Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 16:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe
- Size 12.9MB
- Sample260808-vbj64aed94
- SHA256 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05
- MD5 c7dca8acdc08f9739294fc286047634d
- SHA1 b1c66576422d0018fbdbb44c8c1e5680b80b7355
- SHA512 1f13ccc4bfdcfd534d56b35173194c7f32eadc4d87569fee188f77a7475a9c9dda9e293f6ab9a15b1f1e838f2f79d195c9a7bc1b64cfd7cf97fb2295dd571ae7
- SSDEEP 393216:lpKIqKMMHrD6rO1ERNKSfC7Q7x/WN/7F3:LIKMGX6rwIK0C7Q7deDF3
- TLSH T160D63324B5D0D432E93365309B789ABA9878BC259B3181EFF3DC4A690F342D1D83A757
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\Windows\system32\drivers\urfltv64.sys ursetvpn.exe File opened for modification C:\Windows\system32\drivers\urfltv64.sys ursetvpn.exe File opened for modification C:\Windows\System32\drivers\covpnv64.sys DrvInst.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 14 IoCs
pid Process 2568 F5ElHelper.exe 640 f5vpn.exe 1028 F5Win32CheckHelper.exe 2148 ursetvpn.exe 3792 urset64.exe 4660 urset64.exe 1308 urset64.exe 5008 urfltv64.sys 4400 F5PolicyServer.exe 4892 f5epi.exe 1680 F5InstH.exe 3504 f5unistall.exe 728 F5InstallerService.exe 3676 f5fpclientW.exe - Loads dropped DLL 24 IoCs
pid Process 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe 1840 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 3268 MsiExec.exe 3268 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 2148 ursetvpn.exe 4292 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 4292 MsiExec.exe 3676 f5fpclientW.exe - Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 26 4292 MsiExec.exe 28 4292 MsiExec.exe 31 4292 MsiExec.exe 38 4292 MsiExec.exe 39 4292 MsiExec.exe 40 4292 MsiExec.exe 41 4292 MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\E: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\R: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\W: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\K: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\L: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\V: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\T: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\O: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\Q: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\N: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\Z: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\Y: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\U: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\S: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\X: ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe File opened (read-only) \??\M: msiexec.exe - Drops file in System32 directory 40 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{ab293761-6def-e741-b34f-46744343a8e4}\SET4B09.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab293761-6def-e741-b34f-46744343a8e4}\covpn10.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab293761-6def-e741-b34f-46744343a8e4}\covpn10.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\covpn10.inf_amd64_29049aabd350da54\covpn10.PNF urset64.exe File created C:\Windows\system32\perfh009.dat WMIADAP.EXE File created C:\Windows\system32\perfc010.dat WMIADAP.EXE File created C:\Windows\System32\DriverStore\Temp\{ab293761-6def-e741-b34f-46744343a8e4}\SET4B1A.tmp DrvInst.exe File created C:\Windows\system32\perfc007.dat WMIADAP.EXE File created C:\Windows\system32\perfh00C.dat WMIADAP.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{ab293761-6def-e741-b34f-46744343a8e4}\SET4B09.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab293761-6def-e741-b34f-46744343a8e4}\SET4B1A.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ab293761-6def-e741-b34f-46744343a8e4}\SET4B1B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab293761-6def-e741-b34f-46744343a8e4} DrvInst.exe File created C:\Windows\system32\perfc009.dat WMIADAP.EXE File created C:\Windows\system32\perfh00A.dat WMIADAP.EXE File opened for modification C:\Windows\System32\DriverStore\Temp\{ab293761-6def-e741-b34f-46744343a8e4}\covpnv64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ab293761-6def-e741-b34f-46744343a8e4}\SET4B1B.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\covpn10.inf_amd64_29049aabd350da54\covpnv64.sys DrvInst.exe File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini WMIADAP.EXE File created C:\Windows\system32\perfc00A.dat WMIADAP.EXE File created C:\Windows\system32\perfc011.dat WMIADAP.EXE File created C:\Windows\system32\PerfStringBackup.TMP WMIADAP.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft MsiExec.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\covpn10.inf_amd64_29049aabd350da54\covpn10.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache MsiExec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\covpn10.inf_amd64_29049aabd350da54\covpn10.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h WMIADAP.EXE File created C:\Windows\system32\perfc00C.dat WMIADAP.EXE File created C:\Windows\system32\perfh010.dat WMIADAP.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\covpn10.inf_amd64_29049aabd350da54\covpnv64.sys DrvInst.exe File created C:\Windows\system32\perfh007.dat WMIADAP.EXE File created C:\Windows\system32\perfh011.dat WMIADAP.EXE File opened for modification C:\Windows\system32\PerfStringBackup.INI WMIADAP.EXE File created C:\Windows\SysWOW64\F5InstallerService.exe msiexec.exe - Drops file in Program Files directory 11 IoCs
description ioc Process File created C:\Program Files (x86)\F5 VPN\F5_TMP\f5tunsrv.cab msiexec.exe File created C:\Program Files (x86)\F5 VPN\F5_TMP\urxhost.cab msiexec.exe File created C:\Program Files (x86)\F5 VPN\F5_TMP\urxshost.cab msiexec.exe File created C:\Program Files (x86)\F5 VPN\f5fpapi.dll msiexec.exe File created C:\Program Files (x86)\F5 VPN\scew_uls.dll msiexec.exe File created C:\Program Files (x86)\F5 VPN\f5fpclientW.exe msiexec.exe File created C:\Program Files (x86)\F5 VPN\F5_TMP\f5InspectionHost.cab msiexec.exe File created C:\Program Files (x86)\F5 VPN\F5_TMP\InstallerControl.cab msiexec.exe File created C:\Program Files (x86)\F5 VPN\F5_TMP\urxvpn.cab msiexec.exe File created C:\Program Files (x86)\F5 VPN\config.f5c msiexec.exe File created C:\Program Files (x86)\F5 VPN\f5fpc.exe msiexec.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{6D4839CB-28B4-4070-8CA7-612CA92CA3D0} msiexec.exe File opened for modification C:\Windows\Installer\MSIE4BE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEE92.tmp msiexec.exe File created C:\Windows\Downloaded Program Files\ursetvpn.exe ursetvpn.exe File created C:\Windows\Downloaded Program Files\F5InstP.dll MsiExec.exe File created C:\Windows\Downloaded Program Files\TunnelServerX.dll MsiExec.exe File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.ini WMIADAP.EXE File created C:\Windows\Downloaded Program Files\F5Win32CheckHelper.exe MsiExec.exe File opened for modification C:\Windows\Installer\MSIF0F5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF347.tmp msiexec.exe File created C:\Windows\Downloaded Program Files\urxhost.inf MsiExec.exe File created C:\Windows\Downloaded Program Files\f5LogViewer.exe MsiExec.exe File created C:\Windows\Downloaded Program Files\urSuperHost.dll MsiExec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Downloaded Program Files\F5ElHelper.dll MsiExec.exe File created C:\Windows\Downloaded Program Files\ursetarm64.exe ursetvpn.exe File opened for modification C:\Windows\Installer\MSI4FC2.tmp msiexec.exe File created C:\Windows\Downloaded Program Files\f5unistall.exe MsiExec.exe File created C:\Windows\Downloaded Program Files\InstallerControl.dll MsiExec.exe File created C:\Windows\Installer\{6D4839CB-28B4-4070-8CA7-612CA92CA3D0}\icon.ico msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\{6D4839CB-28B4-4070-8CA7-612CA92CA3D0}\icon.ico msiexec.exe File created C:\Windows\Downloaded Program Files\F5ElHelper64.dll MsiExec.exe File created C:\Windows\Downloaded Program Files\urxvpn.inf MsiExec.exe File opened for modification C:\Windows\INF\setupapi.dev.log urset64.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\Downloaded Program Files\f5InspectionHost.inf MsiExec.exe File created C:\Windows\Downloaded Program Files\InstallerControl.inf MsiExec.exe File created C:\Windows\Downloaded Program Files\setup2000.dll ursetvpn.exe File opened for modification C:\Windows\Installer\MSI51C7.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Downloaded Program Files\urxhost.dll MsiExec.exe File created C:\Windows\Downloaded Program Files\urxshost.inf MsiExec.exe File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File opened for modification C:\Windows\Installer\MSI4205.tmp msiexec.exe File created C:\Windows\Downloaded Program Files\urxdialer.dll MsiExec.exe File created C:\Windows\Downloaded Program Files\ietrust.exe MsiExec.exe File created C:\Windows\Downloaded Program Files\F5InstH.exe MsiExec.exe File created C:\Windows\Downloaded Program Files\F5InstP64.dll F5InstH.exe File opened for modification C:\Windows\INF\setupapi.app.log urset64.exe File created C:\Windows\Downloaded Program Files\urxvpnad.tag ursetvpn.exe File created C:\Windows\Downloaded Program Files\setupdrvdll.dll ursetvpn.exe File created C:\Windows\Installer\e58dd4d.msi msiexec.exe File opened for modification C:\Windows\Installer\e58dd4b.msi msiexec.exe File created C:\Windows\Downloaded Program Files\scew_uls.dll MsiExec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\Downloaded Program Files\f5tunsrv.inf MsiExec.exe File created C:\Windows\Installer\e58dd4b.msi msiexec.exe File created C:\Windows\inf\WmiApRpl\WmiApRpl.ini WMIADAP.EXE File opened for modification C:\Windows\Installer\MSI42A2.tmp msiexec.exe File created C:\Windows\Downloaded Program Files\F5Win32CheckHelper.dll MsiExec.exe File created C:\Windows\Downloaded Program Files\f5epi.exe MsiExec.exe File created C:\Windows\Downloaded Program Files\f5InspectionHost.dll MsiExec.exe File created C:\Windows\Downloaded Program Files\uregsvr.exe MsiExec.exe File created C:\Windows\Downloaded Program Files\f5instd.exe MsiExec.exe File opened for modification C:\Windows\Installer\MSI5310.tmp msiexec.exe File created C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File created C:\Windows\Downloaded Program Files\urxhostres.dll MsiExec.exe File created C:\Windows\Downloaded Program Files\f5PolicyServer.exe MsiExec.exe File created C:\Windows\Downloaded Program Files\TunnelServer.exe MsiExec.exe File created C:\Windows\Downloaded Program Files\F5ElHelper.exe MsiExec.exe File created C:\Windows\Downloaded Program Files\urxdialerres.dll MsiExec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5ElHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5InstH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5unistall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5PolicyServer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5InstallerService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5Win32CheckHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5epi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5fpclientW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5vpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ursetvpn.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID urset64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs urset64.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs urset64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID urset64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs urset64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 urset64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID urset64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom urset64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 urset64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 urset64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID urset64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 urset64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 urset64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID urset64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags urset64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags urset64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 urset64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID urset64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID urset64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID urset64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2BCDB465-81F9-41CB-832C-8037A4064446} MsiExec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\f5-epi f5epi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\f5-epi\WarnOnOpen = "0" f5epi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B4F1629D-125A-4D72-965F-68831C7861E7}\AppPath = "C:\\Windows\\Downloaded Program Files" F5InstH.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6C275925-A1ED-4DD2-9CEE-9823F5FDAA10} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2BCDB465-81F9-41CB-832C-8037A4064446}\Compatibility Flags = "1024" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B4F1629D-125A-4D72-965F-68831C7861E7} F5InstH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B4F1629D-125A-4D72-965F-68831C7861E7}\AppName = "F5InstH.exe" F5InstH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B4F1629D-125A-4D72-965F-68831C7861E7}\Policy = "3" F5InstH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6C275925-A1ED-4DD2-9CEE-9823F5FDAA10}\Compatibility Flags = "1024" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\f5fpclientW.exe = "11000" msiexec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\f5-vpn f5vpn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\f5-vpn\WarnOnOpen = "0" f5vpn.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ f5fpclientW.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs urset64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs urset64.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E39CAEC9-ED13-4313-9053-854B5942BDBA}\1.0\0\win32\ = "C:\\Program Files (x86)\\F5 VPN\\f5fpapi.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A60D0661-CFAD-4113-B4E3-573A07060A8F}\ProxyStubClsid32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{621B70A9-A5BC-4F0D-A950-A0F62411FA53}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BC9384D64B820704C87A16C29AC23A0D\InspectorService = "\x06" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7A1A30D-4D28-4D8F-B0E0-2BF1C56BB574}\TypeLib\ = "{E39CAEC9-ED13-4313-9053-854B5942BDBA}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7A1A30D-4D28-4D8F-B0E0-2BF1C56BB574}\TypeLib\ = "{E39CAEC9-ED13-4313-9053-854B5942BDBA}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8B063F94-529C-4C99-B264-1CEEF93FA695}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{82BFA4B6-F84C-43F2-8F10-2D036D7498BC}\TypeLib\Version = "1.0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0FF21FA-B857-45C5-8621-F120A0C17FF2}\TypeLib MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{621B70A9-A5BC-4F0D-A950-A0F62411FA53} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{621B70A9-A5BC-4F0D-A950-A0F62411FA53}\ = "IDictionaryHelper" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57C76689-F052-487B-A19F-855AFDDF28EE}\ToolboxBitmap32\ = "C:\\Windows\\Downloaded Program Files\\f5InspectionHost.dll, 101" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SuperHost.DictionaryHelper\CurVer\ = "SuperHost.DictionaryHelper.1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{621B70A9-A5BC-4F0D-A950-A0F62411FA53}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InstallerHelper.InstHelper.1 F5InstH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InstallerHelper.InstHelper\CLSID\ = "{C55F7A4D-4F8E-4116-88C2-B7179DAA67C2}" F5InstH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C55F7A4D-4F8E-4116-88C2-B7179DAA67C2}\ProgID F5InstH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33BB4A46-028E-4ABE-8032-6F2B6C92CA00}\TypeLib\Version = "1.0" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ElevationHelper.TrafficControlHelper\CurVer\ = "InstallerHelper.TrafficControlHelper.1" F5ElHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0818D430-6247-11D1-ABEE-00D049C10025}\Implemented Categories MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{565005A1-8716-426a-AD12-6FFDFF9FAC1C}\LocalServer32 F5ElHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52E776ED-C97A-4857-9A6F-ECE9014876F3}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6A1CA97B-3591-4C6E-B00E-19C5007F6CB0}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DAB6006-CF31-4B6E-929A-B8E3FB20BFED} F5ElHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8739ED63-F374-46DC-B3A9-D8FDB6F44A38} F5ElHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\f5-epi\ = "URL:F5 APM Endpoint Inspection protocol" f5epi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\f5-epi f5epi.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C05458F-8A26-40DB-AA4D-DF5F557DBBDF} F5ElHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F89D033-FC4B-4E98-A35C-9CC26E25789D}\LocalServer32\ = "C:\\Windows\\Downloaded Program Files\\F5ElHelper.exe" F5ElHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB34551D-BA53-4E6D-9BD2-486BD81AD144} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41EF3CD2-D8CC-4438-84B1-280BB4E77C8E}\MiscStatus\1\ = "131473" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4BAAB5AB-A515-4239-B662-1376A8AC4F97}\ProxyStubClsid MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6C275925-A1ED-4DD2-9CEE-9823F5FDAA10}\InprocServer32\ThreadingModel = "Free" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppCtrl.PropertyBagX MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00C33BF0-7740-4f52-AE29-F3FF9B2A74D0} F5ElHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A9E1D39-621D-4146-AF6C-EE9D4C52623A}\ProxyStubClsid32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B3D93A9-B45D-4FD1-B03D-633DB4BD181D}\TypeLib\Version = "1.0" F5PolicyServer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45B69029-F3AB-4204-92DE-D5140C3E8E74}\ToolboxBitmap32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InstallerControl.InstControl2\CurVer\ = "InstallerControl.InstControl2.1" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41EF3CD2-D8CC-4438-84B1-280BB4E77C8E}\ = "F5 Networks Dynamic Application Tunnel Control" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC85ACDF-B277-486F-8C70-2C9B2ED2A4E7}\Control MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46588130-FB8B-446C-B2ED-B45C9951D254}\1.0 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B3D93A9-B45D-4FD1-B03D-633DB4BD181D}\TypeLib\Version = "1.0" F5PolicyServer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5FFC3D25-AE3B-4811-B964-D992E9ADBFA2}\NumMethods F5InstH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC9384D64B820704C87A16C29AC23A0D\SourceList\PackageName = "f5fpclients.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1DB6596-BC73-4DD1-A84A-04428FA92D7D}\Insertable MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8B063F94-529C-4C99-B264-1CEEF93FA695}\ = "IAppTunnelExConnectionSettingsEx" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBB8D037-0529-457C-A306-4660DF697CCA}\ = "IRasEntryHelper" F5ElHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5CB711E3-4E42-47BF-9331-DBD33752FD8D}\ = "Win32CheckHelper" F5Win32CheckHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0818D430-6247-11D1-ABEE-00D049C10025}\MiscStatus\1 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{621B70A9-A5BC-4F0D-A950-A0F62411FA53}\TypeLib MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2BCDB465-81F9-41CB-832C-8037A4064446}\Programmable MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45B69029-F3AB-4204-92DE-D5140C3E8E74}\Version MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4B28355-8DA2-404C-BD96-B528BB4FEC5F}\Version\ = "1.0" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33BB4A46-028E-4ABE-8032-6F2B6C92CA00}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B063F94-529C-4C99-B264-1CEEF93FA695} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2BCDB465-81F9-41CB-832C-8037A4064446}\InprocServer32\ = "C:\\Windows\\Downloaded Program Files\\urxdialer.dll" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{22522A49-5BB1-4BDA-B71D-30916518786F} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TunnelServerX.UTunnelX MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4B28355-8DA2-404C-BD96-B528BB4FEC5F}\MiscStatus\1 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A60D0661-CFAD-4113-B4E3-573A07060A8F}\TypeLib\Version = "1.0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A124AEA4-FDC7-4528-816C-655940A03CD9} MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B9B51C4F-67AC-4678-9898-9FE43AFA28EC}\TypeLib MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{017C1AEE-EBDE-42A7-B2BB-49413C914719}\1.0 MsiExec.exe - Modifies system certificate store 2 TTPs 8 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 5c000000010000000400000000080000190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000001a7f62aedb011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f00000001000000360000003034060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030706082b06010505070301530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd940400000001000000100000004be2c99196650cf40e5a9392a00afeb22000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0400000001000000100000004be2c99196650cf40e5a9392a00afeb20f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f00000001000000360000003034060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030706082b0601050507030162000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000001a7f62aedb010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d4190000000100000010000000fa46ce7cbb85cfb4310075313a09ee052000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4532 msiexec.exe 4532 msiexec.exe 640 f5vpn.exe 640 f5vpn.exe 4892 f5epi.exe 4892 f5epi.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid 4 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeIncreaseQuotaPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeSecurityPrivilege 4532 msiexec.exe Token: SeCreateTokenPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeAssignPrimaryTokenPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeLockMemoryPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeIncreaseQuotaPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeMachineAccountPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeTcbPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeSecurityPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeTakeOwnershipPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeLoadDriverPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeSystemProfilePrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeSystemtimePrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeProfSingleProcessPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeIncBasePriorityPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeCreatePagefilePrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeCreatePermanentPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeBackupPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeRestorePrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeShutdownPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeDebugPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeAuditPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeSystemEnvironmentPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeChangeNotifyPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeRemoteShutdownPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeUndockPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeSyncAgentPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeEnableDelegationPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeManageVolumePrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeImpersonatePrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeCreateGlobalPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeCreateTokenPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeAssignPrimaryTokenPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeLockMemoryPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeIncreaseQuotaPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeMachineAccountPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeTcbPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeSecurityPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeTakeOwnershipPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeLoadDriverPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeSystemProfilePrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeSystemtimePrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeProfSingleProcessPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeIncBasePriorityPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeCreatePagefilePrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeCreatePermanentPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeBackupPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeRestorePrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeShutdownPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeDebugPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeAuditPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeSystemEnvironmentPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeChangeNotifyPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeRemoteShutdownPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeUndockPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeSyncAgentPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeEnableDelegationPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeManageVolumePrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeImpersonatePrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeCreateGlobalPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeCreateTokenPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeAssignPrimaryTokenPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe Token: SeLockMemoryPrivilege 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe 4104 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3504 f5unistall.exe 3676 f5fpclientW.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4532 wrote to memory of 1840 4532 msiexec.exe 88 PID 4532 wrote to memory of 4912 4532 msiexec.exe 94 PID 4532 wrote to memory of 968 4532 msiexec.exe 98 PID 4532 wrote to memory of 4292 4532 msiexec.exe 99 PID 4532 wrote to memory of 3268 4532 msiexec.exe 100 PID 4292 wrote to memory of 2568 4292 MsiExec.exe 102 PID 4292 wrote to memory of 640 4292 MsiExec.exe 103 PID 4292 wrote to memory of 1028 4292 MsiExec.exe 104 PID 4292 wrote to memory of 2148 4292 MsiExec.exe 105 PID 2148 wrote to memory of 3792 2148 ursetvpn.exe 106 PID 2148 wrote to memory of 4660 2148 ursetvpn.exe 107 PID 2148 wrote to memory of 1308 2148 ursetvpn.exe 108 PID 4448 wrote to memory of 1960 4448 svchost.exe 111 PID 4448 wrote to memory of 2292 4448 svchost.exe 113 PID 4292 wrote to memory of 4400 4292 MsiExec.exe 116 PID 4292 wrote to memory of 4892 4292 MsiExec.exe 117 PID 4292 wrote to memory of 1680 4292 MsiExec.exe 119 PID 4292 wrote to memory of 3504 4292 MsiExec.exe 120 PID 4532 wrote to memory of 3676 4532 msiexec.exe 122 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe"C:\Users\Admin\AppData\Local\Temp\ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4104
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B3218381959AD5F77CB0C3ED3ADA7EB6 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1840
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4912
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 83A282825AFB9FAB16601AC1C11DA44F2⤵
- System Location Discovery: System Language Discovery
PID:968
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F31201AEACDB7635EA8FABA5780942F9 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\Downloaded Program Files\F5ElHelper.exe"C:\Windows\Downloaded Program Files\F5ElHelper.exe" /RegServer3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2568
-
-
C:\Windows\Downloaded Program Files\f5vpn.exe"C:\Windows\Downloaded Program Files\f5vpn.exe" /RegServer3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:640
-
-
C:\Windows\Downloaded Program Files\F5Win32CheckHelper.exe"C:\Windows\Downloaded Program Files\F5Win32CheckHelper.exe" /regserver3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1028
-
-
C:\Users\Admin\AppData\Local\Temp\F5_TMP_62441751941282118839\ursetvpn.exe"C:\Users\Admin\AppData\Local\Temp\F5_TMP_62441751941282118839\ursetvpn.exe" /q3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\F5_TMP_62441751941282118839\urset64.exeurset64.exe UnInstallAdapter F5%20Networks%20VPN%20Adapter4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3792
-
-
C:\Users\Admin\AppData\Local\Temp\F5_TMP_62441751941282118839\urset64.exeurset64.exe UnInstallAdapter f5%5Fnetworks%5Fvpn%5Fadapter4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4660
-
-
C:\Users\Admin\AppData\Local\Temp\F5_TMP_62441751941282118839\urset64.exeurset64.exe InstallAdapter 0xf0146 C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5CF5%5FTMP%7E1%5C2017%5Ccovpn10%2Einf f5%5Fnetworks%5Fvpn%5Fadapter4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1308
-
-
-
C:\Windows\Downloaded Program Files\F5PolicyServer.exe"C:\Windows\Downloaded Program Files\F5PolicyServer.exe" /RegServer3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4400
-
-
C:\Windows\Downloaded Program Files\f5epi.exe"C:\Windows\Downloaded Program Files\f5epi.exe" /RegServer3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4892
-
-
C:\Windows\Downloaded Program Files\F5InstH.exe"C:\Windows\Downloaded Program Files\F5InstH.exe" /RegServer3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:1680
-
-
C:\Windows\Downloaded Program Files\f5unistall.exe"C:\Windows\Downloaded Program Files\f5unistall.exe" /createshortcut3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3504
-
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\F5 VPN\f5fpapi.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3268
-
-
C:\Program Files (x86)\F5 VPN\f5fpclientW.exe"C:\Program Files (x86)\F5 VPN\f5fpclientW.exe" /createshortcut2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3676
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "c:\users\admin\appdata\local\temp\f5_tmp~1\2017\covpn10.inf" "9" "6c065c457" "0000000000000140" "WinSta0\Default" "0000000000000160" "208" "c:\users\admin\appdata\local\temp\f5_tmp~1\2017"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1960
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:8bec3032194c39c4:COWAN.Ndi.wlh64:7220.2022.228.1527:f5_networks_vpn_adapter," "6c065c457" "0000000000000140"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2292
-
-
C:\Windows\system32\drivers\urfltv64.sysC:\Windows\system32\drivers\urfltv64.sys1⤵
- Executes dropped EXE
PID:5008
-
C:\Windows\SysWOW64\F5InstallerService.exeC:\Windows\SysWOW64\F5InstallerService.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:728
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /R /T1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:4100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58dd4c.rbs
- Size 1.3MB
- SHA256 16d93fb6efe79557e4dfd5581ab2eb7f0e4c9aacef571d4e3b2465abb9a8da6b
- MD5 db60e23a21b5e4581dcc72b615acb582
- SHA1 732c11bb191964faa7b31c1f02e1e3e695d2ecb5
- SHA512 aa4c66abb6a656e952a9a15d72036747fb504cc5c5a25cdf6f77e61ad7f7493b5c7db4e100bfabc4a932882f2d8f88a661b14d6f6c351ba57c3b7fdd1ae03e72
- SSDEEP 24576:doLdV8nFqHoLdV8nFqUoLdV8nFqAoLdV8nFqOoLdV8nFqFoLdV8nFqa:yLn8nFdLn8nFmLn8nF4Ln8nFMLn8nF1A
- TLSH T1EA558E113681C17ED67F2234957ACB7BBA7DA9604770D4CB638CDE682E341C12A31EA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
- Size 2KB
- SHA256 f383634c716124d2fafb3b13c1ad6c16d946100831303d622d9cfcb469074c61
- MD5 5a1c2b240788f4452e54bcd451478a82
- SHA1 0761db9ef544acf9a94ebe01e488720bdd382a98
- SHA512 328806d96f182415d1fe05eb95ec397afcb072cca1a849ea6a5a32535f2c0123de22fd00b3bdaefbf16c29da50eecd0642ee82283bc517ef11f305d3671f8444
- TLSH T10F410BB59FA5EF01B7C25414EFC08A321CA6915CB85405A27C22DC96EE05F152B5FC6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
- Size 1KB
- SHA256 a128f07ee008a9a5854cf5e56bb80f5c38bbd63349084f88be740b5bff712f02
- MD5 8c7276a9a411538c607965eb5a1c141a
- SHA1 351f6c0d8899e8e087104807ed5cd48d11d5bc80
- SHA512 e951e6512d7cf66768ee5a472fb62d6ac61d19a47d51e849c1858d7fe2e58737f10d14dcb68ac62d8596b6ac1f34a6414bf97b36dcf45ee89ed127b05a279728
- TLSH T1E431B7434AF02FD9B955DDD03489E3332FB0E5ED75452456AC2A8C7B85893F12A26A0A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AF360AACB1570042DEFBC833317997D0_1C71A55BE4D771E763612A0A7E2744CE
- Size 765B
- SHA256 19ba6a599980d20bf5eeacd536c9c9af49b1c2405b432083b558410580fabd27
- MD5 d2dadcfe05b3ef398b7c85544628e963
- SHA1 f2c6cb2900d61251d70f135321389aa6a376c74b
- SHA512 19b2d63602437d55f3a37b2d12a6fb1864b5ab0b387dade200c09f912e79a774aac94a86260188477dee76df3a31dc40562752ac1148537042be813af7043f1b
- TLSH T1B401B5625D159CD01817DA824AE8AE2A4E1A43E90740007AEC3E36FF0705F0339F6024
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
- Size 492B
- SHA256 066b7406b2e8ddd0e9d4253008721cd683a168bff8c77eb6b786342d0a36e667
- MD5 eda2b65401e06f944f77a4ec1c142195
- SHA1 9445c8faa1952850b34c34296b370e97fa6d42e4
- SHA512 1042840bc1e2f525f084c6e6fe7055fd53bc6209496617ebe3a765eba4f11595db984160a2e5cc441e5e2d55b5315f82bc6df4bd3381e0a11042c571a13a4ffb
- TLSH T159F05C781EE5443EF572CD348AE5D217894AF1061D008A6B17E58A0E7913A01E961938
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
- Size 480B
- SHA256 c0f81a039644d05c19e411675bddfe717631d83fe15dddf4d6a3fecc9553ff22
- MD5 1e0fbbb6c9d391fa55be1119f4bbef20
- SHA1 d9af782f1dbe2daa893633d66f438703f62eacf0
- SHA512 441f76cc8f4a57400e6c98767de90d0af3b0766b3c70034f49e86be398a69e24fb4a819efb255a360a2be62d4cf2a68d040e83455bd2efbd637d09fdc6bda62a
- TLSH T1E5F02B1412D9602EF7B1BFB0CFF9D62B896AF917080586ED0A27621EAD13E024DA153D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AF360AACB1570042DEFBC833317997D0_1C71A55BE4D771E763612A0A7E2744CE
- Size 492B
- SHA256 918e4631b8eaaf431e08a8db4c8ff1b2753ba892fed1123f2c4f894fc32952f6
- MD5 48f4c66f5cbd0962b0656c1605e44477
- SHA1 9420d6660115d15d37661668a3f9ac83ada541b3
- SHA512 c4b7b055ab82ea266a41ef41844ee063a8dd37e72214382955f4193cf9d06ecfd3524793e2c42a1f0e0a81e266c0c167301d6c0681af0220adb34e34210c83b1
- TLSH T199F0DC1820B8023DF576DF310BD0989A614BEA076404453726E4470A6106E08ECE39B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_MSI_TMPcf09afa159b6281\F5 VPN\F5InstallerService.exe
- Size 577KB
- SHA256 26c5bbfed3616e4ac6cc7747b5c8aa658c6c359c7a3bf12fcb711d73a90b447c
- MD5 9f470e5c032688d8fb217779b2851acb
- SHA1 641682c52e1c3267c46e5741015b20c034a747af
- SHA512 de54899cd908ade0eaf0e2bd1d96a0440066746e8a4a76b2f84b0c764429a2160da3a03bc635234f3ef8bfe6ae3b6c351d5eb54a077bf080ee9b9a051a86ad1a
- SSDEEP 12288:63d0V5tQKLLvnUsUuDoqAWTyWuXgRVZ1bcaG6vaqPaLoB:63d0V5tQK8sUqlAWTqgRZbG6CqPakB
- TLSH T19CC46B242021F536C97290FD8E9AD37BE9189C70537B15C3A3C407666D948E3B77AA2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_MSI_TMPcf09afa159b6281\F5 VPN\F5_TMP\InstallerControl.cab
- Size 2.0MB
- SHA256 d2abe197220f62549f958b848dbc571e6afad943e1cbea1f0dce2fb9f7c1c4fb
- MD5 a752ade420b384b66bc4f9e6faf39fef
- SHA1 2400229dfe97ff8c084b0c5ee40d122f72730626
- SHA512 131ad52dca90614cfdd90deecfdf7d5e86a3b80ed304073c99739938ea9f6886876eae78af7f9190cc0df45b249723f628449794ec0165ecc80ce6e0c7bfd50c
- SSDEEP 49152:XVijwhe2hDAHmZmQ4SrAGem4p4SexjWRhMZ/KLcNoA:Xs8hWHVG0aoexaRhSKwz
- TLSH T1A4A5331D54D12A32E80BD1B8F6D060EFFED4A9AD792FC9F870835C204FA5AB505906ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_MSI_TMPcf09afa159b6281\F5 VPN\F5_TMP\f5InspectionHost.cab
- Size 1.1MB
- SHA256 07f11b0c5ed09a57bbb70d20cfe55e98d2b7cc280ef686647fa50a5701eebfab
- MD5 7a2f4cde41639def25be7d17ee117748
- SHA1 07ed2c45e3dcf9cab09638370aab8061ca1f695d
- SHA512 c66da3cd6277bacde805ace10e47f8f8fb7cbd34ce80123275a610b62bd6a61cb56e0da13bfaf1d7dbf990703abb523f337e513c40f70b2a9f0bd6664e98d311
- SSDEEP 24576:vsj9AWuQrwn2zl+/niYbzpJ3r1sEExlGYDe37GXnz:vsjaQrwn2zlKniYbPZsEExlGN3KXz
- TLSH T1DE4533EE0CCADA92993BDC7517CC795E9078E01EF133E9D3282AC4B915087DA8C6B547
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_MSI_TMPcf09afa159b6281\F5 VPN\F5_TMP\f5tunsrv.cab
- Size 1.6MB
- SHA256 14c820d316f26ad95ba75a3de1dcc837b554ee79fd16358e20f82949057c1c5e
- MD5 40b2978ff93387139eb62f732f884321
- SHA1 3ab69e77a4678993adef93a388cc48f7930e5d74
- SHA512 02257dcf58c4dc67816d01f5e0cfe652874e090ee951f3f3196c53ec992225cf884bb15c07a92eb43b2dac6ca6adc5db60586dd67ea3630b6d742e1e1b62cc36
- SSDEEP 24576:sY/VrDwopkzZ+J5t7MtaSunU94rk9t6he0nw0tj7xdHCPkBU5ml:jDwoYKt7ounU94rkzD8NdHIyUU
- TLSH T1838533440590A939BF150CFA320A65674CD4B115FE0923FBC968EC16687FFABD8ED8D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_MSI_TMPcf09afa159b6281\F5 VPN\F5_TMP\urxhost.cab
- Size 929KB
- SHA256 58dcd967ccebc2ae8c1c1cbb576d828337799c57da036ed3f624dc5e3dc4b4a0
- MD5 c504c1a86c2af2a0f04cc26698dfe47a
- SHA1 b4bf28929cd9169e1aca026087266147badf9d3b
- SHA512 caf1e1fe1dc3feadf089840b26860b071409ccf4f03e9e10496323cbebaa6c289f8595e50558fd1e9c2a0056f11883d3c657183aa5ac3c0bae97e78b2ea33184
- SSDEEP 24576:EkyVu3WNqrUghFo8ALmGSX3RRFMq2XcKHut6Vt8dTLRr:EzQr/hiLmnbdFK86U/
- TLSH T1CC1533565218EA9BC788F436C1A4847FF56416F2DC0262ED74FCA5A34C0CE77E93A20B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_MSI_TMPcf09afa159b6281\F5 VPN\F5_TMP\urxshost.cab
- Size 1.5MB
- SHA256 b7510ef1a6626ede1d3bb7a46ac31b06a304842c7a46020d2e04346f4298dbde
- MD5 31e474298efce4e85f60100a6e65fd6b
- SHA1 05d3e65510e4a39c825c533e648b4dc3cbdfeb10
- SHA512 21c9369bc3126e659485b77a25c3080f4e4046ff9b5010c69e538f085418d77d7e1afc4d0274f796df362618a3e88c6d81eb3e3bf3391593c81d7c2736c50c95
- SSDEEP 49152:HCEDM6okzRhFupxlb0I3MkqSqaKq6UemEh8uad:HjDM6oS3Fejf8ktqa/ToWd
- TLSH T13B7533BE64DE5831AC87C939CC074C7394B8EE4992C315652B37134A17BEB86E51FA0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_MSI_TMPcf09afa159b6281\F5 VPN\F5_TMP\urxvpn.cab
- Size 1.5MB
- SHA256 dd2cd86d718642297dd556fe23dc7da5d555f8905386735223b0df44c1ecbe76
- MD5 dcb0e284aecf0cf7cce8fe0191d7a5fd
- SHA1 1d86031dc8ef8692eb5d0a10be2e11caf034f2f0
- SHA512 dc193a726e32fee3bb3fa0be3bbfda3e9fc499847d10cd121d7ace1c39d08ae8f1801562f4db05609b24db404a797ed2257f68f3a363b3c2157f32c35ca7e1b2
- SSDEEP 24576:pp1laRLe9lF9ajZszp6yHIYvXX6UjUHwKWodm1wSjn1qASeIypXiPoY7MbJXCYZ:JlaLeD6jZGpXfvXXJDrBSebiPoVNXCM
- TLSH T1467533A3C7687DDBB9A17420D0568587B894136EF90DA8E7FC24A385CDC2B6579CC0F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_MSI_TMPcf09afa159b6281\F5 VPN\config.f5c
- Size 766B
- SHA256 f9ecf343596c2e6f79bdfcccf391d460a8fe98d5d398f11d3151b75bdbea187d
- MD5 252a12c6f088a59e9b10be5b64edb640
- SHA1 8b8e1cc283c83e9fb0c5a7cf3792749b9be448c5
- SHA512 fdddee3f85b7fb1cb1c24ff460241492b3e5dddacdf4279964f6b18848b477be9a6f10486c793281ac1017f8241ec405c459038227ff9ce6290dcc6e0e4714e0
- TLSH T1D7016868D0E2AEA0D127FB92D852801A7EC3C356427563C83818DB710AD1004C7ABDB6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_MSI_TMPcf09afa159b6281\F5 VPN\f5fpapi.dll
- Size 2.4MB
- SHA256 1521d182167ba2ace018c58d8997db0543d614f7f6316f0799d79386a5f5199b
- MD5 ecde87e4989996267bf86b8a6b013ef2
- SHA1 03a845fb5ba557176f94e12eaa2fe565d8ca124b
- SHA512 ba63f8c1f11c1a762ba99e6882a794a1156ef406c1be9afa4ddd6b5af1cc8503d1051b0390bfbb74bc6c11bbbaef14016ab030a46863c298a3a957e4c176c95b
- SSDEEP 49152:ak9Kl1e+U+2dK5llSRyelteodYOrAeOL3t65W5ZngLK/A1UT57wD/jBzlBsfOqIn:1hellSRJlteodYO87YaZgLK9T5aF
- TLSH T185B58F32B109C131E6AE51B48D2EAB6BD51CA53103A525C397CDE97B3D3C5E33A32627
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_MSI_TMPcf09afa159b6281\F5 VPN\f5fpc.exe
- Size 447KB
- SHA256 08416fbc391cc8ff525faf5feb90c0bb0a1293a7bb581506c670a41c2aeab973
- MD5 6d465930aa6fc8f1fa13a3007486cd7f
- SHA1 c5d5d3384c667cb5394259dc3bb6741eac4df717
- SHA512 a9f08a20600b0e7807f68002bdde67e8106ffba042579b5ab4a8d4fcb86e26a91d60a600db5cc118765750595e71d7d31c73223b47d18e3d3c2224648b1452f6
- SSDEEP 12288:GQqjkLt2el1JfcIpxVuM4tih5DNnPDT+jj3hDY97XwEyQuFMGwBjv:GbkcIpxVuM4tih5DNPo7hYpANbjgjv
- TLSH T1FDA49D2135E6C033D57281314C69EB2618BDA8700F6119DBB7F85BAD9F749C26732B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_MSI_TMPcf09afa159b6281\F5 VPN\f5fpclientW.exe
- Size 4.8MB
- SHA256 6f80b1f33a82ed15278fedc3186d95d3b366f774ec72566b59cb1d5fb7048d3a
- MD5 3051bbada219a33470026ff43a32c534
- SHA1 57b142656983fa2f1f21fdbd37c8997348711352
- SHA512 9b1beebb009c336d43cb765549696161cfe9022225e7a28d0c8674784eab0013cbfe87f07af3ce61141286f3cff55566a48dd6605c111f9a3ed4ec929cf84548
- SSDEEP 98304:uEWAr/Gbw5C3AJubKLgTka/CBGFxxDf2TgW8VP9UYKGU4KwfWVR:2Ar+wcPIa/VWTgW8VPGGU4KJR
- TLSH T1FB365C207EAE8415E06327709E79B639606EFD243B7480CFD2947A1DE970BC21937B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_MSI_TMPcf09afa159b6281\F5 VPN\scew_uls.dll
- Size 242KB
- SHA256 32b3d1b28a704a47b0b76da3bf9bb46506f7a02956620b6ee6e14b8e1ce6d7ae
- MD5 caf8bad5944d5a0cf63734b10f23e831
- SHA1 4c7da26cba42ea738406fef0a1d0843ff61d68de
- SHA512 ce532501132d9712bea6302dd15629657e48c34eea745142628788090ad5ec0a127b7b2b45cefb0342e2f02a75ac92bbf724395177578e98e33ff8e26a7848a5
- SSDEEP 6144:o9+MYIMsdzpZglYe355yMp9CEojkOcd6olzaf:a+MYIMsdpCP355J1odcnlzaf
- TLSH T1DF348D20B893D073D9EA083050F546B28D7C6F34476AC6EB6B14B57D4E2B7C27A35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_MSI_TMPcf09afa159b6281\f5fpclients.msi
- Size 1.1MB
- SHA256 cd0771f55ad0cb3a016831067b19a203aa594fb61506934d0d0311d286240cd4
- MD5 baf60cc575adece717c140fbc9f0d2ba
- SHA1 2b59e9bbae1fdc5969349c35c2b57410778ff4f0
- SHA512 295f1970bbf2cef4404d1d9f98e102cdfc95992a40fa53a8e445c396ab92fe7354c8b1becf534d438a944d10d662ccc54b718a38004a87bbd2070e9d65d26e91
- SSDEEP 24576:LZDVYCGW7OY/0z5HzkWx3UGwcEmMSLdV8nFq71Xb:LZDVYi7OY/g5HwWxpEyLn8nFW1
- TLSH T10A357C22F107C431EE2A01BD591AE77AD5285C306779C4C363D87ABB6DF44E22636E87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_104022191137160127126\f5InspectionHost.dll
- Size 851KB
- SHA256 fa832a8d0506c202fde8cad9b4569552af5a0115379e1477bcec1af4d1ff6131
- MD5 df7775f1282f023813bd45f64e5c2610
- SHA1 9b8e1fe92e0a91c95ff2e48ece096daaa31f91c0
- SHA512 3f2e86bfaf56aaa590b297a99e51d9d8ffe1e74e980de531490add4a399900fea1307d7b16b990b7818bcc216b50a39b1979382f85136569d8778118ee473a1c
- SSDEEP 12288:015mSyn+ai89qO/ddonxV8xAAQoNW9RKrwuEoTvFDeP40I/csofRWZ:015mSC+QkOFQoCurTvVePqFkgZ
- TLSH T1A8058C213649C032F6BF067069A96F7F9568F832573184C752C186B9AC3C6C26B35F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_104022191137160127126\f5InspectionHost.inf
- Size 759B
- SHA256 212746b560d18acbaa2e0985c4ff9c05af2ca5a12893046b8b8ca348c7da1430
- MD5 5754a883e006aa81167f36b834e38efb
- SHA1 8390ec9db81761b9c015c14ea6edde7bc6f82ca8
- SHA512 11ac83f7222badbaa618053c5579d0892ea7fbe9ff705cc6bd134a3ffa0af169a10264a69dd3dc75421b0309d79565d4a331e4194c2f0fdf995a343737d9850c
- TLSH T14A014C9CD1078BE502492B9496422384F79B2A7F9B19B20871900E0B4DF3C0E1F4DCFA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_104022191137160127126\f5PolicyServer.exe
- Size 830KB
- SHA256 1cad7a5e7ac85bf01985382be33670e75b951977db2e6f82edc72c6b0135d2ff
- MD5 0bf9dd5150db86f4064329f2a006555a
- SHA1 c2c88a881c024eb9052a32a727f9f79746ddb232
- SHA512 f8a68e3e0e856f6bc4e820a71b6cc52ece3911360b9219d59c1b145e5cf88fe9f02d392468eff2c16df17bf3c41f0f249dfad1a81e3e13c74c72423f5b0decb8
- SSDEEP 24576:EWGbHT14l7t7FqLPpdLmoU9xl9g4dvqRHrR9qyHUCWzBCfCNklHWyZRdiqlSuPQj:EWGbHT14l73qLPpdLmoU9xl9g4dvqRHe
- TLSH T118055C1136DAD039F67215719AB8A376842FBC301B31A5CF62C4466DBCB06D31E72BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_104022191137160127126\f5epi.exe
- Size 1.4MB
- SHA256 4c9e6ccdfba971a46d9a075492dd422e2a8d99c09748277b991d06a48d693fff
- MD5 a075661ac5221d4208af27f5764ef5c2
- SHA1 1813df0ff5c98f064e850894394e6b3ca5730053
- SHA512 f7da627794a3322b8a8d41513d45ca7ad832018a85682b4bb46290ad09bb291a254c75ed32df9dfec3186196b04616bf0bfa46ce175b8862eadc5850cdd0250b
- SSDEEP 24576:QgW3ljOkpeegpNFzL/PkAOv38Q5ZrPZnthX9skXzl4UGblIfYOjHQs:zW3ljjpNGFTOv8Q5ZrPZnthX9s+4UGpu
- TLSH T1C165073173C7D021EAF203F0D93D96664569FC643B2180CBBEE46659183DBC2A9B7762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_104022191137160127126\ietrust.exe
- Size 181KB
- SHA256 4432c2b3c2fa1680f5daa36557a901794f6524c6e655de6542d9aaef15519393
- MD5 fe1bedaea05d9dce85f4ba8e0ed767f4
- SHA1 872c24d3485e2d4d2b878657b07917ba745bc83c
- SHA512 236e78f5341f8d1c5f9b84744a5ea7e82fc14c39d0a1754736cb1ad7af7fb7b7c34f121243b5eed44ae3ea0947cfbadab688ef40169152c4e424b136917309fb
- SSDEEP 3072:8/xfLVu7HqEi6GCsjzrpeOyXDSuCjLbDjvgJ7xFa7UXaNX8apa3Tl9Py02AUKXgG:8/5Vu7NbeLkOCAjLzvmOmC02AtQG
- TLSH T1DD046B3936D5D032E4B3153169F8D7B6A82EFD300B6188DB6398037A5F305D26A36B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_236226100231116194139134\F5InstH.exe
- Size 348KB
- SHA256 5c7f22a8043c4e69c2c84cccdce2cc93c2b7deff284cb4e3a2fcc2b21ea24be2
- MD5 059c1751a4e5da032e2d43dd147348a2
- SHA1 1b978ed7a6e9155ce709ab2cdd6abf1e579748ba
- SHA512 8b93bfc2d90cc2d20d7f40631043ed3e4d8e705b9ce4d3cb4d8db4712a36a0e1c953f55a8d2a8eb8c353ad07741ade5f7b59437f06f26a1c8f4d549faff5b3fa
- SSDEEP 6144:RKiHoH3BgYVhhaA8KS3L846MZ2z5hJSX6OKYXsP9heQ:RwXBgYVdS4mQz5hsX6FYXs1hZ
- TLSH T1EF748D1276D48172E57205358CFADA7A973DF82207318ACF6398073D6E227D25E39B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_236226100231116194139134\F5InstP.dll
- Size 91KB
- SHA256 48956498474b511334dc284ec9d6329056daa37ad3796f71865eb746bbfde14a
- MD5 963547ffc3c1dc308cdf689ec09a9697
- SHA1 d6ca18f970f14a68342504953f28e3f03097aef8
- SHA512 f196a67295e0b1c35c700281ecd89a213d0201e06064d9f759182c58b8780ffa4f2bf5216d1bcd97b6c0410774755c88a0e9295cd2c245fc1199a159469a990e
- SSDEEP 1536:Vulk/4zdximmy8nQNgdxp+7DwFRFPZsu0TiTuARXsWiHpcdmzDIGdwHKxn1xS6W:IiVyBNgdxYwFmeiWmzDIGdwHKXrW
- TLSH T1C3934A00B5D4D030E47E593815A495A19B397860DFE2CFEF3BA549AD4FB81C0BE31E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_236226100231116194139134\InstallerControl.dll
- Size 679KB
- SHA256 daaaf1ba9f115c0b57fc6433f9bb6e5c2165e96cad07715c378f040350525854
- MD5 8571f488f98f5d06f0630d592e65f405
- SHA1 fec0ef387a3c4c447129175a5436b881f18edee2
- SHA512 8534e2d68c382f9c54aef34b7163dce265c20664c78eb28b761fdb875c26f96dc1c837fc5f9430c64eb8b82f29af4b906429d752cde422bd645cfabdb811d5b5
- SSDEEP 12288:k8qZnPwSn9E3Ytr47hXNDMiBUTk0U+kLO+F/LqRiHsr7SE:MwSn9WYF2hX7Uw0UXHdq9r7SE
- TLSH T171E46C633341D171E66E01BCA528ABFED52DA630537014C3ABC45F797CE84E2663EA62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_236226100231116194139134\InstallerControl.inf
- Size 912B
- SHA256 43efdb2d840d0451727bb19b3d5c89a24960ab8eeff7fbb87b1ef85106504326
- MD5 fe3f21dc1957c00f5384f7c3b18257d3
- SHA1 86a764d59c7e85b2b55c16ae44ba0c5641e880b2
- SHA512 41135cfdbe095bb4c2c414f061e39b20dc985c4fbfb11245a01de03b8c8ba4fda6feb3099f49b3a829f74172ff3cebac365d37c30a06f8c43e4afbfef64dd2a9
- TLSH T18311C625D10303FD16843B64C78116A4F39F55EA4F29A208B2D75E4749E3C2D5B9CCB7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_236226100231116194139134\f5instd.exe
- Size 566KB
- SHA256 a9fd80b153e53296b016be30adcbf3d165f0336794e6ffe6c9e597de3e5e8f68
- MD5 7e7d1ace29bda5e78d71413e68de0b05
- SHA1 b953439521f82f61e0250312ef6c1c692f5c7f0b
- SHA512 4e17923ab2f0739c0c06e15b4cb6675380a163ab9b55b7813bd00478d18aa307d3ac0b457c552ca0a1920efba3a461785ce775a80b095618efbeaa0eb14f1c15
- SSDEEP 12288:J0mqhaqYsePS0v2MPEPgTRh7UrGodt35aNFZWVRXY:uVhaqYse60fEPgVwGodtpaNqVRXY
- TLSH T134C45B253521F532C92341F66D3AD3B6A418DD7067B64CC3F3C482A86CD46E27B3AE66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_236226100231116194139134\f5unistall.exe
- Size 3.6MB
- SHA256 dcaa172b32202252e1e88c73c30585217ac1b46fd26539f43db29d6072215d86
- MD5 8b8269f0610327e091854e75e17b9c6d
- SHA1 83e55d2dbd1c95c4b70f6b7fb10ae57cbd97245c
- SHA512 8f919fc1288b55dc9093277bd1c5a10850eebf7acff37a8185590140d1828f84779fb481774dcb1cebb6179fc8f1fb61058eb86ce9ac07e484c0d7173f7f576d
- SSDEEP 98304:pePJkx+jNNzOWgjkSc4KdAZayqn9v/Yr6lEI:pePuxEWjkSgX9v/Yi
- TLSH T100068D313E498076D56B0272AA5DBA3A726CBC341F39E1C763883B1D6D346C32E36657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_236226100231116194139134\uregsvr.exe
- Size 121KB
- SHA256 0202d6d9ccd26d77cb554ee3d7d4c981fb1c1154e195843f39e3be8eca6a9e21
- MD5 c2cf46f5c6e47cc24a245c36efb9233b
- SHA1 f3974d674127170b7a4551824cd5a7a8b6e17dc8
- SHA512 cf4f10f4aa4bacd1266c29520bdefbb9bc9eea00c8e1225f84d36cd076c046eb3a0662976eaa06558aade3dbeeece53be847bb859a2731b49decfab5476ee025
- SSDEEP 3072:a+bH7sfSiBWCYG2Y/Xc9clUDOeSXE75DeHT98sk5SrKXF:NbsSrGJXcSa8z9Zk5SWV
- TLSH T12FC37E0275CDC471F8B2193219B4DAB3492CF9705B70AEE7379416798F682C0AE39E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_32204211170241902091\f5LogViewer.exe
- Size 2.1MB
- SHA256 0cc059703e530c074761722de0aefae5c927e12d7a473f38c095fe6b70594806
- MD5 5705b919c175df9b0db637421525cc3e
- SHA1 02e2fd3e49d737dbeb198d7b0543c7780b50a767
- SHA512 d39f58df8f07d933103623b03629b7dd3ecacef03e35ea10b54db090fa3e39e7b6fcfa591d072f221fb208e9cb00e6527a0a7ecfcfaf497901e46f00c58aa095
- SSDEEP 49152:ipeL+98lBOnpvF/19iGyZDIqcXafiwW4yB6QaK9mBN+VOMHUgTOH4trGq:dL+GXOnp5LgZ4aft1yBXYUVOMHUgTlFl
- TLSH T196A57B317DA980B2C5A313318AEDF63E78BDE6340B3901D713E41B5C6E646D35A396A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_32204211170241902091\urxshost.inf
- Size 585B
- SHA256 c78817899fd394680af5bd0818dc7b2411191341b973974481a153b99e247d5c
- MD5 27ac4a372d16d232f72e0221b6f79daa
- SHA1 da698462ad8dc87bc9736ed034f1b79f55ab92b9
- SHA512 7247e9e17717bb0ea524fc91cc3f3ea62630d6ed7519ee0339eeffb828e5dec8d0e52da98323ceda6e09d45792a113df75f4f584897fa92d98c9986808907c62
- TLSH T193F04C24D10A09FD368827A185435280F3C7097F47D8752870E98F8649D3C4E4B59CBA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_62441751941282118839\F5Win32CheckHelper.dll
- Size 95KB
- SHA256 7bdf9ded10880be056aaa090a8b41bf0d6936188ee3630498732c0d7bea2c6a3
- MD5 d60c7bba82e4125654a556a1d90c2fed
- SHA1 6796eda88190a47f373a08a8109aa69508ab1fc5
- SHA512 185446f1ed3bbf006da9db9c6eee45d15fc0978a8dde2da352069636d611225d625ba2278c941c095cdf01e4e909f77be72d16deda1d25295fa4a427cbe91ab8
- SSDEEP 1536:+7Xkusu0gOMDl2xcaC/tVIe05wFOPo1P2TuKysWdcUDccdboCG9qpzGkbQKuZKxB:bqkcn/tEwFOPliZcUD9b1G9qpzdbfuZ0
- TLSH T145A34900B594A030D8BE5D390865D6519B38BD10DFE58EEF2F957A6E4FB81C0BE31E62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_62441751941282118839\scew_uls.dll
- Size 242KB
- SHA256 537db1c88ac11d79ce8dc2f4343285dbf650b1d5261a17d6e103025c9b9e1d2d
- MD5 2b7c07067f841856ccb783bb0c16ebbb
- SHA1 439fc32b6c5f0eec2bbae5b59e5fbeffd1fd7a55
- SHA512 a1febfab891196692c906ff5d8558d10d8497c5dba38c29ababa2e1fb2d192c31fd22d6db261647b6bf437580e667f8cc7cffe4e841967db698f370114c35b2c
- SSDEEP 6144:C9+MYIMsdzpZglYe355yMp9CEojkOcd6olzaI:Q+MYIMsdpCP355J1odcnlzaI
- TLSH T1A0348D20B893D073D9EA083050F546A28D7C6F34476AC6EF6B14B57D4E2B7C27A35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_62441751941282118839\setupdrvdll.dll
- Size 250KB
- SHA256 932a6b9088a91dde862ad6151cad9d3cd3d741aa84942ef282307e377b8f51cc
- MD5 4fc00dd21d433edc1c6fc6cfbb7b783e
- SHA1 818bd7dfd4b4720995b8331ebd3ac78e8a1c3b21
- SHA512 ef649ed5826ee45aa0487b034edc4bceadfa7a920901d7831270450a439ce9a6ba9c5eeaf107ad491bcd76a254e6cf9d2f6915e5c8f20dff250d6dd082a3d0e1
- SSDEEP 3072:bNRDhhAXrQjukHLl5i+sQC2mClICaQ4K31XMU8HMUYGLMRxZnik4yTKGd9+NgdqU:rqQ6ul5hGC0QgMUxMRFHt+Ng25LZ/nm
- TLSH T199448C213641D03AD5BF0174592AD37B987C68328F70C4CBD39A1A78AE755D31E32EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_62441751941282118839\urset64.exe
- Size 308KB
- SHA256 40c674a2bcc6bdc8c4e813825e8c59067fc0f6fb214af853a87c3c12963163b0
- MD5 34cfc969c137fedae8ece49db7b3d4b8
- SHA1 583ca7197e5df3b03270fe58be6f60105fc5c7be
- SHA512 b6f18ca154645cd06cb630847c157a1fba1dee337ce30324eb72ca2315b5814cb41fb4dbc4cef1f7afa55843c5d6aed7a05ac162f857938d384d8f3aabbe9f35
- SSDEEP 6144:H524CLpZAgB5CJhdZePqkRdeYfdSF76v43vUvatTO67d:HVSBBqkfe+wY4fCOS67d
- TLSH T140644A6CB3A50AF5E8A3C13CC4C29553FA7178418B79DEFB1354472A6F232A09E39B54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_62441751941282118839\ursetvpn.exe
- Size 221KB
- SHA256 0cac5e2594e7ffc76ff414e0861d65663eaa72afff343b0906f87898f3837f53
- MD5 1ed9e5498401da0cc70adaf75f4bb3f7
- SHA1 70344a9474422ab764d0d3c43a9e1cb991d25d33
- SHA512 a639a249f3de2d629d4e8dcf8ab1697800064b66105a65ee943ba8d8a990dcc633c2e1b2af5722f20a1509714ea669d7151ce730e431c4d27cd68d3f4deec8a3
- SSDEEP 3072:0HPlRixnjLAK8I2QFdvBROhZHU2SryfyR3HkSfEQ3PIp/KuUPUeBerE7HKrwQKXE:oRihA7I2SGZHCArSrIhqPUeBerEesh0
- TLSH T1F5247C3175D0C072E573017119F8873AA92DBE220B2588EB739C13AE6F721D25637B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_62441751941282118839\urxvpn.inf
- Size 1KB
- SHA256 a0d1b03cc8a81d3d4631197ef68bbd6b3dc98775a5bfb294118884682a5543dd
- MD5 4463337d73c30bfb973fed6c3f4dc91b
- SHA1 2ed617e7e62333695b0346fa6485f4f3f7f36d39
- SHA512 320b217814dec560e29f6a980ec3ebdf35dab9fc4ac1f9053372352cb0dd3c33517ff7dde0c4716bd1b0acf9a2322ef614a2b274821e188c90d494d6e7cff33a
- TLSH T197219E2AD4071E1A623C2E6C8E715288FA57114E1B7FD948F044CACB1E97D0B978CC39
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_64351451471697446253\F5ElHelper.dll
- Size 212KB
- SHA256 dbb45411f900e05b538e316335171e82d563f8eb97243bc1cd2eb08177808837
- MD5 dcae817fe7ffd6b526d5d0690ce837d0
- SHA1 250858827a8b93a930b245ed76948d60674bef12
- SHA512 5348356e7093918bf44685ace9954ab55d57230f8aceabcd341ed5f168fc058e80eda40123e26defb6243a62d58493b8eac1020306fb5b06c07ac602cf8d6942
- SSDEEP 3072:Z1UVkFm8tPoVuuYuAATBwyvLU+hoKWGLdZrurpUWs3FMQIg0KXlo:jasm8UuuboyvLmK1LSw12cO
- TLSH T1B4247D1136C5C03DD67F1A3444BEA6769A3CB8704FB48DCBA3AD4E691FB00C16735AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_64351451471697446253\F5ElHelper64.dll
- Size 243KB
- SHA256 3c637d27ecbd78b60afe657e51a771abed29471802ccc4c29cb7276e9bec555a
- MD5 e47806aa4c45ba2848d49c00adaeb537
- SHA1 334b3b4595be57686306b3d4486f65a87e8aaefc
- SHA512 73dad43ff15eb8575050e41fbb8bedf9fda5d3bb89128111ecac11f8d789f414cd66a51ffea2c85b5d3ab7c97eefa2630216b243f71f95076ea751356d32f7c4
- SSDEEP 3072:fc/GLXwJ8vEWQ3kJqvtA5Zx8riz/TqNOW6uShpqnM4zEAPQhOG9hk4GQueM8eKRG:M8XbQUJqQx8mEOWKhN4d2jSuG5
- TLSH T1EF347D1DB7A848B5EC77C139C8A35906F6B2B8014B70D6DF1364032E9F6B7D09A3AB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_64351451471697446253\urxhost.inf
- Size 806B
- SHA256 c149b8a32033a5a7929a419103a4fda5ca624b36d7ab17a125219c23a07d13c6
- MD5 831c169c11b45759c5516d2d236611a2
- SHA1 f86b8467ab2650133e7060ec09a83b4791b11b33
- SHA512 6506614eec0f764b5d6fc23892b10da3deea9b82f3aed8a698ee30640dc22b324a77029021cc44eace5f215cf29d65d2a70a503d1cf9d4eda523fb7408120991
- TLSH T1FA01F018C0431FED014D279CD18162A8E79B16BE9F6D761CB1811F870DA3C1D47A8CB6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_885219147138148145189\TunnelServer.exe
- Size 3.7MB
- SHA256 569a3c3b5f9d67cf6bf388e74001c19893f4c977945e9f37fbf2d19ca9ade4b7
- MD5 ce7f9b4daab9720c12f269ab7ba8e352
- SHA1 f413c5e654fd833b9731c63d1198f6e33f9fd948
- SHA512 21a5527977f8664f85fc2a0891f55ac0a9268cc60041bcf70de8ff9c79d4638f43d12f0c9f67d03666acf44c603238b992e3de75f2ddcc4784a398e0d9383bcc
- SSDEEP 98304:S/BsvNRuX6e3pF5RydtddzrDwgQH9nVVUY3:0QNRuX6U9gW9nVVb
- TLSH T1AF06CF52BB0788B1E5574070916DAB7F9C3E6D3103A484C3D3D0495B9EB22E36A37B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_885219147138148145189\TunnelServerX.dll
- Size 572KB
- SHA256 ff91405e801bd048aad2d5d55c725a8fa14580e57be5d35904ff307627f21c8d
- MD5 a2506bc6c01e376764d23bb21528423f
- SHA1 aa7bf09844740b876a20a4c1eda288a889198fa0
- SHA512 970d45f7264176fb92c7f42ed2cfce832335b1908fc44eb11fc388e7698b2606ee6d9d5d1e165eb3999630d57d73903b218a98e338e72c0b55f9075a6fc2c05b
- SSDEEP 12288:Gl8pIb05ppU6Hs4XM4tO2mkNj76gV8Sxbd6copr3BWWAH:88pIb0myM4tOAP6U16coprxAH
- TLSH T153C46A62714AD935C62D02B45CD8AB7F996D9D301778A8C7B38C4F7AACF05C36A30E16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\F5_TMP_885219147138148145189\f5tunsrv.inf
- Size 484B
- SHA256 b326ac25bd5fe67b59dc066cae815eaa3f4f90584c52de0a47bb052820d49b1a
- MD5 782c4a42e57d633194a6de8f23b8d740
- SHA1 08d065c0ea253c27d32261cd9791a46a29bc7916
- SHA512 f6ae05c02bb0339c6c1ea897252a7331d627402bd708168f11abb0ce709cd628511092b425632cf6fbf324ceaac9da9538678b560c433f1b9652030aa335eb9c
- TLSH T13AF02BB5840705E922482F509155D3CCAB57166A878C62CC33940FE716F2C7E1B7CDF5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6E55.tmp
- Size 495KB
- SHA256 f7e57e5b7b8b34de8fe4f8a17b38c84e3c7ca80af90898164f6b59ba72b582d8
- MD5 44d10ad3af1dc2f96b5057eab482c3f4
- SHA1 42c78344d2850451c4cdedd62de87e684800741c
- SHA512 f15dd3e8a106d9bf93d09a9d420ba6557bf57b45f8439cb51775d1ec8702481f1dd608d80aea34a36260dda2ffddd793895f17f9bd91f32bed6a621086c95538
- SSDEEP 12288:LGW7OXdGx/9v6OyskcGHE5IrkWx31D+nGo9Axh4v1Zrc9n:LGW7OY/0z5HzkWx3UGwcEmn
- TLSH T17FB46B226019C830EA6F81F49E0A9B7FD51C547077AC94C35BD942BB7DA84F36636E0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\logterminal.txt
- Size 1KB
- SHA256 b859af942a93f867962850514203064d7e23d7475e2a9b89e306234296d56ccf
- MD5 5a2c0e027f39b818dd981ea09cf18e88
- SHA1 a93d45d5753104dfc4bb6b53c0729406c1e4d149
- SHA512 2183a39f8b71d840fa94645af4b38ecc2818ae618f2095c44dd8f79455833e2bd6eedce6907c0bfd33e99fc78afa7db8f028decaff370c8ad2ab2cf5019ab247
- TLSH T14B2193E498BA8221ADF70758A99F294B2152E644600C7A2FF35942505F1D38C8D909AB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\logterminal.txt
- Size 2KB
- SHA256 e30ddc447f99a878ee9fa3ddc0a2cfbee129d2d238cfbdc6e9b000a4fcf4a2ac
- MD5 d7ab378d29fd7d760eec6d741a775e58
- SHA1 b67fbb333ad0784797c117f0019ba0914b56f9f1
- SHA512 b14b2c713cf4fe1c14256709498b9537bf1aa519cb9cf55c09552e33758b6110af82ec7994e379a51e86273bd6aa53e72011558775a49252c954063603fadb3e
- TLSH T1E841EAF55CF74220ACF74769A9CF298F2116F248A00C755BF355D3545A0E78D8CC68A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\logterminal.txt
- Size 4KB
- SHA256 97f2c90d25b065157a2ec2d5a253c0d518f78aecc28febaa8837e0bad2208bd1
- MD5 d5aabef07eb0285d070b77b2b2bafdfb
- SHA1 706a26ce4d3475ba05bbb41e190889a988eb0d9a
- SHA512 d20a1d7c906dfdc0c8c3ffaf63f53a57f56a3a0e93bcc53b2305035b5f012813c527be2701c93bc6761c82e72507bc43c0fa2c26eca521a73b111ad9c4cbe0bf
- SSDEEP 96:XwRjRJSATSJQCfNGfCL3/3U3u3Z3U3/3yDI61IDeqEz4ql4zuHLi1jeFvL9c/PtJ:kj4/yUxy/egyqNz8M
- TLSH T11B914AF4A8E7D1346CFB4758AACF1D8F2192F244200CB557F26983546A0E7CD8DA68A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\logterminal.txt
- Size 55KB
- SHA256 a70682689acb2a7efa56abd4d698a6c92314e58bfc68786c4795a4a6f69ee6e0
- MD5 3b28d3a39e3533dc8412e7d001ec1b64
- SHA1 4e092a9ae589e5f4e541b8ff0daa849cdc2ab0f4
- SHA512 34ba959aa6d53f9764d90f3b95a9090554f26a4057ab5940eb6e1290600f6ff0c4ace47bd22777ef0c3ad21e9e27ca2102588e7aef4fedff85409ac39e598fa3
- SSDEEP 1536:4kL1NiW+3X1SEsumaOQsNWbmXcAzEw6vA6Zz4U:BLHiW+D
- TLSH T1A243F4B469E3D5393DB7478C9FCF1D8BA292F204325D7223F2648314994A78986FE853
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Downloaded Program Files\F5ElHelper.exe
- Size 516KB
- SHA256 11f60308789cb6e2eb9b2f05771e25851408a02014c7ec6475e44f61577ac670
- MD5 4cdee3c8ab4b2d9cd2451a9ee2b8516c
- SHA1 88c3ead27164dd79e18dd75518af652915454d66
- SHA512 9fb6bf951f57ab4258bf620d80b91752e44a8e7d21e6f19749c6534cc71b96d5675f60e0564f5abf7c99211e953d5f5dc049a8ae576986b9fe0b889469b6475a
- SSDEEP 12288:0xqLM5WX7Um7v+5y+jghlpIJxa5z0YEvKJE+pVfq8P:0L5r6lpIez0nvkLfq8P
- TLSH T13CB45C20B6EAE635CA7A00BC9D5DE77BD41DA8B0176101D3B3CC02693E515D32A3AF67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Downloaded Program Files\F5Win32CheckHelper.exe
- Size 268KB
- SHA256 a714328ce5209ab2a63282e781e67aeec27522b37955ada2f8a7c72e8d3e5b51
- MD5 dfa6536fd708ecdddde9f667cb05a446
- SHA1 0e3b1498af5b8453b0e2a6a0d24bac9e3737bf90
- SHA512 315b2609f8cde45f9c5415a194c887e929c66c89a807bc680bc0f193e12b7fc49b1b44aba76a538608396827b4af126f383f1181870d79ad557d0d4d1e379f54
- SSDEEP 3072:+aiBg7Dx7xG0+ANKwDSEvuQOIzdS4AZMtQR6+tsPMID4d6XN4wqpzdeC8FNKXw:Zn5AEGQvzAvR6joCO44A
- TLSH T140447C317995C831D9B31076AE6CD77EB81EBC30471454E7A3DC272DED385C21A32AAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Downloaded Program Files\f5vpn.exe
- Size 1.2MB
- SHA256 947ca3d8a520fe66d519f8d268b3cd64d99ea00a58a9d6572c57cf7897ee08d2
- MD5 9c6955535a51584108cef0b19187c93a
- SHA1 e37e42c5568a4339cff352fbcb2bbddb02b8c481
- SHA512 9df9f48cfde17637d54742510d27a27507be053e7ba661f72860a11434a68e916b00cef4cf0c5d44597f0bc6e469b4bd9a0862969eef83d9583ed867a019d225
- SSDEEP 24576:ttyS7KqBUKCS2iBOCzPs1zyV7T6mzhcjg6ld9tt9oz6S4RceCCCzBd5tf:tj7KGUKCS7Ois1zyV7T6mzhcjg6ldbo5
- TLSH T1CD45F61237A7C122E9F257F0D97D96765429FC213B2085CB7E84366D287C9C28E37B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Downloaded Program Files\urSuperHost.dll
- Size 972KB
- SHA256 4cf1989b7ca706488035cb841a290100d7384c055bd9419115d91d752363cc75
- MD5 fe0020c4e9f94d718ee5a9c7fbbd6ad8
- SHA1 c680f92f8382d122c0044c2dce57c862de7c9524
- SHA512 8aae4dd3ead26c5227e316c0f93e2ccad7c7b48b9d0ee729b876bd50c434b9e6482a0d70bcb9da71b165df9cadee82d83c12308491d4465663782b7d4e672f0f
- SSDEEP 12288:4Qx7s9SdDdhNVbSkceb9E2JwWyPEB3Qn4mUEgCBGHG5bGsePCoQoFCFliLmP:t7s9SdDlVbShebjzwCtEgMgRCTFMyP
- TLSH T1AE257D213744C52DEBBF01F34C2C9B3A996DA8310BA445C352D8FA696C145F2763EB9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Downloaded Program Files\urxdialer.dll
- Size 1.6MB
- SHA256 3e2e6b5b336415d9ca82bb307436bd785d6a3db3182264bd6d306ce16a180e4a
- MD5 351fa6f40ae0b391a15f231f526c485b
- SHA1 c7f2b12d23d3dced6b2dc6e42997be4ccffd1b14
- SHA512 8fda8a9f8ee46d13900f3b945bfb49a69a9a2e73826b0674f57f4883682caa4e1278c3f0be0dcbc45b3872791579cc36746b3bac7613cae687e2afbaa9d91048
- SSDEEP 24576:eSSrNNc/+yKBnvz27ZGAbQKGYQIekl7w0cfaN3f1:3Srrcj4nK7ZiKGYReaw0cfaBt
- TLSH T1F5756C32FE968621D92D52B4971E636FFD2CA870072044C36654DE9DFC609C36A31BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Downloaded Program Files\urxdialerres.dll
- Size 71KB
- SHA256 fb61429679c0e0bcd79489166dfde86aed1deb6bcee6fd25ff2de99d6f8bd8f2
- MD5 ff16bd45303a9e72cbe1296327f23dec
- SHA1 861f768561cbb6f43ef259c9c1db9ee0d9d71e57
- SHA512 74b13b80c2a40187517f3f7ee2f6d4c4150b13e80dd6fac0972f81b0defc2c87207f55f006fd42b771c130d6a4c3c2e6fdc5859d9961c276e68e8437b8f9e833
- SSDEEP 768:MNIEZs10Hhlc05cPHSISjV/eqz987IotPre6YE8TiMTBSIlVkSmqQWmAbJA2vRxM:MNIE3hlc05c498lYpT/zzKxn1xSq
- TLSH T183631C1653F88A05F1F2BF3099BA52900E36FC96AD39C69E1245589E1C70FA0DE31B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Downloaded Program Files\urxhost.dll
- Size 1.4MB
- SHA256 ee87123e072d091a2d7abdd6380d2c3303e6ede19fb80facecfa49033e247b0e
- MD5 befa89d7bc9047f63e2ff8dd1f74561a
- SHA1 2c29f10afd2c9f3e7d56310b012d174edf590f63
- SHA512 3228484b84e1529650de58f98cab45bba72c8914dbb767ea88372d57dfbbc7050c8687bd563cae0259e1c202c364397fdb79f2a3f93defbd26f5aa2993112ef2
- SSDEEP 24576:QC3BPmN3AaUBEZmQFZXYcAVLWgN6K2da3pR0C1Kn6BnxIGJwGt:b31kZZTHXYDtN6opR0IKn+nxIGJw2
- TLSH T1F2656C31BA0DD226EAAE31B0D96F77EBD318A471072440D7EAD44E686C314D36A35F93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Downloaded Program Files\urxhostres.dll
- Size 128KB
- SHA256 fc12bb9a059eadd04b5ab9e62507c342a520792a8b4e4f27c0c7ecc47f5d8d8d
- MD5 9980ce00bbf2fe48574278485f815e58
- SHA1 56ca51ada7ed7be98d342752948ed4a991f5d560
- SHA512 9f7fbd81a6f5880ad38ae8528ec7d87f143615a2358c8a2f452bb46d89acd1cdb2c5805df5894791511ba18e19c0c3c9f97214fb1e6832faf717f0d88cd20f3d
- SSDEEP 3072:lPS0EL1JcI5Q05g51PkhasoztFVkUH9DAZKXV8:/1PkhasozTFF8
- TLSH T191D3EA2653F98A05F1F2BF30AE7A46911E36FC91AE39C64E4205585E1870F64EE31B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\setupapi.app.log
- Size 1KB
- SHA256 9a9e6dcab0e67c4ae45cb0071808ad7638c3bb37e3fed1be45643e152d981048
- MD5 71f5f04946f7439fc952322c6e04bb3b
- SHA1 8f5db41f30f4bf9428b1d8df07994b174eca8806
- SHA512 29a5d1a43a7fcf190992d109eb3e792c1eb4e41ad6d93bde24e42f0d733e3f3d99c626b4d31c92c9823d203103b41239853f6f2a3d29b2b0865b7db320cbaf33
- TLSH T1B821CE20D79100E09D3349471D2BF590D6E8758BE4CAC8B4B2EEC6442F7208DC329E4F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\Temp\{ab293761-6def-e741-b34f-46744343a8e4}\SET4B09.tmp
- Size 58KB
- SHA256 c28b7f0dc76b1ed9b05547652fa3439dd322dd49710fd79ec0713ea95b0bfc0d
- MD5 fbf2006520dc73305261d8d08bebf69c
- SHA1 77228c2349352a636be7f04f970d4162cf865800
- SHA512 6b9cb88e52ac7bd473f494947ceca8091b6b8ee041af554891409914ac0e15d09dd37625824878ce751835ad658781aa17a29b5f893a96f67112bc83b606a88b
- SSDEEP 768:hnCKoBd0ZrDe6T7qcHZunm4hs5o3eZ7lfVD6aZXBrDBm8sJhJyKxnVbIay8OGb3E:J1/ln0m4hwTfVWWrDBMlyKxnOipbFm
- TLSH T148438D8696B40896F9ABD57253B1CE0BEEB174822712D7DF01A0C1B61F937D1663C33A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{ab293761-6def-e741-b34f-46744343a8e4}\SET4B1A.tmp
- Size 11KB
- SHA256 2387a205f164d577cbb4d2a2aeee29e1b8d8eb7d4ba8814ff90b989cafbf74c3
- MD5 62acf4d4f8763708508839689fb9f416
- SHA1 832d2403828b2215e04a4aa988baa094dc3c2106
- SHA512 0991e56f3a3368e8d99c020b8865637194f9d70945fcab257e04039aef29ed78aacc54857cb5fa0472b3d69e945a847171aa4a11ed6a13aaad0997782ac1bd20
- SSDEEP 192:FZV7M71PUFJC8RNF1agjEwOXP6hYCJbgoqnajKsV2dV:pXRn/k6h3JbnlGsV2j
- TLSH T13732E9A1946941C3F9A7AC6003E8F51BBC3D67CB6C1001A9256FF76E0DA33C5E71516E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{ab293761-6def-e741-b34f-46744343a8e4}\SET4B1B.tmp
- Size 6KB
- SHA256 ff7945f2c864700069a7d3ca7d0e67aa608038cac47716752c539a783ba8880d
- MD5 262f9f2de1948ab613bcb10d0f8245f9
- SHA1 e75076c5758e76fc359bc12175716e6c5725c306
- SHA512 0f21be452cde06dbbbf2ab406e4d262bdd4907a199294b2b9e25e7de046a9f59599e5e3fd5ae8787771a261226bf256b73fdb8db80a0513a6d339b1d591dd6db
- SSDEEP 192:D93lA4NodFUf9P6+zst3sbTs6brkgVU0KMR6z7CAE86RLV5iBH:DxVPveovVV9KOI7H
- TLSH T1A3D1241976CB0F371D0310D9EB0774E39256600401A56D1973BEB5A48BFEE6C9339BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfc007.dat
- Size 142KB
- SHA256 55b47d0f965800c179a78314b6489d02788a44fa2ce00f68b2d860440216927a
- MD5 1bd26a75846ce780d72b93caffac89f6
- SHA1 ff89b7c5e8c46c6c2e52383849bbf008bd91d66e
- SHA512 4f5e14637e9e89700f1ee2d0e575d26d4f3d164d859487f1471bf4410dec6d0d7dbf552c6f791c12388be035c6b974610cda8882c6394438e2220b79e4d74e9e
- SSDEEP 3072:wb+j2tTPhtq3LnfxNlu9rinu2xo17pYopTdelMTdlPf90DG:4
- TLSH T1C5E314610BE90518F2F77F38AAF54085AE6AFDA6BE32D81D1150118E05B3E11DCB5B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfc00A.dat
- Size 147KB
- SHA256 44f8db37f14c399ea27550fa89787add9bfd916ffb0056c37f5908b2bac7723e
- MD5 6d4b430c2abf0ec4ca1909e6e2f097db
- SHA1 97c330923a6380fe8ea8e440ce2c568594d3fff7
- SHA512 cf28046fb6ab040d0527d7c89870983c02a110e9fe0ecf276395f080a3bd5745b920a79b3ce3bb820d7a5a878c0d13c37f67f4b5097245c5b93ca1111c1e830b
- SSDEEP 1536:jLLxUhWnjnfMIlk9dsN2Lol73y4T5TqtMZuh6f90DG:XLJnfMIlk9dsN2Lol73y4T5xf90DG
- TLSH T1E0E399605BF81206F2F7BF38AAFA05555E3ABD56AE36D42D0160118E0DB2F41DCB8727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfc00C.dat
- Size 141KB
- SHA256 0b16ac631d596f85f0062dbe5da238c0745bd4c033207cba2508465c7c7983cf
- MD5 6adbb878124fcd6561655718f12bff5f
- SHA1 1711619dda04178fb47eea6658da6ad52f6cf660
- SHA512 88ec8b3c4670970900ef8fdaf0865e24a5bbc9c0ca375eb6ce12e8d8a3ec08c8a45dfc8ae3c7f4ff1974d5e4b53e0905c5dffadb852e730eb8097a22cd750006
- SSDEEP 1536:SkD6nfVQlg9ZDH2lo57Eu5kIgdmqtMZuh6f90DG:SkD6nfVQlg9ZDH2lo57X5kIgd6f90DG
- TLSH T1B8E39BA55BF80115F2F7BF38AAFA11419E6ABD6BAE32D41D0150018E08B2F51DCB9737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfc010.dat
- Size 138KB
- SHA256 71c5a18d082651484ae96e93f127bac9ac217513976b7e98eeb2b879d643b735
- MD5 c0a264734479700068f6e00ef4fd4aa7
- SHA1 4e1a8c6a53ea9b54eb76f12d99b1327137a47ebd
- SHA512 85ff44333fc4d47b02cdbc8c665c0bace22a19961e40419227976333ec1384ef8779232d241a9e3b54d988117b84c436f695f0be80dd109ede60fed919ee5fca
- SSDEEP 3072:0A67APRnfTIlv9T/E2do37H6Xx8ECf90DG:B
- TLSH T1F4D3CDA15BF81108F2F77F3CAAB951525E3ABE66AE35D42D0190018F09B2E11DCB573B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfc011.dat
- Size 125KB
- SHA256 9f32176066529c5699d45728fcad1bccce41d19dded4649b49cb24f7eef9ce7f
- MD5 eef14d868d4e0c2354c345abc4902445
- SHA1 173c39e29dbe6dfd5044f5f788fa4e7618d68d4d
- SHA512 c926f13a0fc900dd7d740e2d7d33cdd1902ece0bfb44b6e1f5fed6ffd348c3e7d71089fb9792e38799e8df6573bc09e67bbe132cf9c2ae0a7199534dc5d959ee
- SSDEEP 3072:Xbnfw8lZ96mRDaUR28oV7OY+7S0bif90DG:A
- TLSH T193C3C0A55BF81018F2B77F3CAAF640529E6ABE66AE31D41D0190118F05B3F12DCB573A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfh007.dat
- Size 710KB
- SHA256 3053aa67e9cb37cd6f9645ef3bec8d43b1863afd852d3860ea73fcd83c7010c3
- MD5 82d7f8765db25b313ecf436572dbe840
- SHA1 da9ed48d5386a1133f878b3e00988cbf4cdebab8
- SHA512 59766b408b548dc020b54c79a426b361112c33c7263c16ca2e69485dadca05fb4c63b6433063e77c6a9e28a43ec6d3c8206ea702a33b79151fa6309d83b316a8
- SSDEEP 3072:MhpwBxTEsmVdx1wN8EBNjcbg+hSILPDtzcSx2A8q1JuqaB32rSrSQYCxly/2dj9K:zqv1N
- TLSH T11CF4956153EA8618F2F77F64AEB812A46E66BCE6BD79D64D1250109D0CB1F40CDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfh009.dat
- Size 683KB
- SHA256 318ddf14845758c9eb20d8a5b77b1ed2d0741d1ecee3d29fc403e5bb9dfec80e
- MD5 3a681d0069917d0cb9b335fbe120c7e5
- SHA1 563f018111992add15aa8052b3727adeaca682f5
- SHA512 48115ebfe5654b288712a49379b2f805c3337ba3b40a749fd94e7bad6fce20f61a50ac2c4b56ae97729198713d2fa5f14e2287e8d232862d2995efd1866038fc
- SSDEEP 3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHHx643/A5BK9YXdhPHlVziwC4ALWI1dnmRu:78M6d0w+WB6z
- TLSH T19EE4699167FD4208F2F73F64A9B516A45E7ABCA6FD79C25C1250009E4AB2E50CDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfh00A.dat
- Size 754KB
- SHA256 3df3adaa8bd1ec4dd99bf304c7a1b0d513097fbeb8648efad4b127c5522c3263
- MD5 4e62108a0d4a00aa39624f4f941d2595
- SHA1 7fbff1d3ac293c715a303ac37da0ceb12591028b
- SHA512 c79a483e4012d8c97f4a2188fdc27ea04bae24993b12487551872f1413a1a0884197dc71d13ba1dfd32c9b2c93089761f6f3ec37f0bb19e209dbf19283462126
- SSDEEP 3072:o2xx7F17Fetjvtx1tT3JCF86nceg1nE643GYBncOvuldhEtZ1d813KXKUBUcwg5T:+tjvtx1tT5Snyn6vuxZDFwq6
- TLSH T1CFF4FE5067F95209F6F77F29A9B91A654E7ABD96EC39C11C0220019E0EB1F84CDB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfh00C.dat
- Size 758KB
- SHA256 6cd8b09f644b22c39e02af26b57580baa0fbed01b682d158b29c676d17dac5c0
- MD5 b87c7ea0e738fc61eb32a94fbd6c6775
- SHA1 0e730aa70900f623205b93cb1d6e11be4c0d51b5
- SHA512 4bad64af992b17a5700cf25ccfa299b2db5be846b8bc28233fa6987964994a34694eb53329ede8d04092298e4b16f06563e459692c210111e0420ee34468f23d
- SSDEEP 3072:8seo6JpGytgViPIny4auTsQy2XQDIefsnnSRfERwpZRVDNtflhz4FV643NB+/dvk:gTGQcyygIv
- TLSH T1D5F42E60A7FA5209F6F73F64A9B915654E6B7D96EC39C21C0250009E1DB2F84CDB8B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfh010.dat
- Size 747KB
- SHA256 6699946552b9d5ebe64d6854228984a773e413a345816a5597b7d7035d4c09bf
- MD5 77a299c7d27f4e4372cd6c1de0781586
- SHA1 bb6bf16619da6d0acc30797cd10978bde64892fd
- SHA512 21fa8fd59e56018a3d888aed054e4117b246a5ea4568c2df93334d7565d50a512b5fc2c66c09572f7d1363e5b65ddb34d0c072267be78b15681076d2380cf98b
- SSDEEP 3072:g+8gxXowjkUXx5E8d8tj/v9GLcr+cu8ov+pmPxw643SBYwTaa2BydhOK06J1d9Mz:rYj/v9GLBLaa2Bx6Z2Bbf
- TLSH T144F44462A7FD5608F6F77F64A97816654E7BBE96AC39D21C0260009E0972F54CCB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\perfh011.dat
- Size 462KB
- SHA256 6de2fdef2860e6e37cab23fa1785182c47955bc525c6e43f5b6887962ec7da8b
- MD5 a8bc9760fe491ad0305212839f5caaaf
- SHA1 e5aa69598284bc55ef94adcf3745053650179f42
- SHA512 4e19385e847d0f2de2d66979272a32bdb159c34319f45e7a497672904f20e52fa288778a7a5d1500b43abaeaea5f9f3cfda805895cf94442e5bd4d92d8751f13
- SSDEEP 3072:ZZg3ID5H7gVmRw4T0O643IBh5oUdhlFStjdC1dpylObLb3tLbsBU+wgyXzdW9nmM:Tg33mRwZYpm/7g40
- TLSH T195A4B88436EC060CF2F77F64A9B520A02E6EFD65AD7AC56C1550408F0972E49CEB5B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\Performance\WmiApRpl.h
- Size 3KB
- SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
- MD5 b133a676d139032a27de3d9619e70091
- SHA1 1248aa89938a13640252a79113930ede2f26f1fa
- SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
- TLSH T17561011D8E8A416EDA7E36A95C2C192419B5FE770AC058EF317DBCDF0D4A80A24D352F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\wbem\Performance\WmiApRpl.ini
- Size 29KB
- SHA256 c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
- MD5 ffdeea82ba4a5a65585103dd2a922dfe
- SHA1 094c3794503245cc7dfa9e222d3504f449a5400b
- SHA512 7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a
- SSDEEP 384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2V0DrtcYkcTu:esoW/g4kg4oG4J
- TLSH T1F3D2201267F94158F2F66F98AAF594775A73BEE66D38D1AC01A0031E09E1E40CDB13B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 ba1bee3c9f56133e08512c51bd4d79c5e8517424e84e2cfd8ae45f51e94e6b31
- MD5 19f5f10ee5bb61492c1872a96c7b75ee
- SHA1 2742f12192ffb2ba07d0ae8a0333cf7f4841e744
- SHA512 d6865734aafcd05e9e53bed09bf3ccb0dc33ec806b332577bbb13650e9562af159f6b78f60c3a457b95c07e64adfd791926beddb07fbff52b75fa555768a738b
- SSDEEP 24576:su8m+1zGdoO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:9
- TLSH T1A247C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{651fe038-1482-4d20-bafc-adeedc241522}_OnDiskSnapshotProp
- Size 6KB
- SHA256 d3cccafbabaf8519d83c76e5a86b0ab0c05018a4f14323fcfaadaa1784b48add
- MD5 133cab3acc3a67418730a25bb9a26d84
- SHA1 bf9f9f5f6cfd01223c59b539a48f9278c8a357a1
- SHA512 c996df4917631664ceab20c331a0b2a9bfc692ef8b27a5a36ed5c3409308332d6bdfb016071ceed00081674d062f9dce7aed5e0a3f870ee0edaa4341bfe8566d
- SSDEEP 96:FSy8BApPvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:kyTb++ZVm
- TLSH T14AD189085AF54711E2B3AB7129F18557A477B911EF33CB8E0298238E2671A10F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH