Overview
overview
8Static
static
3TraceX Fin...er.bat
windows10-2004-x64
6TraceX Fin...er.bat
windows11-ltsc_2024-x64
3TraceX Fin...rs.ps1
windows10-2004-x64
3TraceX Fin...rs.ps1
windows11-ltsc_2024-x64
3TraceX Fin...ds.ps1
windows10-2004-x64
3TraceX Fin...ds.ps1
windows11-ltsc_2024-x64
3TraceX Fin...ds.ps1
windows10-2004-x64
3TraceX Fin...ds.ps1
windows11-ltsc_2024-x64
3TraceX Fin...ss.ps1
windows10-2004-x64
3TraceX Fin...ss.ps1
windows11-ltsc_2024-x64
8TraceX Fin...id.ps1
windows10-2004-x64
3TraceX Fin...id.ps1
windows11-ltsc_2024-x64
3TraceX Fin...ds.ps1
windows10-2004-x64
3TraceX Fin...ds.ps1
windows11-ltsc_2024-x64
3TraceX Fin...nt.ps1
windows10-2004-x64
3TraceX Fin...nt.ps1
windows11-ltsc_2024-x64
8TraceX Fin...ls.ps1
windows10-2004-x64
3TraceX Fin...ls.ps1
windows11-ltsc_2024-x64
8TraceX Fin...pn.ps1
windows10-2004-x64
8TraceX Fin...pn.ps1
windows11-ltsc_2024-x64
8TraceX Fin...er.ps1
windows10-2004-x64
3TraceX Fin...er.ps1
windows11-ltsc_2024-x64
8TraceX Fin...me.ps1
windows10-2004-x64
3TraceX Fin...me.ps1
windows11-ltsc_2024-x64
3TraceX Fin...64.exe
windows10-2004-x64
1TraceX Fin...64.exe
windows11-ltsc_2024-x64
1TraceX Fin...er.ps1
windows10-2004-x64
3TraceX Fin...er.ps1
windows11-ltsc_2024-x64
3TraceX Fin...64.msi
windows10-2004-x64
8TraceX Fin...64.msi
windows11-ltsc_2024-x64
8TraceX Fin...er.exe
windows10-2004-x64
6TraceX Fin...er.exe
windows11-ltsc_2024-x64
6Analysis
- max time kernel
899s - max time network
850s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 07:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
900 seconds
Behavioral task
behavioral2
Sample
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
Behavioral task
behavioral3
Sample
TraceX Final/scripts/TraceX-Helpers.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
TraceX Final/scripts/TraceX-Helpers.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
TraceX Final/scripts/change_disk_ids.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
TraceX Final/scripts/change_disk_ids.ps1
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral7
Sample
TraceX Final/scripts/change_hardware_ids.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral8
Sample
TraceX Final/scripts/change_hardware_ids.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral9
Sample
TraceX Final/scripts/change_mac_address.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral10
Sample
TraceX Final/scripts/change_mac_address.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral11
Sample
TraceX Final/scripts/change_monitor_hwid.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral12
Sample
TraceX Final/scripts/change_monitor_hwid.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral13
Sample
TraceX Final/scripts/change_registry_hwids.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral14
Sample
TraceX Final/scripts/change_registry_hwids.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral15
Sample
TraceX Final/scripts/create_restore_point.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral16
Sample
TraceX Final/scripts/create_restore_point.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral17
Sample
TraceX Final/scripts/hide_peripheral_serials.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral18
Sample
TraceX Final/scripts/hide_peripheral_serials.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral19
Sample
TraceX Final/scripts/setup_vpn.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
900 seconds
Behavioral task
behavioral20
Sample
TraceX Final/scripts/setup_vpn.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
28 signatures
900 seconds
Behavioral task
behavioral21
Sample
TraceX Final/scripts/tracex_cleaner.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral22
Sample
TraceX Final/scripts/tracex_cleaner.ps1
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral23
Sample
TraceX Final/scripts/uninstall_game.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral24
Sample
TraceX Final/scripts/uninstall_game.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral25
Sample
TraceX Final/tools/AMIDEWINx64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral26
Sample
TraceX Final/tools/AMIDEWINx64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral27
Sample
TraceX Final/tools/HWID-Spoofer.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral28
Sample
TraceX Final/tools/HWID-Spoofer.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral29
Sample
TraceX Final/tools/OpenVPN-2.6.14-I001-amd64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
900 seconds
Behavioral task
behavioral30
Sample
TraceX Final/tools/OpenVPN-2.6.14-I001-amd64.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
27 signatures
900 seconds
Behavioral task
behavioral31
Sample
TraceX Final/tools/RevoUninstaller.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral32
Sample
TraceX Final/tools/RevoUninstaller.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
900 seconds
General
- Target TraceX Final/scripts/setup_vpn.ps1
- Size 28KB
- Sample260816-jsc9bsshpa
- SHA256 36f7cca326f67cacf24d63facafa92e4300527946b590280da30e99e65ab4752
- MD5 56fa01e2df8c9952a5c18531cb080d88
- SHA1 4ec595d5822d9ee61cb0d3c695b63c98a5a65373
- SHA512 acf641ef78b5c0ce372a33985914b35edf3639abca397aa62d95f64a577cd6a2e33703c808f0964e68d3bb3c0fd6c95a675f7fb913da5764679c9108d1a1afd9
- SSDEEP 384:4XH2dunqF8g9Ch21nTfViwZNJ41ZDaTcaQUJBYxt4sdh7EarMjKwjlecW2z:K2JrViY7qaYaQUsh7Wleiz
- TLSH T1D7D2C71E9E01172EAABB877FC8406064FD4A553B038A1582729CD1D53FF052EC3B9D97
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\StubPath = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v OPENVPN-GUI /t REG_SZ /d \"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\"" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\ = "OpenVPN 2.6.14-I001 amd64" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\Version = "1" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\IsInstalled = "1" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\DontAsk = "2" MsiExec.exe - Drops file in Drivers directory 9 IoCs
description ioc Process File created C:\Windows\System32\drivers\SETC922.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\SETD680.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETD680.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\SETC922.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\wintun.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\SETDD85.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETDD85.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\ovpn-dco.sys DrvInst.exe - Executes dropped EXE 6 IoCs
pid Process 3024 openvpn-gui.exe 2796 openvpn.exe 6960 openvpnserv.exe 7048 openvpnserv2.exe 4948 openvpnserv2.exe 6696 openvpn-gui.exe - Loads dropped DLL 23 IoCs
pid Process 5416 MsiExec.exe 5416 MsiExec.exe 4432 MsiExec.exe 4432 MsiExec.exe 4432 MsiExec.exe 4432 MsiExec.exe 3596 MsiExec.exe 3596 MsiExec.exe 3596 MsiExec.exe 3596 MsiExec.exe 3596 MsiExec.exe 2796 openvpn.exe 2796 openvpn.exe 2796 openvpn.exe 2796 openvpn.exe 2796 openvpn.exe 2796 openvpn.exe 6960 openvpnserv.exe 3596 MsiExec.exe 3596 MsiExec.exe 4432 MsiExec.exe 5416 MsiExec.exe 4832 msedge.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\OpenVPN-GUI = "C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe" msiexec.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 29 3468 msiexec.exe 29 3468 msiexec.exe 29 3468 msiexec.exe 29 3468 msiexec.exe -
pid Process 4280 PowerShell.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_24496b197c188680\netl160a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_616d8a2e59fc462f\netl1e64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_a78e41f934de228a\netwew01.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_668551398886eaf3\mrvlpcie8897.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_e0770fc2820687e2\netrtwlans.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_59e293fc00a669f4\netmlx4eth63.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b503e67f-6619-6743-afa1-c4a6ba27cc92} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_c5f16d20642e3070\netwtw06.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_daa0dfc87505ee8d\netmlx5.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_3dc2e896fdc07ff7\netnvm64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw10.inf_amd64_400af1170541b7b0\netwtw10.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d6d043d0-c52f-2d42-a04e-51d7c04c5bd7}\SETB30A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9c76708d-606f-f041-a2df-2792806918f3}\ovpn-dco.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6.ini DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_dd38edc9e96390ae\netvg63a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_27530893ea84631e\netavpna.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_b48ccf297d0cca81\usbncm.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b503e67f-6619-6743-afa1-c4a6ba27cc92}\OemVista.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_b0aef9976b305f93\netv1x64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\usb4p2pnetadapter.inf_amd64_cc88f42fbf400320\usb4p2pnetadapter.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8f9eb8ff490e6c70\ndisimplatformmp.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_cc8804127f78dd92\netwew00.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_d630255fa92e6727\netwns64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_9f581aa49737d7bf\netrtwlane.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_600627b27b9c7b10\athw8x.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_4c416384b17ee84f\netbc64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic_legacy.inf_amd64_052adde7f2101c60\kdnic_legacy.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_86493878b5fef607\b57nd60a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{b503e67f-6619-6743-afa1-c4a6ba27cc92}\SETC24D.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{9c76708d-606f-f041-a2df-2792806918f3}\SETC402.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_3e5c319fac7067a7\net1yx64.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b503e67f-6619-6743-afa1-c4a6ba27cc92}\SETC24D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9c76708d-606f-f041-a2df-2792806918f3}\SETC413.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_382d70e2c349183c\rtux64w10.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_de1bf895eba0afa5\rtwlanu_oldic.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d6d043d0-c52f-2d42-a04e-51d7c04c5bd7}\SETB32B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_e646b306d9138846\netrtl64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_448906930b28afd9\netwtw08.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_20b3691d6e7445a9\netl1c63x64.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{9c76708d-606f-f041-a2df-2792806918f3}\SETC412.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\net2ic68.inf_amd64_7af2e2aa52ab9b71\net2ic68.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{9c76708d-606f-f041-a2df-2792806918f3}\SETC413.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_5f83c04f4adb7630\ykinx64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_f329abee714f5000\msux64w10.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_c908ea6dab3e932a\bthpan.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_fdc036dc83da2115\msdri.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_16c785b9ba77e7b0\netvwifimp.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d6d043d0-c52f-2d42-a04e-51d7c04c5bd7} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9c76708d-606f-f041-a2df-2792806918f3} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\oemvista.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_0c3c6ca9708e5a9a\bcmdhd64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_c4fbd94d20e3c73c\netefe3e.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9c76708d-606f-f041-a2df-2792806918f3}\ovpn-dco.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_39ee03ea6ee818e4\netl260a.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d6d043d0-c52f-2d42-a04e-51d7c04c5bd7}\SETB31B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_7a936ac081dc1b16\net7500-x64-n650f.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_28271e5be9a9f6f4\netwtw04.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_f4299f18c1844724\netg664.PNF MsiExec.exe - Drops file in Program Files directory 27 IoCs
description ioc Process File created C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.cat msiexec.exe File created C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.sys msiexec.exe File created C:\Program Files\OpenVPN\sample-config\server.ovpn msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpn-plap-uninstall.reg msiexec.exe File created C:\Program Files\OpenVPN\config\README.txt msiexec.exe File created C:\Program Files\OpenVPN\doc\INSTALL-win32.txt msiexec.exe File created C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpnserv2.exe msiexec.exe File created C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf msiexec.exe File created C:\Program Files\OpenVPN\bin\libopenvpn_plap.dll msiexec.exe File created C:\Program Files\OpenVPN\license.txt msiexec.exe File created C:\Program Files\OpenVPN\doc\openvpn.8.html msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpnserv.exe msiexec.exe File created C:\Program Files\OpenVPN\config-auto\README.txt msiexec.exe File created C:\Program Files\OpenVPN\bin\tapctl.exe msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpn-plap-install-new.reg MsiExec.exe File created C:\Program Files\OpenVPN\bin\libssl-3-x64.dll msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpn.exe msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg msiexec.exe File created C:\Program Files\OpenVPN\sample-config\client.ovpn msiexec.exe File created C:\Program Files\OpenVPN\ssl\modules\legacy.dll msiexec.exe File created C:\Program Files\OpenVPN\res\ovpn.ico msiexec.exe File created C:\Program Files\OpenVPN\include\tap-windows.h msiexec.exe File created C:\Program Files\OpenVPN\bin\vcruntime140.dll msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpn-gui.exe msiexec.exe File created C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll msiexec.exe File created C:\Program Files\OpenVPN\log\README.txt msiexec.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_713122113\nav_config.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_905795600\office_endpoints_list.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1270890238\classification.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1545774576\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1789314999\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Sigma\LICENSE msedge.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1270890238\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_21703999\deny_etld1_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_283761941\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_968455217\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Mu\Cryptomining msedge.exe File created C:\Windows\SystemTemp\~DF3870C8D75E7D3216.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1388313373\protocols.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1270890238\travel-facilitated-booking-bing.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_851866074\keys.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_283761941\regex_patterns.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Mu\LICENSE msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Mu\Other msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Sigma\Analytics msedge.exe File opened for modification C:\Windows\Installer\MSIA257.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_905795600\llm_user_input_extractor_config.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_905795600\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_21703999\deny_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_953756627\arbitration_metadata.txt msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Mu\Staging msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Sigma\Social msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Sigma\Staging msedge.exe File created C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\openvpn.ico msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIEE6A.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1993003174\_metadata\verified_contents.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1270890238\automation.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1270890238\extraction.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Mu\Entities msedge.exe File opened for modification C:\Windows\Installer\MSIA081.tmp msiexec.exe File created C:\Windows\Installer\e59867c.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Mu\Content msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Sigma\Cryptomining msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Sigma\Other msedge.exe File created C:\Windows\SystemTemp\~DFAA2B59473DD612C8.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E} msiexec.exe File opened for modification C:\Windows\Installer\MSIB505.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC3AC.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIC68B.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Sigma\Entities msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Sigma\Fingerprinting msedge.exe File opened for modification C:\Windows\Installer\MSI910B.tmp msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_21703999\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_283761941\autofill_bypass_cache_forms.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Mu\Analytics msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Mu\Fingerprinting msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Sigma\Advertising msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1446211910\ct_config.pb msedge.exe File opened for modification C:\Windows\INF\setupapi.dev.log MsiExec.exe File created C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIEDAC.tmp msiexec.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 7144 sc.exe 5708 sc.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3536 msedge.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters DrvInst.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe\JScript9LegacySetScriptStateStarted = "240764140" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial\Default svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AdvertiseFlags = "388" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe msedge.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings PowerShell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\DefaultIcon\ = "C:\\Program Files\\OpenVPN\\res\\ovpn.ico,0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command\ = "\"notepad.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\ = "Start OpenVPN on this config file" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\ProductIcon = "C:\\Windows\\Installer\\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\\openvpn.ico" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TraceX Final\\tools\\" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox" msedge.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.PLAP.Register = "\x06OpenVPN.Service" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenSSL = "\x06" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\TraceX Final\\tools\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI = "OpenVPN" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.OvpnDco = "Drivers" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\ = "OpenVPN Config File" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import\command msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902 msedge.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\.ovpn msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe" msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn.exe\" --pause-exit --config \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.SampleCfg = "OpenVPN" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\" --command import \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72\3FDCD1DCCACB33241ACCD5FAEEE106E4 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ovpn\ = "OpenVPNFile" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\ = "Import into OpenVPN-GUI" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Service = "OpenVPN" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI.OnLogon = "OpenVPN.GUI" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.TAPWindows6 = "Drivers" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.Wintun = "Drivers" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{F46D21E2-1F66-40D3-ADC9-D382C5C94579} msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\ = "import" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Documentation = "OpenVPN" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Version = "33949049" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\PackageCode = "22912DF0EEBE3A3498FA548D65979F16" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\PackageName = "OpenVPN-2.6.14-I001-amd64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\EasyRSA = "\x06OpenSSL" msiexec.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4280 PowerShell.exe 4280 PowerShell.exe 4512 msiexec.exe 4512 msiexec.exe 6448 msedge.exe 6448 msedge.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid 4 - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4280 PowerShell.exe Token: SeShutdownPrivilege 3468 msiexec.exe Token: SeIncreaseQuotaPrivilege 3468 msiexec.exe Token: SeSecurityPrivilege 4512 msiexec.exe Token: SeCreateTokenPrivilege 3468 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3468 msiexec.exe Token: SeLockMemoryPrivilege 3468 msiexec.exe Token: SeIncreaseQuotaPrivilege 3468 msiexec.exe Token: SeMachineAccountPrivilege 3468 msiexec.exe Token: SeTcbPrivilege 3468 msiexec.exe Token: SeSecurityPrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe Token: SeLoadDriverPrivilege 3468 msiexec.exe Token: SeSystemProfilePrivilege 3468 msiexec.exe Token: SeSystemtimePrivilege 3468 msiexec.exe Token: SeProfSingleProcessPrivilege 3468 msiexec.exe Token: SeIncBasePriorityPrivilege 3468 msiexec.exe Token: SeCreatePagefilePrivilege 3468 msiexec.exe Token: SeCreatePermanentPrivilege 3468 msiexec.exe Token: SeBackupPrivilege 3468 msiexec.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeShutdownPrivilege 3468 msiexec.exe Token: SeDebugPrivilege 3468 msiexec.exe Token: SeAuditPrivilege 3468 msiexec.exe Token: SeSystemEnvironmentPrivilege 3468 msiexec.exe Token: SeChangeNotifyPrivilege 3468 msiexec.exe Token: SeRemoteShutdownPrivilege 3468 msiexec.exe Token: SeUndockPrivilege 3468 msiexec.exe Token: SeSyncAgentPrivilege 3468 msiexec.exe Token: SeEnableDelegationPrivilege 3468 msiexec.exe Token: SeManageVolumePrivilege 3468 msiexec.exe Token: SeImpersonatePrivilege 3468 msiexec.exe Token: SeCreateGlobalPrivilege 3468 msiexec.exe Token: SeCreateTokenPrivilege 3468 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3468 msiexec.exe Token: SeLockMemoryPrivilege 3468 msiexec.exe Token: SeIncreaseQuotaPrivilege 3468 msiexec.exe Token: SeMachineAccountPrivilege 3468 msiexec.exe Token: SeTcbPrivilege 3468 msiexec.exe Token: SeSecurityPrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe Token: SeLoadDriverPrivilege 3468 msiexec.exe Token: SeSystemProfilePrivilege 3468 msiexec.exe Token: SeSystemtimePrivilege 3468 msiexec.exe Token: SeProfSingleProcessPrivilege 3468 msiexec.exe Token: SeIncBasePriorityPrivilege 3468 msiexec.exe Token: SeCreatePagefilePrivilege 3468 msiexec.exe Token: SeCreatePermanentPrivilege 3468 msiexec.exe Token: SeBackupPrivilege 3468 msiexec.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeShutdownPrivilege 3468 msiexec.exe Token: SeDebugPrivilege 3468 msiexec.exe Token: SeAuditPrivilege 3468 msiexec.exe Token: SeSystemEnvironmentPrivilege 3468 msiexec.exe Token: SeChangeNotifyPrivilege 3468 msiexec.exe Token: SeRemoteShutdownPrivilege 3468 msiexec.exe Token: SeUndockPrivilege 3468 msiexec.exe Token: SeSyncAgentPrivilege 3468 msiexec.exe Token: SeEnableDelegationPrivilege 3468 msiexec.exe Token: SeManageVolumePrivilege 3468 msiexec.exe Token: SeImpersonatePrivilege 3468 msiexec.exe Token: SeCreateGlobalPrivilege 3468 msiexec.exe Token: SeCreateTokenPrivilege 3468 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3468 msiexec.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 3468 msiexec.exe 4832 msedge.exe 3468 msiexec.exe 3024 openvpn-gui.exe 3024 openvpn-gui.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3024 openvpn-gui.exe 3024 openvpn-gui.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3468 msiexec.exe 4512 msiexec.exe 5416 MsiExec.exe 4432 MsiExec.exe 3596 MsiExec.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4280 wrote to memory of 4832 4280 PowerShell.exe 90 PID 4832 wrote to memory of 5844 4832 msedge.exe 91 PID 4280 wrote to memory of 3468 4280 PowerShell.exe 92 PID 4832 wrote to memory of 1276 4832 msedge.exe 94 PID 4832 wrote to memory of 3536 4832 msedge.exe 95 PID 4832 wrote to memory of 1276 4832 msedge.exe 94 PID 4832 wrote to memory of 1276 4832 msedge.exe 94 PID 4832 wrote to memory of 252 4832 msedge.exe 96 PID 4832 wrote to memory of 252 4832 msedge.exe 96 PID 4832 wrote to memory of 404 4832 msedge.exe 97 PID 4832 wrote to memory of 404 4832 msedge.exe 97 PID 4832 wrote to memory of 404 4832 msedge.exe 97 PID 4832 wrote to memory of 1344 4832 msedge.exe 98 PID 4832 wrote to memory of 1344 4832 msedge.exe 98 PID 4832 wrote to memory of 1344 4832 msedge.exe 98 PID 4832 wrote to memory of 4288 4832 msedge.exe 99 PID 4832 wrote to memory of 4288 4832 msedge.exe 99 PID 4832 wrote to memory of 4288 4832 msedge.exe 99 PID 4832 wrote to memory of 5672 4832 msedge.exe 100 PID 4832 wrote to memory of 5672 4832 msedge.exe 100 PID 4832 wrote to memory of 5672 4832 msedge.exe 100 PID 4832 wrote to memory of 4232 4832 msedge.exe 101 PID 4832 wrote to memory of 4232 4832 msedge.exe 101 PID 4512 wrote to memory of 5416 4512 msiexec.exe 104 PID 4832 wrote to memory of 2456 4832 msedge.exe 105 PID 4832 wrote to memory of 2456 4832 msedge.exe 105 PID 4832 wrote to memory of 1792 4832 msedge.exe 106 PID 4832 wrote to memory of 1792 4832 msedge.exe 106 PID 4832 wrote to memory of 5420 4832 msedge.exe 108 PID 4832 wrote to memory of 4316 4832 msedge.exe 113 PID 4832 wrote to memory of 4316 4832 msedge.exe 113 PID 4832 wrote to memory of 4052 4832 msedge.exe 114 PID 4832 wrote to memory of 4052 4832 msedge.exe 114 PID 4832 wrote to memory of 5784 4832 msedge.exe 116 PID 4832 wrote to memory of 5784 4832 msedge.exe 116 PID 4832 wrote to memory of 5784 4832 msedge.exe 116 PID 4832 wrote to memory of 3544 4832 msedge.exe 117 PID 4832 wrote to memory of 5020 4832 msedge.exe 118 PID 4832 wrote to memory of 6136 4832 msedge.exe 119 PID 4512 wrote to memory of 6016 4512 msiexec.exe 122 PID 4512 wrote to memory of 4432 4512 msiexec.exe 124 PID 4512 wrote to memory of 3596 4512 msiexec.exe 126 PID 4832 wrote to memory of 5640 4832 msedge.exe 128 PID 4832 wrote to memory of 5640 4832 msedge.exe 128 PID 3024 wrote to memory of 2796 3024 openvpn-gui.exe 137 PID 3596 wrote to memory of 6248 3596 MsiExec.exe 142 PID 3596 wrote to memory of 6628 3596 MsiExec.exe 147 PID 3596 wrote to memory of 6760 3596 MsiExec.exe 150 PID 3596 wrote to memory of 7144 3596 MsiExec.exe 156 PID 3596 wrote to memory of 5708 3596 MsiExec.exe 158 PID 5416 wrote to memory of 6696 5416 MsiExec.exe 162 PID 4832 wrote to memory of 6688 4832 msedge.exe 163 PID 4832 wrote to memory of 6688 4832 msedge.exe 163 PID 4832 wrote to memory of 6860 4832 msedge.exe 164 PID 4832 wrote to memory of 6860 4832 msedge.exe 164 PID 4832 wrote to memory of 6780 4832 msedge.exe 165 PID 4832 wrote to memory of 6780 4832 msedge.exe 165 PID 4832 wrote to memory of 6448 4832 msedge.exe 166 PID 4832 wrote to memory of 4476 4832 msedge.exe 167 PID 4832 wrote to memory of 4476 4832 msedge.exe 167 PID 4832 wrote to memory of 7024 4832 msedge.exe 168 PID 4832 wrote to memory of 7024 4832 msedge.exe 168 PID 4832 wrote to memory of 4088 4832 msedge.exe 169 PID 4832 wrote to memory of 4088 4832 msedge.exe 169 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\TraceX Final\scripts\setup_vpn.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.nordvpn.net/SH9fX2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffa6c96c188,0x7ffa6c96c194,0x7ffa6c96c1a03⤵PID:5844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,14738021313462742525,8277305567673141759,262144 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:23⤵PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,302802041803739430,17783166438057573194,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:113⤵
- System Time Discovery
PID:3536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,11035045489379759091,3095083280257293844,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:133⤵PID:252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,8838590613447207653,539109937937746072,2097152 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:13⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,8579983884703273790,7383664848595913518,2097152 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:13⤵PID:1344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,16464512192311931219,1328564403160419141,2097152 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:93⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,6334696911435352567,6414143172399503982,2097152 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:13⤵PID:5672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,365175370593751897,14744824209158772141,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:143⤵PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,2587875417887113597,10729080416856427348,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:143⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,3230999506091547949,1996693304173598771,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:143⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,11618820721968467217,14597961918274313844,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:143⤵PID:5624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,11618820721968467217,14597961918274313844,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:143⤵PID:5420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,3039365138732130246,1501764344096213510,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:143⤵PID:4316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,9315356770670147759,13350578259376933270,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:143⤵PID:4052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4800,i,1262308255271054690,6042299973005127767,2097152 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:13⤵PID:5784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,3013749246935934783,6254373182865536299,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:143⤵PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,17180597416316068476,2095193499839410612,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:143⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,15082341536398879255,12046984495110115472,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:143⤵PID:6136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,5968762049569065824,11309204552679308379,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:143⤵PID:5640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,5975109838648735148,11574305099037003461,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:143⤵PID:6688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,9853667386781759728,3598767215333196186,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:143⤵PID:6860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,14390139919232888840,16087367848307076432,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:143⤵PID:6780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6048,i,14684847831224443458,12702435029341142973,262144 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
PID:6448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,9175368000285799602,1125458672975845835,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:143⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,1739944554277768299,1985020367617691044,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:143⤵PID:7024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,7941490159001823914,9960086371588437370,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:143⤵PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,17606226249556438715,9512493599933840525,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:143⤵PID:6380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,4591842543260759733,6642069279081171905,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:143⤵PID:3868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,11305560717487914291,529959774195144488,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:143⤵PID:6008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,3724631561134874401,9233624424096725433,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:143⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2788,i,13334919208614625872,4515919084015622709,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:143⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,18030060195064633057,15405043966292264109,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:143⤵PID:6232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,4219465389963458344,18120912486440160912,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:143⤵PID:6564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,3572244308841210228,11660112722244793917,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:143⤵PID:1148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,11909993360982389512,13141220021997053155,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:143⤵PID:6020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,16413125371821695209,14936634103263650532,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:143⤵PID:4880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,4188316323138263155,362177537688055894,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:143⤵PID:6728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,11565407954844000418,7505444504468365908,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:143⤵PID:6788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,11526712275534507874,14891142075443556124,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:143⤵PID:2392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,6712311810915230413,17791532618668973959,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:143⤵PID:6596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,10537925200676435307,3636233214175076500,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:143⤵PID:6128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,5060633251392787139,2876393148485483945,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:143⤵PID:6432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,4735935545821116677,2527308162499457417,524288 --field-trial-handle=2588,i,17652104325371609810,13335169116380411519,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:143⤵PID:2644
-
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\OpenVPN-2.6.14-I001-amd64.msi"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3268
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 07BC403053530BFB075B9BF831354C80 C2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Program Files\OpenVPN\bin\openvpn-gui.exe"C:\Program Files\OpenVPN\bin\openvpn-gui.exe"3⤵
- Executes dropped EXE
PID:6696
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:6016
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding C5AC4D1EA9FC84773727FB2F398856F12⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4432
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding EAC151199DD32A342CD53A994092D0E6 E Global\MSI00002⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\System32\netsh.exenetsh interface set interface name="Local Area Connection" newname="OpenVPN Wintun"3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:6248
-
-
C:\Windows\System32\netsh.exenetsh interface set interface name="Local Area Connection" newname="OpenVPN TAP-Windows6"3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:6628
-
-
C:\Windows\System32\netsh.exenetsh interface set interface name="Local Area Connection" newname="OpenVPN Data Channel Offload"3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:6760
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config OpenVPNService start= auto3⤵
- Launches sc.exe
PID:7144
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start OpenVPNService3⤵
- Launches sc.exe
PID:5708
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:2700
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4852
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Windows\Temp\d83cd812eaf34c95459b4478d1c83d137189c89345a6b716661920bf4f9c049a\wintun.inf" "9" "4af8f397f" "000000000000018C" "WinSta0\Default" "0000000000000190" "208" "C:\Windows\Temp\d83cd812eaf34c95459b4478d1c83d137189c89345a6b716661920bf4f9c049a"1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3824
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Windows\Temp\85aaf42f3b30269ef5320593b86990890ee8a794d9a45453819b71ec0e318a52\OemVista.inf" "9" "4fc424b83" "0000000000000174" "WinSta0\Default" "00000000000000E0" "208" "C:\Windows\Temp\85aaf42f3b30269ef5320593b86990890ee8a794d9a45453819b71ec0e318a52"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:6008
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf" "9" "4e746adf3" "0000000000000174" "WinSta0\Default" "00000000000000E0" "208" "C:\Program Files\Common Files\ovpn-dco\Win11"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2796
-
C:\Program Files\OpenVPN\bin\openvpn-gui.exe"C:\Program Files\OpenVPN\bin\openvpn-gui.exe"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Program Files\OpenVPN\bin\openvpn.exeopenvpn --version2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.inf" "oem1.inf:9ef34515d755ec66:Wintun.Install:0.8.0.0:wintun," "42b53aaff" "0000000000000174" "b323"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5708
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:6392
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\NET\0001" "C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\oemvista.inf" "oem2.inf:3beb73aff103cc24:tap0901.ndi:9.27.0.0:root\tap0901," "433338203" "0000000000000190" "b323"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:6528
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\NET\0002" "C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.inf" "oem3.inf:c695c3de07ba2b5d:ovpn-dco_Device:1.2.1.0:ovpn-dco," "43b135903" "0000000000000174" "b323"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:6728
-
C:\Program Files\OpenVPN\bin\openvpnserv.exe"C:\Program Files\OpenVPN\bin\openvpnserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6960
-
C:\Program Files\OpenVPN\bin\openvpnserv2.exe"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"1⤵
- Executes dropped EXE
PID:7048
-
C:\Program Files\OpenVPN\bin\openvpnserv2.exe"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"1⤵
- Executes dropped EXE
PID:4948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4316
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:5220
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59867d.rbs
- Size 876KB
- SHA256 8105f10f87f570fedfc3616745eb5cb031cae553525e80c5bd6cffbb63ac9aac
- MD5 47797ba33f29ff118a4ff363805b53bd
- SHA1 d9c95694889874b7ea7dbc787d87e2a695c33fdb
- SHA512 7650fe2d1421ca648625cc6573611749cc04bc2776046ff86556c7ccbf7254e5ca688fb46039c2a0d5faa7e203083adff0ee602b9d6f3062384004c8a9c0898d
- SSDEEP 24576:XC4LJNBjSblC4LJNBjSbvC4LJNBjSb9C4LJNBjSbP:3vB+JvB+7vB+BvB+r
- TLSH T153157D05B7D000F9EDB7863889674616E773780107749A9F03A4837AEF2F7D1A639B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win11\ovpn-dco.cat
- Size 11KB
- SHA256 8c9456aeacd5566234519b5b34ceecd0f7ebb22f6813747e595f5945517ec438
- MD5 8fd89f82a273cd3ed2f76f7f09cf30ae
- SHA1 43bb4e81acac468715e874ab86521497ca2e9369
- SHA512 f77ad5dca3f72701ab2b779e900d22fa3f0c3ca6b8713e25bb7d6d1480992518d66879b6315122c555b32be527fef7c86ead1d59244c955287d48c3132b684f0
- SSDEEP 192:FXasYRLFJCtNRnnXBEwZIhYCpMKIjwX01k9z3AmFX:FS2NdRIh3jHR9zlV
- TLSH T199322BA796280082DD97BD6042D8E897BC3E3BCB1C11556A22AFFA540DD33D8FB1416F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win11\ovpn-dco.sys
- Size 90KB
- SHA256 2c2958dac6f36922ae094705e058bf6470e1622b31318fb9fe0db5457e383f45
- MD5 6b0722f0b6ed86877d96da4a57f3aa03
- SHA1 85cd52a10a8be6ca807fb5f6e180a1b1a1554583
- SHA512 74c399af44e982bb02eeb103bc634d2b5923b5623625a87bd148b6dad1afc438775a00ecbcdeeb2adb13d04c3b1d23a92cd9ee815c89f1af4fdbb3eb8fc3f49b
- SSDEEP 1536:uDK30YojzlMIQLPZkecHuvaSsYU2ug/0A0gA1j7ajE/T2yR1O8Jz4:u2x5pTZUHuvat2ug/0A0Px2yTOw0
- TLSH T1CE93F875A6E010D4F47B96F886B68A05BFB17A922F32D6DF0410856D0F32BC8CE39755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf
- Size 2KB
- SHA256 1f6c35bc11d910f91c32ea54894d0fddb0094876bdd526d04a9287d04d636242
- MD5 77da079a3665afc84d05c3d07bcaa0d0
- SHA1 3fbfafe2c08100f5b46b792398c2ecb9157760e9
- SHA512 10fcd8464c6aab386bf2f675175598764e0b784a898b7b450fef3d055ecf902c7a57ac0aef2725b9e6899146e4e9230c8677bfd2a8f18489b642fa6beca25507
- TLSH T19441F14A52C20FBD3B432D7596077BA2B9D6910050C8151AF18CDA468B8FF99B31B7EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\OpenVPN\bin\VCRUNTIME140.dll
- Size 94KB
- SHA256 c51c64dfb7c445ecf0001f69c27e13299ddcfba0780efa72b866a7487b7491c7
- MD5 5797d2a762227f35cdd581ec648693a8
- SHA1 e587b804db5e95833cbd2229af54c755ee0393b9
- SHA512 5c4de4f65c0338f9a63b853db356175cae15c2ddc6b727f473726d69ee0d07545ac64b313c380548211216ea667caf32c5a0fd86f7abe75fc60086822bc4c92e
- SSDEEP 1536:yOHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1lLN:yOr/Z+jPYNV9H0Q8ecbjt1j
- TLSH T12F937C4A76A442B7D06BD274C1E34A5AF770B8408B7053CF03B6866A5F63BE05E3E356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll
- Size 4.6MB
- SHA256 71270ed463648bcbe45829cbc0ce3827faf3267e46d530ae0a82d9bc0c619ec0
- MD5 5984ea63df1671b1d174d4d957a7b483
- SHA1 3691290a86290533537593654db9e11b2bd15fac
- SHA512 04f087a1bce16c811eb6a4be318dc5846e5553f3b0d50318aa335bc46a262cfe177479ea06b637aa6934df1ae4a998e7b764df17d2efba0ef80ef302c05c57a2
- SSDEEP 98304:9gGN3UNaucJAWjXHJPx+s1CPwDvt3uF0nCc:6GN3UZcJAWjXpph1CPwDvt3uF0nCc
- TLSH T18E268C69A6BC0096D86A95BCC2D76227D371B41257F057CF2E284AF90F23FD426BB740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll
- Size 111KB
- SHA256 e2500ded6e44090f0c76528903269938a029bee206fde25adac040d6e3a124f7
- MD5 e5353f2c01b77b433ea518923b1b8dbd
- SHA1 fad48fbf2d115b5426b40fd52d51a8729a976462
- SHA512 b81ae3412a4312e0f499860586d866d47f41647441f5875e645ffa74f83aa2ef1569b5df6535ab347a89fd3b6bb6bc69558bca65336674f0459eeda167efeb34
- SSDEEP 1536:Usfoicdz0Suh6YcYwnIrHL6PS7ySVfPrZm8KAd0uM82FjE25YiL3nyj7LoNA:qdzA3ynIrHLye1VfPrZqE25RL3nyj/ou
- TLSH T1F5B30902BD846870D49AD33DEC62022BA3767890137657DF476260E92F93F96AD39F43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\libssl-3-x64.dll
- Size 818KB
- SHA256 c681893dd0c9f86e7f405792dec32adab33cb899cbd3b2ddda533e28f577ab6d
- MD5 10d4982726da7c122404f6d6f9bcd793
- SHA1 4e6861066218f0909b8ae851fbfe9ebe0b894e46
- SHA512 a7e3ce35d60ffba3072211e600bd91e4f0419673ad64471b6b94a537e4c908a02b6fee673ea55e95c22a2b4a2dcc967f56aba0ffb99a95a8875c9b4bda37e668
- SSDEEP 12288:OXxxYXIy6weQqYjq2NIUuXWGfcFTdsFgIMPA3AK8t72tJAh1z/VhEi:OXkIrjY+E4bWUgIMPA5S7KJAh1znt
- TLSH T12B053A69BBB8009DD876C13986938613E6F6B4563370EBDB0B648A7A0F637D4273D344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\openvpn-gui.exe
- Size 1.1MB
- SHA256 1f07550f3decbfd7c8737694001ee13c26de84ef498dc493d313a79db2080646
- MD5 75d5db58796acffda38dd0139a9aa15a
- SHA1 f1eeab1b9967f0ba54f12f6ead70a0ce85f597e2
- SHA512 d987ded834671be0894f5953a800947280b012288a2ec44fdcc7fc42dd08e70577ddd6f4c22118e18ebbf0fdca0c5054e8c11bbd3b104bd7c7f8b8f9056999bd
- SSDEEP 12288:wtlBCAQ/WWOn+wP/nQStD6Fo+41GqKqx8xmwApbn:wO/LOnBHQS4Fo+yGqKtobn
- TLSH T129457001B3F98118F5F3AB349DBA46526E3BBC815E34CA8E5295755E0A72B90DD30B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg
- Size 454B
- SHA256 18b542b3de918da103ea6d79f3be0c5af8349502dc9c673f2db5b6f05dc57d35
- MD5 2b7d47401bad3221ed6d92996d49f9f7
- SHA1 a3b8cbc667f5023e4a4dd8c50bc6ab78c51048de
- SHA512 dceafceeff05a61fde179dbdf13bc2b1243ee756028b1c8a96e311f279effbd9e2567f65f8ae063841ca2c4961f6b522553b9c7095daa94898ff5ed048607aa5
- TLSH T151F0DCF2CE079202DA91122D291606F147B64569758E0B92F181A3A86DFECE343FC08B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\OpenVPN\bin\openvpn.exe
- Size 1019KB
- SHA256 89479084f420ca55864c957a689971c327209d9c0e7ea4302df947e7cefff8c2
- MD5 1860b259b69d1b78e5f82013cb21af20
- SHA1 530eaff3d8d54b13b391a954082a9261bc1d0452
- SHA512 99b2d3c75d13ff436ac0bd380e770460f6a19162b1246ffc156b3fee7e68b94d393c0fcd6bca8986ac17d71864862b0ee3620a6354ab42046abc7aed42ff3dc2
- SSDEEP 24576:vMiKDhl3hB1g8QVNaEUQVdcRZehHDLUVvNrPMJomWa:vJKDhZhk8QVNadodKZeBiPUB
- TLSH T19A259D2A139911A9D8ABD078D6178013E772745423749AEB79BCCA142F17EF2B73EF40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\tapctl.exe
- Size 41KB
- SHA256 d5aab270d61d7d1709e85ba81525be5948ae5bf397bb7b12a11e11ba0788ecd1
- MD5 bc1fec27a50d102d805f7cdb79272b50
- SHA1 562719ef2494b237f5ff164f952b5ea4e23e097d
- SHA512 a3c0e3c489775f704bd22ef1f01ee51615ed8ab5abd6f6e13667d117dead7a3c61810e95cfec13d0d994acdaa89312cfb1b2577ae59b2639ede75149115dcb03
- SSDEEP 768:uV7EIM5A5/2jrvnihtk591X3hZaZYiLo+Cc+2EsLB:uVQIkjrPihtk591XRZaZ7Lo+ys
- TLSH T189133B016BE90099E573573898B716276A777D512B70C6DF238CC22D0F63B80BE39B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
- MD5 74012bbce5fada7634c1da1b567562b3
- SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
- SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
- TLSH T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
- MD5 22959b3a06a842ac30237dd57e8a3801
- SHA1 0b7c28071a592034aa2607038000f085c7bb6362
- SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
- TLSH T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 334B
- SHA256 21586153e9aea132d2932a7991ae299b160183bdce7ebc6eea06694fbe9a6897
- MD5 e209951cdf0bd92a24d56caf42b30a76
- SHA1 5ce20d59284e250b21901954f1da7b4e2d6f3f95
- SHA512 9a52ee15ead9197ca9ea55eba0100e8b9bb7a8d7937b1541a710e5846460db063d440d233190811975f711dbce8122391068b0f457504343661cb2a8f398787a
- TLSH T152E020C707C8C79DFD4065CFB168674CC1A0375AE2C4B925174C8448758205076876D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 334B
- SHA256 355dbc0263189e8e67d40427458b6ec9d1920bb06d0b83fb4d8ebc002b02488c
- MD5 1d2be6a66dfb11ea4a763ab8800697ae
- SHA1 e3227bd4aebabb432af1e61ed1276f76a113a9d5
- SHA512 44f7acb040ba332cf46bbf570ab01d90043731019884c2a85182bf325ddfb2686fcd9a80d252a0512d185519ef62039e7e7164d61d9d174014c9fc0c38377676
- TLSH T1D6E020C8A9CCC21DD94475C7917C430DC1807B4BA3CCBACD27C9854870428446AC37D4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 331B
- SHA256 404f4fa3714e60d0dbb42944acc53cf352789c30988328e9221b07fb7f0a8e5e
- MD5 7bb4253afa040708f24798468eda1bca
- SHA1 530bb2fb252ee3bc981a1864197b5037504f2023
- SHA512 30e6da5c28d3fef7ca4994f94cbd54c22ddab529551c9811ffe685d3b418a6ad8b77e73acfca40092e5861ca1e00400583a011607ee6a5dbac81fe915f1efefa
- TLSH T14EE0208B45C4C62EAD40698BD1D8470CC1903B4BA2C4F9495748884C7402144F3E3698
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 334B
- SHA256 569f25936b241e564b88bed54c30b8e5052c1ad46cd593560180386bfef591c7
- MD5 fe72dabb7068f317f70c4555562401d7
- SHA1 ed9383e44f8d584988c91c34f6cd607c42b70181
- SHA512 5b0d0cf270742e8ba72ad0f53e918c16c857b7cd9e5bbcda4a61ea426373d92c827423d6ffb5d7bac4377f9cd60e82ebe49fe17ed1700378ff646d73847ee8c4
- TLSH T176E020C455D4C33EE940758B9154934CC2907B8BE2C4BF952780888A700244072D7551
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 4KB
- SHA256 928e7125d5c68bd30811e20fe67504f9c70ca08b24dc28feeca289c6dd28ffa6
- MD5 2da739a9e2ab79cb0c4d209825ca7d5e
- SHA1 e01bd08a990028a2405d71916bba90dab3ce1f22
- SHA512 1f0846f0f75b04b83f9a157719d8f025c4c6a99dc66b9a8e75b0f5f36bf5a48fdc18fbb575b9823e6f02f983b1457900ceaedc5614c18956a54fd0caa1048669
- SSDEEP 48:PluFMVcmkWOwNaA+vNT3fq/i4n26WNeLlFJ9v/+9VJadIp:+MVv5OG+V3qhJZFz+9LNp
- TLSH T11881755963210AF3E7E5C5B952E8B648B1F74C66010FAF361383BDB068ABF7410D8417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 fde4c865e56564067eddeb531a1327cf36a43e24dd14b5d740313b1571ff1ca0
- MD5 fa2c3ecb09de94d890f97c99ea437dcf
- SHA1 8a2a842e358dbd06e04d63f88af9c27fcfae2147
- SHA512 9e35e6f40cd5c5c5d28afa3b1767e9054fe8fff371ef0cb7251667bd00c3ad710067f60fba3c0ac5f56c256a72e5b49741717ca567a9798f87f7fa41490d14bd
- TLSH T18961535963210FE3E7E5C5F192E0B48831F78C60450BAB3A4293ADF068AAF7851DC417
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592418.TMP
- Size 3KB
- SHA256 6541feee007e16c3f3c8d36346fb285b87aa14fb6f725a80599b226d4b3a74a7
- MD5 91ee09a1d85ec08fc9d4cf215f3b4ca2
- SHA1 528f1bfe06935a4a3b7e04dcaa149a07fab6aee4
- SHA512 858029fc80622680fd624555a879bcdc3083afecfb267e3f70f8c110508e2421166256fab3ad38495d03372d2d53a6c5b9c40f7bff678b969b654ab35f6246af
- TLSH T1FC61415963210AE3EBE5C9F196E0B48831F78C61450BAB3A4293ADF06CAAF7851DC417
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 d0da4cfeb024cabdffed7c27381085b7a1265911685d392383849c2ba438da57
- MD5 fd05f2a087d45222d9a5948a8e7cb2ce
- SHA1 3763b260f0311a372fb93ca6e12485e33ec00943
- SHA512 0ab8245cc6ab352152abd4175eb9ef8cfbb4dc04facb510844975e31f36f1d1a06ca68b4b483fd1b18a0e28abcb505f6b3000360a0e60d9de23c4f20847a96f4
- SSDEEP 96:DuEuGQueuRu1uaukuruxwVaae0lVuxuDuzuLuwuYuzuauAuOwQ:D9+JW4DTy8wVaae0lVGKWuhje31lT
- TLSH T1C5B18EF2C3D4822DD84626F8A7147E1EDE6D096443283C2FCDE5DE8B93E1571E284A5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 a260951b8c647c2cd73cc412c442d3d0631b6a0dc7aeb57cde4417d0fea8979c
- MD5 402900777b19a70dbc4ec62ad5aac80e
- SHA1 6e8e2c51344061f76a1825a871bc7d8bc46c2ecf
- SHA512 edd1822cc8d112a84f33fcce8227e5d28f6099388f386845dc56d920394457b48543c5d412454f7373a771b42c8aa4f05725ab0986af9fafc586be2a22436ddb
- SSDEEP 96:Du3uJQusuQuYuwu+upuQE+VaaewiuqudueuLuFumwDGj4/3:DWpf7RJNwpE+Vaaewi983uEpWGj4v
- TLSH T188815AF683A4826DE94561F8E704BE1FDE2C1824432C3D6A89D0EE57D3E2172E185A5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 6a39d23aef5c1c6e1d9c093cc62cf72723573112ec0a0bafc0936a1390e89a66
- MD5 e83c4b154146ef3bd34ad99d7f3594cc
- SHA1 0c45546b6523fc8e35be8502a7b4a6bc2d4c104e
- SHA512 da6c31d756799d06127d76b3bc0d8a44bace062579a326674b71a438b19cb4fbe2606b6e11d6b329e104b311f68d7f3eae407fd8999decdf3ae29295c7b0870b
- SSDEEP 192:sxRLrC7/fLscfaCprQ5mzoA8pi/g6+WNIYnYUYhh0G7IgDrxEJ:sxRLe7/fLscfaCKi/5I5L7DxI
- TLSH T15332C8196D28A93B9CCBE25DFB557F53D2F92032A1D51E48AAFC9A0C04EB6DD120740F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 69c0a0cef8b44e30b6fd95485fb484689ff10099647f3ffac6f99d37afb7df22
- MD5 09d57cda883a3eecebb2d387a6f4dee1
- SHA1 8883d2fb0b41776a9ca16205b95831189e88bd53
- SHA512 d878a0616c7813c627a252339e63d8eaeecbd01d0ca97ba186a77fce76bbba480aeaa30d46cdac684b13b1c1e5dfb626074b8aa0c3b1af781f68c2f85df71732
- SSDEEP 192:sxRLrC7/fLscfazXZ4jzoA8pebd/g6+WN2mmQ/Ynf98YZh0G7IgD5xEJ:sxRLe7/fLscfazp/o/5f/kDzDnI
- TLSH T16A42C8556928697B5CC7E25DBB15BF53E3FD1032A0D61E48AAFC9A1C04EB6DD220380B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 f9adc82b9615d12a88a3f43dea8ac3044f50285c6f91ee3651405d860e6cf193
- MD5 241af94cc92ad5744e66af35c8ffa11f
- SHA1 56ca7a9dc64380f8f2ddc5dbecab74e5c8a5237d
- SHA512 6d9fc5db6af6909f31fbf4835ab3751cddd52d234ada29009b9e43075f49332721eaf6434661e8a48d3eac6cb67dfd03352ab20ea69565a0f205e1e76e2d5e7f
- SSDEEP 192:sxR8rC7/fLszaCprQ5mzoA8pi/g6+WNIYnYUYhh0G7IgVxMJ:sxR8e7/fLszaCKi/5I5L7DXw
- TLSH T19432C8156D28A83B9CC7E25DBB157F53D6F92032A1D51E48AAFC9A0C04EB6DD120780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 26KB
- SHA256 6b372a6c7fb23ecd44641e7d2caacf2f4dc707fb62c75e801cec017d0a9d63fa
- MD5 fa8294bd2c74470a7e92e811c70f916a
- SHA1 3b6301bdc2ce6299c2a72acbc2b8e49386134704
- SHA512 ad2efcba77d20ac3167f99a6df6d98331f372be09b2247d4f01c895709bb70b09bd5459091c751cc8ca2e8c7dcc3e183e0beb955b86af8abc75fb87beae97241
- SSDEEP 384:sxRLe7/fLscfaU66s8qMpRiYnazAW8pZS15posJWeT+Xp/2/5f/kDzDnI:sve7/fvT4Mnc7WeT+Xw/5nknc
- TLSH T162C2F805A924D83B9EC36D1C653D7E33DAEC505221C6DEDA5AECCA1C01AE1FDAB07817
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 27KB
- SHA256 4335740ce3ab93d4add5662e1a32daae0998ff051d47a6566e2f6318e597309a
- MD5 48653970bcada3702d460471bea44acc
- SHA1 a5493ec3f59594493bacc7903821c147d4ae7ffd
- SHA512 1a0627115f946b99f0312dbc61347461fdad00dc2ce96997c6006616ba4f9570656df73378e68d2ccf03f0f56fe9dac0850714194c4857134de048bf4f9d31bd
- SSDEEP 768:wb8dug7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfu467rohg55t:wb8dusE7r6Wgouf6Mu1ja4V6IQ/
- TLSH T133C2D97B740CCB7E4F800ADDAC19BE9F6DA802CB5AD8CD4447FE951C02C6BEA51164DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index
- Size 360B
- SHA256 3e4e7c211881502fb654792a552cc9e1f002a2602ffb08fdd76c84b4b8e57e21
- MD5 82747e97b269c7b1e7898a483f25e146
- SHA1 6f967a900d22afd16c460c2b2179ad9bd85ad5a7
- SHA512 dc7778f98ab03db21162cbd57105f662bb81b2de75e4da01bbe426b8ec2a4df3f5463bd891425bffd359959a0c614f3a0c5953d40a0d65dbeb826ef54b43a695
- TLSH T1BEE02B8ECC634517CA25287B09B6252D333B0BFD2A05AE2A10FE041F9D91A3C824571D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index~RFe5dd1e9.TMP
- Size 360B
- SHA256 1e619c24e21eb5cfc0db6506c371f69c2b4fa764d5ebbe9fb9a839c83ba7168a
- MD5 d18c868ef26f18addcb342e4677646e5
- SHA1 95ac1a6509f1b8be436dbfb1735abcb5ba8fbe47
- SHA512 77eb28bda1d751ed955deb336ba4c06a5f5b8ebd8e61140b09ce4ac5eab681c1413840eccf54f49abe98eed28bdf5ccb76343f91bb896f71b9e28e37a5f950e4
- TLSH T1E2E095CF40D15D52CF2669391543552E333F0C342505DB1F50DE545F19627BC874560A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
- Size 371B
- SHA256 6e6c749331e9154dcf3cc27af71b426519d9ed777ee6bd2ebb1d6f1032b6c125
- MD5 55d56909a39f3649173eb4dbf45de6e3
- SHA1 b26a899c6d4cf928da60b4ff8880adf7638ab3af
- SHA512 7008e0927e1b3a93cbf3117960594acbdd5abfb3a032394e1ff8fc6a761ecc6465b72fe48d56741aa1a27cb95f800740e4faafd181a580fef1e28d3dbcc8e393
- TLSH T1CBE020773EF72804ECFFD7DA1831649105507454884EBD4FA815E3D714B235434AAC61
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59bcfd.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 61a442f68d83a62113079b2c13fcc7bcdc6e0942bdabf7eb84f15864b232ccfa
- MD5 7036ac56f098502c4bdca47244f27827
- SHA1 b2de0b260a09b959f5cc9de035871af82ac69025
- SHA512 2d1482cff6e0f4d7bda9b2c67fc6ceeb92959f1c9a2ee373d88683a7cbdf23b9261a772cd9993f31f10810495c0bf1a19b465eb877b20e57fa10e2ce54a8f58d
- SSDEEP 768:6rv+4UNbds3qHDZIO03SNzc4ReyIsXweVH1S5D:6bsbS3Otc44bsgEH1Y
- TLSH T1E103CE32A868D977ACF6A786B10775537EF8512B82C81ED0C9DE2F0C4A4B1DD131B923
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 e957f6174528a5df0ed8c389264e5353354f5be7335992dd49f5c2e0e6f1475c
- MD5 2b0ffdba590af3f226bf8d03e46016b8
- SHA1 84d021f2d77eec197b6fc7247b42cb78ca5b300b
- SHA512 8f885f993b1a188e5d99e27413e03da93ccdd2b144253879928c25a96b6d206333b0b08560a1295bd4e25e7097a3cd601c51ff86ff13f1d8a4eeff938a161bd2
- SSDEEP 768:xrv+4UNbdI3yDqHDZIO033wNzc4ReyIsPvaY:xbsbi3yDUtc44bsHaY
- TLSH T13703BF31BC28DD73ACE6A285B20B76437EF8216B81C50E94D9D95F4C094B1ED275F923
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 41KB
- SHA256 01c3e30afa5fdeb383e9811fe7a3af7732137f7a4fbdd4d4d5f840683c893502
- MD5 ed6adacc459a2ea6f372d516348a6ad4
- SHA1 80831093b7cb76b6c9e7b675a7ee1463ef980f81
- SHA512 c41212e7d97613e7d2d0c5c73a5fcf27d4c4a796ad0e8ee9e557818fddaea56aab18475e3bdd32c6649dd078f1ac5b083b502648a80d63f0a4077f4453a72a5d
- SSDEEP 768:zrv+4UNbdI3KDqHDZIO033wNzc4ReyIsPveVH1S5F:zbsbi3KDUtc44bsHEH1W
- TLSH T10B13CF32AC78DD33ACE69286B14B76837EF8216B81C50E94C9E95F0C0A4B1DD175F923
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 d09de1a5d1258155a67844f36be2fb5cb9395d6581a95ed0e65ff46b46fc0fb7
- MD5 1b565cb62223dc8b7a60fc49dd5df3c2
- SHA1 73f907044fcd59b387a2fa0d7f45bbdd1171dc34
- SHA512 b426afa5c5450d0358b5cd3ea3651cc2da5736b543e87e519e0ca9b4dcfce7406aad4115e731dcb777a3f7d4779978597892954e5b7845aab537c8e50526153c
- SSDEEP 768:9rv+4UNbds3OdDZIO033iNzc4ReyIs2veVH1S5D:9bsbS3stc44bsUEH1Y
- TLSH T14103D032A878CD33ACEAA786B14776937EF8216B81C40E94C9E95F4C0A471DD175F923
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 e485e4583e0203ffd51f98450df72a418d633fd3e142eb50ae60f47bd6d2095c
- MD5 691e5f1ee4cf3c39f9ea8f93308ac0e9
- SHA1 9bcf5bc87cb7621524f9b0d3c0bf505a05efc2d3
- SHA512 20f2287afd23e54a1dac1de56b0289e79f965d57d44b5c88db15c46ff0c888d08171aca69601766c3ead1acac93c8a9d2243b374226acb7ad02b48d51a83e2e6
- SSDEEP 768:sFsm3DwgrDqmZw5O033gNzc4ReyIsPva1:9m3tD7tc44bsHa1
- TLSH T133F28C76EC64CA6BBCE69786B70A7642AEF41167C1C89DD4DAD99E0C00871ED070FC23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 41KB
- SHA256 cc5492d840f7a95d74963127b2f14ccf414a67f8f9bcf7de03ebb9cd00d88e6b
- MD5 d1b04acd4ea766f1011217b76ac533d8
- SHA1 af6bc88fce1ae0ca3849e56a909c4e34b12141d7
- SHA512 63a7265cefe14556a0aef890c430caf1fd2040faf9397b82f3d9fede1d81cd0f78560f082d9af3e63da5b9077ff80402e4f1f03480c3fbe6e6910708feb15a4d
- SSDEEP 768:krv+4UNbdI3KD4HDZIO033CNzc4ReyIsPveVH1S5F:kbsbi3KDstc44bsHEH1W
- TLSH T1F113BF31A878DD33ACFA9286B14B76937EF8212B81C50E94C9E95F0C0A4B1DD175F923
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 32KB
- SHA256 3a60da39563a37b30904bfd5b6a86aaf838323be87d32576d96597045b3ddee6
- MD5 19f38ff9b5a66940269c4a9a6d269c82
- SHA1 e1c561e3de72b3660ad92f95da3b74cc902b4536
- SHA512 4763a74d5aa920d78309c0c86ba7adfa6fa7243862609284d088269f51a9bc5eeac0bbf144e39bb8f1140a6a45ea1d25f1b9bf6011a152722eeaf8e9fef2cf54
- SSDEEP 384:nvZcIX38N8uvMD/+3HQ2JDZNfNoXOVSUUHXCDOHTETRzcoXfK86sfxEZxxsIj4lI:nX3vDqHDZIO033wNzc4ReyIsPva1
- TLSH T1FDE2BF71BC35DC636CEAA246B60A3643BEF8612BC1C51E94D9ED9F0C05072AD175F827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\bf65009c-99d7-466a-b039-48bb6cf68ee6.tmp
- Size 852B
- SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
- MD5 1a8162cc03c34509f59ea81728419884
- SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
- SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
- TLSH T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 7cffb53aa771e330cf6f2977045f4c8ed1482ca623c76ed54436c17c2fb3bc34
- MD5 ee65d1478524f0ac6ac8e7a8633e1f28
- SHA1 db2a1937caa4e9bc70d10bb859b484d651b81b83
- SHA512 93985d792fc252309e3ef2a80dce6d338aec723461976ac2981393e36be3ec0d737a217f3001e99a8d119bd9ce4f8bcd72a9ea424f5554c2ea0be0c7bae636c2
- TLSH T15A3110E0587D1AD1D0BE0DAFB04729FC44D89212F8A434386899E9689A7E51E255087F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 68dd4a6a0b1711003690c2995fd0b77ba3c9ae6c27dd853ff492b52bd7701bc5
- MD5 bc900814bda342e30ca622ecf6edf1a1
- SHA1 58549077a989da91156012baf9dbfc98ecfe429d
- SHA512 c918bfea1c94a06e69e13a1edffa87e69fd698fc8ddf310fc5545d1e2a80613e7617e19110e5496fa91c8e8037bc67a81e300b571bebefb407ab16a384d97fa1
- TLSH T124111FD11C7E1AC6C6BE0E6FA4833AFD40D8A622F4E8307818C8E964927951E2451C7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 252B
- SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
- MD5 880fe67d2d8def8a73d1f09d09f8f2ff
- SHA1 adad7fdd0652919461f89bfe36b449081489052b
- SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
- TLSH T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 732B
- SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
- MD5 87299a8105078d6252386ba9d333ff05
- SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
- SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
- TLSH T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 0e2427c94f170f6dda5a9a85ddaaa0dc0088899c19efbb73c05e3598cb541423
- MD5 95ac3c4f8946991b2f4b965a390aa896
- SHA1 864730b7c80ff406dcef7eefce17b842687c2bd8
- SHA512 b13343c0c56d9943ac874eacdf49f82ad4ffcf8be1ca55600fbc7e0ba55c6203da11354a956eb54c11ee241672e2d8c66d8469e722cfb0c0129f0dbbe3c2167c
- TLSH T1942112E0183E1AC2D5BE0DAFB0872AED50DC9612F8D834382898FD68967E51D2550C7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 824de99fb2d26a9652ce4d147d41b5f42d8eb58933629e98754b359ef813de81
- MD5 c854428d46d0bd8106d3a4b26b2c17af
- SHA1 3414466742a52757c163c28cc508953129b9067d
- SHA512 1de7dd4e62a741fd98b414fa13966befbe757d57478e2eca3d9d49fc11f15eff8310633888dec1ae7c7fd5ab938d39ed341567261f568dc0a1838e5acd6da636
- TLSH T1E93122E0583E19C2D1BE0EAFB0872AEC50EC9211F49834382899E868967E51D3550C7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 290c47f16a77a8c56d1890de9be5d50c9f5e730f9ee6a4d249f490ed2c0a63fc
- MD5 5db66ce3aa3c6ec4970dd243fb876bf1
- SHA1 d43a86481b0ade68457623f1ffa0509d3d294a83
- SHA512 996f82a16b0cdea315cf0b77214319c7236f9937f30c8c2d50c0389fe14667674546146415de540f92310f5850fa8a84f29723b5ce5cd630aceab14948611a5b
- TLSH T1AA3123E0587D1AD1D4BD0DAFB08735FC94D89211F8A434796898ED685A7E51D354083F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 0dcbd641392011e3042d4affe27de6b54e3bfe1fed2f238c1326586e38dbfb80
- MD5 5791c60bac582e1f169aefd7494e8b65
- SHA1 fc220a11a5357f3b3134686ea018f8327ad6720a
- SHA512 7ea314ea2431da694bb2d6ab59852e9e0458aedea4693b1d78718c5a54c1c97849afbf8992b044f2295319673c112e8e40e08f8732d473893c556cad7c1d8183
- TLSH T12A2111E11C7E1AD2C5BE0EAFE4833AED50D8A616F4D834381888FD68A63D51D2551C7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 972B
- SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
- MD5 54b0cf5610d4cbeadf10f35941bea007
- SHA1 8bcec79787775ec6c2625b88611eb0de385e393b
- SHA512 3f6d82da490f1b52647d9f376be4aa3159f57072ad2b52a048895bf7f53255d860bc12cc4b5af53cf9d9ce8c76cfab722e47cef3b58fa776a8ffd7e991630253
- TLSH T1841184D00C7F1AC7C6BE0E6FA0872AED40C8A622F09830381CCCF964917901D3451C3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 eacf1adcab56ea7707951a59a1d5415c83ac02e038089cf23fd24d14c5a52cf2
- MD5 13fbadbf74e4028d922652c3b1fb7281
- SHA1 2cd5239ea161b2a994b9b84a77f0296997a22ea1
- SHA512 c1600d8593594bf33e8eea3c0e9b7153a41c3ed3ee25dc39ca5b63f2eb3a021af51fb979ffea4d93c39aff5ea2b0e6b4348c8eaaec269e725dc1eb353379cb59
- TLSH T1A43153E0583D19D1C07E0DBFB08729FC40DCD212F49434382898EC68967E51D254087F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 372B
- SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
- MD5 80c2dfaf9affc09798a4976ae70f1b0b
- SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
- SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
- TLSH T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 612B
- SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
- MD5 5ca920f0e1c81dfb329b916e242a4065
- SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
- SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
- TLSH T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 492B
- SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
- MD5 c1bec3bc77db46888e279f8b3eeb18fc
- SHA1 c2d14f387c796193ddc6378267768745c10dae14
- SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
- TLSH T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 6531717fb8828c3907681f9478370384c0c10cc24afa904b56e9112c63c994cf
- MD5 bdc21d0913e43146bd3fc5be5536e175
- SHA1 dd7434e03cc6a3d201cf22d3db6686d240f4ceba
- SHA512 61551f4323a370886e4faf7c25b2e704a51cf2e76f27a6cd110700693f9a548dfd9e1014875219721454bfc2b94737d010d5c7c2fe7f74d542937489e428bc81
- TLSH T1F54142E0483D2AD1D4BD0DBFB08B35FC94D89222F4A434792898ED68967E51D254083F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\235df7c8-9c98-4671-83c6-f87d9887e63d.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSIDD99.tmp
- Size 209KB
- SHA256 8351a40a632facd1f79a1bccfe8e32e88876a23065be1144621533700ecb05ad
- MD5 3037e214e0f9b25fc63d4d16f7c4c91d
- SHA1 b03dce2090033ca3029526485039b75a5aa4b488
- SHA512 437fd240c0af2afaa3a5a1791db4739dff04c7003f25f1bc512797cfffb7fc3e8377656b6eb8714a50b3189c2616b230a619730bc63628d9ab4bc214ce31de90
- SSDEEP 3072:l9FCdj6rw5iUeqEetAByXxqr8lyc8t5W6/eb7eUZxfZ/oR:l9FC4wuJeiByXwrtcO6ZVxoR
- TLSH T1C6248E09B7D100B9EDB78638CD678656E673780107609A9F03A08376EF2F7D1A63DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4832_1805054676\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9D03.tmp
- Size 275KB
- SHA256 fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f
- MD5 2232c07e354364e0eb1dc80024593826
- SHA1 65bb4232c0416cfb2c158bfc32a7732ad72cee72
- SHA512 f0d295565b209f4dedd2a79123fa54ff9b8cbb173f14463ab3d3707b8d87aad84b05c2898478ecc148e29d02fa07ddda9499795e0ceafc2982c0adbd570a3572
- SSDEEP 3072:A736bBrGsu4ldGrlmxElEmNoPl4+eDhIVJkRZ5Br/NbvcjKX5mMgQSeRocPvuocM:A736UWldGrlmxEDNMea+H5R/B/1lp4x
- TLSH T136548D41B7E404A6EC73C73499A39606FA3278411B70DAEF035082768F6B7D1AA3DB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9D91.tmp
- Size 281KB
- SHA256 45e855461f5d1be28a2f88416603070bd1778055abdd06834ae58e97b7ddf53c
- MD5 718222e232d11298dfbabbc2b70d8b14
- SHA1 89fc560692111c2245694867b8772fd8969f46d2
- SHA512 9191961c28a7a4647ae8f9f9e1956d60b97f5f5c3e4e838d888bf78c1ea665e98e8e3c75cc1247a68a89b2413493ea6d39dbc60827eec919ddba0536d793c801
- SSDEEP 3072:sEcOO6pMedPCy5654WKlfE5qbHsfmYud8d2VCsOLlk1lHgQNvLvPMm88cYzdFOS:OOO6OedPjw58l85/grhSQNDsYz2
- TLSH T111549D45BF9504B6E8BBC1348AA74A82E772740203109A9F33AC97799F2F7D1663D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9DF0.tmp
- Size 143KB
- SHA256 2738720da0b6ce474ca6eb51a92372d047eca2d713c256f0cd6c147ac3a0db21
- MD5 84a1cc9540d5cdad74bc54f8090dd27a
- SHA1 c6f82d1491015457785ae0d365e7196d693d9a6b
- SHA512 9c25d6e7331844d01d732ac923e99c68f305749d92407c873cd09b451e59a8864001e308864fda319fa4a2bcae9dbe50682201c67901dce14272291dedecd2c8
- SSDEEP 3072:+1gnuc/GBdzVQqyIgt8DB7QKPw3hL6nCMfBXqpU:Bnuc/GBdJmIgtesKP+Lh+
- TLSH T154E37E17B7A400BBE5B78235C9635A06E772B81117219F9F03A443766F237D0AD3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59867c.msi
- Size 5.5MB
- SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
- MD5 1e150b4507fc951c8a23b08b85236cd2
- SHA1 3f6980947c16778efb3126193726c038453c85d6
- SHA512 2074822532d38e94c131ceb3b4b7a01379ea20b5d6e3fb85a6912a586b8e6f1ff5a4973c200087ccd5ecd17727acef2d5568e6afc9df392da5c1f1978b4cd3a8
- SSDEEP 98304:fEnzYKCLSBI0lGIOKv8k7VHTB87GnJ6tEGb7MrisWnB+A/yue/bjBe:z/LS9ZzVV87G2hbWij+xB/Re
- TLSH T128460101B6C10462EC678230C85E925AF2F27C5117A0D66FA2DCBF7CBF3B3A5526A751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 64KB
- SHA256 1424e594fabd03380f5adb83714c1673f45c5e53b6b138d9e74ce90974b050df
- MD5 74af66a7b9fc727674af4bba040777ee
- SHA1 20e37dff2e5834e04b16994021d84307678f3ecb
- SHA512 8c4ca472fd80a64713892cd06ca65f763f87a730f82de39326cc163b58bc19bc21686c1e4f5c6c1eb960fd4d5923a9c8c28852a2ac7dfab1bfb1688d7075ddbf
- SSDEEP 1536:wwLXhBUD/VBpr2CaIg+S3bESL0EUDU0XeVH0LYTOIeG0yw/Zra4GNv5c/PIurq2u:WMG4
- TLSH T18E535F4680D88519C9B20BB272A7EE72CE2E6586770B0DE531AD7341DDC2B542F7A07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 64KB
- SHA256 b956f359f6a4569d695fe92111526fa15792c3a3ec9be673c0ac3f14b21d10f9
- MD5 11d9a1bba770c050685ae2353de7cbc8
- SHA1 f114cb069a3e57a6b4eebeba781cfbce5ea83115
- SHA512 ca3073f299fbd90c34ba852ee5e622740076e53724b0d77199239f89635e2390d018c961b2066eafff498cd70ea2067bae561b614733e3138d4e8cb3fc6ba2ba
- SSDEEP 1536:wwLXhBUD/VBpr2CaIg+S3bESL0EUDU0XeVH0LYTOIeG0yw/Zra4GNv5c/PIurq2b:WMGp
- TLSH T1BC535F4680D88519C5B20BB272A7EE72CE2E658A770B0DE531AD7341DDC2B542F7A07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b.ini
- Size 421B
- SHA256 9a2df709382381f745b8e73cdd7f0f5b8ca9a1b877a7c6a034a29e6840aae566
- MD5 a2ecbf7e0e4f385f8e2aa90a76e44beb
- SHA1 63391ee090664570900e3c41bbd1413f40f02b63
- SHA512 d0c8f8b9bc589b2d52510cca93e9ce3de3b5dc17f4d8084a69239cf53b954a97d894c20089dd55405393bc77a49c280b04029a3d029a35d63ddb832955b07742
- TLSH T1D6E0228218A8C489CE634A3C239C1FA6941B73E31822B3B83AC286088ECBC583828101
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6.ini
- Size 420B
- SHA256 49c88f63243f71a3a4e0e176d8834c6a6dc46e6e4ae2d1a1f50691e5f477d7e4
- MD5 794439906b440f5e071729704319f1a0
- SHA1 2797dc98076391073c4c49a49e28343eab63ce4c
- SHA512 b46c1881158c9c683baa7f2cb6b52a045dc64bd7fba201b31aa1864b1e2e112a45d3c03c685ee9b9a53aea58b7ab2cfe7ae0795b674c5a9783a02a74a5a9d574
- TLSH T188E02B2E13F3E9EBA708AC0002277B784C4AB40A15782F117104C1452F5BE2058CBBD3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414.ini
- Size 415B
- SHA256 b3391fb73946c5c918763e92b5959e2f6dd26908f65b6767f6e31518955fecd1
- MD5 c18222910f7df79b6b17e06b9b857845
- SHA1 2254aed79a36c40518f6c67ee1a7214068f54724
- SHA512 76b0342396ed91b2a874550c3a44b78bf620e445e2db6378bdc455f94569f93cd3723f0bdd835c5385313fa931da6c2e52dcdf73cac93078f317237d94f9b7bf
- TLSH T12EE022C15EA49E859C0BA33EE61E7F64493B37628A40B03EF34042608F4FE396932A01
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_1391137605\Mu\Other
- Size 34B
- SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
- MD5 cd0395742b85e2b669eaec1d5f15b65b
- SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
- SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4832_851866074\LICENSE
- Size 1KB
- SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
- MD5 ee002cb9e51bb8dfa89640a406a1090a
- SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
- SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
- TLSH T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\85AAF4~1\tap0901.cat
- Size 11KB
- SHA256 ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7
- MD5 71ecece58bb00bdc1e728ee28d7a5332
- SHA1 4305889415cf95662a30d024f1138f1af224cf42
- SHA512 9b23404d867fc4fd7c7beeba3768e8fed3113cc7430ec1bc9ca7faf6e6105388de7057b1402f9b4ba8fbc11e5fcd3afe14233721e8d15b6c0bed40f65aa5b58b
- SSDEEP 192:HxDuDjbfXJCKnEwKUNhYCy1QySaI8HNsAX01k9z3Aqcp9wdGEC:CXaUNh3auatHNsAR9zWZEC
- TLSH T1FF322AA2942C52C3ECABBC7043D4E9977C3E2BCB1950506A269FF7141DA73C8EB1516E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\85AAF4~1\tap0901.sys
- Size 40KB
- SHA256 581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1
- MD5 1bb9772a05517e227d1dafd3936e8f66
- SHA1 d695ca5791a4b6a3509939aebdfaf5e229c6fbcf
- SHA512 3f1966038f91b887fe1a71474929bd87f3c75091846c6e9563f7424d3a7c19c908f1d874895341c61a868a616aba637e3d4188d4ebb7383087886a13a4dc0aa2
- SSDEEP 768:EGvByM5JLLvslmdu9lsECPURPNkilzdCH3C9zySb:EfM7VE88fkilzdCHOzySb
- TLSH T112038DD16AA814D1E8AA9874C7EBCE43F7B5B1430311AAEF0764D6691F23BD05637328
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\85aaf42f3b30269ef5320593b86990890ee8a794d9a45453819b71ec0e318a52\OemVista.inf
- Size 7KB
- SHA256 1327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9
- MD5 6f5ffb58a9e406ab1643c890e2a198c6
- SHA1 3ff1faba00ac18a93e88a6f2bbfa747c9fdc7e0c
- SHA512 af29bc13cc02238208c51e4e95dd0a4445a952755635a9eab38aa77a5c087cc8e2025af55d8f3a0e9f2430baa91534e7f892bb71aa0ef72bab4483211a845b4b
- SSDEEP 192:wr8tW9yCTi314vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGBdkkzo3DcNSj6jvKFkPs7EQTXvtk
- TLSH T1F9F150681C83EE3A31FEE58557565EC7E24611823A172800355CFC549BBDD9FE33C92A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\D83CD8~1\wintun.cat
- Size 9KB
- SHA256 602187e5470ddbdf9421045bb0515f358c88bf88f59fd8a886fb6373da5d0f82
- MD5 faba2ccb8fe366fd281ca6be6d2bb7c2
- SHA1 bb7bd32a21f3eba652fde24146387ffc5278143e
- SHA512 ec424a545e2598f299706499dab07b4d12b0734a52f928216a53bca2b7f384b97bd4fc092d7d68de636a75daf79ac392c4b49b7251ec011236de1659253d6214
- SSDEEP 192:6wRp8yDJCKE4uyK6iWPFWQFAnTz36ArNc4qnajr7NCo:L/iWPFRI64lrNt
- TLSH T10522F8E28A5C44C2E993ADB05398F5977C3E7BDB4C20906922ABF7650DD27C5E70843E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\D83CD8~1\wintun.sys
- Size 37KB
- SHA256 eb58bf00df7b4f98334178e75df3348c609ea5c6c74cf7f185f363aa23976c8b
- MD5 1945d7d1f56b67ae1cad6ffe13a01985
- SHA1 2c1a369f9e12e5c6549439e60dd6c728bf1bffde
- SHA512 09af87898528eaa657d46c79b7c4ebc0e415478a421b0b97355294c059878178eb32e172979ee9b7c59126861d51a5831e337a96666c43c96cb1cf8f11bc0a0f
- SSDEEP 768:UwtoHKG2ZqGhg+Eqpg0bUORjj71PKgPrbHZIb4:UwtoHt2ZLg+zg5cv7ld7Zy4
- TLSH T1E1037DD2E6A868C2E973CE3151F5E523BD74B2612B20D5EF4511C4350FA3BC1EA7863A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\d83cd812eaf34c95459b4478d1c83d137189c89345a6b716661920bf4f9c049a\wintun.inf
- Size 1KB
- SHA256 44098408ab9611dd99a38e140c7fb1ca5dce6eb2d5f0d5e500547ac1ba5d235b
- MD5 8480579050970b0812cc3d9a1bce1340
- SHA1 edebebd090602f4eee375ad754c8566d4fda23cb
- SHA512 46de9202c3cf0ddbf19f9e0e02ec17530f2722abfa08669fd30a6095ce2342fa89a2cc59c1d47afd82b48c915bb95f4c6d16e7c21129a9c8f09c2bf239566933
- TLSH T1933135D954E10D693CD3322E77277F81E65C123041CA200EB6FD8559D64BCDFA654CAA
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 194d8199906c728267d85b784d0394728957e227d58483d66de6247a142240b2
- MD5 34d2c9f30ef3df659e3ad1ed0bebfacd
- SHA1 9593229cd7b3737f36c562ecb4f6ecd248e31a41
- SHA512 6573f7584170f759e43c1e50027e2f1324188b8454a3e1436d26940f59ec2988a7d3e6dd045d14378e80f5693af104f5add53fcedb3e4e66f3118f2acdd5d5c7
- SSDEEP 24576:JFo3DMPodoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+z:8HI
- TLSH T1F057B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{def01006-d11e-4ef6-9f8e-b1c77cec3169}_OnDiskSnapshotProp
- Size 6KB
- SHA256 20348cdcc7d1a9875fcafd67dfcda889f411c1747b39cd08349448807be0fff3
- MD5 b678ba85b18076f7e3734748cc8d117c
- SHA1 b6662f7ad27cb2b4fda9e6f8cabccf2061a3ebf6
- SHA512 b1265124e73f23767984d6ccfc06e9af0d09eaf01649e468fb7ce3c9036d4af31da1ea201c0e5562353bfbcaeddf59e46c7151d1403df38d9e29003647d15810
- SSDEEP 96:FaIPbjvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:EIjb++uVmN
- TLSH T136D188085AE54711E2B3AB3128F14557A877B911FF33CB8E0198238E6671910F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH