Overview
overview
8Static
static
3HWID Spoof...x).zip
windows10-2004-x64
1HWID Spoof...x).zip
windows11-21h2-x64
1TraceX Fin...er.bat
windows10-2004-x64
3TraceX Fin...er.bat
windows11-21h2-x64
3TraceX Fin...rs.ps1
windows10-2004-x64
3TraceX Fin...rs.ps1
windows11-21h2-x64
3TraceX Fin...ds.ps1
windows10-2004-x64
3TraceX Fin...ds.ps1
windows11-21h2-x64
3TraceX Fin...ds.ps1
windows10-2004-x64
3TraceX Fin...ds.ps1
windows11-21h2-x64
3TraceX Fin...ss.ps1
windows10-2004-x64
3TraceX Fin...ss.ps1
windows11-21h2-x64
3TraceX Fin...id.ps1
windows10-2004-x64
3TraceX Fin...id.ps1
windows11-21h2-x64
3TraceX Fin...ds.ps1
windows10-2004-x64
3TraceX Fin...ds.ps1
windows11-21h2-x64
3TraceX Fin...nt.ps1
windows10-2004-x64
3TraceX Fin...nt.ps1
windows11-21h2-x64
3TraceX Fin...ls.ps1
windows10-2004-x64
3TraceX Fin...ls.ps1
windows11-21h2-x64
3TraceX Fin...pn.ps1
windows10-2004-x64
8TraceX Fin...pn.ps1
windows11-21h2-x64
8TraceX Fin...er.ps1
windows10-2004-x64
3TraceX Fin...er.ps1
windows11-21h2-x64
3TraceX Fin...me.ps1
windows10-2004-x64
3TraceX Fin...me.ps1
windows11-21h2-x64
3TraceX Fin...e.ovpn
windows10-2004-x64
3TraceX Fin...e.ovpn
windows11-21h2-x64
3TraceX Fin...64.exe
windows10-2004-x64
1TraceX Fin...64.exe
windows11-21h2-x64
1TraceX Fin...er.ps1
windows10-2004-x64
3TraceX Fin...er.ps1
windows11-21h2-x64
3Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/06/2026, 19:41
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
HWID Spoofer Final (tracex).zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
HWID Spoofer Final (tracex).zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
TraceX Final/scripts/TraceX-Helpers.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
TraceX Final/scripts/TraceX-Helpers.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
TraceX Final/scripts/change_disk_ids.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
TraceX Final/scripts/change_disk_ids.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
TraceX Final/scripts/change_hardware_ids.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
TraceX Final/scripts/change_hardware_ids.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
TraceX Final/scripts/change_mac_address.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
TraceX Final/scripts/change_mac_address.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
TraceX Final/scripts/change_monitor_hwid.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
TraceX Final/scripts/change_monitor_hwid.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
TraceX Final/scripts/change_registry_hwids.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
TraceX Final/scripts/change_registry_hwids.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
TraceX Final/scripts/create_restore_point.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
TraceX Final/scripts/create_restore_point.ps1
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral19
Sample
TraceX Final/scripts/hide_peripheral_serials.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
TraceX Final/scripts/hide_peripheral_serials.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
TraceX Final/scripts/setup_vpn.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral22
Sample
TraceX Final/scripts/setup_vpn.ps1
Resource
win11-20260513-en
windows11-21h2-x64
27 signatures
150 seconds
Behavioral task
behavioral23
Sample
TraceX Final/scripts/tracex_cleaner.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
TraceX Final/scripts/tracex_cleaner.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
TraceX Final/scripts/uninstall_game.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
TraceX Final/scripts/uninstall_game.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
TraceX Final/templates/nordvpn_template.ovpn
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
TraceX Final/templates/nordvpn_template.ovpn
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
TraceX Final/tools/AMIDEWINx64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
TraceX Final/tools/AMIDEWINx64.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
TraceX Final/tools/HWID-Spoofer.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
TraceX Final/tools/HWID-Spoofer.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target TraceX Final/scripts/setup_vpn.ps1
- Size 28KB
- Sample260608-yd7lysew21
- SHA256 36f7cca326f67cacf24d63facafa92e4300527946b590280da30e99e65ab4752
- MD5 56fa01e2df8c9952a5c18531cb080d88
- SHA1 4ec595d5822d9ee61cb0d3c695b63c98a5a65373
- SHA512 acf641ef78b5c0ce372a33985914b35edf3639abca397aa62d95f64a577cd6a2e33703c808f0964e68d3bb3c0fd6c95a675f7fb913da5764679c9108d1a1afd9
- SSDEEP 384:4XH2dunqF8g9Ch21nTfViwZNJ41ZDaTcaQUJBYxt4sdh7EarMjKwjlecW2z:K2JrViY7qaYaQUsh7Wleiz
- TLSH T1D7D2C71E9E01172EAABB877FC8406064FD4A553B038A1582729CD1D53FF052EC3B9D97
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\StubPath = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v OPENVPN-GUI /t REG_SZ /d \"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\"" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\ = "OpenVPN 2.6.14-I001 amd64" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\Version = "1" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\IsInstalled = "1" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\DontAsk = "2" MsiExec.exe - Drops file in Drivers directory 9 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\SETE923.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETE923.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\ovpn-dco.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\SETDE26.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\wintun.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\SETE54A.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETDE26.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETE54A.tmp DrvInst.exe - Executes dropped EXE 6 IoCs
pid Process 4464 openvpn-gui.exe 4156 openvpn.exe 3480 openvpnserv.exe 4116 openvpnserv2.exe 4768 openvpnserv2.exe 4252 openvpn-gui.exe - Loads dropped DLL 21 IoCs
pid Process 1920 MsiExec.exe 1920 MsiExec.exe 3400 MsiExec.exe 3400 MsiExec.exe 3400 MsiExec.exe 3400 MsiExec.exe 3520 MsiExec.exe 3520 MsiExec.exe 3520 MsiExec.exe 3520 MsiExec.exe 3520 MsiExec.exe 4156 openvpn.exe 4156 openvpn.exe 4156 openvpn.exe 4156 openvpn.exe 4156 openvpn.exe 3480 openvpnserv.exe 3520 MsiExec.exe 3520 MsiExec.exe 3400 MsiExec.exe 1920 MsiExec.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OpenVPN-GUI = "C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe" msiexec.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 27 2416 msiexec.exe 27 2416 msiexec.exe -
pid Process 5372 powershell.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\netwsw00.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF MsiExec.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4e2101d6-d7ce-d644-adf9-555be27db77d} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{34326849-817c-d54d-a014-31448c067d83}\SETDC22.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{34326849-817c-d54d-a014-31448c067d83}\SETDC34.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\netnvm64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\netathrx.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{34326849-817c-d54d-a014-31448c067d83}\ovpn-dco.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.sys DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\netsstpa.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\usbncm.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\netloop.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\netxex64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\netk57a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\netr7364.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\net7500-x64-n650f.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_dba6eeaf0544a4e0\netwmbclass.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\netvf63a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_32a9ad23c1ecc42d\c_net.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{4e2101d6-d7ce-d644-adf9-555be27db77d}\SETD6D5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\rndiscmp.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\netathr10x.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\OemVista.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\nete1e3e.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\netvchannel.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_8984d8483eef476c\rt640x64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\b57nd60a.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0dae971b-03a7-474b-b7da-04c9a7bd8545}\OemVista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0dae971b-03a7-474b-b7da-04c9a7bd8545}\SETDBA7.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0dae971b-03a7-474b-b7da-04c9a7bd8545} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\netwew01.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmwdidhdpcie.inf_amd64_977dcc915465b0e9\bcmwdidhdpcie.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\netbxnda.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\netrtwlane.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0dae971b-03a7-474b-b7da-04c9a7bd8545}\SETDBA6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{34326849-817c-d54d-a014-31448c067d83}\ovpn-dco.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{34326849-817c-d54d-a014-31448c067d83}\SETDC34.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{34326849-817c-d54d-a014-31448c067d83} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\netrasa.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\kdnic.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\netwtw02.PNF MsiExec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\pa\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_2056158375\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\128.png msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\te\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\fr_CA\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_1957394585\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\sr\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\zh_TW\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\en_US\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\vi\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\id\messages.json msedge.exe File created C:\Program Files\OpenVPN\config-auto\README.txt msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\ta\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\en\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\uz\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\mn\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\el\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\ms\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\sk\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\hu\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\fa\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\pl\messages.json msedge.exe File created C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\mr\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\en_CA\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\es_419\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\cy\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\az\messages.json msedge.exe File created C:\Program Files\OpenVPN\sample-config\client.ovpn msiexec.exe File created C:\Program Files\OpenVPN\ssl\modules\legacy.dll msiexec.exe File created C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.sys msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\hy\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\fil\messages.json msedge.exe File created C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg msiexec.exe File created C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\ko\messages.json msedge.exe File created C:\Program Files\OpenVPN\bin\openvpn-gui.exe msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\gl\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_867240005\test.txt msedge.exe File created C:\Program Files\OpenVPN\bin\libssl-3-x64.dll msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\ja\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\bn\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\hi\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_867240005\ranked_dicts msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\dasherSettingSchema.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\km\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_2056158375\data.txt msedge.exe File created C:\Program Files\OpenVPN\bin\tapctl.exe msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\kn\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\pt_PT\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\lv\messages.json msedge.exe File created C:\Program Files\OpenVPN\include\tap-windows.h msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\service_worker_bin_prod.js msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\bg\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\ur\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\be\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_867240005\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\manifest.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\it\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\kk\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\ar\messages.json msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_867240005\male_names.txt msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_867240005\passwords.txt msedge.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping552_52253147\_locales\en_GB\messages.json msedge.exe - Drops file in Windows directory 41 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIF43B.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\e58c5fb.msi msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSICBBA.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\openvpn.ico msiexec.exe File opened for modification C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\openvpn.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIDD83.tmp msiexec.exe File created C:\Windows\INF\oem3.PNF MsiExec.exe File created C:\Windows\INF\oem4.PNF MsiExec.exe File created C:\Windows\inf\oem4.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log MsiExec.exe File opened for modification C:\Windows\Installer\MSICB2C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICBEA.tmp msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSIF3BC.tmp msiexec.exe File created C:\Windows\Installer\e58c5fb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID890.tmp msiexec.exe File opened for modification C:\Windows\inf\oem5.inf DrvInst.exe File created C:\Windows\inf\oem5.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\SourceHash{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E} msiexec.exe File opened for modification C:\Windows\Installer\MSIC7C0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICCE5.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIDC0B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF3DC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICB9A.tmp msiexec.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSICDB1.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico msiexec.exe File created C:\Windows\INF\oem5.PNF MsiExec.exe File created C:\Windows\Installer\e58c5fd.msi msiexec.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5112 sc.exe 6024 sc.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5124 msedge.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134254213385295894" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe\JScriptSetScriptStateStarted = "240704671" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe - Modifies registry class 61 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\ = "OpenVPN Config File" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\ = "Start OpenVPN on this config file" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Version = "33949049" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Service = "OpenVPN" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.OvpnDco = "Drivers" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.PLAP.Register = "\x06OpenVPN.Service" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.ovpn msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.SampleCfg = "OpenVPN" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI.OnLogon = "OpenVPN.GUI" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72\3FDCD1DCCACB33241ACCD5FAEEE106E4 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\PackageName = "OpenVPN-2.6.14-I001-amd64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\ProductName = "OpenVPN 2.6.14-I001 amd64" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\PackageCode = "22912DF0EEBE3A3498FA548D65979F16" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{C10BE2AE-B41C-4338-B88F-A275DE73C537} msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TraceX Final\\tools\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.TAPWindows6 = "Drivers" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI = "OpenVPN" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenSSL = "\x06" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\EasyRSA = "\x06OpenSSL" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\DeploymentFlags = "3" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ovpn\ = "OpenVPNFile" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command\ = "\"notepad.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\" --command import \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.Wintun = "Drivers" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\TraceX Final\\tools\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\ = "import" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\ = "Import into OpenVPN-GUI" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Documentation = "OpenVPN" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\ProductIcon = "C:\\Windows\\Installer\\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\\openvpn.ico" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\DefaultIcon\ = "C:\\Program Files\\OpenVPN\\res\\ovpn.ico,0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn.exe\" --pause-exit --config \"%1\"" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5372 powershell.exe 5372 powershell.exe 1568 msiexec.exe 1568 msiexec.exe 3012 msedge.exe 3012 msedge.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid 4 - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5372 powershell.exe Token: SeShutdownPrivilege 2416 msiexec.exe Token: SeIncreaseQuotaPrivilege 2416 msiexec.exe Token: SeSecurityPrivilege 1568 msiexec.exe Token: SeCreateTokenPrivilege 2416 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2416 msiexec.exe Token: SeLockMemoryPrivilege 2416 msiexec.exe Token: SeIncreaseQuotaPrivilege 2416 msiexec.exe Token: SeMachineAccountPrivilege 2416 msiexec.exe Token: SeTcbPrivilege 2416 msiexec.exe Token: SeSecurityPrivilege 2416 msiexec.exe Token: SeTakeOwnershipPrivilege 2416 msiexec.exe Token: SeLoadDriverPrivilege 2416 msiexec.exe Token: SeSystemProfilePrivilege 2416 msiexec.exe Token: SeSystemtimePrivilege 2416 msiexec.exe Token: SeProfSingleProcessPrivilege 2416 msiexec.exe Token: SeIncBasePriorityPrivilege 2416 msiexec.exe Token: SeCreatePagefilePrivilege 2416 msiexec.exe Token: SeCreatePermanentPrivilege 2416 msiexec.exe Token: SeBackupPrivilege 2416 msiexec.exe Token: SeRestorePrivilege 2416 msiexec.exe Token: SeShutdownPrivilege 2416 msiexec.exe Token: SeDebugPrivilege 2416 msiexec.exe Token: SeAuditPrivilege 2416 msiexec.exe Token: SeSystemEnvironmentPrivilege 2416 msiexec.exe Token: SeChangeNotifyPrivilege 2416 msiexec.exe Token: SeRemoteShutdownPrivilege 2416 msiexec.exe Token: SeUndockPrivilege 2416 msiexec.exe Token: SeSyncAgentPrivilege 2416 msiexec.exe Token: SeEnableDelegationPrivilege 2416 msiexec.exe Token: SeManageVolumePrivilege 2416 msiexec.exe Token: SeImpersonatePrivilege 2416 msiexec.exe Token: SeCreateGlobalPrivilege 2416 msiexec.exe Token: SeCreateTokenPrivilege 2416 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2416 msiexec.exe Token: SeLockMemoryPrivilege 2416 msiexec.exe Token: SeIncreaseQuotaPrivilege 2416 msiexec.exe Token: SeMachineAccountPrivilege 2416 msiexec.exe Token: SeTcbPrivilege 2416 msiexec.exe Token: SeSecurityPrivilege 2416 msiexec.exe Token: SeTakeOwnershipPrivilege 2416 msiexec.exe Token: SeLoadDriverPrivilege 2416 msiexec.exe Token: SeSystemProfilePrivilege 2416 msiexec.exe Token: SeSystemtimePrivilege 2416 msiexec.exe Token: SeProfSingleProcessPrivilege 2416 msiexec.exe Token: SeIncBasePriorityPrivilege 2416 msiexec.exe Token: SeCreatePagefilePrivilege 2416 msiexec.exe Token: SeCreatePermanentPrivilege 2416 msiexec.exe Token: SeBackupPrivilege 2416 msiexec.exe Token: SeRestorePrivilege 2416 msiexec.exe Token: SeShutdownPrivilege 2416 msiexec.exe Token: SeDebugPrivilege 2416 msiexec.exe Token: SeAuditPrivilege 2416 msiexec.exe Token: SeSystemEnvironmentPrivilege 2416 msiexec.exe Token: SeChangeNotifyPrivilege 2416 msiexec.exe Token: SeRemoteShutdownPrivilege 2416 msiexec.exe Token: SeUndockPrivilege 2416 msiexec.exe Token: SeSyncAgentPrivilege 2416 msiexec.exe Token: SeEnableDelegationPrivilege 2416 msiexec.exe Token: SeManageVolumePrivilege 2416 msiexec.exe Token: SeImpersonatePrivilege 2416 msiexec.exe Token: SeCreateGlobalPrivilege 2416 msiexec.exe Token: SeCreateTokenPrivilege 2416 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2416 msiexec.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 552 msedge.exe 2416 msiexec.exe 2416 msiexec.exe 4464 openvpn-gui.exe 4464 openvpn-gui.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4464 openvpn-gui.exe 4464 openvpn-gui.exe - Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 5372 wrote to memory of 552 5372 powershell.exe 90 PID 552 wrote to memory of 5060 552 msedge.exe 91 PID 552 wrote to memory of 5124 552 msedge.exe 93 PID 552 wrote to memory of 1428 552 msedge.exe 94 PID 552 wrote to memory of 1428 552 msedge.exe 94 PID 552 wrote to memory of 1428 552 msedge.exe 94 PID 552 wrote to memory of 6032 552 msedge.exe 95 PID 552 wrote to memory of 6032 552 msedge.exe 95 PID 552 wrote to memory of 3316 552 msedge.exe 97 PID 552 wrote to memory of 2212 552 msedge.exe 96 PID 552 wrote to memory of 3316 552 msedge.exe 97 PID 552 wrote to memory of 3316 552 msedge.exe 97 PID 552 wrote to memory of 2212 552 msedge.exe 96 PID 552 wrote to memory of 2212 552 msedge.exe 96 PID 5372 wrote to memory of 2416 5372 powershell.exe 98 PID 1568 wrote to memory of 1920 1568 msiexec.exe 102 PID 552 wrote to memory of 3736 552 msedge.exe 105 PID 552 wrote to memory of 3736 552 msedge.exe 105 PID 552 wrote to memory of 3736 552 msedge.exe 105 PID 552 wrote to memory of 4592 552 msedge.exe 110 PID 552 wrote to memory of 4592 552 msedge.exe 110 PID 552 wrote to memory of 1512 552 msedge.exe 111 PID 552 wrote to memory of 1512 552 msedge.exe 111 PID 552 wrote to memory of 5704 552 msedge.exe 114 PID 1568 wrote to memory of 2076 1568 msiexec.exe 129 PID 1568 wrote to memory of 3400 1568 msiexec.exe 131 PID 1568 wrote to memory of 3520 1568 msiexec.exe 133 PID 3264 wrote to memory of 1228 3264 svchost.exe 135 PID 3264 wrote to memory of 5856 3264 svchost.exe 136 PID 3264 wrote to memory of 4168 3264 svchost.exe 138 PID 3264 wrote to memory of 3956 3264 svchost.exe 140 PID 3520 wrote to memory of 3152 3520 MsiExec.exe 142 PID 4464 wrote to memory of 4156 4464 openvpn-gui.exe 149 PID 552 wrote to memory of 4512 552 msedge.exe 151 PID 552 wrote to memory of 1480 552 msedge.exe 152 PID 552 wrote to memory of 1236 552 msedge.exe 153 PID 3264 wrote to memory of 4832 3264 svchost.exe 154 PID 3520 wrote to memory of 4540 3520 MsiExec.exe 155 PID 552 wrote to memory of 1648 552 msedge.exe 158 PID 552 wrote to memory of 1648 552 msedge.exe 158 PID 552 wrote to memory of 2696 552 msedge.exe 159 PID 552 wrote to memory of 2696 552 msedge.exe 159 PID 3264 wrote to memory of 3720 3264 svchost.exe 161 PID 3520 wrote to memory of 904 3520 MsiExec.exe 162 PID 3520 wrote to memory of 5112 3520 MsiExec.exe 169 PID 3520 wrote to memory of 6024 3520 MsiExec.exe 171 PID 1920 wrote to memory of 4252 1920 MsiExec.exe 175 PID 552 wrote to memory of 5196 552 msedge.exe 177 PID 552 wrote to memory of 5196 552 msedge.exe 177 PID 552 wrote to memory of 5396 552 msedge.exe 181 PID 552 wrote to memory of 5396 552 msedge.exe 181 PID 552 wrote to memory of 4980 552 msedge.exe 183 PID 552 wrote to memory of 4980 552 msedge.exe 183 PID 552 wrote to memory of 3012 552 msedge.exe 185 PID 552 wrote to memory of 4124 552 msedge.exe 186 PID 552 wrote to memory of 4124 552 msedge.exe 186 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\TraceX Final\scripts\setup_vpn.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.nordvpn.net/SH9fX2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffa74c6c188,0x7ffa74c6c194,0x7ffa74c6c1a03⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,14894297282994751362,5296679546562236256,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:33⤵
- System Time Discovery
PID:5124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,11188724357047713783,9869376577057188200,262144 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:23⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,11307401309183919489,12192951561608791038,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:83⤵PID:6032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,7949055606283628814,4789539282774844666,2097152 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:13⤵PID:2212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,7771677433183240059,7074216807336656619,2097152 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:13⤵PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4888,i,1862907322983993068,7840286323777081903,2097152 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:13⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,6654525117867794332,4989616604692051179,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:83⤵PID:4592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,12321715667076537083,13457274327922058719,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:83⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,3088176426518645046,4767650318914825810,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:83⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,3088176426518645046,4767650318914825810,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:83⤵PID:5704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,17430681487762586374,6585942524768806699,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:83⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,9092917231859680391,13593082685229855165,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:83⤵PID:1480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,5966604554991967026,16489084978807199514,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:83⤵PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,17752591077031189986,9431196550392438809,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:83⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,1423598357009802156,1837475109082859004,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:83⤵PID:2696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,14152114455508409383,11175807585111818751,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:83⤵PID:5196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,4319563505473280509,6885592019210891727,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:83⤵PID:5396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,17933297582195069956,6635815240698276928,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:83⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6160,i,7852072001680071660,10878844937742069263,262144 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,5672054475914635684,11257110798812982907,524288 --field-trial-handle=2252,i,14312661140927041541,9433544994125058509,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:83⤵PID:4124
-
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\OpenVPN-2.6.14-I001-amd64.msi"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2452
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 4C6E3F6B177440545707D7C743DCBADC C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files\OpenVPN\bin\openvpn-gui.exe"C:\Program Files\OpenVPN\bin\openvpn-gui.exe"3⤵
- Executes dropped EXE
PID:4252
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2076
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding A9091CD1C0A671337D39B273E63A5A012⤵
- Loads dropped DLL
PID:3400
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding AFBE13418BE50029D6E201A7991E7B61 E Global\MSI00002⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\System32\netsh.exenetsh interface set interface name="Local Area Connection" newname="OpenVPN Wintun"3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3152
-
-
C:\Windows\System32\netsh.exenetsh interface set interface name="Local Area Connection" newname="OpenVPN TAP-Windows6"3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4540
-
-
C:\Windows\System32\netsh.exenetsh interface set interface name="Local Area Connection" newname="OpenVPN Data Channel Offload"3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:904
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config OpenVPNService start= auto3⤵
- Launches sc.exe
PID:5112
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start OpenVPNService3⤵
- Launches sc.exe
PID:6024
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:4840
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5400
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Windows\Temp\3def93af44edb488b6b178b4b22a001b9086f0ccd5877cb37b7984530fbc3206\wintun.inf" "9" "44a81c227" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Windows\Temp\3def93af44edb488b6b178b4b22a001b9086f0ccd5877cb37b7984530fbc3206"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1228
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Windows\Temp\ec4f022f8a9a202401dbb81f8def70f5af879b283619e8e838cc19008832e679\OemVista.inf" "9" "42cdc5d9b" "0000000000000158" "WinSta0\Default" "000000000000015C" "208" "C:\Windows\Temp\ec4f022f8a9a202401dbb81f8def70f5af879b283619e8e838cc19008832e679"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5856
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.inf" "9" "4e1f3ffd3" "000000000000015C" "WinSta0\Default" "0000000000000154" "208" "C:\Program Files\Common Files\ovpn-dco\Win10"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4168
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:9ef34515d755ec66:Wintun.Install:0.8.0.0:wintun," "42b53aaff" "000000000000015C"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3956
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\NET\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.27.0.0:root\tap0901," "433338203" "000000000000015C"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4832
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\NET\0002" "C:\Windows\INF\oem5.inf" "oem5.inf:c695c3de07ba2b5d:ovpn-dco_Device:1.2.1.0:ovpn-dco," "43b135903" "0000000000000170"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3720
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:3112
-
C:\Program Files\OpenVPN\bin\openvpn-gui.exe"C:\Program Files\OpenVPN\bin\openvpn-gui.exe"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Program Files\OpenVPN\bin\openvpn.exeopenvpn --version2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4156
-
-
C:\Program Files\OpenVPN\bin\openvpnserv.exe"C:\Program Files\OpenVPN\bin\openvpnserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3480
-
C:\Program Files\OpenVPN\bin\openvpnserv2.exe"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"1⤵
- Executes dropped EXE
PID:4116
-
C:\Program Files\OpenVPN\bin\openvpnserv2.exe"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"1⤵
- Executes dropped EXE
PID:4768
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58c5fc.rbs
- Size 876KB
- SHA256 467d3017803729e697d6a458d69e3dd710ad044ae9c906a09bc287b11896817a
- MD5 5df46a687da5585da503f061ed164eeb
- SHA1 c406aa6c0157d4fcd267cd4cee0a184761ded205
- SHA512 4b4d1f4a1f5df1e2276fe4f40ff00a39dd460b863d39b84fd699cae0c7d63793af02ad2d483608c57629cf2404a6c9ee63fdb7ef78cc10e74d898000cff2beae
- SSDEEP 24576:kC4LJNBjSblC4LJNBjSbCC4LJNBjSb9C4LJNBjSbW:kvB+JvB+OvB+BvB+i
- TLSH T1F6157D09B7D000F9EDB7463889674616E773780107749A9F03A4837AEF2F7D1A639B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win10\ovpn-dco.cat
- Size 11KB
- SHA256 26c54ce26cb43407855ba24d10fbb30a87e5a1a0a35536025a02cb003fe474f4
- MD5 5551203f3f1095335ff00421b16fd7e2
- SHA1 0d14402407d60952f631dffe35240de3a1f910cb
- SHA512 3c31b8f60bb59e4ac3c0cda8335af1918927c51b203c8b68f2601b390ad0bc0228cb9d5566dedef05ff38cabfce46eb3d54c52cd59c828bc17dcf0b1c24a8b08
- SSDEEP 192:aOLm9xJCxkJnEwKUNhYCns2owcLK+X01k9z3AB3CmByFGx:s0kmUNh3sK6R9zc3Cm+Gx
- TLSH T1E4322AEA9A2C01C2ED977C6083D8E9537C3E27CB1C5051AA21ABFA140CE73C8F71556E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win10\ovpn-dco.sys
- Size 89KB
- SHA256 2357e4d2007f346a3d2b3bf05115caeaf3eb069a70be654ce472be71e6f7fc75
- MD5 5e69b6c42467b2673101e592a2b28638
- SHA1 16d076f57b3cbdbe945c6666676823871f5c90d1
- SHA512 232e9441db8da52cd5e6f29baf5340b0540125074a7ccc9d4754762c56460b72327f89d6583a8afde71ed400433eb850e1eb2b9d5fc536d8f9c18992b83fa587
- SSDEEP 1536:b/+PHw1yLCA62eiARYLdBX0A0gA1j7ajEMB0khx+SmzH1CzcI:QlCWOYf0A0PO0kH+SSCYI
- TLSH T1B1930875A6E010D4F47B56B886B64E01BFB1BA522F33D6EF0410856D0F36BC88E3A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.inf
- Size 2KB
- SHA256 1f6c35bc11d910f91c32ea54894d0fddb0094876bdd526d04a9287d04d636242
- MD5 77da079a3665afc84d05c3d07bcaa0d0
- SHA1 3fbfafe2c08100f5b46b792398c2ecb9157760e9
- SHA512 10fcd8464c6aab386bf2f675175598764e0b784a898b7b450fef3d055ecf902c7a57ac0aef2725b9e6899146e4e9230c8677bfd2a8f18489b642fa6beca25507
- TLSH T19441F14A52C20FBD3B432D7596077BA2B9D6910050C8151AF18CDA468B8FF99B31B7EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll
- Size 4.6MB
- SHA256 71270ed463648bcbe45829cbc0ce3827faf3267e46d530ae0a82d9bc0c619ec0
- MD5 5984ea63df1671b1d174d4d957a7b483
- SHA1 3691290a86290533537593654db9e11b2bd15fac
- SHA512 04f087a1bce16c811eb6a4be318dc5846e5553f3b0d50318aa335bc46a262cfe177479ea06b637aa6934df1ae4a998e7b764df17d2efba0ef80ef302c05c57a2
- SSDEEP 98304:9gGN3UNaucJAWjXHJPx+s1CPwDvt3uF0nCc:6GN3UZcJAWjXpph1CPwDvt3uF0nCc
- TLSH T18E268C69A6BC0096D86A95BCC2D76227D371B41257F057CF2E284AF90F23FD426BB740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll
- Size 111KB
- SHA256 e2500ded6e44090f0c76528903269938a029bee206fde25adac040d6e3a124f7
- MD5 e5353f2c01b77b433ea518923b1b8dbd
- SHA1 fad48fbf2d115b5426b40fd52d51a8729a976462
- SHA512 b81ae3412a4312e0f499860586d866d47f41647441f5875e645ffa74f83aa2ef1569b5df6535ab347a89fd3b6bb6bc69558bca65336674f0459eeda167efeb34
- SSDEEP 1536:Usfoicdz0Suh6YcYwnIrHL6PS7ySVfPrZm8KAd0uM82FjE25YiL3nyj7LoNA:qdzA3ynIrHLye1VfPrZqE25RL3nyj/ou
- TLSH T1F5B30902BD846870D49AD33DEC62022BA3767890137657DF476260E92F93F96AD39F43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\libssl-3-x64.dll
- Size 818KB
- SHA256 c681893dd0c9f86e7f405792dec32adab33cb899cbd3b2ddda533e28f577ab6d
- MD5 10d4982726da7c122404f6d6f9bcd793
- SHA1 4e6861066218f0909b8ae851fbfe9ebe0b894e46
- SHA512 a7e3ce35d60ffba3072211e600bd91e4f0419673ad64471b6b94a537e4c908a02b6fee673ea55e95c22a2b4a2dcc967f56aba0ffb99a95a8875c9b4bda37e668
- SSDEEP 12288:OXxxYXIy6weQqYjq2NIUuXWGfcFTdsFgIMPA3AK8t72tJAh1z/VhEi:OXkIrjY+E4bWUgIMPA5S7KJAh1znt
- TLSH T12B053A69BBB8009DD876C13986938613E6F6B4563370EBDB0B648A7A0F637D4273D344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\openvpn-gui.exe
- Size 1.1MB
- SHA256 1f07550f3decbfd7c8737694001ee13c26de84ef498dc493d313a79db2080646
- MD5 75d5db58796acffda38dd0139a9aa15a
- SHA1 f1eeab1b9967f0ba54f12f6ead70a0ce85f597e2
- SHA512 d987ded834671be0894f5953a800947280b012288a2ec44fdcc7fc42dd08e70577ddd6f4c22118e18ebbf0fdca0c5054e8c11bbd3b104bd7c7f8b8f9056999bd
- SSDEEP 12288:wtlBCAQ/WWOn+wP/nQStD6Fo+41GqKqx8xmwApbn:wO/LOnBHQS4Fo+yGqKtobn
- TLSH T129457001B3F98118F5F3AB349DBA46526E3BBC815E34CA8E5295755E0A72B90DD30B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg
- Size 454B
- SHA256 18b542b3de918da103ea6d79f3be0c5af8349502dc9c673f2db5b6f05dc57d35
- MD5 2b7d47401bad3221ed6d92996d49f9f7
- SHA1 a3b8cbc667f5023e4a4dd8c50bc6ab78c51048de
- SHA512 dceafceeff05a61fde179dbdf13bc2b1243ee756028b1c8a96e311f279effbd9e2567f65f8ae063841ca2c4961f6b522553b9c7095daa94898ff5ed048607aa5
- TLSH T151F0DCF2CE079202DA91122D291606F147B64569758E0B92F181A3A86DFECE343FC08B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\OpenVPN\bin\openvpn.exe
- Size 1019KB
- SHA256 89479084f420ca55864c957a689971c327209d9c0e7ea4302df947e7cefff8c2
- MD5 1860b259b69d1b78e5f82013cb21af20
- SHA1 530eaff3d8d54b13b391a954082a9261bc1d0452
- SHA512 99b2d3c75d13ff436ac0bd380e770460f6a19162b1246ffc156b3fee7e68b94d393c0fcd6bca8986ac17d71864862b0ee3620a6354ab42046abc7aed42ff3dc2
- SSDEEP 24576:vMiKDhl3hB1g8QVNaEUQVdcRZehHDLUVvNrPMJomWa:vJKDhZhk8QVNadodKZeBiPUB
- TLSH T19A259D2A139911A9D8ABD078D6178013E772745423749AEB79BCCA142F17EF2B73EF40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\tapctl.exe
- Size 41KB
- SHA256 d5aab270d61d7d1709e85ba81525be5948ae5bf397bb7b12a11e11ba0788ecd1
- MD5 bc1fec27a50d102d805f7cdb79272b50
- SHA1 562719ef2494b237f5ff164f952b5ea4e23e097d
- SHA512 a3c0e3c489775f704bd22ef1f01ee51615ed8ab5abd6f6e13667d117dead7a3c61810e95cfec13d0d994acdaa89312cfb1b2577ae59b2639ede75149115dcb03
- SSDEEP 768:uV7EIM5A5/2jrvnihtk591X3hZaZYiLo+Cc+2EsLB:uVQIkjrPihtk591XRZaZ7Lo+ys
- TLSH T189133B016BE90099E573573898B716276A777D512B70C6DF238CC22D0F63B80BE39B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\vcruntime140.dll
- Size 94KB
- SHA256 c51c64dfb7c445ecf0001f69c27e13299ddcfba0780efa72b866a7487b7491c7
- MD5 5797d2a762227f35cdd581ec648693a8
- SHA1 e587b804db5e95833cbd2229af54c755ee0393b9
- SHA512 5c4de4f65c0338f9a63b853db356175cae15c2ddc6b727f473726d69ee0d07545ac64b313c380548211216ea667caf32c5a0fd86f7abe75fc60086822bc4c92e
- SSDEEP 1536:yOHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1lLN:yOr/Z+jPYNV9H0Q8ecbjt1j
- TLSH T12F937C4A76A442B7D06BD274C1E34A5AF770B8408B7053CF03B6866A5F63BE05E3E356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping552_1957394585\manifest.json
- Size 117B
- SHA256 0f38d58679ba75ccf1b80144c998549e09e08e8fce7e1c6ecf35142ef004131f
- MD5 5836d59405b134944c3f2b02fb148539
- SHA1 c577f1816960edd81a8fb469bc1ceb4e05bd0c55
- SHA512 cb8c568105000d84c46aaadb4ab34c5a3747c9e588707dd4f3a5dc24ee3458983aec3e1ffca1a108ae47408daa6c96a0625dcc6e4a6970c8114f62eed82f20cf
- TLSH T1B3B092B00C0AA03B22849320EDA06A8283F80218E8021B1E088036481F8917880362F2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping552_2056158375\data.txt
- Size 146KB
- SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
- MD5 e28f6cc38e9dfcbb14a5d49174b0e6e5
- SHA1 e2f3ee57ee5d91232ac5d1b934c865d8a2a2676b
- SHA512 3dd75928b8f59a28fa4ddad1aa08e261318ec4e35a9db9af28b3a5ce09097128088dbfc8946b35d80ce293cdc431a9c27b6ffa8e2dd166ed48f4beb7a9892fd8
- SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEFq5IDI45/y:4X1aI5aZoKzMJ07NcQI456
- TLSH T1E2E3F115CEC41FDDDEA8261850BE0F1E53D0835E442B6AC9E763BD497F9BA04863B1C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping552_2056158375\manifest.json
- Size 53B
- SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
- MD5 58aa82c06223ecd1156ff2fb420bd991
- SHA1 8c8b8bb475ab624cf0a2fa4eb88f7053e0992423
- SHA512 4e96250fa556ab86538518843cd0455f9df2af58174219b17cc7d64871d5305e011896b454406492b5c5eef6e905e7967fe68c612ae16ab91a47d4fa71081f54
- TLSH T1389002704424951716C20E5065B0B8819391661995854D1E0445155D039546CE050298
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping552_867240005\manifest.json
- Size 69B
- SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
- MD5 fb0d9796a86299d3689982f7a949dc6e
- SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
- SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
- TLSH T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 c5a1e796dbe36d2f425ed3c1b6ebc78f8d4d8685a50d1c41ccd108f643af9033
- MD5 c29a22d23640752fe38c6775434a856f
- SHA1 5ad8c4e473d3ad5e40fd286be58c31ca5b4a5335
- SHA512 7b25ad6607327c4bea6465fd424dcb432d527a8a7d9416360a7231d5a4bdd4fc9be3e3875420281a61ba22a18886085524b06d11f96f7c5d20e6c17d4caa0609
- TLSH T132F097279AEAB5E33D02C0AFBBA88D3124E0A84E08C64822203194F147A19B5760F86D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433
- Size 727B
- SHA256 f962c69c0d7da6477f5d3c1d16188f361f4f77435d6233fb84318b2838ac25dd
- MD5 f7d6b66f09acdf6cc7e42cd8eaeefa27
- SHA1 aaaafc43742917adc3831dd461e878e803005c30
- SHA512 5d349536aa02731bd1a20044558ded26a89e596fa574b5b835267bdbac9c7a20f72f5aafa499f5d7e58ab149320806441de6c5c15edde375bebf0578f1c4e801
- TLSH T14D01658A2F6DBEC656118EDE0B6485BCBE60023A81DA652FB936908A75016220E550A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 84803e9ba61ec23ec64652b4def39958bd0fcfd2a967dd84b8cd6ea31a1e72d3
- MD5 dd01fd4e80199017dadb40360c50d71f
- SHA1 a331d9f20de50f150f658e11c9b0c77902f276ff
- SHA512 dcb135bcb87d9b1f7a112e66aa43fc7664a90b66a04cb5e761debcf873ed9bd0885637570e826608eb5dfd68a15a2c6cab1e3305bd3f25db2383e82bf6f0ea4d
- TLSH T102016509C8A51A40B828CD22C7B4B2A079BBB4F25BC502961365089D10C77616F03AA6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 1979b73b2b316fa00c4239d3a2fa8fc6cff6ca8799820e1f4e635fad36064f18
- MD5 afbb6854d1ba0c23891574d8ba4b3e4b
- SHA1 eac102b6973e8f903d2b33e40d503726269959f7
- SHA512 d51ef0d05e8291d7b5c7ac79cba9bc97c949ff1efc83bed2ec9ad9cb8e37f938213e5b01920dedf6e5c606ea22743c8d8d0d7abde0423696cd6808d29ea13e74
- TLSH T1D2E0202037FF542EF164977443E5A195AF2AF1032C6557BD09D5156D6D15A004C96C34
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433
- Size 408B
- SHA256 df96864721ea1afed08dc6b5864f0675605ed93530f2896881476437f0b9c895
- MD5 f62801be9b15506a356c47495aa0da8b
- SHA1 f98c4a0229851a5b6fbee190dcd444db9303bcde
- SHA512 b409eeb2e3dbd6e6180b62366c57532b5767bd0768780100a1520851d51f6bfc710fdf80ddb1279fc86f3e007d6a469b09c470fd8b1e00198cfe16b3969f5ec7
- TLSH T1B5E0203423F6095DF1F0E47845F6D913549EF2570956C3A911C0AB95BB136005DE2A24
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 4801e3f36194607bed446b68f1078579f15cc64f5241abae3261a13b2be2b1e1
- MD5 c9b16a4c89417fc9c94de5b94f2adb8c
- SHA1 911e483279c3147ccc53e17d10c473e6f58560b7
- SHA512 4911413b45e2aa0eba12d36ba739e81b77ae7c616f023dcc0e33869f5ca81ab07bdb68a99876f75ac74d64e8bfeee83bfde1c43e8b99dd747ba1334e18981039
- TLSH T1FCE0DF2826EFB95EF0A0DC3986FAE1B61D59E20128549AB912914708BB17F446C12AB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
- MD5 81f1d957977f2d73471366011b7128bf
- SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
- SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
- TLSH T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
- MD5 b031933009b03b3dcfc6f363760f83dd
- SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
- SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
- TLSH T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 d4fc040536d1276e612cee6f826a2c0fc368d8c4035b7ed5805de6e3be16396b
- MD5 a048a03d6484cbd3dea43ed40c6a8c3b
- SHA1 6bd29a47b76913dbe798dce59a652d5b1eec7687
- SHA512 704bfb5dcf0f8bd2d0abd39fc3492947d6fe35643a32887445a18347348ff71f2865fa76e7d27da035ad7d15d08ef87460cb6ac2cc9b542701fe4dd9abb4e5c4
- TLSH T17DF028B6C921EC3718FD0B6870694B4AE75013273780895F3B3CA20D8FB463B868581C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 866d1e55444158e30f8ee0029c2fbf3aa8765731fafd63db2b2df9eaef91a198
- MD5 fba11b0172ebb69e34329fd8a95aa0ac
- SHA1 f1de0862ee276f1d3e6f7198a1a8d71b1662382e
- SHA512 3c992f279f1bfeb6f7c596df677eafba69bea86e18c3add93d826962decca706feaa6ed9bbf61d9031da9d2827c3a1e38ee583d080b254cafc4479af3058be9a
- TLSH T114511BB8FAC0085EFB15223FA5E0B618BD29C8E8F94B0DD14D905034E9E7B64C1358C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58de74.TMP
- Size 2KB
- SHA256 8d738024d5686847cbf17bb770ac512e5cbe1cc5fd3b05176913a2575e5939be
- MD5 5589158a80385c8bb0ecd7f8c47d5577
- SHA1 0dc696b17a1930074ba02ed85287e59b9c28525c
- SHA512 ec06b834364e3dec5fc7c814d22c63443db3923f39c8a6c280884e1c4ed5a5769af5749123919919753fce5d49f45eba856a8d475842e78c21da8431c897f143
- TLSH T1CB51EAB9F9D109ADF31A223F61E07218BD29CCE8FD9A0DE11E505138E9D3B64C5759C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 4f4fe01bb4f1d3cef376bca275f9cedc7db0cd8f3a90bf4521915900e81334a2
- MD5 1c8499983041c4425e4823c67dfe4cbe
- SHA1 b1d59468edee56d8368cf4df0767563b0a927b5f
- SHA512 c36e4a82ff73891736dcac28c4f89b609e52f48ec37639e605783ae5fb546c26a55651d5be3e48f969f2c8db518229ecce7ff3421ea1d14cb127198eb9e8382f
- SSDEEP 96:D1FOugu1QuzuPuVunudiaij6czfubuZuWu+uUfu9u4uzGwUzN:D1IJFckG2miaij6c7QE3PxMHwGBzN
- TLSH T1E9B18BF3C3D8822DD95656F4BB147E2EDE2D096443283D2E88D5EF4B93E2471E28164E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 41344b2b12f60d9cb0445cc0d729917c8e427bda993a9df729ca212c9ba4d661
- MD5 ddf6eb07b274a48a66a7569740892268
- SHA1 4cc0d4e553202c6f795a7d0b2b3d006bd2e3a726
- SHA512 6bf63147071b04a5fd5786ec6c4bd9cef11cfb39b5c13dfbe9cbe5408a911a619e04e8d50e95351003b85e09e1a7be673ff0859a5b2774bad20a402671aa69b5
- SSDEEP 384:sxZDI7H/fnssd2azIKYPvzHHbS6c/SB3jB:s7qH/fNd2azoHbuGN
- TLSH T1E272D806AA24997B8DD7D219F645BB57D7F9016392905E489AFCCF0C04DBBEC220782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 16KB
- SHA256 e1e573b35343bb14049f56f56be3dfa8a74b9c1fc05e4981dd778ffd638d036a
- MD5 335d0e863405390ee24b2c507a66a1f7
- SHA1 2e1d98d2c9b22fd973037130fb4d9cb491f8bb39
- SHA512 5d6e92eec531fe3a9e78e6cfa1015ffc4ffac2580be8a7ae4e645d50f8dd6331f1fbc128b6e27ca9091c5747f77630aa0af0fafe4071289fe35950f925ce80c9
- SSDEEP 384:sxZDIqJH/fnst5zIKYPvzHHbS6c/Sw3dU:s7PJH/fy5zoHbu7u
- TLSH T12372E806AA34997B8CD7D219F645BB57D3F9116292905E489AFCCF0C04DBBED220782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 35KB
- SHA256 1256eb24b8435d098f6360b18787760c15b1d240ff91c5c0af2b4604bc0ba2fa
- MD5 855fa227b4a0e685bb77b5cae4297800
- SHA1 36a641a688a2764d950bd5058e9cbecae7ca24a3
- SHA512 096945bb0174c5cebc82c5e7297781eba656d2aa71283e7f801ebe1a9c974e8d886ed7c9c8c09798cef4ea6e9169a1e81e970b20f19e0f4d349c1c819f22bf30
- SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzysy10LlV:eY8Od/HEnFhWvFvmXu1jaLt10Lm2NuFU
- TLSH T19DF2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 23KB
- SHA256 3b8e8f123ad5ab6f4bee67cdfba2aceba6358b41e943b6c6fd8c66badee2a71d
- MD5 acb6375b96cc12d76a8d17052e390c4f
- SHA1 a928143a77b47b7bfbc596e11333c495fad82e41
- SHA512 93bfdc3ee1d56939f39503c804d038a527399ce14b809ae5dec4acb5d3a68107d830e5406490d28d10edc1a3f97af58914dc537c64926e8a6e394e03f12de67f
- SSDEEP 192:05ppxnY753RNBvRJJdt7p5J97rppwZ8Aaj:0LppY93PBZJPtN537tn
- TLSH T1DBB25A5A703E0212393E2988B39696364F4135A37058E4AF7FB814A54F27E225CFDCED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 f7e23fd5ec3543fd74b0f10becb4d455fb3c27204b34e96dbadf43fa03c77c91
- MD5 d62ffd65e7327078393ae8c78a343a9b
- SHA1 86f7f88c1ff0080640da804299cc4a36b2b81cd0
- SHA512 359ac89b2cd8ef87c8f83d79fb24ccb66c2a6027cae855e2f9475e706f26e596c419502f326afcdec0e4eac7425dabdc4f319711bd7505915782b35f82b5b836
- SSDEEP 384:npXiF1tNn/s3n9SK3sNn8TUNTUlI4+QckCrk6ScpvBftGJXfhT9J8dLEHaXzVpGu:pSF1j+9X3+wgdknqjGzT9J8kaXJ+ysv6
- TLSH T180D25B36D858DDB7ADE74FC9B75A3A47EEF001A3898C5AD8D9D85E4C008729D030BD1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 33KB
- SHA256 adb7d1dfe9063e182509170d10332fa51ec9b9d3910d9ea7054dc5d70b506f6a
- MD5 fb79e49287bf90cfbe1412ee6f0204fd
- SHA1 7c346e1576931a6d576134fcb2d7d97df166b16e
- SHA512 20bd656c7da7d0fc04bd1957241e894cea0a9e1986115c59f8fac914fa0d5c93309e13845f85ece430541f6a1a0a17e337c50db33e8da9a90c0e1eb3f4414d92
- SSDEEP 384:nziF5tNn/s3n9SeQ3sNn8TUNTUlI4iQckCrY6ocpvBftGJXfhT9J8dLEHdXzVpGu:eF5j+9e3+wgZkpqjGzT9J8kdXJ+ysv6
- TLSH T192E2D4F598DB9977D8AE4B87A37D2D069AFCC153B8881A84F7C45D0CCC861BFC20A905
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 24KB
- SHA256 7a3391116ad6295652791209dcb64d4456e3c631fef36a4a7d5208a2e7c0b7e6
- MD5 8409650e00c723bf02edddeff90b9934
- SHA1 a43b924dc1c818891a714fc3e09ee0773578fc5d
- SHA512 cd15b9b8ff51265bf9ead2d6cbe318367d28cc9b06e578fc0ba3417a31696260f2a858f963446ea5c7617aa7216ac091d407c904401fbb33fe3f3c79c8deaeb4
- SSDEEP 384:npkiF9CcmyWCs3sNG8TUNTUlIm2QckCr9ldKpvBftGJXfhT9J84opye4KV8p0/HZ:p/Fccps3HwgbkUnkjGzT9J84nI8p0/Z
- TLSH T13CB25D36EC68DABBEDE74F89B74A7A07DEE0526785DC59E4CAD85D0D00931DC030B826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 a83ddb5b9813f464f369c6422d2ebc97bccbae3bc94cb9bcd4714e8b305b99ae
- MD5 8c02abcecead3d1bcd85fbfd38d6eefc
- SHA1 728cd1dd7e340623590f591e8dec526ea34bb226
- SHA512 9abbdd7d927456f8583b76435fef4e6e9cf7594bbaa9f7e6c3437f2d417e80bb71271434eea7c53d4acf1c0a7adc255ee67959bb06effbc5dc1641779a0255ba
- SSDEEP 384:nLiF5tNn/s3n9S83sNn8TUNTUlI4iQckCrY6ScpvBftGJXfhT9J8dLEHpXzVpG3+:mF5j+9Z3+wgZkbqjGzT9J8kpXJ+ysv6
- TLSH T168D25B36D858DDB7ADE74BC9B75A3A47EEF001A3898C5ED8D9D85E4C008729D030BD1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 d646b5670106e355f39c9049c651fda574d02fb55f72923ea90025a0ac3031e7
- MD5 bf4e493f5633f4219319f4c55442febf
- SHA1 1f5054125c9555f275477409540b3ca517bd196c
- SHA512 f9b33ae394b8b74374ecec92b945f874bdcfb18bfd80774cd02cf2c4ca43d143ebb5ba8844b381d27c65c3d0f7b697978a86e09753607d2722946a87f41cd3cd
- SSDEEP 384:npXiF5tNn/s3n9S83sNn8TUNTUlI4iQckCrY6ScpvBftGJXfhT9J8dLEHpXzVpGu:pSF5j+9Z3+wgZkbqjGzT9J8kpXJ+ysv6
- TLSH T1C6D24B36D858DDB7ADE74BC9B75A3A47EEF001A3898C5ED8D9D85E4C008729D030BD1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.6.1\typosquatting_list.pb
- Size 555KB
- SHA256 b95639cf9dc46683acccb9ead8440ae9d6a852a37407cc7cd9c0b309acf7af1a
- MD5 fa2f059815f3357487cf7fc8f93e5252
- SHA1 d7affd654c8571ba0177750adb5f63ab3443496e
- SHA512 729e3443b5da00521d52c60acdc9056b11229d8ce69d47e2a1e1c12cb1784dac58c51f49e5f3423a687aecdcf5ed79697e855a353d5c253756857b7ad186d136
- SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDh:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhfk
- TLSH T1F3C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
- Size 865KB
- SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
- MD5 959460a18173908111523bbf4c39073e
- SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
- SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
- SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
- TLSH T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 c72f5978cd5cc492d92399dd59b178ca615bd8cd201a2237343ed9434bed09ba
- MD5 32c79477eaddd63353ab56bfc0b54391
- SHA1 5e8284770a3fb1c6c3401d13bd62922bab8fc95e
- SHA512 1bac80c9084734149c0875296c055f629132b9bbdcdece431677b46d79947c71ff8a48671e6cd7fc9b07113cfb93d40c311f615cfbe402e39d85cd14e5253651
- TLSH T1693121E25D3C1AD1C4BD0EAFB48774FC95E8D726F2E471796858E994063C94D608183F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 fb9396affbe4edaed7c5e5778f2a44cef7072b36827c8e2b21d9c188cd40e9d9
- MD5 786ded8bdfa708814164d3ff18a033e1
- SHA1 e0926f586e1633a8be300327c5544ae0d687fd19
- SHA512 fc43b530414309ffe16991af60c5a62b8b30da3c41955e511f90ae94220f298c8b2a28fdf56130affa8a9cc306d59c0657b6a06f35ce6cfc5975c3601f9676c8
- TLSH T1CC3142E25E3C2AD1C4BD0ABEB48734FC94E8D72AF1E470796C58E9980739A4D608143F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 754c50c43718e94d3c8138715b1cf329e26f1531021c4a5e2593d7b14fb0a3bb
- MD5 c363081f2b8b7a0c95a8b5ff1cc937d5
- SHA1 f8feac743e36e1090a962f31b8253d379a0fa8c4
- SHA512 d3cf3b806402682774210272399d47e0204b9b175cace6b6ea1f4fc3b1d372fff64b3205f9846f847db06088b04cfc3168758099b400df2c4d8cc215c296c427
- TLSH T1264140E25D3C2AD1C4BE0A7EA49734FC94E8D72AF1E474792C58E9980738A4E608143F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
- Size 147KB
- SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
- MD5 a9f7675ff091bb15c88909424bab4a39
- SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
- SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
- SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
- TLSH T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 132B
- SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
- MD5 e6d52bbc2ba6378f83c8e079c3b58d30
- SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
- SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
- TLSH T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 0bc5e53ba80dbbc0c25e739fb728cda33de00c513d8fbcaf56706a5b91725e62
- MD5 6e3d6c54cf5af996d0fbaa65bd3446a6
- SHA1 658e4512390bcf9b027425faf747c01292e0e339
- SHA512 699fdef7dd06c551b1748a31a5001dde7940a6835e48676c3dbd5049145d4f1497862b0d4d228a9846daeebd3fc28b0529c5eb230c5ef7a317773e62d9f866c1
- TLSH T13B414C58AAFE1148B3B76F5A9BF7A87D487B78772E07945D10010E4F0666E01CCA1B33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7337.tmp
- Size 209KB
- SHA256 8351a40a632facd1f79a1bccfe8e32e88876a23065be1144621533700ecb05ad
- MD5 3037e214e0f9b25fc63d4d16f7c4c91d
- SHA1 b03dce2090033ca3029526485039b75a5aa4b488
- SHA512 437fd240c0af2afaa3a5a1791db4739dff04c7003f25f1bc512797cfffb7fc3e8377656b6eb8714a50b3189c2616b230a619730bc63628d9ab4bc214ce31de90
- SSDEEP 3072:l9FCdj6rw5iUeqEetAByXxqr8lyc8t5W6/eb7eUZxfZ/oR:l9FC4wuJeiByXwrtcO6ZVxoR
- TLSH T1C6248E09B7D100B9EDB78638CD678656E673780107609A9F03A08376EF2F7D1A63DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1kprbuiy.neh.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSICB9A.tmp
- Size 275KB
- SHA256 fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f
- MD5 2232c07e354364e0eb1dc80024593826
- SHA1 65bb4232c0416cfb2c158bfc32a7732ad72cee72
- SHA512 f0d295565b209f4dedd2a79123fa54ff9b8cbb173f14463ab3d3707b8d87aad84b05c2898478ecc148e29d02fa07ddda9499795e0ceafc2982c0adbd570a3572
- SSDEEP 3072:A736bBrGsu4ldGrlmxElEmNoPl4+eDhIVJkRZ5Br/NbvcjKX5mMgQSeRocPvuocM:A736UWldGrlmxEDNMea+H5R/B/1lp4x
- TLSH T136548D41B7E404A6EC73C73499A39606FA3278411B70DAEF035082768F6B7D1AA3DB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICBBA.tmp
- Size 281KB
- SHA256 45e855461f5d1be28a2f88416603070bd1778055abdd06834ae58e97b7ddf53c
- MD5 718222e232d11298dfbabbc2b70d8b14
- SHA1 89fc560692111c2245694867b8772fd8969f46d2
- SHA512 9191961c28a7a4647ae8f9f9e1956d60b97f5f5c3e4e838d888bf78c1ea665e98e8e3c75cc1247a68a89b2413493ea6d39dbc60827eec919ddba0536d793c801
- SSDEEP 3072:sEcOO6pMedPCy5654WKlfE5qbHsfmYud8d2VCsOLlk1lHgQNvLvPMm88cYzdFOS:OOO6OedPjw58l85/grhSQNDsYz2
- TLSH T111549D45BF9504B6E8BBC1348AA74A82E772740203109A9F33AC97799F2F7D1663D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICBEA.tmp
- Size 143KB
- SHA256 2738720da0b6ce474ca6eb51a92372d047eca2d713c256f0cd6c147ac3a0db21
- MD5 84a1cc9540d5cdad74bc54f8090dd27a
- SHA1 c6f82d1491015457785ae0d365e7196d693d9a6b
- SHA512 9c25d6e7331844d01d732ac923e99c68f305749d92407c873cd09b451e59a8864001e308864fda319fa4a2bcae9dbe50682201c67901dce14272291dedecd2c8
- SSDEEP 3072:+1gnuc/GBdzVQqyIgt8DB7QKPw3hL6nCMfBXqpU:Bnuc/GBdJmIgtesKP+Lh+
- TLSH T154E37E17B7A400BBE5B78235C9635A06E772B81117219F9F03A443766F237D0AD3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58c5fb.msi
- Size 5.5MB
- SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
- MD5 1e150b4507fc951c8a23b08b85236cd2
- SHA1 3f6980947c16778efb3126193726c038453c85d6
- SHA512 2074822532d38e94c131ceb3b4b7a01379ea20b5d6e3fb85a6912a586b8e6f1ff5a4973c200087ccd5ecd17727acef2d5568e6afc9df392da5c1f1978b4cd3a8
- SSDEEP 98304:fEnzYKCLSBI0lGIOKv8k7VHTB87GnJ6tEGb7MrisWnB+A/yue/bjBe:z/LS9ZzVV87G2hbWij+xB/Re
- TLSH T128460101B6C10462EC678230C85E925AF2F27C5117A0D66FA2DCBF7CBF3B3A5526A751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 37KB
- SHA256 2aebee72faeef8c6820488c0368ec1022de5d87abb5cf46abcc88c6b3cbac7d2
- MD5 1f0f68d182582f7984c9f9ff1325351f
- SHA1 2e667b0fac9578f8f1337f83e1665d5bcd42e8ee
- SHA512 28e03ad5d4b3b37b79f7e541062e04a38bb7d5a971673b52cc11eaacd10d26c83a72979b271bd353871f5cb204ef064221e8ca45891e63787d98518bc8237f07
- SSDEEP 768:n6e9lze3CCnLtdvoip4G+z0ha2ErzmmYB2Er3:n6e9c3CCnLtdvoip9Bha2ErzmmYB2E7
- TLSH T1B6035A0865D8C818C5F50A66276FDE71C57BE5C6B30B0EE570BCA754A9C2B042EFA09F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 37KB
- SHA256 8cf69da122ae30fb44907e3d6d30cd2219667b9f448b1884a95a62bf0b8dfb5f
- MD5 6a291b4e893b1000f78bb7c1c7077496
- SHA1 340f5bb6a764331a9b6470e2ee4632e92d877d60
- SHA512 3812a2d9febeab0fd16f13d79ae8f3064530e48c96dde9ff3ca70994a76a7d71f5f0f4ed77c0ba768dfa9fb84c348144ade3a2982676c3b86faee50ab026e201
- SSDEEP 768:n6e9lze3CCnLtdvoip4G+z0ha2ErzmmYB2Er9:n6e9c3CCnLtdvoip9Bha2ErzmmYB2EZ
- TLSH T1C5035A0865D8C818C5F50A66276FDE71C57BE5C6B30B0EE570BCA754A9C2B042EFA09F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\3DEF93~1\wintun.cat
- Size 9KB
- SHA256 602187e5470ddbdf9421045bb0515f358c88bf88f59fd8a886fb6373da5d0f82
- MD5 faba2ccb8fe366fd281ca6be6d2bb7c2
- SHA1 bb7bd32a21f3eba652fde24146387ffc5278143e
- SHA512 ec424a545e2598f299706499dab07b4d12b0734a52f928216a53bca2b7f384b97bd4fc092d7d68de636a75daf79ac392c4b49b7251ec011236de1659253d6214
- SSDEEP 192:6wRp8yDJCKE4uyK6iWPFWQFAnTz36ArNc4qnajr7NCo:L/iWPFRI64lrNt
- TLSH T10522F8E28A5C44C2E993ADB05398F5977C3E7BDB4C20906922ABF7650DD27C5E70843E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\3DEF93~1\wintun.sys
- Size 37KB
- SHA256 eb58bf00df7b4f98334178e75df3348c609ea5c6c74cf7f185f363aa23976c8b
- MD5 1945d7d1f56b67ae1cad6ffe13a01985
- SHA1 2c1a369f9e12e5c6549439e60dd6c728bf1bffde
- SHA512 09af87898528eaa657d46c79b7c4ebc0e415478a421b0b97355294c059878178eb32e172979ee9b7c59126861d51a5831e337a96666c43c96cb1cf8f11bc0a0f
- SSDEEP 768:UwtoHKG2ZqGhg+Eqpg0bUORjj71PKgPrbHZIb4:UwtoHt2ZLg+zg5cv7ld7Zy4
- TLSH T1E1037DD2E6A868C2E973CE3151F5E523BD74B2612B20D5EF4511C4350FA3BC1EA7863A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\3def93af44edb488b6b178b4b22a001b9086f0ccd5877cb37b7984530fbc3206\wintun.inf
- Size 1KB
- SHA256 44098408ab9611dd99a38e140c7fb1ca5dce6eb2d5f0d5e500547ac1ba5d235b
- MD5 8480579050970b0812cc3d9a1bce1340
- SHA1 edebebd090602f4eee375ad754c8566d4fda23cb
- SHA512 46de9202c3cf0ddbf19f9e0e02ec17530f2722abfa08669fd30a6095ce2342fa89a2cc59c1d47afd82b48c915bb95f4c6d16e7c21129a9c8f09c2bf239566933
- TLSH T1933135D954E10D693CD3322E77277F81E65C123041CA200EB6FD8559D64BCDFA654CAA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\EC4F02~1\tap0901.cat
- Size 11KB
- SHA256 ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7
- MD5 71ecece58bb00bdc1e728ee28d7a5332
- SHA1 4305889415cf95662a30d024f1138f1af224cf42
- SHA512 9b23404d867fc4fd7c7beeba3768e8fed3113cc7430ec1bc9ca7faf6e6105388de7057b1402f9b4ba8fbc11e5fcd3afe14233721e8d15b6c0bed40f65aa5b58b
- SSDEEP 192:HxDuDjbfXJCKnEwKUNhYCy1QySaI8HNsAX01k9z3Aqcp9wdGEC:CXaUNh3auatHNsAR9zWZEC
- TLSH T1FF322AA2942C52C3ECABBC7043D4E9977C3E2BCB1950506A269FF7141DA73C8EB1516E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\EC4F02~1\tap0901.sys
- Size 40KB
- SHA256 581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1
- MD5 1bb9772a05517e227d1dafd3936e8f66
- SHA1 d695ca5791a4b6a3509939aebdfaf5e229c6fbcf
- SHA512 3f1966038f91b887fe1a71474929bd87f3c75091846c6e9563f7424d3a7c19c908f1d874895341c61a868a616aba637e3d4188d4ebb7383087886a13a4dc0aa2
- SSDEEP 768:EGvByM5JLLvslmdu9lsECPURPNkilzdCH3C9zySb:EfM7VE88fkilzdCHOzySb
- TLSH T112038DD16AA814D1E8AA9874C7EBCE43F7B5B1430311AAEF0764D6691F23BD05637328
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\ec4f022f8a9a202401dbb81f8def70f5af879b283619e8e838cc19008832e679\OemVista.inf
- Size 7KB
- SHA256 1327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9
- MD5 6f5ffb58a9e406ab1643c890e2a198c6
- SHA1 3ff1faba00ac18a93e88a6f2bbfa747c9fdc7e0c
- SHA512 af29bc13cc02238208c51e4e95dd0a4445a952755635a9eab38aa77a5c087cc8e2025af55d8f3a0e9f2430baa91534e7f892bb71aa0ef72bab4483211a845b4b
- SSDEEP 192:wr8tW9yCTi314vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGBdkkzo3DcNSj6jvKFkPs7EQTXvtk
- TLSH T1F9F150681C83EE3A31FEE58557565EC7E24611823A172800355CFC549BBDD9FE33C92A
- MD5 SHA1 SHA512 SSDEEP TLSH