Overview

overview

8

Static

static

5

Fing.exe

windows10-2004-x64

8

Fing.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

Fing.exe

windows10-2004-x64

6

Fing.exe

windows11-ltsc_2024-x64

6

extraResou...58.dll

windows10-2004-x64

3

extraResou...58.dll

windows11-ltsc_2024-x64

3

extraResou...58.dll

windows10-2004-x64

3

extraResou...58.dll

windows11-ltsc_2024-x64

3

extraResou...58.dll

windows10-2004-x64

3

extraResou...58.dll

windows11-ltsc_2024-x64

3

extraResou...58.dll

windows10-2004-x64

3

extraResou...58.dll

windows11-ltsc_2024-x64

3

extraResou...58.dll

windows10-2004-x64

3

extraResou...58.dll

windows11-ltsc_2024-x64

3

extraResou...58.dll

windows10-2004-x64

3

extraResou...58.dll

windows11-ltsc_2024-x64

3

extraResou...58.dll

windows10-2004-x64

3

extraResou...58.dll

windows11-ltsc_2024-x64

3

extraResou...58.dll

windows10-2004-x64

3

extraResou...58.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/07/2026, 00:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Fing.exe
  • Size 14.7MB
  • Sample260716-akcs6acv2v
  • SHA256 c80daec0fb85cef35abfe47489e1ac08208f6954c92a059a56867066506f9a76
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Manipulates Digital Signatures 1 TTPs 5 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Drops file in System32 directory 43 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 28 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 45 IoCs
  • Modifies registry class 24 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fing.exe
    "C:\Users\Admin\AppData\Local\Temp\Fing.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Windows\SysWOW64\net.exe
      net stop Fing.Agent
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:708
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop Fing.Agent
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2108
    • C:\Program Files\Fing\extraResources\npcap-1.83-oem.exe
      "C:\Program Files\Fing\extraResources\npcap-1.83-oem.exe" /S
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Users\Admin\AppData\Local\Temp\nsk216.tmp\NPFInstall.exe
        "C:\Users\Admin\AppData\Local\Temp\nsk216.tmp\NPFInstall.exe" -n -check_dll
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1500
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq 'DDFB16CD4931C973A2037D3FC83A4D7D775D05E4'} | Sort-Object -Descending -Property FriendlyName | Select-Object -Skip 1 | Remove-Item"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3740
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "If (Get-ChildItem Cert:\LocalMachine\Root\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4){certutil.exe -verifystore 'Root' 'DDFB16CD4931C973A2037D3FC83A4D7D775D05E4';If($LASTEXITCODE -ne 0){Remove-Item Cert:\LocalMachine\Root\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4}}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5404
        • C:\Windows\SysWOW64\certutil.exe
          "C:\Windows\system32\certutil.exe" -verifystore Root DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
          4⤵
          • Manipulates Digital Signatures
          • System Location Discovery: System Language Discovery
          PID:3052
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -verifystore "Root" "DDFB16CD4931C973A2037D3FC83A4D7D775D05E4"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1380
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nsk216.tmp\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4.sst"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1384
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nsk216.tmp\signing.p7b"
        3⤵
        • Manipulates Digital Signatures
        • System Location Discovery: System Language Discovery
        PID:4916
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -addstore -f "AddressBook" "C:\Users\Admin\AppData\Local\Temp\nsk216.tmp\digi-ts-2023.p7b"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5816
      • C:\Program Files\Npcap\NPFInstall.exe
        "C:\Program Files\Npcap\NPFInstall.exe" -n -c
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4264
        • C:\Windows\SYSTEM32\pnputil.exe
          pnputil.exe -e
          4⤵
            PID:240
        • C:\Program Files\Npcap\NPFInstall.exe
          "C:\Program Files\Npcap\NPFInstall.exe" -n -iw
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          PID:1620
        • C:\Program Files\Npcap\NPFInstall.exe
          "C:\Program Files\Npcap\NPFInstall.exe" -n -i
          3⤵
          • Drops file in Drivers directory
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:5984
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Microsoft.PowerShell.Management\Start-Service -Name npcap -PassThru | Microsoft.PowerShell.Management\Stop-Service -PassThru | Microsoft.PowerShell.Management\Start-Service"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4088
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "ScheduledTasks\Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (ScheduledTasks\New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (ScheduledTasks\New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (ScheduledTasks\New-ScheduledTaskTrigger -AtStartup) -Settings (ScheduledTasks\New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3404
      • C:\Program Files\Fing\extraResources\fingagent.exe
        "C:\Program Files\Fing\extraResources\fingagent.exe" --installservice Fing.Agent
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5572
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4f1bad54-6457-734d-b1f3-14369812f058}\NPCAP.inf" "9" "405306be3" "0000000000000178" "WinSta0\Default" "0000000000000174" "208" "C:\Program Files\Npcap"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3096
    • C:\Program Files\Fing\extraResources\fingagent.exe
      "C:\Program Files\Fing\extraResources\fingagent.exe" --servicemode Fing.Agent --agentroot "C:\Users\Admin\AppData\Roaming"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:4520

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          npcap.cat
          • Path C:\PROGRA~1\Npcap\npcap.cat
          • Size 12KB
          • SHA256 1439c1a65d8bf0fde19a691b4e266d5906af459b6754f52471a8af860aba9221
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          npcap.sys
          • Path C:\PROGRA~1\Npcap\npcap.sys
          • Size 79KB
          • SHA256 91e91ea4c9b48360282eb86ba7f4f0c7476b1666ccfc4a5f49eab91733cae850
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ip-services.properties
          • Path C:\Program Files\Fing\extraFiles\ip-services.properties
          • Size 90KB
          • SHA256 d5b6c2bfd521f1edf66fbeeac4b0df56c8da23361d6f194c1a684a6fd16da46d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LIBEAY32.dll
          • Path C:\Program Files\Fing\extraResources\LIBEAY32.dll
          • Size 1.3MB
          • SHA256 a6b59882d750b0e2effc31be977a85e9de3561ab39db4802bdc7b5540d42b29d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SSLEAY32.dll
          • Path C:\Program Files\Fing\extraResources\SSLEAY32.dll
          • Size 358KB
          • SHA256 91c13eb6310a962bc084011aa2978c67cc7d3485c5da3874bf30f50b7c35077d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          boost_date_time-vc90-mt-1_58.dll
          • Path C:\Program Files\Fing\extraResources\boost_date_time-vc90-mt-1_58.dll
          • Size 52KB
          • SHA256 733bdb2488c26e5f7d536fac59be5ba48eedb7b4fb71d97db49346b1e9975141
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          boost_filesystem-vc90-mt-1_58.dll
          • Path C:\Program Files\Fing\extraResources\boost_filesystem-vc90-mt-1_58.dll
          • Size 107KB
          • SHA256 d2eb71a16fc0dfe1faa6169af4108fe90945bcd9749d99851c1c55721a43a323
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          boost_program_options-vc90-mt-1_58.dll
          • Path C:\Program Files\Fing\extraResources\boost_program_options-vc90-mt-1_58.dll
          • Size 335KB
          • SHA256 ee3c5b8f07388dca3b167eed6b4172a0ef834bcfbb5eda7033f51c0e4ec5028f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          boost_regex-vc90-mt-1_58.dll
          • Path C:\Program Files\Fing\extraResources\boost_regex-vc90-mt-1_58.dll
          • Size 712KB
          • SHA256 631900be4ad89841545f4bd7961871c29d4ef421927b79ca9db315c1f20f292d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          boost_system-vc90-mt-1_58.dll
          • Path C:\Program Files\Fing\extraResources\boost_system-vc90-mt-1_58.dll
          • Size 24KB
          • SHA256 4b04901b0b3e5a151e16bbbeeac80247fb934eadaf9fed9675976eb139e53e32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          boost_thread-vc90-mt-1_58.dll
          • Path C:\Program Files\Fing\extraResources\boost_thread-vc90-mt-1_58.dll
          • Size 95KB
          • SHA256 ade039bf860c5fac132a455140ca47b607c5abf52fb56ff32052868d18ef6554
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fingagent.exe
          • Path C:\Program Files\Fing\extraResources\fingagent.exe
          • Size 2.6MB
          • SHA256 60317df41cfc707da4c620457f81750a93cf88a56aa2ed3586da06268dbd3faa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libprotobuf.dll
          • Path C:\Program Files\Fing\extraResources\libprotobuf.dll
          • Size 1004KB
          • SHA256 66b334147fe6de43dc09983b7600a9ba52faea6e91c1fd87ba87d2aad4fbe0de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          npcap-1.83-oem.exe
          • Path C:\Program Files\Fing\extraResources\npcap-1.83-oem.exe
          • Size 1.2MB
          • SHA256 0786ec5b0c1f8cc0e1a84023f42f6454ce4277f783796e3f6df6e569696bbe5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          overlook.dll
          • Path C:\Program Files\Fing\extraResources\overlook.dll
          • Size 10.9MB
          • SHA256 1eb375be15ef56be0adac68427094ef3a1d705809c892ed91a3b8dc16ab38ec5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NPCAP.inf
          • Path C:\Program Files\Npcap\NPCAP.inf
          • Size 8KB
          • SHA256 f959b2cfa9fe0411834894459b5c0ee3fcd578c3a96f925bed19cb040f2bead5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NPCAP_wfp.inf
          • Path C:\Program Files\Npcap\NPCAP_wfp.inf
          • Size 2KB
          • SHA256 e0459f47807269360e327b8a4fa7988d5db3bc9f1c64c50eb5bc34c5362fef7b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          NPFInstall.log
          • Path C:\Program Files\Npcap\NPFInstall.log
          • Size 393B
          • SHA256 9cee056be6b0d561f9df15fb6ef4c9ed2eacca73dcac5f3307b862e5f070bd06
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          NPFInstall.log
          • Path C:\Program Files\Npcap\NPFInstall.log
          • Size 1KB
          • SHA256 1ab0f879b2e02efcf59b90f2bed0fc04831e08bcadaa96c11a0d1ee72b7b4fdb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          NPFInstall.log
          • Path C:\Program Files\Npcap\NPFInstall.log
          • Size 2KB
          • SHA256 827c970742ee5d83867b7460ad2cf54f7289c7ce615d48b094082bd19313867b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          NPFInstall.log
          • Path C:\Program Files\Npcap\NPFInstall.log
          • Size 2KB
          • SHA256 9026c2a253f7944476530e91f15bb4f71b23b0eeb53ee1e11bfac9877f46c706
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          NPFInstall.log
          • Path C:\Program Files\Npcap\NPFInstall.log
          • Size 3KB
          • SHA256 8ec536950ba35749354fe68c3f32ca119d88616c854a313ee64f485eff5dcfbd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          NPFInstall.log
          • Path C:\Program Files\Npcap\NPFInstall.log
          • Size 3KB
          • SHA256 7f852aa2cdc3ec9bf12e65cfbe392c9df9e888365f73abb6c134a7e45406fe6f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          NPFInstall.log
          • Path C:\Program Files\Npcap\NPFInstall.log
          • Size 4KB
          • SHA256 fca3fefa38858e0f0493179a626847baf1628b5a1c5519a539a59ac48b22175d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NPFInstall.log
          • Path C:\Program Files\Npcap\NPFInstall.log
          • Size 4KB
          • SHA256 1723b77d69ae820f8916c5a0a45e3cdf3c6b6419745d26169d7718607c3785c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 c28ad1da81f4011038e1ddd90d35e2165032b6c067c4d681fbbeaf94025ffadf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 16KB
          • SHA256 5f559e35492bb26bea8f7a6545912def84a19473855f66fac7a837d5df805efe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 dbe96e6e5b57b07a222a8f26b035d6a7e97e230ab0a4812f7c6b0559c6adbeb1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_srdbmr0h.sh1.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_srdbmr0h.sh1.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DDFB16CD4931C973A2037D3FC83A4D7D775D05E4.sst
          • Path C:\Users\Admin\AppData\Local\Temp\nsk216.tmp\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4.sst
          • Size 1KB
          • SHA256 98280770b3d1e577754a07b6d3e5790f988bae9b905c2b30c0e646d0fb619b03
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          InstallOptions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsk216.tmp\InstallOptions.dll
          • Size 15KB
          • SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NPFInstall.exe
          • Path C:\Users\Admin\AppData\Local\Temp\nsk216.tmp\NPFInstall.exe
          • Size 319KB
          • SHA256 3896af626f39a46942df264d0df3cf689fcf6e501deacac8577d33279fcb1369
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          digi-ts-2023.p7b
          • Path C:\Users\Admin\AppData\Local\Temp\nsk216.tmp\digi-ts-2023.p7b
          • Size 3KB
          • SHA256 0594d1899bf9f738ef4c1b9049372ca66059c1343b4d8dd7ecbda465ad04deea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          options.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nsk216.tmp\options.ini
          • Size 2KB
          • SHA256 e3707c82f4117deedf70550146bbd320e41b3dc8db8041c1a04c777553e8f12f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          signing.p7b
          • Path C:\Users\Admin\AppData\Local\Temp\nsk216.tmp\signing.p7b
          • Size 3KB
          • SHA256 dfa30b3667f5d98f267c52078846db6649532a8f877cec6d3e4f8b83a7f1f80a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsoBDDA.tmp\System.dll
          • Size 12KB
          • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          modern-wizard.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\nsoBDDA.tmp\modern-wizard.bmp
          • Size 25KB
          • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDialogs.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsoBDDA.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsExec.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsoBDDA.tmp\nsExec.dll
          • Size 7KB
          • SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsis_tauri_utils.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsoBDDA.tmp\nsis_tauri_utils.dll
          • Size 45KB
          • SHA256 877e7c0a51fd9179fecae5994e703ed84939611cc82024d7e0620ebf2becc8ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          npcap.inf_amd64_493b255613492041.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_493b255613492041.ini
          • Size 408B
          • SHA256 902c28cb3cdd10dfe9157115f97ed48ea9de6894c55ea2c59f942cbd407a150b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/3404-442-0x0000000006270000-0x00000000065CB000-memory.dmp
          Download

          memory/3404-444-0x0000000007A70000-0x0000000007AA6000-memory.dmp
          Download

          memory/3740-241-0x0000000005910000-0x0000000005932000-memory.dmp
          Download

          memory/3740-239-0x0000000003260000-0x0000000003296000-memory.dmp
          Download

          memory/3740-249-0x0000000007990000-0x0000000007A26000-memory.dmp
          Download

          memory/3740-246-0x0000000006330000-0x000000000668B000-memory.dmp
          Download

          memory/3740-243-0x0000000006150000-0x00000000061B6000-memory.dmp
          Download

          memory/3740-250-0x0000000006BF0000-0x0000000006C0A000-memory.dmp
          Download

          memory/3740-247-0x0000000006700000-0x000000000671E000-memory.dmp
          Download

          memory/3740-240-0x0000000005B00000-0x000000000614A000-memory.dmp
          Download

          memory/3740-242-0x0000000005A30000-0x0000000005A96000-memory.dmp
          Download

          memory/3740-251-0x0000000006C40000-0x0000000006C62000-memory.dmp
          Download

          memory/3740-248-0x0000000006730000-0x000000000677C000-memory.dmp
          Download

          memory/3740-252-0x0000000007FF0000-0x00000000085AA000-memory.dmp
          Download

          memory/3740-253-0x0000000008C30000-0x00000000092AC000-memory.dmp
          Download

          memory/3740-254-0x0000000007740000-0x000000000777D000-memory.dmp
          Download

          memory/4088-433-0x0000000005E30000-0x000000000618B000-memory.dmp
          Download

          memory/4520-499-0x00000000014A0000-0x0000000001552000-memory.dmp
          Download

          memory/4520-498-0x0000000001460000-0x000000000146D000-memory.dmp
          Download

          memory/4520-509-0x00000000016F0000-0x000000000174B000-memory.dmp
          Download

          memory/4520-507-0x0000000001650000-0x00000000016D7000-memory.dmp
          Download

          memory/4520-506-0x0000000001630000-0x0000000001643000-memory.dmp
          Download

          memory/4520-505-0x0000000001610000-0x000000000161D000-memory.dmp
          Download

          memory/4520-503-0x00000000015A0000-0x00000000015F3000-memory.dmp
          Download

          memory/4520-501-0x0000000001570000-0x000000000158C000-memory.dmp
          Download

          memory/5572-484-0x00000000016F0000-0x00000000017A2000-memory.dmp
          Download

          memory/5572-494-0x0000000001940000-0x000000000199B000-memory.dmp
          Download

          memory/5572-493-0x00000000018A0000-0x0000000001927000-memory.dmp
          Download

          memory/5572-491-0x0000000001880000-0x000000000188D000-memory.dmp
          Download

          memory/5572-490-0x0000000001860000-0x0000000001873000-memory.dmp
          Download

          memory/5572-488-0x00000000017F0000-0x0000000001843000-memory.dmp
          Download

          memory/5572-486-0x00000000017C0000-0x00000000017DC000-memory.dmp
          Download

          memory/5572-481-0x00000000016A0000-0x00000000016B8000-memory.dmp
          Download

          memory/5572-483-0x00000000016D0000-0x00000000016DD000-memory.dmp
          Download