Overview
overview
8Static
static
3HWID Spoof...x).zip
windows10-2004-x64
1HWID Spoof...x).zip
windows11-21h2-x64
1TraceX Fin...er.bat
windows10-2004-x64
3TraceX Fin...er.bat
windows11-21h2-x64
3TraceX Fin...rs.ps1
windows10-2004-x64
3TraceX Fin...rs.ps1
windows11-21h2-x64
3TraceX Fin...ds.ps1
windows10-2004-x64
3TraceX Fin...ds.ps1
windows11-21h2-x64
3TraceX Fin...ds.ps1
windows10-2004-x64
3TraceX Fin...ds.ps1
windows11-21h2-x64
3TraceX Fin...ss.ps1
windows10-2004-x64
3TraceX Fin...ss.ps1
windows11-21h2-x64
3TraceX Fin...id.ps1
windows10-2004-x64
3TraceX Fin...id.ps1
windows11-21h2-x64
3TraceX Fin...ds.ps1
windows10-2004-x64
3TraceX Fin...ds.ps1
windows11-21h2-x64
3TraceX Fin...nt.ps1
windows10-2004-x64
3TraceX Fin...nt.ps1
windows11-21h2-x64
3TraceX Fin...ls.ps1
windows10-2004-x64
3TraceX Fin...ls.ps1
windows11-21h2-x64
3TraceX Fin...pn.ps1
windows10-2004-x64
8TraceX Fin...pn.ps1
windows11-21h2-x64
8TraceX Fin...er.ps1
windows10-2004-x64
3TraceX Fin...er.ps1
windows11-21h2-x64
3TraceX Fin...me.ps1
windows10-2004-x64
3TraceX Fin...me.ps1
windows11-21h2-x64
3TraceX Fin...e.ovpn
windows10-2004-x64
3TraceX Fin...e.ovpn
windows11-21h2-x64
3TraceX Fin...64.exe
windows10-2004-x64
1TraceX Fin...64.exe
windows11-21h2-x64
1TraceX Fin...er.ps1
windows10-2004-x64
3TraceX Fin...er.ps1
windows11-21h2-x64
3Analysis
- max time kernel
150s - max time network
142s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/06/2026, 19:41
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
HWID Spoofer Final (tracex).zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
HWID Spoofer Final (tracex).zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
TraceX Final/scripts/TraceX-Helpers.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
TraceX Final/scripts/TraceX-Helpers.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
TraceX Final/scripts/change_disk_ids.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
TraceX Final/scripts/change_disk_ids.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
TraceX Final/scripts/change_hardware_ids.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
TraceX Final/scripts/change_hardware_ids.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
TraceX Final/scripts/change_mac_address.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
TraceX Final/scripts/change_mac_address.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
TraceX Final/scripts/change_monitor_hwid.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
TraceX Final/scripts/change_monitor_hwid.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
TraceX Final/scripts/change_registry_hwids.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
TraceX Final/scripts/change_registry_hwids.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
TraceX Final/scripts/create_restore_point.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
TraceX Final/scripts/create_restore_point.ps1
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral19
Sample
TraceX Final/scripts/hide_peripheral_serials.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
TraceX Final/scripts/hide_peripheral_serials.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
TraceX Final/scripts/setup_vpn.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral22
Sample
TraceX Final/scripts/setup_vpn.ps1
Resource
win11-20260513-en
windows11-21h2-x64
27 signatures
150 seconds
Behavioral task
behavioral23
Sample
TraceX Final/scripts/tracex_cleaner.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
TraceX Final/scripts/tracex_cleaner.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
TraceX Final/scripts/uninstall_game.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
TraceX Final/scripts/uninstall_game.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
TraceX Final/templates/nordvpn_template.ovpn
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
TraceX Final/templates/nordvpn_template.ovpn
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
TraceX Final/tools/AMIDEWINx64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
TraceX Final/tools/AMIDEWINx64.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
TraceX Final/tools/HWID-Spoofer.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
TraceX Final/tools/HWID-Spoofer.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target TraceX Final/scripts/setup_vpn.ps1
- Size 28KB
- Sample260608-yd7lysew21
- SHA256 36f7cca326f67cacf24d63facafa92e4300527946b590280da30e99e65ab4752
- MD5 56fa01e2df8c9952a5c18531cb080d88
- SHA1 4ec595d5822d9ee61cb0d3c695b63c98a5a65373
- SHA512 acf641ef78b5c0ce372a33985914b35edf3639abca397aa62d95f64a577cd6a2e33703c808f0964e68d3bb3c0fd6c95a675f7fb913da5764679c9108d1a1afd9
- SSDEEP 384:4XH2dunqF8g9Ch21nTfViwZNJ41ZDaTcaQUJBYxt4sdh7EarMjKwjlecW2z:K2JrViY7qaYaQUsh7Wleiz
- TLSH T1D7D2C71E9E01172EAABB877FC8406064FD4A553B038A1582729CD1D53FF052EC3B9D97
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\IsInstalled = "1" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\DontAsk = "2" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\StubPath = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v OPENVPN-GUI /t REG_SZ /d \"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\"" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\ = "OpenVPN 2.6.14-I001 amd64" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\Version = "1" MsiExec.exe - Drops file in Drivers directory 9 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\SETE22D.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETE22D.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\SETE76D.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETE76D.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\SETEBB3.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\ovpn-dco.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\wintun.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe File created C:\Windows\System32\drivers\SETEBB3.tmp DrvInst.exe - Executes dropped EXE 6 IoCs
pid Process 5228 openvpn-gui.exe 5280 openvpn.exe 5928 openvpnserv.exe 6024 openvpnserv2.exe 704 openvpnserv2.exe 5368 openvpn-gui.exe - Loads dropped DLL 22 IoCs
pid Process 2208 MsiExec.exe 2208 MsiExec.exe 3960 MsiExec.exe 3960 MsiExec.exe 3960 MsiExec.exe 3960 MsiExec.exe 2652 MsiExec.exe 2652 MsiExec.exe 2652 MsiExec.exe 2652 MsiExec.exe 2652 MsiExec.exe 5280 openvpn.exe 5280 openvpn.exe 5280 openvpn.exe 5280 openvpn.exe 5280 openvpn.exe 5280 openvpn.exe 5928 openvpnserv.exe 2652 MsiExec.exe 2652 MsiExec.exe 3960 MsiExec.exe 2208 MsiExec.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\OpenVPN-GUI = "C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe" msiexec.exe - Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 32 4280 msiexec.exe 115 4280 msiexec.exe 116 4280 msiexec.exe 120 4332 msiexec.exe 121 4280 msiexec.exe 115 4280 msiexec.exe 120 4332 msiexec.exe -
pid Process 2728 PowerShell.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\netl1e64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\netrtwlanu.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_1fab0fd8cb4d7dee\netwmbclass.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\netwew01.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{cfe32c55-30d0-e84f-a8a0-aa0a5aa8a4a2}\SETDA02.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_2299fee965b7e92c\netvwwanmp.PNF MsiExec.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91eabed7-c8cd-9e42-aa6c-ec4d9cad0952}\ovpn-dco.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\netl260a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_bccd4c0a924862b1\netrndis.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_35c52a008b0fba12\netrtwlane.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\netwtw02.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\OemVista.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{91eabed7-c8cd-9e42-aa6c-ec4d9cad0952}\SETE02A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91eabed7-c8cd-9e42-aa6c-ec4d9cad0952} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{70311b52-f009-2f47-9449-f9b8f6240b2c}\OemVista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\tap0901.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{91eabed7-c8cd-9e42-aa6c-ec4d9cad0952}\SETE03A.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\net2ic68.inf_amd64_23084e964d79333d\net2ic68.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_206e9e544d84356f\ndisimplatformmp.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_6150ccb5b6a4c3cd\rt640x64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{cfe32c55-30d0-e84f-a8a0-aa0a5aa8a4a2}\SETD9F0.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1ed57daf97af7063\netrasa.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_62f41b89e0dc2537\netwtw08.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_f1efe88b4f90c639\netax88772.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\net8187bv64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\netbc64.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw10.inf_amd64_3b49c2812809f919\netwtw10.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_cf2766005585f6cd\c_net.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\usb4p2pnetadapter.inf_amd64_a9fd59ce64f17c8a\usb4p2pnetadapter.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\rtcx21x64.inf_amd64_d2a498d51a4f7bec\rtcx21x64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_3aa3e69e968123a7\wceisvista.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.inf DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_ef71073a5867971f\ipoib6x.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_a39ece60dbc76c55\rtux64w10.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cfe32c55-30d0-e84f-a8a0-aa0a5aa8a4a2}\wintun.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{70311b52-f009-2f47-9449-f9b8f6240b2c}\SETDF10.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{70311b52-f009-2f47-9449-f9b8f6240b2c}\SETDF21.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91eabed7-c8cd-9e42-aa6c-ec4d9cad0952}\SETE02A.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\nett4x64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\netwsw00.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cfe32c55-30d0-e84f-a8a0-aa0a5aa8a4a2}\wintun.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cfe32c55-30d0-e84f-a8a0-aa0a5aa8a4a2}\SETD9F1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cfe32c55-30d0-e84f-a8a0-aa0a5aa8a4a2}\SETDA02.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{70311b52-f009-2f47-9449-f9b8f6240b2c}\SETDF22.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_badb18141de40629\netbxnda.PNF MsiExec.exe - Drops file in Program Files directory 27 IoCs
description ioc Process File created C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg msiexec.exe File created C:\Program Files\OpenVPN\sample-config\client.ovpn msiexec.exe File created C:\Program Files\OpenVPN\doc\INSTALL-win32.txt msiexec.exe File created C:\Program Files\OpenVPN\ssl\modules\legacy.dll msiexec.exe File created C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpnserv.exe msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpnserv2.exe msiexec.exe File created C:\Program Files\OpenVPN\include\tap-windows.h msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpn.exe msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpn-plap-uninstall.reg msiexec.exe File created C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll msiexec.exe File created C:\Program Files\OpenVPN\res\ovpn.ico msiexec.exe File created C:\Program Files\OpenVPN\bin\vcruntime140.dll msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpn-plap-install-new.reg MsiExec.exe File created C:\Program Files\OpenVPN\bin\openvpn-gui.exe msiexec.exe File created C:\Program Files\OpenVPN\config\README.txt msiexec.exe File created C:\Program Files\OpenVPN\bin\libssl-3-x64.dll msiexec.exe File created C:\Program Files\OpenVPN\log\README.txt msiexec.exe File created C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.cat msiexec.exe File created C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf msiexec.exe File created C:\Program Files\OpenVPN\bin\tapctl.exe msiexec.exe File created C:\Program Files\OpenVPN\bin\libopenvpn_plap.dll msiexec.exe File created C:\Program Files\OpenVPN\license.txt msiexec.exe File created C:\Program Files\OpenVPN\doc\openvpn.8.html msiexec.exe File created C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.sys msiexec.exe File created C:\Program Files\OpenVPN\config-auto\README.txt msiexec.exe File created C:\Program Files\OpenVPN\sample-config\server.ovpn msiexec.exe - Drops file in Windows directory 46 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_603397398\protocols.json msedge.exe File created C:\Windows\SystemTemp\~DF3DD0237223419B4B.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSID1E7.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log MsiExec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSIDFE4.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico msiexec.exe File created C:\Windows\SystemTemp\~DF61D3ECC9020CEF34.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_603397398\manifest.json msedge.exe File opened for modification C:\Windows\Installer\MSICF64.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem5.inf DrvInst.exe File opened for modification C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\openvpn.ico msiexec.exe File opened for modification C:\Windows\SystemTemp msedge.exe File created C:\Windows\Installer\e58c7c0.msi msiexec.exe File opened for modification C:\Windows\Installer\e58c7c0.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E} msiexec.exe File opened for modification C:\Windows\Installer\MSICF53.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF66B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF68B.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFCF0789F85A051B67.TMP msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIDB10.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\openvpn.ico msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_1725391302\manifest.json msedge.exe File opened for modification C:\Windows\Installer\MSICFB3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID0DD.tmp msiexec.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File created C:\Windows\inf\oem4.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSIF6FA.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF580C194F5ADB3097.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSICE87.tmp msiexec.exe File created C:\Windows\Installer\e58c7c2.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSICADD.tmp msiexec.exe File created C:\Windows\inf\oem5.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSIE1AA.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 6084 sc.exe 6136 sc.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4980 msedge.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027a96ea556b175d40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000027a96ea50000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090027a96ea5000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a27a96ea5000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d27a96ea5000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial\Default svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe\JScriptSetScriptStateStarted = "240705750" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe - Modifies registry class 61 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command\ = "\"notepad.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\ProductIcon = "C:\\Windows\\Installer\\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\\openvpn.ico" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn.exe\" --pause-exit --config \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\ = "Import into OpenVPN-GUI" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{9D999C7A-2FC9-4C19-8A79-B37D40B5278D} msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.SampleCfg = "OpenVPN" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\ProductName = "OpenVPN 2.6.14-I001 amd64" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI = "OpenVPN" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Service = "OpenVPN" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\PackageName = "OpenVPN-2.6.14-I001-amd64.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\TraceX Final\\tools\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.TAPWindows6 = "Drivers" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenSSL = "\x06" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.OvpnDco = "Drivers" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ovpn\ = "OpenVPNFile" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\PackageCode = "22912DF0EEBE3A3498FA548D65979F16" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Version = "33949049" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.ovpn msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.PLAP.Register = "\x06OpenVPN.Service" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\ = "OpenVPN Config File" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\DefaultIcon\ = "C:\\Program Files\\OpenVPN\\res\\ovpn.ico,0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\" --command import \"%1\"" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\InstanceType = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings PowerShell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.Wintun = "Drivers" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\ = "import" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\ = "Start OpenVPN on this config file" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Documentation = "OpenVPN" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI.OnLogon = "OpenVPN.GUI" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\EasyRSA = "\x06OpenSSL" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TraceX Final\\tools\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72\3FDCD1DCCACB33241ACCD5FAEEE106E4 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media\1 = ";" msiexec.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2728 PowerShell.exe 2728 PowerShell.exe 4332 msiexec.exe 4332 msiexec.exe 1828 msedge.exe 1828 msedge.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid 4 - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2728 PowerShell.exe Token: SeShutdownPrivilege 4280 msiexec.exe Token: SeIncreaseQuotaPrivilege 4280 msiexec.exe Token: SeSecurityPrivilege 4332 msiexec.exe Token: SeCreateTokenPrivilege 4280 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4280 msiexec.exe Token: SeLockMemoryPrivilege 4280 msiexec.exe Token: SeIncreaseQuotaPrivilege 4280 msiexec.exe Token: SeMachineAccountPrivilege 4280 msiexec.exe Token: SeTcbPrivilege 4280 msiexec.exe Token: SeSecurityPrivilege 4280 msiexec.exe Token: SeTakeOwnershipPrivilege 4280 msiexec.exe Token: SeLoadDriverPrivilege 4280 msiexec.exe Token: SeSystemProfilePrivilege 4280 msiexec.exe Token: SeSystemtimePrivilege 4280 msiexec.exe Token: SeProfSingleProcessPrivilege 4280 msiexec.exe Token: SeIncBasePriorityPrivilege 4280 msiexec.exe Token: SeCreatePagefilePrivilege 4280 msiexec.exe Token: SeCreatePermanentPrivilege 4280 msiexec.exe Token: SeBackupPrivilege 4280 msiexec.exe Token: SeRestorePrivilege 4280 msiexec.exe Token: SeShutdownPrivilege 4280 msiexec.exe Token: SeDebugPrivilege 4280 msiexec.exe Token: SeAuditPrivilege 4280 msiexec.exe Token: SeSystemEnvironmentPrivilege 4280 msiexec.exe Token: SeChangeNotifyPrivilege 4280 msiexec.exe Token: SeRemoteShutdownPrivilege 4280 msiexec.exe Token: SeUndockPrivilege 4280 msiexec.exe Token: SeSyncAgentPrivilege 4280 msiexec.exe Token: SeEnableDelegationPrivilege 4280 msiexec.exe Token: SeManageVolumePrivilege 4280 msiexec.exe Token: SeImpersonatePrivilege 4280 msiexec.exe Token: SeCreateGlobalPrivilege 4280 msiexec.exe Token: SeCreateTokenPrivilege 4280 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4280 msiexec.exe Token: SeLockMemoryPrivilege 4280 msiexec.exe Token: SeIncreaseQuotaPrivilege 4280 msiexec.exe Token: SeMachineAccountPrivilege 4280 msiexec.exe Token: SeTcbPrivilege 4280 msiexec.exe Token: SeSecurityPrivilege 4280 msiexec.exe Token: SeTakeOwnershipPrivilege 4280 msiexec.exe Token: SeLoadDriverPrivilege 4280 msiexec.exe Token: SeSystemProfilePrivilege 4280 msiexec.exe Token: SeSystemtimePrivilege 4280 msiexec.exe Token: SeProfSingleProcessPrivilege 4280 msiexec.exe Token: SeIncBasePriorityPrivilege 4280 msiexec.exe Token: SeCreatePagefilePrivilege 4280 msiexec.exe Token: SeCreatePermanentPrivilege 4280 msiexec.exe Token: SeBackupPrivilege 4280 msiexec.exe Token: SeRestorePrivilege 4280 msiexec.exe Token: SeShutdownPrivilege 4280 msiexec.exe Token: SeDebugPrivilege 4280 msiexec.exe Token: SeAuditPrivilege 4280 msiexec.exe Token: SeSystemEnvironmentPrivilege 4280 msiexec.exe Token: SeChangeNotifyPrivilege 4280 msiexec.exe Token: SeRemoteShutdownPrivilege 4280 msiexec.exe Token: SeUndockPrivilege 4280 msiexec.exe Token: SeSyncAgentPrivilege 4280 msiexec.exe Token: SeEnableDelegationPrivilege 4280 msiexec.exe Token: SeManageVolumePrivilege 4280 msiexec.exe Token: SeImpersonatePrivilege 4280 msiexec.exe Token: SeCreateGlobalPrivilege 4280 msiexec.exe Token: SeCreateTokenPrivilege 4280 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4280 msiexec.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 4280 msiexec.exe 2704 msedge.exe 2704 msedge.exe 4280 msiexec.exe 5228 openvpn-gui.exe 5228 openvpn-gui.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 5228 openvpn-gui.exe 5228 openvpn-gui.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2704 2728 PowerShell.exe 81 PID 2704 wrote to memory of 2468 2704 msedge.exe 82 PID 2728 wrote to memory of 4280 2728 PowerShell.exe 83 PID 2704 wrote to memory of 4980 2704 msedge.exe 84 PID 2704 wrote to memory of 2200 2704 msedge.exe 85 PID 2704 wrote to memory of 2200 2704 msedge.exe 85 PID 2704 wrote to memory of 2200 2704 msedge.exe 85 PID 2704 wrote to memory of 4572 2704 msedge.exe 86 PID 2704 wrote to memory of 4572 2704 msedge.exe 86 PID 2704 wrote to memory of 1532 2704 msedge.exe 89 PID 2704 wrote to memory of 1532 2704 msedge.exe 89 PID 2704 wrote to memory of 1532 2704 msedge.exe 89 PID 2704 wrote to memory of 3948 2704 msedge.exe 88 PID 2704 wrote to memory of 3948 2704 msedge.exe 88 PID 2704 wrote to memory of 3948 2704 msedge.exe 88 PID 2704 wrote to memory of 2712 2704 msedge.exe 90 PID 2704 wrote to memory of 2164 2704 msedge.exe 91 PID 2704 wrote to memory of 1284 2704 msedge.exe 92 PID 2704 wrote to memory of 4444 2704 msedge.exe 93 PID 2704 wrote to memory of 2712 2704 msedge.exe 90 PID 2704 wrote to memory of 2712 2704 msedge.exe 90 PID 2704 wrote to memory of 2164 2704 msedge.exe 91 PID 2704 wrote to memory of 2164 2704 msedge.exe 91 PID 2704 wrote to memory of 1284 2704 msedge.exe 92 PID 2704 wrote to memory of 1284 2704 msedge.exe 92 PID 2704 wrote to memory of 4444 2704 msedge.exe 93 PID 2704 wrote to memory of 4444 2704 msedge.exe 93 PID 2704 wrote to memory of 4288 2704 msedge.exe 95 PID 2704 wrote to memory of 4288 2704 msedge.exe 95 PID 2704 wrote to memory of 1552 2704 msedge.exe 97 PID 2704 wrote to memory of 1552 2704 msedge.exe 97 PID 2704 wrote to memory of 4140 2704 msedge.exe 98 PID 2704 wrote to memory of 4140 2704 msedge.exe 98 PID 2704 wrote to memory of 4140 2704 msedge.exe 98 PID 2704 wrote to memory of 760 2704 msedge.exe 99 PID 2704 wrote to memory of 760 2704 msedge.exe 99 PID 2704 wrote to memory of 3916 2704 msedge.exe 100 PID 2704 wrote to memory of 3916 2704 msedge.exe 100 PID 2704 wrote to memory of 876 2704 msedge.exe 102 PID 2704 wrote to memory of 3812 2704 msedge.exe 103 PID 876 wrote to memory of 1032 876 msedge.exe 104 PID 2704 wrote to memory of 3064 2704 msedge.exe 105 PID 2704 wrote to memory of 3064 2704 msedge.exe 105 PID 2704 wrote to memory of 3800 2704 msedge.exe 106 PID 2704 wrote to memory of 3800 2704 msedge.exe 106 PID 2704 wrote to memory of 5000 2704 msedge.exe 107 PID 2704 wrote to memory of 5000 2704 msedge.exe 107 PID 2704 wrote to memory of 4776 2704 msedge.exe 108 PID 2704 wrote to memory of 4776 2704 msedge.exe 108 PID 2704 wrote to memory of 2208 2704 msedge.exe 109 PID 2704 wrote to memory of 2208 2704 msedge.exe 109 PID 4332 wrote to memory of 2208 4332 msiexec.exe 111 PID 2704 wrote to memory of 3960 2704 msedge.exe 120 PID 2704 wrote to memory of 704 2704 msedge.exe 115 PID 2704 wrote to memory of 3904 2704 msedge.exe 116 PID 4332 wrote to memory of 2656 4332 msiexec.exe 118 PID 4332 wrote to memory of 3960 4332 msiexec.exe 120 PID 4332 wrote to memory of 2652 4332 msiexec.exe 121 PID 4428 wrote to memory of 3744 4428 svchost.exe 123 PID 4428 wrote to memory of 760 4428 svchost.exe 124 PID 4428 wrote to memory of 2452 4428 svchost.exe 125 PID 4428 wrote to memory of 3264 4428 svchost.exe 127 PID 2652 wrote to memory of 5212 2652 MsiExec.exe 131 PID 5228 wrote to memory of 5280 5228 openvpn-gui.exe 134 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\TraceX Final\scripts\setup_vpn.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.nordvpn.net/SH9fX2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ffc66c9c188,0x7ffc66c9c194,0x7ffc66c9c1a03⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,9916391331919831379,7121826486879240465,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:113⤵
- System Time Discovery
PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,11283649710052597584,16844884471686587486,262144 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:23⤵PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,14498797708916354179,14689143575925878346,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:133⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,13895763287049272410,8124479164241893877,2097152 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:13⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,4675534804764522614,16059974729064433319,2097152 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:13⤵PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,4427467291902131229,8092976281377560013,2097152 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:13⤵PID:2712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,13168275960621964140,1782911639041112905,2097152 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:93⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4228,i,14983434754752178207,15541913645481663299,2097152 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:13⤵PID:1284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4268,i,7341239648160002859,12755103686541990781,2097152 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:93⤵PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,861645432310230515,6162443304504271055,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:143⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,7172122811574303113,11912843374971933455,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:143⤵PID:1552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5168,i,13962677887166738976,10921267858369700663,2097152 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:13⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,5819182765082701359,16695797927211963463,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:143⤵PID:760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,4363090615811109102,5092739392921941189,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:143⤵PID:3916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,9096000700067131603,10349541408732383040,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:143⤵PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,9443984392523539178,15307670010140593538,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:143⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11284⤵PID:1032
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,9096000700067131603,10349541408732383040,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:143⤵PID:3812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,15866831809363579606,9077352995484704778,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:143⤵PID:3064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,14599918766132604949,2427127912540164982,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:143⤵PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,4293004454270550973,8346475718843351083,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:143⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,5062311567796058708,7642684456404127935,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:143⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,240210352366170421,13823063476562255157,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:143⤵PID:2208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,11376559588191006180,11175378617329214040,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:143⤵PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,18349850668821819821,13385952033796786889,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:143⤵PID:704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,11550818912776107306,576008887267704956,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:143⤵PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,18145220474637453346,11766048729623500680,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:143⤵PID:5612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,2355844643086860036,3977708237337515713,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:143⤵PID:5340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6256,i,1813962957580235776,14764473108898686386,262144 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=880 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,11821114642599550877,17822717519960292109,524288 --field-trial-handle=2136,i,5331576809137434010,9230860910071397505,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:143⤵PID:4464
-
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\OpenVPN-2.6.14-I001-amd64.msi"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4228
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 56856A0BD6396A26198EE165AFE23076 C2⤵
- Loads dropped DLL
PID:2208 -
C:\Program Files\OpenVPN\bin\openvpn-gui.exe"C:\Program Files\OpenVPN\bin\openvpn-gui.exe"3⤵
- Executes dropped EXE
PID:5368
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2656
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding A7C2056D841126CACE1D5DAF8845FDA12⤵
- Loads dropped DLL
PID:3960
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D69FE218975464C3200E7610F337977A E Global\MSI00002⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\System32\netsh.exenetsh interface set interface name="Local Area Connection" newname="OpenVPN Wintun"3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5212
-
-
C:\Windows\System32\netsh.exenetsh interface set interface name="Local Area Connection" newname="OpenVPN TAP-Windows6"3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5620
-
-
C:\Windows\System32\netsh.exenetsh interface set interface name="Local Area Connection" newname="OpenVPN Data Channel Offload"3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5792
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config OpenVPNService start= auto3⤵
- Launches sc.exe
PID:6084
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start OpenVPNService3⤵
- Launches sc.exe
PID:6136
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Windows\Temp\d95a09c7f82fdc64b6be219214d947e0b3595d35b0a6f07fea47c57b0a79a86c\wintun.inf" "9" "460b16c83" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "C:\Windows\Temp\d95a09c7f82fdc64b6be219214d947e0b3595d35b0a6f07fea47c57b0a79a86c"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3744
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Windows\Temp\c7a8da2883c34da26a715518ccd6bac4f445312530125f38d9b3f23b33e0d4fd\OemVista.inf" "9" "4b7e20947" "000000000000016C" "WinSta0\Default" "0000000000000168" "208" "C:\Windows\Temp\c7a8da2883c34da26a715518ccd6bac4f445312530125f38d9b3f23b33e0d4fd"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:760
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf" "9" "4e746adf3" "0000000000000168" "WinSta0\Default" "0000000000000150" "208" "C:\Program Files\Common Files\ovpn-dco\Win11"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2452
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:9ef34515d755ec66:Wintun.Install:0.8.0.0:wintun," "42b53aaff" "000000000000015C" "1413"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3264
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\NET\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.27.0.0:root\tap0901," "433338203" "0000000000000178" "1413"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5572
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\NET\0002" "C:\Windows\INF\oem5.inf" "oem5.inf:c695c3de07ba2b5d:ovpn-dco_Device:1.2.1.0:ovpn-dco," "43b135903" "0000000000000184" "1413"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5748
-
-
C:\Program Files\OpenVPN\bin\openvpn-gui.exe"C:\Program Files\OpenVPN\bin\openvpn-gui.exe"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Program Files\OpenVPN\bin\openvpn.exeopenvpn --version2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5280
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:5380
-
C:\Program Files\OpenVPN\bin\openvpnserv.exe"C:\Program Files\OpenVPN\bin\openvpnserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5928
-
C:\Program Files\OpenVPN\bin\openvpnserv2.exe"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"1⤵
- Executes dropped EXE
PID:6024
-
C:\Program Files\OpenVPN\bin\openvpnserv2.exe"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"1⤵
- Executes dropped EXE
PID:704
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58c7c1.rbs
- Size 876KB
- SHA256 fdb3f91017aa650f21ba1f12ea3004f8ab6f8a6158ccca249fc8adca13bbfd70
- MD5 ca3aa61567a1e407ceb16856cb786ca5
- SHA1 0ac9204466ab546bb0171ca872595301187cf2a8
- SHA512 6ea78ef412f26422339b29bc2d56181988b826741209d3a350a845ea30c6d5d1afbe21099bffa4bda693d8342081a58b82f1b1a850874f4de9e2dc23eb93e2ee
- SSDEEP 24576:LC4LJNBjSblC4LJNBjSbqC4LJNBjSb9C4LJNBjSbv:rvB+JvB+OvB+BvB+b
- TLSH T1B1157D05B7D000F9EDB7863889674616E773780107749A9F03A4837AEF2F7D1A639B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win11\ovpn-dco.cat
- Size 11KB
- SHA256 8c9456aeacd5566234519b5b34ceecd0f7ebb22f6813747e595f5945517ec438
- MD5 8fd89f82a273cd3ed2f76f7f09cf30ae
- SHA1 43bb4e81acac468715e874ab86521497ca2e9369
- SHA512 f77ad5dca3f72701ab2b779e900d22fa3f0c3ca6b8713e25bb7d6d1480992518d66879b6315122c555b32be527fef7c86ead1d59244c955287d48c3132b684f0
- SSDEEP 192:FXasYRLFJCtNRnnXBEwZIhYCpMKIjwX01k9z3AmFX:FS2NdRIh3jHR9zlV
- TLSH T199322BA796280082DD97BD6042D8E897BC3E3BCB1C11556A22AFFA540DD33D8FB1416F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win11\ovpn-dco.sys
- Size 90KB
- SHA256 2c2958dac6f36922ae094705e058bf6470e1622b31318fb9fe0db5457e383f45
- MD5 6b0722f0b6ed86877d96da4a57f3aa03
- SHA1 85cd52a10a8be6ca807fb5f6e180a1b1a1554583
- SHA512 74c399af44e982bb02eeb103bc634d2b5923b5623625a87bd148b6dad1afc438775a00ecbcdeeb2adb13d04c3b1d23a92cd9ee815c89f1af4fdbb3eb8fc3f49b
- SSDEEP 1536:uDK30YojzlMIQLPZkecHuvaSsYU2ug/0A0gA1j7ajE/T2yR1O8Jz4:u2x5pTZUHuvat2ug/0A0Px2yTOw0
- TLSH T1CE93F875A6E010D4F47B96F886B68A05BFB17A922F32D6DF0410856D0F32BC8CE39755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf
- Size 2KB
- SHA256 1f6c35bc11d910f91c32ea54894d0fddb0094876bdd526d04a9287d04d636242
- MD5 77da079a3665afc84d05c3d07bcaa0d0
- SHA1 3fbfafe2c08100f5b46b792398c2ecb9157760e9
- SHA512 10fcd8464c6aab386bf2f675175598764e0b784a898b7b450fef3d055ecf902c7a57ac0aef2725b9e6899146e4e9230c8677bfd2a8f18489b642fa6beca25507
- TLSH T19441F14A52C20FBD3B432D7596077BA2B9D6910050C8151AF18CDA468B8FF99B31B7EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\OpenVPN\bin\openvpn-gui.exe
- Size 1.1MB
- SHA256 1f07550f3decbfd7c8737694001ee13c26de84ef498dc493d313a79db2080646
- MD5 75d5db58796acffda38dd0139a9aa15a
- SHA1 f1eeab1b9967f0ba54f12f6ead70a0ce85f597e2
- SHA512 d987ded834671be0894f5953a800947280b012288a2ec44fdcc7fc42dd08e70577ddd6f4c22118e18ebbf0fdca0c5054e8c11bbd3b104bd7c7f8b8f9056999bd
- SSDEEP 12288:wtlBCAQ/WWOn+wP/nQStD6Fo+41GqKqx8xmwApbn:wO/LOnBHQS4Fo+yGqKtobn
- TLSH T129457001B3F98118F5F3AB349DBA46526E3BBC815E34CA8E5295755E0A72B90DD30B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg
- Size 454B
- SHA256 18b542b3de918da103ea6d79f3be0c5af8349502dc9c673f2db5b6f05dc57d35
- MD5 2b7d47401bad3221ed6d92996d49f9f7
- SHA1 a3b8cbc667f5023e4a4dd8c50bc6ab78c51048de
- SHA512 dceafceeff05a61fde179dbdf13bc2b1243ee756028b1c8a96e311f279effbd9e2567f65f8ae063841ca2c4961f6b522553b9c7095daa94898ff5ed048607aa5
- TLSH T151F0DCF2CE079202DA91122D291606F147B64569758E0B92F181A3A86DFECE343FC08B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\OpenVPN\bin\tapctl.exe
- Size 41KB
- SHA256 d5aab270d61d7d1709e85ba81525be5948ae5bf397bb7b12a11e11ba0788ecd1
- MD5 bc1fec27a50d102d805f7cdb79272b50
- SHA1 562719ef2494b237f5ff164f952b5ea4e23e097d
- SHA512 a3c0e3c489775f704bd22ef1f01ee51615ed8ab5abd6f6e13667d117dead7a3c61810e95cfec13d0d994acdaa89312cfb1b2577ae59b2639ede75149115dcb03
- SSDEEP 768:uV7EIM5A5/2jrvnihtk591X3hZaZYiLo+Cc+2EsLB:uVQIkjrPihtk591XRZaZ7Lo+ys
- TLSH T189133B016BE90099E573573898B716276A777D512B70C6DF238CC22D0F63B80BE39B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 c5a1e796dbe36d2f425ed3c1b6ebc78f8d4d8685a50d1c41ccd108f643af9033
- MD5 c29a22d23640752fe38c6775434a856f
- SHA1 5ad8c4e473d3ad5e40fd286be58c31ca5b4a5335
- SHA512 7b25ad6607327c4bea6465fd424dcb432d527a8a7d9416360a7231d5a4bdd4fc9be3e3875420281a61ba22a18886085524b06d11f96f7c5d20e6c17d4caa0609
- TLSH T132F097279AEAB5E33D02C0AFBBA88D3124E0A84E08C64822203194F147A19B5760F86D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433
- Size 727B
- SHA256 f962c69c0d7da6477f5d3c1d16188f361f4f77435d6233fb84318b2838ac25dd
- MD5 f7d6b66f09acdf6cc7e42cd8eaeefa27
- SHA1 aaaafc43742917adc3831dd461e878e803005c30
- SHA512 5d349536aa02731bd1a20044558ded26a89e596fa574b5b835267bdbac9c7a20f72f5aafa499f5d7e58ab149320806441de6c5c15edde375bebf0578f1c4e801
- TLSH T14D01658A2F6DBEC656118EDE0B6485BCBE60023A81DA652FB936908A75016220E550A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 84803e9ba61ec23ec64652b4def39958bd0fcfd2a967dd84b8cd6ea31a1e72d3
- MD5 dd01fd4e80199017dadb40360c50d71f
- SHA1 a331d9f20de50f150f658e11c9b0c77902f276ff
- SHA512 dcb135bcb87d9b1f7a112e66aa43fc7664a90b66a04cb5e761debcf873ed9bd0885637570e826608eb5dfd68a15a2c6cab1e3305bd3f25db2383e82bf6f0ea4d
- TLSH T102016509C8A51A40B828CD22C7B4B2A079BBB4F25BC502961365089D10C77616F03AA6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 6dbcbf28a95f4226648be1ae8ee5d234ea3a0ddbc6a7465369fd73affb23b515
- MD5 ccc189c500f92a6b00fbd0fcdd7ef6ca
- SHA1 bafc04b460cb8206534b519d6ae834e18b28eba8
- SHA512 dc73ae6a48f7c35455e98b26a40064fc6e8b6ec4d58ef0340c8fc50c83ac3c170d0b2a0695902d736c08abf1be1640a46e4a614f9013d945c045f0fcfeb586be
- TLSH T1FDE0202027FE542EF164977443E5A195BF2AF1132C655BBD09D1151D7D15E005CA6C34
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433
- Size 408B
- SHA256 64d8212c4b1024f5505ec047d75a0384623640e5172e72fede8b942925748d6f
- MD5 80d22ddec7482922feafce54a38c65ce
- SHA1 e083d6f38dd716af83899b29c3df6661fec6d446
- SHA512 7cf01ac3cbc3f1482d534711701b37fefc946a79da7fa46dea83f223c271b2a534f9dd8aa09aeb0a26b27d977be34e440a7116a576ee6fb58252e3d0f6ea227f
- TLSH T170E0203427FA459EF1F0E43845F6D913545AF1530956C36911C46B557B126005DE2A34
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 5a7caf9d4e3778a8ee611f4abe40815d48221b3d93583820c5a69c30ec976f53
- MD5 72429f960c2bd656a96a97e738b3f932
- SHA1 85aa03ef97499d08fe8bdd2386bfe6042c8d4be5
- SHA512 ae32bf65ef8eb9ac922a59225a24599845811f6d419fef0b006ebebba097f1f982c62b481e13299fc2065face27734cb23de8b85b0676a90fd21049da2347c74
- TLSH T143E0DF2826EBA91EF090993686FAE1B61D59E241285897B912D1470CBB07F446C22AB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\11f605bc-cda4-4a57-846d-be178e863e2f.tmp
- Size 19KB
- SHA256 57daf0436df1ffe1eedb3771a02e5317aeb264214ae9cb946f711832e92db4de
- MD5 b057c602279298ba5ce152ad667b8f91
- SHA1 8ff1e262578f036c99cf59cf5aede788e5bad1e7
- SHA512 da53a898d57b2a1d2babafa369c6f0dfad6f136df25b3c97465f003f722b93a3b2faa3f1661ffeffba1e2f394a2de206a77ab0c1683ff94bdcb99b0528c42f49
- SSDEEP 384:nvtNn/s3n9SI8NExwBCXiQOVr/E5P+5JqzVpG3d8t4x9Z:vj+9H6d/EZaqJ+yavZ
- TLSH T134928C31686DACB648A79641F10B3A5B5EB820F79AC11F89E9D96F1D00CE7CC170AD17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
- MD5 f5ed4946834be586ac6410ed88740a7c
- SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
- SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
- TLSH T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
- Size 3KB
- SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
- MD5 1de85fec2dfcc28011a7c2aaab95eb5f
- SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
- SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
- TLSH T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
- MD5 5ed835b9bd8886391af7b9dc575ac02b
- SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
- SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
- TLSH T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
- MD5 9391bc4c1d157f197ee937c50a0513b1
- SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
- SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
- TLSH T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 2f6ee4703396d163c093610d9b2267ece0c147c0195fbe01d80a82845e95cd68
- MD5 925acc835ea063d734475defedca370a
- SHA1 e73f39dce1ae66b451027d8af81296f1fd4dd57d
- SHA512 ba861f6e0cf56bcaa8bd85cfea34cf33ac885ffad7eb62ca13718f6ea68f4c4c62b8cd321d8a56f78b762931b50198e5516a2aeccbac5d84db8811b617330154
- TLSH T105719156328290DDF72D0370B0E93E5638F5E8AB09CF9E6F19E042FD6228F5137A1618
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b9c6.TMP
- Size 3KB
- SHA256 7f234106ae7536bc1c36db1f50dae8ef49d788428b7e500d28ff46fb98afdd95
- MD5 b6c5f22edb6c34b4a61410cdbfb74ab7
- SHA1 74c6dc56f0dbb8257eab3a88c4fa22959885bc95
- SHA512 fb3abf5dac91cc8f1d2d71ba6725f4d9d3b517a64176d62349f3a31c1d4b3244402a880a5577d56c77b407e5e04bcf50c8a36970b0a85abe92b04ca61ae4b7f5
- TLSH T1E771B416328291DDF32D0370B0ED3E5638F9A8AB08DF4E6F14E446FC2124F513792618
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 ec89195dd45e1f48d65b71ad60f1de33a8e1ee3867021a75b9ef32ba381c9451
- MD5 68758a673f9169e12d1b169d2361cd7e
- SHA1 633e93adcdff4174ce17d79e3af4a03c07e04dde
- SHA512 d2f60830241a8016dcbcb98ce34228a82cc6b7d6630be7dfabdd44579773b53e433fd45687865378316d168cd0f9a529e9bc987f87f29f8ec0d3aac1b9bd0e8d
- SSDEEP 96:DuUuWQuFuwu/uQuaduuVsz8ulbucuwuLuyumj62u1brx:DB6aBwzrdu+sgMDV+/pj62Krx
- TLSH T1ABA15AB3C3D8826DD95616F8BB147E1ADE2D096443283D1FC8D5EF8B93E1471E28464E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 010dea2e9f7e3e4ca35065ae0fe803c4e569657d4af10a23e614b2526cb2acf7
- MD5 7ef8d2d65717877e7b97adf149095b5a
- SHA1 6afc0ba27d515c39732f2f54f2ce9c181c343d31
- SHA512 959b2301736f35fb6f083714c64e4d90fac971cd3ef110f1ba655de2946634196f8749ad3035f3cf60312650efaa1a45881ab0a8f9a65cd040f7c2f57ed193be
- SSDEEP 192:sxZRRiyM/jK1Ml8Mcm/fHsOG/PQdQLgIdpgXar/W6+WN8ow/Y0sQDVIg4J:sxZRU0m/fHsJn60L/b4/5Pc
- TLSH T10152FB16AA3499778CDBD219F501BF57D6F8147392500E48AAFCDA1C04E6BED2203C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 c396125529dc39316cfef95f30ec33ec6b95794309a4c336cb5a2982e413ce76
- MD5 b30ef63d8c7745f6b0b791a59ed0dc9a
- SHA1 ffc2dd3a6a89a83f639810b360909afdcd9b22be
- SHA512 9cfdc39d8b1cc29db9c8e4c71b562e38c096697cd399cf7a81351b6e0cac2f0f718f78b0397ae1cdfb1979dd678cb123719e1a2c53e3bb74a008b81e263d2abe
- SSDEEP 192:sxZRRiyM/jK1Ml8UQgcm/fHsGG/GQdQLgIdp6Xar/W6+WN8ow/Y0sODVIg5YJ:sxZRUqfm/fHsxu60N/b4/53a
- TLSH T1F862FA16AA3899B78CDBD219F541BF57D6F4147292500E48AAFCDE1C04E6BED221382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 36KB
- SHA256 443b75bc93fb68eca66874debfd35ec2aae859bd6e814b2337f8f2053c2b67d0
- MD5 7bb3b97607b14470c17e9ad0805b494e
- SHA1 b3086cd32b62412265c9767d710ddb83264bf908
- SHA512 6ca9c170b90abd0bff36678596bf5d2f914301db907ec3659a793d6ef7a7f9eff6499505a3175ce5fda59c90a9a6ba1f4480087fd57be8cf11eddb4f566b249d
- SSDEEP 768:lU/Xh8dF2kf7pLuLXwkWRmwcQDw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV34shjLlw:lU/Xh8dF2kZEXwkWRmwcQDwu1jaK4shW
- TLSH T1A9032B7B6C0CCB7F4F844E9CEC26BE9A6DE801CB9698895447FA490C03C67EB15161DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 7da8c5b9ce3cb60aeb987c0236ea9152d6d8594fe8168c9e40b95bbb325dc03b
- MD5 86ad39099eed7305671110fd15eac302
- SHA1 aa76b73f66eca6dabe5884670ce5bf094a90b598
- SHA512 c318a5274fd6dbd977ab2a50ec84d96c526d9782b86a98b84a5c49e0b3aabd1a4c5648af31e2cfcd4adca69359efa8243a5b4812b916b1ae7ee89f23a9cb2568
- SSDEEP 48:K00IPKpendI5KGMsTyeYb6IInKR28FNIZKJ:K00YKpendWKGMKfIoKR22NyKJ
- TLSH T1F691C08271BA02333C7D750882A787175B817263B119E47B7FA910F64E2AE615DFC8CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59353f.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 9c47b2c93c376380ec4a95c533e1a4fdc83e9c4d1cf57778e3ea3f19664d4e12
- MD5 25943ca957a7916cf782382ad04b071f
- SHA1 fba692a8173053bfc721c9c8b92a24d7b99c21cc
- SHA512 77a5922a67878647c4f612a2b5257a260d19f79b6e0ccada65cf19f222810909f963c9ea381116d496f522e47e1ba2b5e18eb9cdbc38d2358627aa0eea26a31f
- SSDEEP 384:n1tNn/s3n9SW8NEuwBCXiMOVr/E5P+5LqzVpG3d8t4x9Z:1j+91jd/EZgqJ+yavZ
- TLSH T1BA928D31682DACB748A79641F10B3A5B9EB820F79AC51F89E9E96F1D00CE7CC1706D17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 c5481706b9752f89aaa161ea56fac2853b1d12b3007c88c8fc7b914e1e82a46d
- MD5 cfa156a7da88ac37fbd11a1a011c33ce
- SHA1 7424ce23ddccf82348af6a44c905f3e03a838277
- SHA512 691e9e256592a6cab64925e77177fbc62a964e9ca07390ae4503b68559f4a128e1c1e14cacb0376eae001f08bbfb3ccf56fa6424b0c3b3d2eebc545a2ba47cea
- SSDEEP 192:1GNL6t6H3BQmiUyNHBHm2Qq/rUH5mi+0D9Mu6U6:1GNL6MXfCY2Qq/E5P+rVU6
- TLSH T17002F9347868BCBB8DA3AF45B44777279FA4216FE6955F88D9E81B1C01DB68C1342833
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 5457ef8857257a774effdec043e4923d965b59e353035291db7eb53f8afe3bbc
- MD5 9733db12274e1855565f740bc12ea50b
- SHA1 7c988f7ce477885f35d4c9a990dbe5defeaaa73b
- SHA512 f1f780c47d7aa5c9bcc124003dc9eb866f5c5aa3bed9b07f70a1decfc713a9e6520172d608b5c98c32ce12e3ea7be774809a38ebf9a2988ad3b4a8417b1832c2
- SSDEEP 384:nmtNn/s3n9SW8NEuwBCXiMOVr/E5P+5LqzVpG3d8t4x9Z:mj+91jd/EZgqJ+yavZ
- TLSH T136927C31682DACB648A79641F10B3A5B9EB820F79AC51F89E9E96F1D00CE7CC1707D17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 653432d51948893de33a9fe9cf19963c03e5b57b2ed63bea8547c08d69857305
- MD5 d8c29e229d5e8d04c3db92c83a32692c
- SHA1 c05a7d88f5d69676c9a4ccb1f500888c15d4a52c
- SHA512 ddddedd082bb6a6957bcc6ccf216122f394608c792861e8b78821c1464aded728566bb9b37d7d85ef04678790ad54ae83ac1130d1a114248330e292748c55d45
- SSDEEP 192:1GNd6t6H3xQmiUy+0m2nq/rUH5mi+5w/9nuqQBU6:1GNd6MXPD2nq/E5P+5AqU6
- TLSH T1F2120A34B4ACECAB5C93A501B08737979E6421BBDE854F49E5E80B1C05DB6CC2B0A827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 30KB
- SHA256 948de1903b571e310ca15c335773b72b1798dd048f0096d5be7e0bd72c42f226
- MD5 bbcb053129fde1a714db6dc1755ca92a
- SHA1 56b7a219dd6edb96ad0c808a700b515692f13ece
- SHA512 cd996a6b2e849d36bd8f20b3f534f095b0f4decfc9e1e899b99bb68c568e68761f268619c20b4931922251ca078938929d0caf7d3a51903039e2ffd4540e06da
- SSDEEP 384:npDiF2tNn/s3n9SE8NM8TUNTUlIluwBCXiMWVlDfwz/E5P+5uqzVpG3d8t4x9Z:puF2j+95Vwgt0z/EZXqJ+yavZ
- TLSH T1ADD2C4F598D79976D8AE4783B33E7E4699BCD0A375844984FBC91E4CCC862BFC206805
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 252B
- SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
- MD5 551baa462724351873ccd655a8b64ea3
- SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
- SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
- TLSH T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\18436172-9f4a-44af-a1ae-a050222655c0.tmp
- Size 147KB
- SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
- MD5 a9f7675ff091bb15c88909424bab4a39
- SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
- SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
- SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
- TLSH T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI88B3.tmp
- Size 209KB
- SHA256 8351a40a632facd1f79a1bccfe8e32e88876a23065be1144621533700ecb05ad
- MD5 3037e214e0f9b25fc63d4d16f7c4c91d
- SHA1 b03dce2090033ca3029526485039b75a5aa4b488
- SHA512 437fd240c0af2afaa3a5a1791db4739dff04c7003f25f1bc512797cfffb7fc3e8377656b6eb8714a50b3189c2616b230a619730bc63628d9ab4bc214ce31de90
- SSDEEP 3072:l9FCdj6rw5iUeqEetAByXxqr8lyc8t5W6/eb7eUZxfZ/oR:l9FC4wuJeiByXwrtcO6ZVxoR
- TLSH T1C6248E09B7D100B9EDB78638CD678656E673780107609A9F03A08376EF2F7D1A63DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bopr3gnf.uqa.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\a46832c3-7f87-4540-965f-3325e70865f6.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\eaa2722b-3296-4c7b-9045-3c44fd48b5db.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2704_1913262268\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICF53.tmp
- Size 275KB
- SHA256 fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f
- MD5 2232c07e354364e0eb1dc80024593826
- SHA1 65bb4232c0416cfb2c158bfc32a7732ad72cee72
- SHA512 f0d295565b209f4dedd2a79123fa54ff9b8cbb173f14463ab3d3707b8d87aad84b05c2898478ecc148e29d02fa07ddda9499795e0ceafc2982c0adbd570a3572
- SSDEEP 3072:A736bBrGsu4ldGrlmxElEmNoPl4+eDhIVJkRZ5Br/NbvcjKX5mMgQSeRocPvuocM:A736UWldGrlmxEDNMea+H5R/B/1lp4x
- TLSH T136548D41B7E404A6EC73C73499A39606FA3278411B70DAEF035082768F6B7D1AA3DB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICF64.tmp
- Size 281KB
- SHA256 45e855461f5d1be28a2f88416603070bd1778055abdd06834ae58e97b7ddf53c
- MD5 718222e232d11298dfbabbc2b70d8b14
- SHA1 89fc560692111c2245694867b8772fd8969f46d2
- SHA512 9191961c28a7a4647ae8f9f9e1956d60b97f5f5c3e4e838d888bf78c1ea665e98e8e3c75cc1247a68a89b2413493ea6d39dbc60827eec919ddba0536d793c801
- SSDEEP 3072:sEcOO6pMedPCy5654WKlfE5qbHsfmYud8d2VCsOLlk1lHgQNvLvPMm88cYzdFOS:OOO6OedPjw58l85/grhSQNDsYz2
- TLSH T111549D45BF9504B6E8BBC1348AA74A82E772740203109A9F33AC97799F2F7D1663D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICFB3.tmp
- Size 143KB
- SHA256 2738720da0b6ce474ca6eb51a92372d047eca2d713c256f0cd6c147ac3a0db21
- MD5 84a1cc9540d5cdad74bc54f8090dd27a
- SHA1 c6f82d1491015457785ae0d365e7196d693d9a6b
- SHA512 9c25d6e7331844d01d732ac923e99c68f305749d92407c873cd09b451e59a8864001e308864fda319fa4a2bcae9dbe50682201c67901dce14272291dedecd2c8
- SSDEEP 3072:+1gnuc/GBdzVQqyIgt8DB7QKPw3hL6nCMfBXqpU:Bnuc/GBdJmIgtesKP+Lh+
- TLSH T154E37E17B7A400BBE5B78235C9635A06E772B81117219F9F03A443766F237D0AD3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58c7c0.msi
- Size 5.5MB
- SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
- MD5 1e150b4507fc951c8a23b08b85236cd2
- SHA1 3f6980947c16778efb3126193726c038453c85d6
- SHA512 2074822532d38e94c131ceb3b4b7a01379ea20b5d6e3fb85a6912a586b8e6f1ff5a4973c200087ccd5ecd17727acef2d5568e6afc9df392da5c1f1978b4cd3a8
- SSDEEP 98304:fEnzYKCLSBI0lGIOKv8k7VHTB87GnJ6tEGb7MrisWnB+A/yue/bjBe:z/LS9ZzVV87G2hbWij+xB/Re
- TLSH T128460101B6C10462EC678230C85E925AF2F27C5117A0D66FA2DCBF7CBF3B3A5526A751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 104KB
- SHA256 9a5f2926a671d1812ba7206e0bf1842218d2f47c72e990e35f34de17fbe15e3a
- MD5 29c3a1ddb30a01237e4a1d31dd4f20d3
- SHA1 ba38e0e5f1fb233904d238a5264e3d6508c6c6e7
- SHA512 2615eeb3a5fa6ea1a7c1296be9aa4aa1a32a0fcbe141ee0060a049f623c496f766e9e33c0543b2f9a712c58bf8ca830466b93d070b53e870b59808f58fa5d9fd
- SSDEEP 1536:wiLEaNMPTTqQiDt9Di+joUQ9j5MpqvssMiBcyqvKR9D1r9qrP/6uYn+1S1uDyzDs:wsdDf
- TLSH T10AA3474494E8C659C5F20D62625EEE70C97E658F770B4FA970BC6300DAC3B047FBA49A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 104KB
- SHA256 01ad6036f1e3b04bd83b8e93ae74a7c703fbc9775318c67b2ee41b3600870246
- MD5 b91c766532f94653a053f437180e0e82
- SHA1 d920c3358de641e5e18f45c614655e492798056b
- SHA512 9d4008102086821b3b7a5793dbcbf2375910549ca4560efe7dd875544efe97fdb90a62e33cba49226545026ddbb955ce5ec0a66473aeece605e4d9656f5947e0
- SSDEEP 1536:wiLEaNMPTTqQiDt9Di+joUQ9j5MpqvssMiBcyqvKR9D1r9qrP/6uYn+1S1uDyzDd:wsdD2
- TLSH T196A3474494E8C659C5F20D62625EEE70C97E658F770B4FA970BC6300DAC3B047FBA49A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_1725391302\manifest.json
- Size 43B
- SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
- MD5 af3a9104ca46f35bb5f6123d89c25966
- SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
- SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_603397398\manifest.json
- Size 135B
- SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
- MD5 fbebd68ecaa98928909421f66909c054
- SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
- SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
- TLSH T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\C7A8DA~1\tap0901.cat
- Size 11KB
- SHA256 ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7
- MD5 71ecece58bb00bdc1e728ee28d7a5332
- SHA1 4305889415cf95662a30d024f1138f1af224cf42
- SHA512 9b23404d867fc4fd7c7beeba3768e8fed3113cc7430ec1bc9ca7faf6e6105388de7057b1402f9b4ba8fbc11e5fcd3afe14233721e8d15b6c0bed40f65aa5b58b
- SSDEEP 192:HxDuDjbfXJCKnEwKUNhYCy1QySaI8HNsAX01k9z3Aqcp9wdGEC:CXaUNh3auatHNsAR9zWZEC
- TLSH T1FF322AA2942C52C3ECABBC7043D4E9977C3E2BCB1950506A269FF7141DA73C8EB1516E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\C7A8DA~1\tap0901.sys
- Size 40KB
- SHA256 581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1
- MD5 1bb9772a05517e227d1dafd3936e8f66
- SHA1 d695ca5791a4b6a3509939aebdfaf5e229c6fbcf
- SHA512 3f1966038f91b887fe1a71474929bd87f3c75091846c6e9563f7424d3a7c19c908f1d874895341c61a868a616aba637e3d4188d4ebb7383087886a13a4dc0aa2
- SSDEEP 768:EGvByM5JLLvslmdu9lsECPURPNkilzdCH3C9zySb:EfM7VE88fkilzdCHOzySb
- TLSH T112038DD16AA814D1E8AA9874C7EBCE43F7B5B1430311AAEF0764D6691F23BD05637328
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\D95A09~1\wintun.cat
- Size 9KB
- SHA256 602187e5470ddbdf9421045bb0515f358c88bf88f59fd8a886fb6373da5d0f82
- MD5 faba2ccb8fe366fd281ca6be6d2bb7c2
- SHA1 bb7bd32a21f3eba652fde24146387ffc5278143e
- SHA512 ec424a545e2598f299706499dab07b4d12b0734a52f928216a53bca2b7f384b97bd4fc092d7d68de636a75daf79ac392c4b49b7251ec011236de1659253d6214
- SSDEEP 192:6wRp8yDJCKE4uyK6iWPFWQFAnTz36ArNc4qnajr7NCo:L/iWPFRI64lrNt
- TLSH T10522F8E28A5C44C2E993ADB05398F5977C3E7BDB4C20906922ABF7650DD27C5E70843E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\D95A09~1\wintun.sys
- Size 37KB
- SHA256 eb58bf00df7b4f98334178e75df3348c609ea5c6c74cf7f185f363aa23976c8b
- MD5 1945d7d1f56b67ae1cad6ffe13a01985
- SHA1 2c1a369f9e12e5c6549439e60dd6c728bf1bffde
- SHA512 09af87898528eaa657d46c79b7c4ebc0e415478a421b0b97355294c059878178eb32e172979ee9b7c59126861d51a5831e337a96666c43c96cb1cf8f11bc0a0f
- SSDEEP 768:UwtoHKG2ZqGhg+Eqpg0bUORjj71PKgPrbHZIb4:UwtoHt2ZLg+zg5cv7ld7Zy4
- TLSH T1E1037DD2E6A868C2E973CE3151F5E523BD74B2612B20D5EF4511C4350FA3BC1EA7863A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\c7a8da2883c34da26a715518ccd6bac4f445312530125f38d9b3f23b33e0d4fd\OemVista.inf
- Size 7KB
- SHA256 1327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9
- MD5 6f5ffb58a9e406ab1643c890e2a198c6
- SHA1 3ff1faba00ac18a93e88a6f2bbfa747c9fdc7e0c
- SHA512 af29bc13cc02238208c51e4e95dd0a4445a952755635a9eab38aa77a5c087cc8e2025af55d8f3a0e9f2430baa91534e7f892bb71aa0ef72bab4483211a845b4b
- SSDEEP 192:wr8tW9yCTi314vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGBdkkzo3DcNSj6jvKFkPs7EQTXvtk
- TLSH T1F9F150681C83EE3A31FEE58557565EC7E24611823A172800355CFC549BBDD9FE33C92A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\d95a09c7f82fdc64b6be219214d947e0b3595d35b0a6f07fea47c57b0a79a86c\wintun.inf
- Size 1KB
- SHA256 44098408ab9611dd99a38e140c7fb1ca5dce6eb2d5f0d5e500547ac1ba5d235b
- MD5 8480579050970b0812cc3d9a1bce1340
- SHA1 edebebd090602f4eee375ad754c8566d4fda23cb
- SHA512 46de9202c3cf0ddbf19f9e0e02ec17530f2722abfa08669fd30a6095ce2342fa89a2cc59c1d47afd82b48c915bb95f4c6d16e7c21129a9c8f09c2bf239566933
- TLSH T1933135D954E10D693CD3322E77277F81E65C123041CA200EB6FD8559D64BCDFA654CAA
- MD5 SHA1 SHA512 TLSH