ab006331f1f646bc319585088239d55bc54ecde5c269009268e9598307da7a44

Analysis

max time kernel
151s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
softether-vpnclient-v4.44-9807-rtm-2025.04.16-windows-x86_x64-intel.exe
Size 53.6MB
Sample260809-3cbkcaxcph
SHA256 ab006331f1f646bc319585088239d55bc54ecde5c269009268e9598307da7a44
MD5 002322a3adc9b1b9a8c35492624ec604
SHA1 6f23bcc3bfb585c516634071d59e2a68f90c2f20
SHA512 b649fc91029ede360fa90736a09a1dbe8f8f95629b230f8af7f885e31f2498b1dd4d68883419f7b39a67f0b0a6bef9c3eb75fc67a5b03e90a64dc2408ab8560f
SSDEEP 1572864:HBy/3Ry2m3TclE78TZnmMFn9ePG6A++UDA6n5UI6l:hy/3I2mgy78TZh0PGM5AS+
TLSH
T122C72301FB418064E88240F6A3BB4B7E6D78AB20730951C3D7D1BEB5BA396D1793935E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 6 IoCs

execution

Visual Basic

T1059.005

pid	Process
2992	cscript.exe
2896	cscript.exe
6028	cscript.exe
3368	cscript.exe
1424	cscript.exe
4724	cscript.exe

Executes dropped EXE 2 IoCs

pid	Process
1844	vpnsetup.exe
5008	vpnclient_x64.exe

Loads dropped DLL 2 IoCs

pid	Process
1844	vpnsetup.exe
5008	vpnclient_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	1844	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	softether-vpnclient-v4.44-9807-rtm-2025.04.16-windows-x86_x64-intel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe
1844	vpnsetup.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeTcbPrivilege	3228	softether-vpnclient-v4.44-9807-rtm-2025.04.16-windows-x86_x64-intel.exe
Token: SeTcbPrivilege	1844	vpnsetup.exe
Token: SeTcbPrivilege	5008	vpnclient_x64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5008	vpnclient_x64.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5008	vpnclient_x64.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 1844	3228	softether-vpnclient-v4.44-9807-rtm-2025.04.16-windows-x86_x64-intel.exe	89
PID 1844 wrote to memory of 2896	1844	vpnsetup.exe	91
PID 1844 wrote to memory of 6028	1844	vpnsetup.exe	92
PID 1844 wrote to memory of 3368	1844	vpnsetup.exe	94
PID 1844 wrote to memory of 1424	1844	vpnsetup.exe	95
PID 1844 wrote to memory of 2992	1844	vpnsetup.exe	96
PID 1844 wrote to memory of 4724	1844	vpnsetup.exe	97
PID 1844 wrote to memory of 5008	1844	vpnsetup.exe	103

C:\Users\Admin\AppData\Local\Temp\softether-vpnclient-v4.44-9807-rtm-2025.04.16-windows-x86_x64-intel.exe
"C:\Users\Admin\AppData\Local\Temp\softether-vpnclient-v4.44-9807-rtm-2025.04.16-windows-x86_x64-intel.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\vpnsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\vpnsetup.exe" /CALLERSFXPATH:"C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\installer.cache" /ISEASYINSTALLER:0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\cscript.exe "C:\Users\Admin\AppData\Local\Temp\VPN_8CDD\winfire_3F9E8E1CB7C0.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:2896
- - C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\cscript.exe "C:\Users\Admin\AppData\Local\Temp\VPN_8CDD\winfire_59FA81299D88.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:6028
- - C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\cscript.exe "C:\Users\Admin\AppData\Local\Temp\VPN_8CDD\winfire_89AD128FE28C.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:3368
- - C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\cscript.exe "C:\Users\Admin\AppData\Local\Temp\VPN_8CDD\winfire_CA716D49A0A6.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:1424
- - C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\cscript.exe "C:\Users\Admin\AppData\Local\Temp\VPN_8CDD\winfire_A41FC1775011.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:2992
- - C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\cscript.exe "C:\Users\Admin\AppData\Local\Temp\VPN_8CDD\winfire_B38D910E955D.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:4724
- - C:\Users\Admin\AppData\Roaming\SoftEther VPN Client\vpnclient_x64.exe
    "C:\Users\Admin\AppData\Roaming\SoftEther VPN Client\vpnclient_x64.exe" /usermode
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 616
    3⤵
    - Program crash
    PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1844 -ip 1844
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hamcore.se2

Path C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\hamcore.se2
Size 22.1MB
SHA256 ef14f333cce4ed853ccde0075142851e9258040a4e794b13113f8f192556ad16
MD5 d49ed893eec4c4d1e8d2df5b6f38d70c
SHA1 7a343997fabe6fb2d412ef699eff1779e6c9d5e5
SHA512 3d570d3c4699065ef7158d7913df231021b4092a54e654eda03f4923fb9e9d5d5d6951a399d41cdadcb9b7a5315073f265ed3980df067e0c2e67896407de5a3b
SSDEEP 393216:a27n4IHQab8flfG80GlM2xycDzG5hHPh27i9WpCibd53VWgYjjJvAqTzjQBy37ar:aO4sQaul3y2mxPhT9WljpYJhnQBy8Td
TLSH
T18F3733C58F10D4EE0956F4E8F637AABD652CA0CF70C883DAAD1046B1EAAC655D60C1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install_src.dat

Path C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\install_src.dat
Size 13B
SHA256 a14e2262c62cbab88292046dc872d920792e29f35abd1daf536e31be52c8e1a7
MD5 8ea703b7346be22ae7a57a72a273165d
SHA1 786f99aadd05f04c47baca77170b67f5d7df4a71
SHA512 d292c25298ce1eaf7a3972d71a050528b5393f58d99b423bea0552412f7e85d6af2de0df6cac8599e23736f9ff4ad23ebab7d69304d5c9639e2243b8c5e1d837
MD5 SHA1 SHA512

Submit Download

vpnclient.exe

Path C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\vpnclient.exe
Size 5.3MB
SHA256 6b1360724373bd1666a31f72dfe9c466931acee37dbec36a4e0608396dfed095
MD5 881dd1b50d67c677e96ba102ce2d17ba
SHA1 cf927525ee5d5658a2c9770ffa5b7fea744f4724
SHA512 c7b88129ecf1aaefd0c3b9a43328b3f8e56aebb072d25c8af1f9918a2c3f1a15884fccb0b058df1242f8fa83d87c1e5bf57a40fb0d6e1bd5e02bcd13a311229f
SSDEEP 98304:W/vutyH8JUDNeZRayM+L+d4T4WHsgV6sj26T/eb:W/vu88QNebag044q5UsjpbC
TLSH
T15D467D01F7818464F8D600F653BA4A7E6E746B30630991C3D3D2AEB5BE396E1793934E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnclient_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\vpnclient_x64.exe
Size 6.7MB
SHA256 58e64e25ba2e9d155ca6950de03b2c4b2c2a88e2f742cd53ddb96e9abda2fbb5
MD5 aaa992aea2b4779edc023fb7abdcce79
SHA1 cc8f122b68beee2e56d10a5bcde6e9d6a935e2b3
SHA512 8fdb0a82eadf0856758880580918a11a10a6648afd90db580f6a1b90096d6f19c61d8869997b4e8cfbbf6c7fd5454c9408f86e20433d926086220d61f097bada
SSDEEP 98304:N77xphGuXeO/TDNiV/8+keHj+ycZB9EE6DpO6c:FPcO/TDNiV/8LeD+n9EzDo
TLSH
T1E8662A47B7B511E8D4B7C03896626237F9B1BC5983359BE79A1499260F337E0AE3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpncmd.exe

Path C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\vpncmd.exe
Size 5.3MB
SHA256 d09745d77b02b077384af4f56a1d6a03b7ed9dd8cbe2fe26cd07d822cfe3cab0
MD5 b63b0983ae5acb9e87bcfd773c24c677
SHA1 d4bb89f730f97ceeb357c7fd07b0833ccf3038d6
SHA512 e34e0f62e8de0e20d89c4cb7c812bec991ccac1a7128daffeeb4d9be4e2e23e276001240f5a6f4f465b62d05ea6856e5328f4835f8dad73b728e3abe75e340e1
SSDEEP 98304:cxpV+hTB80ld6JH7nIpO/hjjg60vvIKG1+nlQ8sGZcQY8Dj3oCWddJWPqLNKVs:AVqTB88d6JHL/hXgJ3Ib1WUz
TLSH
T153467D01F7818474F89600B653BA4B7EAE746B30730991C3D3C2AEB5AA396E1793535F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpncmd_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\vpncmd_x64.exe
Size 6.7MB
SHA256 6b006be36e081d42f3ecccfb237e06505542aaad807cc7520aaeaf3e7125e022
MD5 faeeb543cc615b5f62c32790daef9ecf
SHA1 e81ff91b165c6d7e8495d356d514ac194651396a
SHA512 24a391c807740f38d8fdae6d6a5e0b6ef8a6db9772bd98a90a5746131ccd4abdd515f03e2b0efba4f8e5d4a340381a929f4105b74a5889539e7101aa35d2881b
SSDEEP 49152:/PycfucYYCQXk6Pyc2fyjwqIOqFIu6sO+HMZSz8DIyU6dqs6wTitZZ+WMHGtlqB2:SXFzczR86XJU8ugT+fq0UxxgbDkYdBeS
TLSH
T1A566298BB7B501D8D4BBC03896636237F9B1BC59833597E79A5499260F327E0AE3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpncmgr.exe

Path C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\vpncmgr.exe
Size 5.4MB
SHA256 5f43266fe190791fdd2226a243a28d6adb65ecf0172daf552c8d529f6b052ee4
MD5 4c0b6f2edcaa393656f92a4662214bc6
SHA1 456a1bb258d4150432260a917d00c74e6896da56
SHA512 6d68a8d0d22c83bbfa01cd4ad839ceb2ab1b744c26d8bcbd9cbdf55bd26b36af2f3ec0d21d82301381ea2a08f8bdd024b77b5366a40237d8593e57e1acd4445b
SSDEEP 98304:UxhFlx38nJwiII5nM0qwTPJ2Ts8RUIWFEWD67NWQW:UxDlB8nrIYewTPJ2AmPWFrpQW
TLSH
T193468D11F7818424F89640F653BA4A3EAE746B30730951C3D3D2AEB5BA396E1793934F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpncmgr_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\vpncmgr_x64.exe
Size 6.9MB
SHA256 a6bd522824ec719f9a4f4922b20a4634549d9feb8fdf50417d060e3ce59a0a84
MD5 c69f58539a0c8fecb5cc6469c52ef6b0
SHA1 fdadc222aa75089dc1e04bafc157386d2ce7ca3a
SHA512 22641428175b435c6e6ef682344d7e34d3972abb80b9f3446918835fd5d4b4a99b75ca676d73f2a6e32be8c4e4ab55eac6c3b042980712031648778c11b12c96
SSDEEP 98304:nSocn0AdfUNAJNM7eWI+3TD+qP5ie+pDaXcJp7NWn:SJUijM7eWIUTFP53+hcn
TLSH
T1C8763987B7B511E8D4B7C03896636237F9B1BC59833597E79A5099260F32BE0AE3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpninstall.exe

Path C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\vpninstall.exe
Size 5.4MB
SHA256 941a715136fad9d4c6cde1f8dafb288872f6eba64d34c7799c05339762e1a8c9
MD5 5935635dff69bd76051e72130338e210
SHA1 dcd33d36ab3131ed54118225193ab05f034d3a65
SHA512 43b44ce1be0bf557e6c7888205dfc7d14ff1464b5dbdfe8fbd5180c49e2cd530242814a6839e1b2b3282219ddc251a954cc8eb286a9cf27eaf08ddc07945e8e8
SSDEEP 98304:wuXl1gmp8VvKOfGjw+tY+FWkC/o4Gf+aRCB1KU:wuXfgmp8lKOeYQWn7U+aU3KU
TLSH
T1E4467D11F7818425F89600B663BA4B3E6E78AB30330951C3D3D2AEB5AE356E1793535F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\vpnsetup.exe
Size 6.2MB
SHA256 7b39e1981e5e7b1386d56631a5f952b599bd1756e6d711b0f4305cd0f152a369
MD5 76300f4b88bc95a34137e0699fd4092e
SHA1 6235895e8c41bb7aaaa0b5b8d96303f71dfd462f
SHA512 3771647512d0cb78fe4e9280316b7ff32fcee4eb3303b9b54dbfdffbec4fef617876d401bd3d5b544bee20b1a3c78aa2089da319c796da600c6cf6df9ebe7efe
SSDEEP 98304:ngmYEyl8AtGF3ml+7Ikf7gXN0WhzY2gTUSDZK4B0GO7N54Neq:ngTNl8YS3ml6f7gXqWJ2TUIn0Ieq
TLSH
T137569E01F7818464F89600B653BA4B7E6E78AB30630951C3D3C2BEB9BE356E1793535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnsetup_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\vpnsetup_x64.exe
Size 7.6MB
SHA256 46ede0a42ca7408ef997e47dedfe66a825be2b10b0b5fbeb9b87e5a8525a7668
MD5 c8de4777ca191572a45ccdd5b3de1fdc
SHA1 868761d11b62b4155434b2634740f58a853f83ea
SHA512 c95e7c29148fc327cda24897b94b7884f2b5c0ed8e627dfab03670d848f02952826b81104a9fbe0c977e397bc07266cffa19b661d2ba9d20a7a3303734cac1df
SSDEEP 98304:5u2V9qDG3q5S+RnB+HRRgSSf4kAz2xcKE4B0GO7N54NeJ:lOG3q5S+RBIReSSfjAKH0IeJ
TLSH
T10A864B47B7B540E8D4BAC03896636237F9B1BC59833997E79A546D260F327E0AE3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnweb.cab

Path C:\Users\Admin\AppData\Local\Temp\VPN_6DB7\vpnweb.cab
Size 213KB
SHA256 c3398437369d621d2cf46664b0416b1eb2f4e395bef244d04b10364b24a3a302
MD5 2049860907b9f9c67670ecdf8c66f55a
SHA1 a66c29d3b9356bb2db70400e834e3e07e83e3695
SHA512 7854e6a90b39a0360a0a6fa2538a8a2f901ef0aa5ad112d3728902b0db0fcc7f2f6a7ecd7bfb2bb33cf052b36cb80680e8d6638798b3b6defcaaa8804500c7a3
SSDEEP 6144:XkN11zrNMglJv+tGJwN6Pgxciv6bWOOLNyN:o1zriSJv+t+g10Wj0
TLSH
T15F24124A6E406A458F07C4AEB0E11C772DB5335369588CDB033EC3958A99BE739D84EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9218E5A4.dll

Path C:\Users\Admin\AppData\Local\Temp\VPN_8CDD\9218E5A4.dll
Size 5.3MB
SHA256 af17ddfcf02a27bc542501be3a2801d0c891a6e39452b9c5b7ac4bf2447536eb
MD5 e9239f890d780ce0b27aebbb2edd2a96
SHA1 6b3731911ec06cd6294d1d6d935e3218f871fc3b
SHA512 dea1c9fb73f1b0a7f2e4249a016a04ae6d77d22cb8b61bdf40f59adabf613b99155bf83ff96566c6da7c246f504dc5881a57305397074dc5a901bbcec9faa3ac
SSDEEP 98304:otT7NoG8VgjPsRLoLvPNdVWoI69knRedC:oteSsdoxWOknRedC
TLSH
T115468CA0A9259777D76385F0898DE8B092693C694216547F37DBBE9BB037300601E3BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winfire_3F9E8E1CB7C0.vbs

Path C:\Users\Admin\AppData\Local\Temp\VPN_8CDD\winfire_3F9E8E1CB7C0.vbs
Size 604B
SHA256 94ccdf57db12d9a2f30ba4f76e9c27739263ec7c33436350784e84ca455f37af
MD5 9f4d461291e6c4206ef8021fc2d74ef6
SHA1 c23933d0f161d361374426a91ff9295cbb0b2b77
SHA512 c48acb63f10d5e5020d438053ad673649dc85dd18f35e8ac12cf4ead39fb84f7100c30dd70597cd1303065f20ac126c1d3ba21c81da7295169c002fc3252fef0
TLSH
T17DF0AC472A4EE5E124617252E091EB80DFE055783EE1F0104C35C02D1ED3D3BEF49029
MD5 SHA1 SHA512 TLSH

Submit Download

winfire_59FA81299D88.vbs

Path C:\Users\Admin\AppData\Local\Temp\VPN_8CDD\winfire_59FA81299D88.vbs
Size 608B
SHA256 68358882e171fcb2adf921a31f44550e0d6e2b1e5785041bb17bcc175d5e2276
MD5 544454ec87755cd8e82397cfe19f4b15
SHA1 49460e01e479492746ba6b9bfeb41337e80b0eae
SHA512 e01dffa45eedf4670f73260a7b861e1c049e9849a58cdb50620824da73eb51d84bd72e7ca17a1eb163ba76325f7297605a18bb81bdd36a5461ac9db015822ec9
TLSH
T160F0AC472E4EE5F12861B252E091EB40DFE155683EE1F1104C76C02D1ED3D3BEF49029
MD5 SHA1 SHA512 TLSH

Submit Download

winfire_89AD128FE28C.vbs

Path C:\Users\Admin\AppData\Local\Temp\VPN_8CDD\winfire_89AD128FE28C.vbs
Size 640B
SHA256 36598758f304b892179ab136df49225c72ed7ba0d0d1823a9db25cc42470cfe4
MD5 4aa361fb1d8ee1987bd007b1fb394d7f
SHA1 6547e1113ad956bebd47f4f458d565d13d020ff0
SHA512 5298443807bcda2e941339ef64ba2cc9f2704dfbb7de404d5f817035e471b7a6fb8bbeae9bc7e51e565188a95069fab2b5299d6856909b7e385059e1301dcc6e
TLSH
T1DAF0DD47294EE8E424627193E092EB40DEF029A83AD1F0104C75C03D1EE3E3AEF4E069
MD5 SHA1 SHA512 TLSH

Submit Download

winfire_A41FC1775011.vbs

Path C:\Users\Admin\AppData\Local\Temp\VPN_8CDD\winfire_A41FC1775011.vbs
Size 635B
SHA256 7f58dfa05d1961d56d5cdcdf31a43552ea680ccce99f34cc22ccb952eca34848
MD5 99f54f773c557e100c9f717f38c48f6b
SHA1 00d233d7c52044403c740c1d934c65d272003ef2
SHA512 93f344423c5dcd9247a41ceaf5e87f7503a84c74e019a89b8549271bfe016a3c8072ecd6e273b8b23232b3809f64e456717ccf230d7d8cd9504e2e1c253ca5cb
TLSH
T182F0A2472C8DD5D594B17452E4A5AB40EFE15A783ED0F0105D3AC02D1AD3D3AEF85035
MD5 SHA1 SHA512 TLSH

Submit Download

winfire_B38D910E955D.vbs

Path C:\Users\Admin\AppData\Local\Temp\VPN_8CDD\winfire_B38D910E955D.vbs
Size 639B
SHA256 64e5a321a9c9a8bf8028c22c57b3d60c80a885ed59b3f823d5927fe9a06d3581
MD5 ec7c0a95e32f2ca3811a3d2269ee936c
SHA1 151fd3b1887fef480fbd4f7b82532d2ab36b041c
SHA512 793a74bb753b9a5e70dab10aed94cb3a0fd8ee557bfb822e0378b1cd06a0b431128d461fb86c98bb6ba2d0007bf871f0091a3eb2edf84262661450eba7061624
TLSH
T1A2F07D472C8DD5D594B17452E4A5AB40EEE15A683ED0F1105C7AC0291AD3D3AEF85035
MD5 SHA1 SHA512 TLSH

Submit Download

winfire_CA716D49A0A6.vbs

Path C:\Users\Admin\AppData\Local\Temp\VPN_8CDD\winfire_CA716D49A0A6.vbs
Size 644B
SHA256 c6c0d7d0a0fad460f0c73ad723dab6dc62f3f49e919bbc29e46c04bc918106aa
MD5 acc8985d8eae03804046c108f8eaa416
SHA1 a8998107675f5990edf6c510a6b3c1c00e19c47c
SHA512 200e7161e6c8bd54a518e9a7f3679283d26bb6a01e0386be60cc87d354ee42f1b0cf3bd965cb36fe66da81d8b9970e3130cf9bd2e5ec3855e6aaaad607d4caa8
TLSH
T1A3F0DD47294EE8E424627193E092EB00DEF129683AD1F0104C75C03D1EE3E3AEF4E069
MD5 SHA1 SHA512 TLSH

Submit Download

0FC343C0.dll

Path C:\Users\Admin\AppData\Local\Temp\VPN_E7E8\0FC343C0.dll
Size 199KB
SHA256 676b997f913bef15fef33edf7dc93ca45649552d2b11df177a6ac5becc72d788
MD5 c8a5b7afc7a8a7ff3b20158494b90d35
SHA1 93c22b774a798624fe78df77b406da79de987e35
SHA512 746d7e040a487e468cd4a853c47bc5eba2c46b3598fbe4a8ce851d310c2d351b8cfe8b8777400c94d1c96406c69a6377c3d2b890e6dfb2762eceaa8196cda480
SSDEEP 6144:ceZAd+VCFqlAJ+VtHCLRbYowmh2m5sHSH:W+AoAJ+XHGRhwmh2m5sHE
TLSH
T1FE142B2D277E2059D46EC07885864119D6B3B432138466FF16E0CA7DAF43BDABE39E0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lang.config

Path C:\Users\Admin\AppData\Roaming\SoftEther VPN Client\lang.config
Size 867B
SHA256 198a807286efe5d84bcccd01ca6d2e4b71dd0b4024919406395483117b745b81
MD5 233a7df4de14fe71d5a8391429c64f3b
SHA1 fd5a9438d220e76652447fc9eb2668537b0f80be
SHA512 d5d96ad31e68512e00d396d1b04455116cb41596b9c89f59d0f5b3515cc0250b1caa5167c88fbe4aa1d58fe1c028bf3c40d11b408c4e061eb3d2f5731c273115
TLSH
T1771123013B4B12FC1C75809B301DEE9AC72500FE10711E5721C9455CB39FB2CE1A18AA
MD5 SHA1 SHA512 TLSH

Submit Download