704	3544	Wireshark-4.2.5-x64.exe	npcap-1.78.exe
PID 3544 wrote to memory of 2704	3544	Wireshark-4.2.5-x64.exe	npcap-1.78.exe
PID 2704 wrote to memory of 1344	2704	npcap-1.78.exe	NPFInstall.exe
PID 2704 wrote to memory of 1344	2704	npcap-1.78.exe	NPFInstall.exe
PID 2704 wrote to memory of 3348	2704	npcap-1.78.exe	powershell.exe
PID 2704 wrote to memory of 3348	2704	npcap-1.78.exe	powershell.exe
PID 2704 wrote to memory of 3348	2704	npcap-1.78.exe	powershell.exe
PID 2704 wrote to memory of 4168	2704	npcap-1.78.exe	powershell.exe
PID 2704 wrote to memory of 4168	2704	npcap-1.78.exe	powershell.exe
PID 2704 wrote to memory of 4168	2704	npcap-1.78.exe	powershell.exe
PID 4168 wrote to memory of 4148	4168	powershell.exe	certutil.exe
PID 4168 wrote to memory of 4148	4168	powershell.exe	certutil.exe
PID 4168 wrote to memory of 4148	4168	powershell.exe	certutil.exe
PID 2704 wrote to memory of 2656	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 2656	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 2656	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 1408	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 1408	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 1408	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 2964	2704	npcap-1.78.exe	powershell.exe
PID 2704 wrote to memory of 2964	2704	npcap-1.78.exe	powershell.exe
PID 2704 wrote to memory of 2964	2704	npcap-1.78.exe	powershell.exe
PID 2704 wrote to memory of 2012	2704	npcap-1.78.exe	powershell.exe
PID 2704 wrote to memory of 2012	2704	npcap-1.78.exe	powershell.exe
PID 2704 wrote to memory of 2012	2704	npcap-1.78.exe	powershell.exe
PID 2012 wrote to memory of 4856	2012	powershell.exe	certutil.exe
PID 2012 wrote to memory of 4856	2012	powershell.exe	certutil.exe
PID 2012 wrote to memory of 4856	2012	powershell.exe	certutil.exe
PID 2704 wrote to memory of 5112	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 5112	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 5112	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 1156	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 1156	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 1156	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 2024	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 2024	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 2024	2704	npcap-1.78.exe	certutil.exe
PID 2704 wrote to memory of 1060	2704	npcap-1.78.exe	NPFInstall.exe
PID 2704 wrote to memory of 1060	2704	npcap-1.78.exe	NPFInstall.exe
PID 1060 wrote to memory of 3468	1060	NPFInstall.exe	pnputil.exe
PID 1060 wrote to memory of 3468	1060	NPFInstall.exe	pnputil.exe
PID 2704 wrote to memory of 1188	2704	npcap-1.78.exe	NPFInstall.exe
PID 2704 wrote to memory of 1188	2704	npcap-1.78.exe	NPFInstall.exe
PID 2704 wrote to memory of 2160	2704	npcap-1.78.exe	NPFInstall.exe
PID 2704 wrote to memory of 2160	2704	npcap-1.78.exe	NPFInstall.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Wireshark-4.2.5-x64.exe
"C:\Users\Admin\AppData\Local\Temp\Wireshark-4.2.5-x64.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3544

C:\Program Files\Wireshark\vc_redist.x64.exe
"C:\Program Files\Wireshark\vc_redist.x64.exe" /install /quiet /norestart
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460

C:\Windows\Temp\{AAD4BC8E-253A-429B-84E5-C47C0A60E789}\.cr\vc_redist.x64.exe
"C:\Windows\Temp\{AAD4BC8E-253A-429B-84E5-C47C0A60E789}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Wireshark\vc_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=536 /install /quiet /norestart
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\Temp\{FD74F357-7215-44E4-AC78-62585F0630AD}\.be\VC_redist.x64.exe
"C:\Windows\Temp\{FD74F357-7215-44E4-AC78-62585F0630AD}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{36FDA101-D2E5-47F1-975B-BC3DF6B7BFF2} {CC9ED71C-19FE-41A6-B5BB-3B1AF97F8741} 4052
4⤵
- Adds Run key to start application
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1044 -burn.embedded BurnPipe.{CF0A5DA5-7520-40D4-9BFC-FFD561FE98E6} {576D9541-86C3-473F-BBDE-2AF6E64E6D37} 4208
5⤵
- Suspicious use of WriteProcessMemory
PID:3964

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1044 -burn.embedded BurnPipe.{CF0A5DA5-7520-40D4-9BFC-FFD561FE98E6} {576D9541-86C3-473F-BBDE-2AF6E64E6D37} 4208
6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4076

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BC7AA13E-FB14-4AA9-873E-A81DF1A01BE2} {6D625A30-9D4A-463C-B6B8-5AE90419A064} 4076
7⤵
- Modifies registry class
PID:5060

C:\Program Files\Wireshark\npcap-1.78.exe
"C:\Program Files\Wireshark\npcap-1.78.exe" /winpcap_mode=no /loopback_support=no
2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704

C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\NPFInstall.exe
"C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\NPFInstall.exe" -n -check_dll
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1344

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq '0563b8630d62d75abbc8ab1e4bdfb5a899b24d43'} | Sort-Object -Descending -Property FriendlyName | Select-Object -Skip 1 | Remove-Item"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3348

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "If (Get-ChildItem Cert:\LocalMachine\Root\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43){certutil.exe -verifystore 'Root' '0563b8630d62d75abbc8ab1e4bdfb5a899b24d43';If($LASTEXITCODE -ne 0){Remove-Item Cert:\LocalMachine\Root\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43}}"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4168

C:\Windows\SysWOW64\certutil.exe
"C:\Windows\system32\certutil.exe" -verifystore Root 0563b8630d62d75abbc8ab1e4bdfb5a899b24d43
4⤵
- Manipulates Digital Signatures
PID:4148

C:\Windows\SysWOW64\certutil.exe
certutil.exe -verifystore "Root" "0563b8630d62d75abbc8ab1e4bdfb5a899b24d43"
3⤵
PID:2656

C:\Windows\SysWOW64\certutil.exe
certutil.exe -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43.sst"
3⤵
PID:1408

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq '5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25'} | Sort-Object -Descending -Property FriendlyName | Select-Object -Skip 1 | Remove-Item"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2964

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "If (Get-ChildItem Cert:\LocalMachine\Root\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25){certutil.exe -verifystore 'Root' '5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25';If($LASTEXITCODE -ne 0){Remove-Item Cert:\LocalMachine\Root\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25}}"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\certutil.exe
"C:\Windows\system32\certutil.exe" -verifystore Root 5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25
4⤵
PID:4856

C:\Windows\SysWOW64\certutil.exe
certutil.exe -verifystore "Root" "5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25"
3⤵
PID:5112

C:\Windows\SysWOW64\certutil.exe
certutil.exe -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25.sst"
3⤵
PID:1156

C:\Windows\SysWOW64\certutil.exe
certutil.exe -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\signing.p7b"
3⤵
- Manipulates Digital Signatures
PID:2024

C:\Program Files\Npcap\NPFInstall.exe
"C:\Program Files\Npcap\NPFInstall.exe" -n -c
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SYSTEM32\pnputil.exe
pnputil.exe -e
4⤵
PID:3468

C:\Program Files\Npcap\NPFInstall.exe
"C:\Program Files\Npcap\NPFInstall.exe" -n -iw
3⤵
- Executes dropped EXE
PID:1188

C:\Program Files\Npcap\NPFInstall.exe
"C:\Program Files\Npcap\NPFInstall.exe" -n -i
3⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2160

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Microsoft.PowerShell.Management\Start-Service -Name npcap -PassThru | Microsoft.PowerShell.Management\Stop-Service -PassThru | Microsoft.PowerShell.Management\Start-Service"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2404

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "ScheduledTasks\Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (ScheduledTasks\New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (ScheduledTasks\New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (ScheduledTasks\New-ScheduledTaskTrigger -AtStartup) -Settings (ScheduledTasks\New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1516

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3276

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:1744

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{306f4678-17e7-0047-baff-66a45ae0380a}\NPCAP.inf" "9" "405306be3" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files\Npcap"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57fed7.rbs

Filesize
19KB

MD5
bd30feca602e8f48db26e9ce7c392d87

SHA1
40766b708b744ddf67bcc15ac8f891688bb7d1ab

SHA256
505959f215e0b5c2dd2b815273f0c13ea0787c5964a16e48dc381fb470823950

SHA512
8426ca1f20290ce25fd79ed153d66cabea3f83f01b557066367b4c995afab872981b9a5256e1ac0466138ebde81fa6aa521bd486f29f2925a28fdf51d138e704

Download Submit
C:\Config.Msi\e57fee3.rbs

Filesize
19KB

MD5
cc3524f0d3b7dc474802b47af806816a

SHA1
b3d025a11763b2f8dd022832ac817bfa34105633

SHA256
31fcf7d3fb69e5e924898a587d870b0caf4b351f6e0004e960eba3a2997656d1

SHA512
d042a4e2f4eef94769d4cf8f6b22f0e9ca489c78914340114e2c596bb1d3643170159f1821b8b7d8df82798aef54a031abd063a1a4e30b1fc2a0ac49dfffa438

Download Submit
C:\Config.Msi\e57feea.rbs

Filesize
21KB

MD5
34a1847006b7a58ab18af0aad3743e06

SHA1
a05ad3b6f62a9daf068203196ab50741e7188841

SHA256
6eec62e1db539e4fab43b5f6a87cfeedea94ff70f2d87fcc464bfa70ef17c751

SHA512
cfba17db4352f967d21fa81bfd2b2527aeb5fe6b4b39052c4bc2b08d42638db2e6f198e51a560ba13912f62b30240ad8f2ee687d87705eec5f67a0f199114822

Download Submit
C:\Config.Msi\e57fef9.rbs

Filesize
21KB

MD5
fb84e5901b033e91919392107859425d

SHA1
4bfa1629f47656e57f06228a83e5bad0c9a2ec74

SHA256
89fc3b50121ed9bd739efd89ef49aa907eabda5bbc1d722c0d10d3627628f15f

SHA512
9a907cffbad0204ae3c0154d5a27689d860dbe672824c3461b7ca44cde316b231b635c75066266e9d34ff72fde4a7c65186414a0fb6e626dc4730043898095a7

Download Submit
C:\PROGRA~1\Npcap\npcap.cat

Filesize
12KB

MD5
de72efb03052c07948619b29a991097f

SHA1
734b1c18a3f1d6367b274aca6aaa1c7af05c570f

SHA256
168e04bc04da8cc8fcd8e796682346efd5dc3a1fe7aeb6292b88b004405a25de

SHA512
11b16cd1e93b65a64c3ab03f15fdf789ee9b89cd2e04688238ad1584e8cdda49749b5ae772a54836cda05bba45097ca3863ece75a8ab3cb6a662541360040c24

Download Submit
C:\PROGRA~1\Npcap\npcap.sys

Filesize
75KB

MD5
56fc763587dae7a34a6c39ebfa44a58f

SHA1
ca5a73a1d59526e73809e13f2dc95a7738c36ad0

SHA256
98abb948f100c7d47c80141a058c869eeca59c357e42c1fedd4cd44140617ca6

SHA512
7bcd793d8b05b0c60c49a4cea34b7b885a0340f9ebee16f96051238306974bbdeed36d08bf83d88d64ae4fc7f37e8f7f7dbcae335bc5722269f8ea26954d7cfd

Download Submit
C:\Program Files\Npcap\NPCAP.inf

Filesize
8KB

MD5
16db6977ce750fa6cd3f9f7be93cc087

SHA1
b899075de2c186ec0fed298af470791025ab8fbc

SHA256
41c067a985f2770b9f1f38f0558d3661b333154e09022831de8a5acaf56c5b87

SHA512
b0941daba49451644293530a0a567d5621cab8b8e6a3a981da2a3079df21242529d3118fa9d2b956405e15319a0d690a4f37e9a6b8242ebe2b009a2d88ca63e6

Download Submit
C:\Program Files\Npcap\NPCAP_wfp.inf

Filesize
2KB

MD5
fada95e3375fbaeacc4fae09baf04e41

SHA1
a4f5ace85dd029ea44f483113700df07f6c6210b

SHA256
806624343df7d618c7652d34bc49254163b164f3cb06240b47d64ecff19ea6d7

SHA512
acf6b02f20f3a4b4ade6a6ec045a7b0215d7fb74512c7c1dd5001dd42e6e89081368b320b4ca92a9470073d17f32e0b06ea5da0612b01f2e0a7dc366fe8307d7

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
245B

MD5
ffc89ed5ae6880417c4e9db0d47ac3dc

SHA1
b52378fb5f2849c886e4cdb37fac9796a650d0d9

SHA256
2b6e6df9853c7ccebd41bc272f1e46cd8578d2ba8ed0b74542058d9c5d67210a

SHA512
9dd01e14a952ad108e59a87578792673ebeb2fe80e3cbc43c35e6ef42add939276abef55dc151009bee29fd7f3ed6cca39a0c02561d01d4c12137315e4242163

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
1KB

MD5
64152fdc9fb9a15c0bf8987bd86f1276

SHA1
04772e4941de8ed6ca4101f6e0d064a094848be1

SHA256
c0fc06fc4503d0a97c748293f37e476398b859dc94f26801fd809f338607d122

SHA512
246c3c270b20b768fff865fcf850c2019eeafa6bd7f3af4d0a64b1fc561083f8a27c225a9bed3e172e62f63da02a95a6a2cc5d0c41c57fdd66786b147c680e7d

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
1KB

MD5
9e2addc0265559acf2762c947346754e

SHA1
d544db5b8752a1777232243c88e5390e28264ee1

SHA256
3a1075ccab192934055654d0155684f0536984e084a1e785681f6100a677c9d7

SHA512
40e74713a12f3b76bbf5aea0a2fb34be72aa070c4b4286581e36cfef305b1ace9927f103b829a41f1d9232b7fa9dd78a8c8776f6397cabed237d9a721eb7acf9

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
2KB

MD5
903eae4a4e5dff66c9a3b603b0d217cc

SHA1
7152b1c9d66363bb1a463efc2e6fc941ab365272

SHA256
14e3cc25c8e68d24cde3b6161fa805f9dab35c5a8f8f2e5d48a3a5fc240087b7

SHA512
85f05bed33f4ac2a1830f2fb423758caf79728905a5cd407b57c725b26fb31a369c4a21c783179ab60b90cf52e20fb9f161439136c6bb98d7a58a6a5043cbf4b

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
3KB

MD5
7ca710a2157d51f8a5da3ef7142f1488

SHA1
8e2335c611a0386e33e88b2c290dfcb34946f22a

SHA256
a572f82476a43a20eeabc1747cb07fc796aaf8c26806c484f6770f2b000908a6

SHA512
dea7391b299bf04a31cbda6ff1c7be5134167ab69f6249a7d7f27cf7fdb860c9838fea81538788f979e26de49f55b09179d48761b137e4fc22fd73157e8835e6

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
3KB

MD5
2dca53df7f46ddcf3092d7ec194476c4

SHA1
49527b4516d3a4ff5388663272c917c0e1f5ac07

SHA256
365196fef4e87304d3c80807a6291053b47109b80613f8f6ed943f80adfe9a39

SHA512
6a93be52b766cb59769ba9d1cb54b7cd766e4a52d6c3f3f138dfe7d8754602bb80315fe2c620353bc26a3145f31ca3e7f4b4da146ad1fc8e21d032c608979a92

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
4KB

MD5
c4507aa9f3e50c3ba0a3be1e53487af6

SHA1
7d40d14ffd60c6970fa8dd4316e00beeeb9d87b7

SHA256
31d8f8ebc0ef4ee7532359d5b0eaf8e06de90547b14acfeadd871a96220d76b5

SHA512
cbd61d8fe3011c7c9b1205954b895be44aa16344166b49f339fa5ebcd19ae85043ba49a2caab57ec0db0e588c2937ac94de3867e9b6726fa5945afa2834d3a27

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
4KB

MD5
c57622d6c3005c80310860e3614307d2

SHA1
b766cae73600c703f66216a725afd229c87146fb

SHA256
9c1ca6fc2d26498d25bbd5515f7cc2f83412d85e148a77507b25aa28f18d8f01

SHA512
57634016a006f2add8813d938426598fb53f5f4a3c5435aa8227637c8f3faa17f682df3dfae7863c943a3b38d72ef62b15f43b468b5bafadbac48e782ae48706

Download Submit
C:\Program Files\Wireshark\npcap-1.78.exe

Filesize
1.1MB

MD5
1b7dfff4e1f16785d5e800c193301bd7

SHA1
e1ee172ee36999daa3cfb2a0406fd8950038cefe

SHA256
deeb39ae22a44ea2698c4a58732e621bc45b84686a444c405491fef946898d90

SHA512
71f8affed3e51b00c85039f211218c5eee66b724bd674bdd4b1c609cff3c440a4ab6ee0c6fa7bc8de39dac5a65f7c7c04a8dcae3baf52c091c512f293ec86920

Download Submit
C:\Program Files\Wireshark\vc_redist.x64.exe

Filesize
24.2MB

MD5
077f0abdc2a3881d5c6c774af821f787

SHA1
c483f66c48ba83e99c764d957729789317b09c6b

SHA256
917c37d816488545b70affd77d6e486e4dd27e2ece63f6bbaaf486b178b2b888

SHA512
70a888d5891efd2a48d33c22f35e9178bd113032162dc5a170e7c56f2d592e3c59a08904b9f1b54450c80f8863bda746e431b396e4c1624b91ff15dd701bd939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f330b8d0fa9694645097a75d1564f8b

SHA1
e8f43d3d9d692908ee755d9c35039e466bcf6840

SHA256
1c9a4691e4098de49cc1547e62fb12ded37a153417e58f6cd5cee6bb72549e51

SHA512
eca9fa26a56ce06b3b1a03e3a43ab44c09f963a459f44af6136941956c8de40f25a49b0322c2e268a382ddffdbc62cbaf4b12a401308878b1c575aa78e7019df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
c57c4a641bfa59382314af6749a60832

SHA1
03b646b6c317d3a004d1a5f7b7be9910c6d369e9

SHA256
3ace24424f3e098cdb5f3ba980e0f5df57a83a5e2b64685a1afc446c1a883332

SHA512
03ccd3168d86dfb3a799ef8a230249da8e823001dbef5ef659a1ffed6b2fb0f32fe3d7ab67c520fa8b7ff8bc1445bfb33ba6fd22f8b291e1fa3b9e6e4210e3a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
301cc1b4b55826175e75ab572d76f648

SHA1
8664980ab77a5c13efbac77b8496951b5f62dea1

SHA256
da16c0f437e4da16f89f3a64722a561a80481c9c8c845c6e671cca0aea6d03e7

SHA512
dadcaed54a9da24955ce9886677ce24f800b3ec46aa810c771bda9641d620b909700eb76c1bdd3c832084c32545d3eee88ba6a902a96264c6b472d2136b26a79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
ac8e42e149e13b522ba2aa995ca6dfbc

SHA1
14231e5cccbcdf8ff582c96c39467fb919970e3b

SHA256
9dff195a4fed7c8ea5748026e26c1bf149d9be0234f10b46be97ae41315da066

SHA512
60b97a72c8d649474403a29ff1e571fe52e8de3314c3649a14accbec76c8b5845f72514964c1341d12116716b2dc7f61899067f36f95cbf8f9a670b2dd8a5174

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uq4ywy3w.qef.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240521155427_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
85dfae296e66b0ef25b1dcfcf37455e4

SHA1
9e544a2375d9b02b93ef8a1cd6487c1431330746

SHA256
d221ce2304346ad9bcf31797c8da8b3201620dc6bdd4bc3f27e05e625d31a7e2

SHA512
da4cd0a3f5443fc22cd808eb49fbd9b63e265ca7e4489782207f5714645251b66475b5b74abe6a3b98a19c39799e8ca92e194167531511c7547d2151fdd8dce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240521155427_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
34f34a27ace196bcf3466314328f28a6

SHA1
52118450a4393e7b6159fe9cad91489dd060f498

SHA256
908c0f0719bc161a3cce9071a844bcafe5b2fdf67e58ca1aaf86634e861aab62

SHA512
14abeeaa968b991a4ed94a10021baca97099ddd4ed203395313083d569c093011ff12520736b2ee2b3f974e1fb9b07cdc0c1b57f72bde16ffba26ae762d4c2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso449C.tmp\DonatePage.ini

Filesize
904B

MD5
a7503cc175535989650d0749c18c8881

SHA1
1f4d8aed9a2677e9a2f0467c022fc98b732ce81a

SHA256
e0f775ff3740334da3924a6537b87d8fc1211942e42d4565f9edd26cf50e7b3f

SHA512
3495eee44dd3756b180e50a6f59e3b5fb41707bd243e9f2631e8f23e8f2cc1f668e449a0f905d8876e997c341adbc234ca4a0b7a6f9857d77ee7fd2f689face5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso449C.tmp\InstallOptions.dll

Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso449C.tmp\NpcapPage.ini

Filesize
2KB

MD5
d2e6fc75aa733910c61d1b31b293bbdf

SHA1
06418041025d17e0fb029da4270b196f67dbd5ba

SHA256
93fb56f4573e9da404b49f2b7b4fdc9fc43cfbf882e15573ed6a21972e21dda0

SHA512
5117ca746e9e422caebb341192732758d2af31af7f6bbfc838ce380634c7e409d0dcf0b1ef906c1ededb282979e8cd43781317996146ff87577e890e624b74e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso449C.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso449C.tmp\USBPcapPage.ini

Filesize
2KB

MD5
49902cb75fabac5a17a628a3331f653f

SHA1
56c1039b97fc1e73c8993079084c6517630e6a82

SHA256
b50711a5582f2ab6b093e26d88de43665929d57db5ffc4535ebb6e29ff8405c2

SHA512
f7788ae0bd5990dd58a34b6dc1759488a69f41912345b4172cc399c0598ab69b6ba4c14ac98bdbafb79059bf40d5f5e40801ea135e9c005c6b3dbb9ee0619691

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso449C.tmp\USBPcapPage.ini

Filesize
2KB

MD5
e99e395d6bfc37663626c4a01c732692

SHA1
75813eb6682b97de44dafdd6f98afae7e4d3868b

SHA256
b4c5e164a7dc968941eab553a3c0f53f3aae8209b8eef74d4be9838b78b51503

SHA512
e13cf96693c5d3971fdb5b14ee25e629b7016b045719f59d451789651127323b0a260f6c085f0b746b64d04a06a4d408aafc20eb71635d6064d8584af20973f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso449C.tmp\USBPcapPage.ini

Filesize
2KB

MD5
b01d75b3bde03722f0413fde17468db3

SHA1
81c4c52882fb429546cebc92d7701d3a5489b7f5

SHA256
b01124d84c451fea1140319291ffb04a24fc5b19cbd151f619161c7c69a8f2be

SHA512
11ab34d8f35ca1024fdd2797613953bca974f93561a62a76ff5e6c89ea93af19a88a5c50f020a32401644a3765ba19ae64b4024cda464c73d231063044d92dde

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso449C.tmp\nsDialogs.dll

Filesize
9KB

MD5
1d8f01a83ddd259bc339902c1d33c8f1

SHA1
9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

SHA256
4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

SHA512
28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43.sst

Filesize
1KB

MD5
de825a838e33ccf3d06b82de337c06d8

SHA1
68956e777f646361eae3f06ce6899cd48bb9f593

SHA256
3b63b09dff7e4c5fe7ccafff74d9f845d1eb04809b0b77a536b2e4aa7dd1097e

SHA512
e935ef759abfcafa4d9cf70a1c5508179600fc85d237e53d3e7f2683fa2e14859e5eee167007328995606996a19f4fcc0c1f9a851011a6fa8db6b53c68160a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25.sst

Filesize
1KB

MD5
a52f3195b5585e1d9a9b38fef66a1801

SHA1
986a5f05ff51d261fe595f0ab56598658aadc9c9

SHA256
40795f603b2eab75fbd886715b0103f2f362494576400ae88925ed1ba7063bdc

SHA512
e9eeb34c3667e56c425b91890f463b5d80e4e5e9f485c2bd3ac064e1784ad118c1460af461e5af8acbbb3bc02432e4f914e54e41d2bdaeaa8af528f0e669b64a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\InstallOptions.dll

Filesize
22KB

MD5
170c17ac80215d0a377b42557252ae10

SHA1
4cbab6cc189d02170dd3ba7c25aa492031679411

SHA256
61ea114d9d0cd1e884535095aa3527a6c28df55a4ecee733c8c398f50b84cc3d

SHA512
0fd65cad0fcaa98083c2021de3d6429e79978658809c62ae9e4ed630c016915ced36aa52f2f692986c3b600c92325e79fd6d757634e8e02d5e582ff03679163f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\NPFInstall.exe

Filesize
300KB

MD5
81d0878756464d5d29ac24e1137351c2

SHA1
9294500e980918b0c672038cc6f928c4304d3eb2

SHA256
71af514081d5aee6946ee7a72546696c79e3d120a821351d8fe107fae70bdb0e

SHA512
7b06c22e16d9b91520e5806d77424ade7d53323791ca7fd373c9957759058f1507dee6deb3bcfbd65f1ea707b5d3ce229991e56a30269ff055ad317aba200237

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\System.dll

Filesize
19KB

MD5
f020a8d9ede1fb2af3651ad6e0ac9cb1

SHA1
341f9345d669432b2a51d107cbd101e8b82e37b1

SHA256
7efe73a8d32ed1b01727ad4579e9eec49c9309f2cb7bf03c8afa80d70242d1c0

SHA512
408fa5a797d3ff4b917bb4107771687004ba507a33cb5944b1cc3155e0372cb3e04a147f73852b9134f138ff709af3b0fb493cd8fa816c59e9f3d9b5649c68c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\final.ini

Filesize
568B

MD5
cae757421db8d011e41266bfd9439885

SHA1
7108a9f0740ee4e3a118f6ac9212e0446f074181

SHA256
ff350a68202aadb145f590c8579f9284d2e3c324b0369fde39e5a3a31d7b8204

SHA512
785d19c796834065c823a7da99036378bba54b932ea1e47d4ba0c1d123a0a09ec307a3459fb862221de74ce61d9a8d7ec73901c9de007d31e7b39eb7a19b16b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\nsExec.dll

Filesize
14KB

MD5
f9e61a25016dcb49867477c1e71a704e

SHA1
c01dc1fa7475e4812d158d6c00533410c597b5d9

SHA256
274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

SHA512
b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\options.ini

Filesize
2KB

MD5
4c03a565eafdd997f6d501d81e3ad3c9

SHA1
1a8e728e164148dc08c4b24242721e6ecf515812

SHA256
0f5a91ef783df6ea57ff35297d7a05f5cc6b38b04ff6f307eabb08be6484b43f

SHA512
fd1c34b3f5ffe51fd91ee82ad68b131918724e6b0b4b19947c17ad169bf3cd1bcd37d6fea36afac817929a9f74c13a65b5e1736de83af65dfdcd895f002e229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\options.ini

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp11DF.tmp\signing.p7b

Filesize
7KB

MD5
dd4bc901ef817319791337fb345932e8

SHA1
f8a3454a09d90a09273935020c1418fdb7b7eb7c

SHA256
8e681692403c0f7c0b24160f4642daa1eb080ce5ec754b6f47cc56b43e731b71

SHA512
0a67cc346f9752e1c868b7dc60b25704255ab1e6ea745850c069212f2724eba62ffaaa48309d5eba6ae0235223518610fb4b60fc422e4babba4f33d331c71db5

Download Submit
C:\Windows\Temp\{AAD4BC8E-253A-429B-84E5-C47C0A60E789}\.cr\vc_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{FD74F357-7215-44E4-AC78-62585F0630AD}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{FD74F357-7215-44E4-AC78-62585F0630AD}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{FD74F357-7215-44E4-AC78-62585F0630AD}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
46efc5476e6d948067b9ba2e822fd300

SHA1
d17c2bf232f308e53544b2a773e646d4b35e3171

SHA256
2de285c0fc328d30501cad8aa66a0ca9556ad5e30d03b198ebdbc422347db138

SHA512
58c9b43b0f93da00166f53fda324fcf78fb1696411e3c453b66e72143e774f68d377a0368b586fb3f3133db7775eb9ab7e109f89bb3c5e21ddd0b13eaa7bd64c

Download Submit
C:\Windows\Temp\{FD74F357-7215-44E4-AC78-62585F0630AD}\cab5046A8AB272BF37297BB7928664C9503

Filesize
935KB

MD5
c2df6cb9082ac285f6acfe56e3a4430a

SHA1
591e03bf436d448296798a4d80f6a39a00502595

SHA256
b8b4732a600b741e824ab749321e029a07390aa730ec59401964b38105d5fa11

SHA512
9f21b621fc871dd72de0c518174d1cbe41c8c93527269c3765b65edee870a8945ecc2700d49f5da8f6fab0aa3e4c2db422b505ffcbcb2c5a1ddf4b9cec0e8e13

Download Submit
C:\Windows\Temp\{FD74F357-7215-44E4-AC78-62585F0630AD}\vcRuntimeAdditional_x64

Filesize
188KB

MD5
dd070483eda0af71a2e52b65867d7f5d

SHA1
2b182fc81d19ae8808e5b37d8e19c4dafeec8106

SHA256
1c450cacdbf38527c27eb2107a674cd9da30aaf93a36be3c5729293f6f586e07

SHA512
69e16ee172d923173e874b12037629201017698997e8ae7a6696aab1ad3222ae2359f90dea73a7487ca9ff6b7c01dc6c4c98b0153b6f1ada8b59d2cec029ec1a

Download Submit
C:\Windows\Temp\{FD74F357-7215-44E4-AC78-62585F0630AD}\vcRuntimeMinimum_x64

Filesize
188KB

MD5
a4075b745d8e506c48581c4a99ec78aa

SHA1
389e8b1dbeebdff749834b63ae06644c30feac84

SHA256
ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93

SHA512
0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada

Download Submit
memory/1516-1577-0x0000000006D60000-0x0000000006D92000-memory.dmp

Filesize
200KB

Download
memory/2964-1320-0x00000000063D0000-0x0000000006724000-memory.dmp

Filesize
3.3MB

Download
memory/3348-1285-0x00000000063E0000-0x0000000006402000-memory.dmp

Filesize
136KB

Download
memory/3348-1266-0x0000000002880000-0x00000000028B6000-memory.dmp

Filesize
216KB

Download
memory/3348-1288-0x0000000007280000-0x00000000072BE000-memory.dmp

Filesize
248KB

Download
memory/3348-1284-0x0000000006330000-0x000000000634A000-memory.dmp

Filesize
104KB

Download
memory/3348-1283-0x0000000006EA0000-0x0000000006F36000-memory.dmp

Filesize
600KB

Download
memory/3348-1282-0x0000000005E90000-0x0000000005EDC000-memory.dmp

Filesize
304KB

Download
memory/3348-1267-0x0000000004F90000-0x00000000055B8000-memory.dmp

Filesize
6.2MB

Download
memory/3348-1268-0x00000000055C0000-0x00000000055E2000-memory.dmp

Filesize
136KB

Download
memory/3348-1270-0x00000000057D0000-0x0000000005836000-memory.dmp

Filesize
408KB

Download
memory/3348-1286-0x00000000074F0000-0x0000000007A94000-memory.dmp

Filesize
5.6MB

Download
memory/3348-1281-0x0000000005E60000-0x0000000005E7E000-memory.dmp

Filesize
120KB

Download
memory/3348-1280-0x0000000005840000-0x0000000005B94000-memory.dmp

Filesize
3.3MB

Download
memory/3348-1287-0x0000000008120000-0x000000000879A000-memory.dmp

Filesize
6.5MB

Download
memory/3348-1269-0x0000000005760000-0x00000000057C6000-memory.dmp

Filesize
408KB

Download
memory/3964-727-0x00000000001C0000-0x0000000000237000-memory.dmp

Filesize
476KB

Download
memory/4076-726-0x00000000001C0000-0x0000000000237000-memory.dmp

Filesize
476KB

Download
memory/4168-1304-0x0000000005630000-0x0000000005984000-memory.dmp

Filesize
3.3MB

Download
memory/5060-689-0x00000000001C0000-0x0000000000237000-memory.dmp

Filesize
476KB

Download