4964bdc7beefc150fa283e5bef49ce01f473e758274891d742fb17bb35bb0a5c

Analysis

user interaction
yes
max time kernel
74s
max time network
62s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
latest.msi
Size 202.4MB
Sample260502-taysesby21
SHA256 4964bdc7beefc150fa283e5bef49ce01f473e758274891d742fb17bb35bb0a5c
MD5 a4161d0f71f5aa5bc10a34d403501eb7
SHA1 3f301a28aa33bdef36dd9d31ac7fe8424611670f
SHA512 b6f5c88f7b93c6b14a3f7ef98f4400dcc8406b24b7c34d1d5833e36dc51579d73c50eaa01a2770276ea2fa3f358ccd5e73e2b5c7a9c778cb40e30e76d616f0bc
SSDEEP 6291456:AQka+OVC0Xlgg2P4c2DWH15BWiM2EycoUpFTotI:Ltt6g+2u1DWpWaTom
TLSH
T181A833137E949530C54A4D7095FACBC80176BC30892098E37A49FA2CDEFAED1E66D9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
656	DedVPN.exe

Loads dropped DLL 1 IoCs

pid	Process
3116	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DedVPN.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\DedVPN\DedVPN.exe	msiexec.exe
File created	C:\Program Files\DedVPN\bin\dedvpn_core.exe	msiexec.exe
File created	C:\Program Files\DedVPN\Uninstall DedVPN.lnk	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{F3BCE134-E05F-4320-A0A0-0ED75C65312E}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e5857a3.msi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DFB15ED0960E1C0497.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B98.tmp	msiexec.exe
File created	C:\Windows\Installer\{F3BCE134-E05F-4320-A0A0-0ED75C65312E}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF30289A59AD1DECFB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5857a1.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF68E09F7AC608FE5C.TMP	msiexec.exe
File created	C:\Windows\Installer\e5857a1.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F3BCE134-E05F-4320-A0A0-0ED75C65312E}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD18E967FBC41047C.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1920	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d3137aa3aa466ad60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d3137aa30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900d3137aa3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ad3137aa3000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd3137aa3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222120677698960"	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\431ECB3FF50E02340A0AE07DC55613E2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\ProductIcon = "C:\\Windows\\Installer\\{F3BCE134-E05F-4320-A0A0-0ED75C65312E}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\SourceList\PackageName = "latest.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\431ECB3FF50E02340A0AE07DC55613E2\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\431ECB3FF50E02340A0AE07DC55613E2\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\ProductName = "DedVPN"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\113C8BDFA77219A5AA1958A968D0DA1D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\PackageCode = "1B65248670488B947B609CD29C02C359"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\113C8BDFA77219A5AA1958A968D0DA1D\431ECB3FF50E02340A0AE07DC55613E2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\431ECB3FF50E02340A0AE07DC55613E2\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\431ECB3FF50E02340A0AE07DC55613E2\External	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\Version = "720896"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\431ECB3FF50E02340A0AE07DC55613E2\AdvertiseFlags = "388"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5264	msiexec.exe
5264	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5004	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1920	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1920	msiexec.exe
Token: SeSecurityPrivilege	5264	msiexec.exe
Token: SeCreateTokenPrivilege	1920	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1920	msiexec.exe
Token: SeLockMemoryPrivilege	1920	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1920	msiexec.exe
Token: SeMachineAccountPrivilege	1920	msiexec.exe
Token: SeTcbPrivilege	1920	msiexec.exe
Token: SeSecurityPrivilege	1920	msiexec.exe
Token: SeTakeOwnershipPrivilege	1920	msiexec.exe
Token: SeLoadDriverPrivilege	1920	msiexec.exe
Token: SeSystemProfilePrivilege	1920	msiexec.exe
Token: SeSystemtimePrivilege	1920	msiexec.exe
Token: SeProfSingleProcessPrivilege	1920	msiexec.exe
Token: SeIncBasePriorityPrivilege	1920	msiexec.exe
Token: SeCreatePagefilePrivilege	1920	msiexec.exe
Token: SeCreatePermanentPrivilege	1920	msiexec.exe
Token: SeBackupPrivilege	1920	msiexec.exe
Token: SeRestorePrivilege	1920	msiexec.exe
Token: SeShutdownPrivilege	1920	msiexec.exe
Token: SeDebugPrivilege	1920	msiexec.exe
Token: SeAuditPrivilege	1920	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1920	msiexec.exe
Token: SeChangeNotifyPrivilege	1920	msiexec.exe
Token: SeRemoteShutdownPrivilege	1920	msiexec.exe
Token: SeUndockPrivilege	1920	msiexec.exe
Token: SeSyncAgentPrivilege	1920	msiexec.exe
Token: SeEnableDelegationPrivilege	1920	msiexec.exe
Token: SeManageVolumePrivilege	1920	msiexec.exe
Token: SeImpersonatePrivilege	1920	msiexec.exe
Token: SeCreateGlobalPrivilege	1920	msiexec.exe
Token: SeCreateTokenPrivilege	1920	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1920	msiexec.exe
Token: SeLockMemoryPrivilege	1920	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1920	msiexec.exe
Token: SeMachineAccountPrivilege	1920	msiexec.exe
Token: SeTcbPrivilege	1920	msiexec.exe
Token: SeSecurityPrivilege	1920	msiexec.exe
Token: SeTakeOwnershipPrivilege	1920	msiexec.exe
Token: SeLoadDriverPrivilege	1920	msiexec.exe
Token: SeSystemProfilePrivilege	1920	msiexec.exe
Token: SeSystemtimePrivilege	1920	msiexec.exe
Token: SeProfSingleProcessPrivilege	1920	msiexec.exe
Token: SeIncBasePriorityPrivilege	1920	msiexec.exe
Token: SeCreatePagefilePrivilege	1920	msiexec.exe
Token: SeCreatePermanentPrivilege	1920	msiexec.exe
Token: SeBackupPrivilege	1920	msiexec.exe
Token: SeRestorePrivilege	1920	msiexec.exe
Token: SeShutdownPrivilege	1920	msiexec.exe
Token: SeDebugPrivilege	1920	msiexec.exe
Token: SeAuditPrivilege	1920	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1920	msiexec.exe
Token: SeChangeNotifyPrivilege	1920	msiexec.exe
Token: SeRemoteShutdownPrivilege	1920	msiexec.exe
Token: SeUndockPrivilege	1920	msiexec.exe
Token: SeSyncAgentPrivilege	1920	msiexec.exe
Token: SeEnableDelegationPrivilege	1920	msiexec.exe
Token: SeManageVolumePrivilege	1920	msiexec.exe
Token: SeImpersonatePrivilege	1920	msiexec.exe
Token: SeCreateGlobalPrivilege	1920	msiexec.exe
Token: SeCreateTokenPrivilege	1920	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1920	msiexec.exe
Token: SeLockMemoryPrivilege	1920	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1920	msiexec.exe
1920	msiexec.exe
656	DedVPN.exe
656	DedVPN.exe
656	DedVPN.exe
656	DedVPN.exe
656	DedVPN.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
656	DedVPN.exe
656	DedVPN.exe
656	DedVPN.exe
656	DedVPN.exe
656	DedVPN.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5264 wrote to memory of 3116	5264	msiexec.exe	80
PID 5264 wrote to memory of 960	5264	msiexec.exe	84
PID 1920 wrote to memory of 656	1920	msiexec.exe	87
PID 656 wrote to memory of 5004	656	DedVPN.exe	88
PID 5004 wrote to memory of 4804	5004	msedgewebview2.exe	89
PID 5004 wrote to memory of 5368	5004	msedgewebview2.exe	90
PID 5004 wrote to memory of 5368	5004	msedgewebview2.exe	90
PID 5004 wrote to memory of 5368	5004	msedgewebview2.exe	90
PID 5004 wrote to memory of 5348	5004	msedgewebview2.exe	91
PID 5004 wrote to memory of 5492	5004	msedgewebview2.exe	92
PID 5004 wrote to memory of 5492	5004	msedgewebview2.exe	92
PID 5004 wrote to memory of 1848	5004	msedgewebview2.exe	93
PID 5004 wrote to memory of 1848	5004	msedgewebview2.exe	93
PID 5004 wrote to memory of 1848	5004	msedgewebview2.exe	93

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\latest.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Program Files\DedVPN\DedVPN.exe
  "C:\Program Files\DedVPN\DedVPN.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=DedVPN.exe --webview-exe-version=0.11.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=656.5272.11855280252762974480
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff87849b078,0x7ff87849b084,0x7ff87849b090
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView" --webview-exe-name=DedVPN.exe --webview-exe-version=0.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,6069155201648304566,11184010712401966259,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView" --webview-exe-name=DedVPN.exe --webview-exe-version=0.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2004,i,6069155201648304566,11184010712401966259,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:11
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView" --webview-exe-name=DedVPN.exe --webview-exe-version=0.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2320,i,6069155201648304566,11184010712401966259,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:13
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView" --webview-exe-name=DedVPN.exe --webview-exe-version=0.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,6069155201648304566,11184010712401966259,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:1848

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5264
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 95F25B826014FC67490587711A1EBC17 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3116
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5857a2.rbs

Path C:\Config.Msi\e5857a2.rbs
Size 10KB
SHA256 fc38adc0d12835048a5450a0c66e57a03a213e1f075ac8675aaf871e5ddba1c4
MD5 aaea102fd5e7b10e9aba27ff6477f4b0
SHA1 1c2fd7e23cfcc9cc2b4fa5795a0ee9062b649227
SHA512 23e5b24957956619d78d004bf6420e872935fe2ad15ce0c207b676729a0527c9cf5c54114abe6e200f46196096787e8c2bcd4ecb592f916fd2abb3883bff3303
SSDEEP 192:PvR4elHTVaF9wDzGqDz7Va0/WHWiqsKp9ZD0vIJp:PvR4elHT8IDBDtF
TLSH
T1E1225101BA19D3C3E8562F35DB5313123BA6D3DA8326134F2DDDA1205E867D62F9938E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DedVPN.exe

Path C:\Program Files\DedVPN\DedVPN.exe
Size 17.1MB
SHA256 191a1111459d591527dea9856e4b4c64e7df0d2689de4779a4bc5cea4b6696b3
MD5 d2673d9fad2efb1feab104bcf72c5899
SHA1 5c82e1b5ee53f15d3f12fd09c0345187e11adb1d
SHA512 c782637adb33f229bce6dd9ab2180abee3b69e45d3134827bd4bfbf712b181ef340b59850929b60a97f99489da6ccd992800c47a5c439951380f88e5fb03bb32
SSDEEP 196608:Xk8slbLEuzUclCBa/mks+qHBZ1HqVgQUZkVFpW802+K:Xk8+qHhHqVgQGkDpH02+K
TLSH
T10207E624BB5B996CD19AC4B0834B86764A7130CB0B35B9BF45C552382F7EBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DedVPN.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DedVPN\DedVPN.lnk
Size 1KB
SHA256 6e57b3b32d9827050bf18db4af1fd826294d5b06ec3b74629ebb6e67fa3fc0c8
MD5 12282a6424c91183ab800d4bcad9fe70
SHA1 26b21e7d573798a11bfcd4533f92044aa42a6da9
SHA512 f7f4fdd49220805a6d2d4f8e4ad9a169f860248b2e7650818e2f551be1c85b263d7cc722f6c22303db868b760deff4035ca19ba35028da7b255b83c05002a4c1
TLSH
T10541BE0016D926A9F2724BB47EB1261B967A7C42F2684F2B455542860EA460056A9F3F
MD5 SHA1 SHA512 TLSH

Submit Download

DedVPN.lnk~RFe585e09.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DedVPN\DedVPN.lnk~RFe585e09.TMP
Size 1KB
SHA256 821655e22e54475f169e1cc435d11d1bd7e18095802e510cb7371912e183d19e
MD5 536454939597f89129f26af49d162a27
SHA1 0b2e0fbebeb3c46f926517bcec2c048fa93d3811
SHA512 a99a8ec33c0cc6aee739e4557176fb11b51b25abb956f130bec280bcc7cb1a7f9c39e66d026b88bc5fe1ce2a2a9d7613a8ac9de6240e262ec4e42cc6c6e1c7b5
TLSH
T1FD41DF0016D52AA9E2728BB47EF1171B967ABC02F7680F1B456542C30EA060056A9F3F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI215E.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI215E.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 264c9dba9cd1f2985f1fa32237041ba6310912996dcfc3a0dfcc1a4ffadf1068
MD5 6da12dd784dced7efc01964961ac1d3e
SHA1 6ffdbc042c7b2d8b25a0ede93653b01cc765838b
SHA512 1c8311e25b1a61af44f0dc31e950fc6ef6a9029defe73eb5febc348fb949f6820e849654539528e70a774310445d30e357ed647d6265baaeb401e13aa26e3358
TLSH
T112D01122BA020238C028203300A2BA0A0800E20F808AC000A83EAAAE3A280B02A03882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5c913d9714a21706094a6ac9f0d8638e49ce1737fab41396cf82bd2655cfef73
MD5 796cb0af7bf91e74b36d72b416679bcc
SHA1 d6ac7f1fafa2f0928cef31e56060b94a816a16dc
SHA512 149d20432db1abe4a514cfbc58e470fe953368dbf7ec2f2f2026ed63f302d59e5b93441ec16da74334e1ecec3e0628429f44f2d02fec115a87b0c59161976d96
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 3e66c6c8ae0b4f6ad367f42bbcd0d93d399e70e203f4df332c4399a80fee9426
MD5 80c7cf4aa71fb99949ca909b8da3fcd6
SHA1 7c90c09d4f161287e29274ed65e475100d7ecaf9
SHA512 54ccb88335d447afa87786b3066bf16943af3f5134ffc24d936316d27ab71a4a024e8ffd6260491bf797360d247e455fa8c1e1e060c70fec5bac2d6be4c779e8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 349399a6ec6d3f18d56933fc00084b68090e3f7ea8eb41a2c2e7e36f6b6c4626
MD5 d0e60f5e4ccf2b655693c89c561662e0
SHA1 f40db78e2389bcadf766673c63ab06a1bb662367
SHA512 547914b67b07f5e63b4fdb9c96832efd6acb7655f7f854c12e2d0b3ce470ee87598dea7a2fa3339f4879a5c33fe2438abfb843c0bbc8aa10cf82c516dfa36b69
TLSH
T16AE05E968135766FC764DDB16CC4404B7ABD06B04DB3DE7AA2D4A6B35A233FDE2A0018
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Default\Preferences
Size 6KB
SHA256 e03f777b3c7e786b756055e23a9832b4c7cb7dbe5244e477104630647167b918
MD5 36365dca20a11ecfb6ea0260f32d725b
SHA1 a6bd114aee7a872ac901a74e92e0a45935c5f838
SHA512 68eab4518b834c672e3b8903956de56d47ff87fcfd6360c370a0c65d96028e91177115856bfd61530265cc8b9504235215db898e1af862d7cbfe1d98d10d456c
SSDEEP 96:stt052/Mssb9WTffDZ8i0vhELkt1m/7qx+WVHMSm+uecJ7j1idQjz+gXyVMOB:stt0c/nTfLZ8pam4/S+WiT7jwdKYVMC
TLSH
T10CD195035E287D778CC7F6597A25FB12E2FA102266D50E64ABFC871C09D6ADD2207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Default\Preferences
Size 6KB
SHA256 df4dffd33a2bc3fafbafb7bbbed7b1224e5480753ba4916c622d25f3756685b0
MD5 a43f58adb68b5ccc7ddcfd7e6318de2a
SHA1 b98f51d50ed260e9ee19e0f721529a5d1d46f49f
SHA512 2214afdf7c779051ac2354ff783336648b226b06a345fadffac07b248e82650c5b4154bae45cf25265b8e92b93c665856d6c610aee1e75700dbd38c079698ed7
SSDEEP 96:stt052/Mssb9lTffDZ8i0vhELkt1m/7qx+WVHMSm+uecJ7j1idQjz+gzVMEB:stt0c/ETfLZ8pam4/S+WiT7jwdKpVM8
TLSH
T106D196035E287D778CC7E6197A35FB12D2FA102166D41E68ABFC871C09D66DC6207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Local State
Size 16KB
SHA256 ebbe16045e32c25008cda4b5605b8e619f20264dbe6f3e0462db5610086d599b
MD5 9480445257f9403ab7e930b2a4518145
SHA1 cdcfe1c0f135161935db32f46de26791390530e7
SHA512 de1d102c3267af1072ebc03d604f39ff7c9f2a11bb8ddd2d40f439c3efbc786095afe681223339b5f6d4e460e2de75e8a608d318d96355832baed09a9057cee6
SSDEEP 384:z/fTPLdSWCUkEaV8DNYi0qnSXaqZvsNbCUU0Z5+uh:rTRMUVai1SKqvifJ
TLSH
T1FC72BFA3AC78A65B18BE8A59FA17320B99B8D154C1D52F1DEDED1F0E07C66981312C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Local State
Size 1KB
SHA256 1642da9bb7fb43a5eaf5fbe23b0163af7b8193df60974fe4b373a01179db0779
MD5 5d3e33a1802cb8d9303270fbfb0a095d
SHA1 ec332cf1fa922a168a2798f12c87806025348d11
SHA512 47aace4f505a2a456a5d234e0357b54d9ad4c75092d97e5e8b5429c8d970e9b683b7baff365f530614f6e744516079898477c1fe180c34c47deaf8910dc99be9
TLSH
T1A8316573E4943A32AC9353C5B5A3B79B7D20417992100E54E2DC0B1C06EBA9CB11AC36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Local State
Size 2KB
SHA256 c48097d21a25550454807cba90f56e3d24779d0b25a0d638afa269b7f0abc867
MD5 ecf5c688c2c52df0a92e748a64346b2c
SHA1 f091082f760e80c6fd1bf3c91794f6d9b68b078f
SHA512 3435023e30ef6dd92c75308f759f7c9d0ffb50515fa99c6a109df6467dcffa85d80f1ff3893cce9fb4d2c4385e59cfda02fcda639eb7914ded96560f8a3b5dd1
TLSH
T1CD519773B854BA3789E347847D9A7B22AA35826596512F7096DC0B0C01DBA5C3306C7B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Local State
Size 3KB
SHA256 208ba033a3867f5e526fd39cda73f981bbad867af4eeed031ee48a995d9a4955
MD5 dbf1dfa67760f664bc55282914e4e542
SHA1 fb19ab49f464a8c2e12c381d1c949007301dee44
SHA512 2a97b9b84683b5f8a6c364c09dc97e87864d8b2768fbee4c44c71b087b952a6e8d8406f4041b8df41acb7e59b5a59e24bdbb5d03871a2184f4c8c9f58b2e8567
TLSH
T111718633A464A9278DF39B44BDC63B16B6654237E5953FA4D6EC0F0C02DB7982342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe586ef1.TMP

Path C:\Users\Admin\AppData\Local\com.dedvpn.application\EBWebView\Local State~RFe586ef1.TMP
Size 1KB
SHA256 d5382c6af050c9f03aadb521662e8f7d587f0af7c481a5096627f62ce11a0b15
MD5 2bd44291fce720d4b534b03ec783570f
SHA1 9f017ce36a07bdbf92354d52bc09f23980f010c3
SHA512 8520d846fd52f5b3524356fd5d41ff2a129f6bd889a80653f405226f11a92c701b3b868b9a96964f3d616beea2dbd795e24e3adb0e3fdcb05685e5d669b901cb
TLSH
T19C216573D4943A72B95346D5BAA3F7CA3D20817952101E18E2DC0B1C16DB99CA22BC37
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 f0a8c564300181d006c76a1c88e8e54bfd024a5ba13beb58e9917012c115bf98
MD5 f8a599ed65c892a82b38dc9152c30495
SHA1 1d30fd918a0f9c54687622e0c84ab4a38232c851
SHA512 0b3ca5aae72f61bc17cf5700ef5881b5cac66a859f0784d62d79e3d1fef0e0da501255f21bc9188b9e0a3dcadced2ff6f46bf31a1b5af7cd12106b4bce134853
SSDEEP 24576:x2gmSp1qdoO/vvTLEGveR0Xaf6pEQYrVWWMN3pkP2U64EjL6o0O47CFox:i
TLSH
T18947D12432FD2240E7F79E3D6CF0AA27493A7D5B9C159E8D45421B4E0921BB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{277b3332-9be6-4cf1-9134-1da03d072d63}_OnDiskSnapshotProp

Path \??\Volume{a37a13d3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{277b3332-9be6-4cf1-9134-1da03d072d63}_OnDiskSnapshotProp
Size 6KB
SHA256 d3910c71f4d17598e82f72cf451a906e041c4cc24c7803d4b480ca09450ec2f7
MD5 39807146bd86a5efa85372633d17ac38
SHA1 4d16d89f1b45a24a8c7c3ed067969cffd812fb55
SHA512 6878d29c8f6da15f76f9ca1e3e464906280bd5f56a4753ebe6d3f44519ec6a07ea4e2b6fb976e745b8a3fb3998a289bbf2e9c913720a76dfcfb0ffcb9a597dee
SSDEEP 96:FGL5sPvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Cub++ZVmN
TLSH
T190D18A185AF54311E2B3AB3129F18557A877B911EF33CB8E0198638E2670A10F876F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1848-156-0x00007FF8980B0000-0x00007FF8980B1000-memory.dmp

Download

memory/4596-4-0x000001E470220000-0x000001E47068C000-memory.dmp

Download

memory/5004-263-0x000002129F3C0000-0x000002129F82C000-memory.dmp

Download

memory/5368-72-0x00007FF8980B0000-0x00007FF8980B1000-memory.dmp

Download