Overview
overview
8Static
static
3TraceX Fin...er.bat
windows10-2004-x64
6TraceX Fin...er.bat
windows11-ltsc_2024-x64
3TraceX Fin...rs.ps1
windows10-2004-x64
3TraceX Fin...rs.ps1
windows11-ltsc_2024-x64
3TraceX Fin...ds.ps1
windows10-2004-x64
3TraceX Fin...ds.ps1
windows11-ltsc_2024-x64
3TraceX Fin...ds.ps1
windows10-2004-x64
3TraceX Fin...ds.ps1
windows11-ltsc_2024-x64
3TraceX Fin...ss.ps1
windows10-2004-x64
3TraceX Fin...ss.ps1
windows11-ltsc_2024-x64
8TraceX Fin...id.ps1
windows10-2004-x64
3TraceX Fin...id.ps1
windows11-ltsc_2024-x64
3TraceX Fin...ds.ps1
windows10-2004-x64
3TraceX Fin...ds.ps1
windows11-ltsc_2024-x64
3TraceX Fin...nt.ps1
windows10-2004-x64
3TraceX Fin...nt.ps1
windows11-ltsc_2024-x64
8TraceX Fin...ls.ps1
windows10-2004-x64
3TraceX Fin...ls.ps1
windows11-ltsc_2024-x64
8TraceX Fin...pn.ps1
windows10-2004-x64
8TraceX Fin...pn.ps1
windows11-ltsc_2024-x64
8TraceX Fin...er.ps1
windows10-2004-x64
3TraceX Fin...er.ps1
windows11-ltsc_2024-x64
8TraceX Fin...me.ps1
windows10-2004-x64
3TraceX Fin...me.ps1
windows11-ltsc_2024-x64
3TraceX Fin...64.exe
windows10-2004-x64
1TraceX Fin...64.exe
windows11-ltsc_2024-x64
1TraceX Fin...er.ps1
windows10-2004-x64
3TraceX Fin...er.ps1
windows11-ltsc_2024-x64
3TraceX Fin...64.msi
windows10-2004-x64
8TraceX Fin...64.msi
windows11-ltsc_2024-x64
8TraceX Fin...er.exe
windows10-2004-x64
6TraceX Fin...er.exe
windows11-ltsc_2024-x64
6Analysis
- max time kernel
898s - max time network
434s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 07:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
900 seconds
Behavioral task
behavioral2
Sample
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
Behavioral task
behavioral3
Sample
TraceX Final/scripts/TraceX-Helpers.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
TraceX Final/scripts/TraceX-Helpers.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
TraceX Final/scripts/change_disk_ids.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
TraceX Final/scripts/change_disk_ids.ps1
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral7
Sample
TraceX Final/scripts/change_hardware_ids.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral8
Sample
TraceX Final/scripts/change_hardware_ids.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral9
Sample
TraceX Final/scripts/change_mac_address.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral10
Sample
TraceX Final/scripts/change_mac_address.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral11
Sample
TraceX Final/scripts/change_monitor_hwid.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral12
Sample
TraceX Final/scripts/change_monitor_hwid.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral13
Sample
TraceX Final/scripts/change_registry_hwids.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral14
Sample
TraceX Final/scripts/change_registry_hwids.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral15
Sample
TraceX Final/scripts/create_restore_point.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral16
Sample
TraceX Final/scripts/create_restore_point.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral17
Sample
TraceX Final/scripts/hide_peripheral_serials.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral18
Sample
TraceX Final/scripts/hide_peripheral_serials.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral19
Sample
TraceX Final/scripts/setup_vpn.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
900 seconds
Behavioral task
behavioral20
Sample
TraceX Final/scripts/setup_vpn.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
28 signatures
900 seconds
Behavioral task
behavioral21
Sample
TraceX Final/scripts/tracex_cleaner.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral22
Sample
TraceX Final/scripts/tracex_cleaner.ps1
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral23
Sample
TraceX Final/scripts/uninstall_game.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral24
Sample
TraceX Final/scripts/uninstall_game.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral25
Sample
TraceX Final/tools/AMIDEWINx64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral26
Sample
TraceX Final/tools/AMIDEWINx64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral27
Sample
TraceX Final/tools/HWID-Spoofer.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral28
Sample
TraceX Final/tools/HWID-Spoofer.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral29
Sample
TraceX Final/tools/OpenVPN-2.6.14-I001-amd64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
900 seconds
Behavioral task
behavioral30
Sample
TraceX Final/tools/OpenVPN-2.6.14-I001-amd64.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
27 signatures
900 seconds
Behavioral task
behavioral31
Sample
TraceX Final/tools/RevoUninstaller.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral32
Sample
TraceX Final/tools/RevoUninstaller.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
900 seconds
General
- Target TraceX Final/tools/OpenVPN-2.6.14-I001-amd64.msi
- Size 5.5MB
- Sample260816-jsc9bsshpa
- SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
- MD5 1e150b4507fc951c8a23b08b85236cd2
- SHA1 3f6980947c16778efb3126193726c038453c85d6
- SHA512 2074822532d38e94c131ceb3b4b7a01379ea20b5d6e3fb85a6912a586b8e6f1ff5a4973c200087ccd5ecd17727acef2d5568e6afc9df392da5c1f1978b4cd3a8
- SSDEEP 98304:fEnzYKCLSBI0lGIOKv8k7VHTB87GnJ6tEGb7MrisWnB+A/yue/bjBe:z/LS9ZzVV87G2hbWij+xB/Re
- TLSH T128460101B6C10462EC678230C85E925AF2F27C5117A0D66FA2DCBF7CBF3B3A5526A751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\ = "OpenVPN 2.6.14-I001 amd64" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\Version = "1" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\IsInstalled = "1" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\DontAsk = "2" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\StubPath = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v OPENVPN-GUI /t REG_SZ /d \"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\"" MsiExec.exe - Drops file in Drivers directory 9 IoCs
description ioc Process File created C:\Windows\System32\drivers\SET2735.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\SET2D11.tmp DrvInst.exe File created C:\Windows\System32\drivers\SET2D11.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\SET1860.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\SET2735.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\ovpn-dco.sys DrvInst.exe File created C:\Windows\System32\drivers\SET1860.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\wintun.sys DrvInst.exe - Executes dropped EXE 6 IoCs
pid Process 4896 openvpn-gui.exe 1104 openvpn.exe 4572 openvpnserv.exe 5064 openvpnserv2.exe 1384 openvpnserv2.exe 2400 openvpn-gui.exe - Loads dropped DLL 20 IoCs
pid Process 3808 MsiExec.exe 3808 MsiExec.exe 4336 MsiExec.exe 4336 MsiExec.exe 4336 MsiExec.exe 4336 MsiExec.exe 2524 MsiExec.exe 2524 MsiExec.exe 2524 MsiExec.exe 2524 MsiExec.exe 2524 MsiExec.exe 1104 openvpn.exe 1104 openvpn.exe 1104 openvpn.exe 1104 openvpn.exe 4572 openvpnserv.exe 2524 MsiExec.exe 2524 MsiExec.exe 4336 MsiExec.exe 3808 MsiExec.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OpenVPN-GUI = "C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe" msiexec.exe - Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 4692 msiexec.exe 8 4692 msiexec.exe 12 4692 msiexec.exe 14 4692 msiexec.exe 15 4692 msiexec.exe 6 4692 msiexec.exe 12 4692 msiexec.exe 15 4692 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\nete1e3e.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{06a2cef1-2fb9-4046-8d8e-7e3913eb816c} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\net9500-x64-n650f.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{06a2cef1-2fb9-4046-8d8e-7e3913eb816c}\SETC4C.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{c35630de-0555-1649-b340-18948a9a75ed}\SET1321.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{c35630de-0555-1649-b340-18948a9a75ed}\SET1323.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6e8821e0-dd95-7e4e-8f55-6c177fd74ee4}\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{c35630de-0555-1649-b340-18948a9a75ed}\ovpn-dco.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{c35630de-0555-1649-b340-18948a9a75ed} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_ef71073a5867971f\ipoib6x.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\netvf63a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\net8187se64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\netr7364.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6e8821e0-dd95-7e4e-8f55-6c177fd74ee4} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{c35630de-0555-1649-b340-18948a9a75ed}\ovpn-dco.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\netl1e64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\netwew01.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_d5996f2a9d9aa9e3\netr28ux.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{c35630de-0555-1649-b340-18948a9a75ed}\SET1322.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_9a5b429abc465278\wnetvsc.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\netbxnda.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_be4ba6237d385e2e\netrndis.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\netathr10x.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_07ad61d07466a58a\wceisvista.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_3294fc34256dbb0e\dc21x4vm.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\tap0901.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\oemvista.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\netxex64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF MsiExec.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\net819xp.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\netvwifimp.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\netrtwlanu.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\netvwwanmp.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\netvchannel.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\netwsw00.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\b57nd60a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\netl260a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\netrtwlane.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\net1ic64.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\net7500-x64-n650f.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\OemVista.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{06a2cef1-2fb9-4046-8d8e-7e3913eb816c}\SETC3B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\netwtw02.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\Temp\{6e8821e0-dd95-7e4e-8f55-6c177fd74ee4}\SET11F9.tmp DrvInst.exe - Drops file in Program Files directory 27 IoCs
description ioc Process File created C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll msiexec.exe File created C:\Program Files\OpenVPN\log\README.txt msiexec.exe File created C:\Program Files\OpenVPN\bin\libopenvpn_plap.dll msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpn.exe msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpn-plap-uninstall.reg msiexec.exe File created C:\Program Files\OpenVPN\config\README.txt msiexec.exe File created C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.inf msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpn-plap-install-new.reg MsiExec.exe File created C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg msiexec.exe File created C:\Program Files\OpenVPN\ssl\modules\legacy.dll msiexec.exe File created C:\Program Files\OpenVPN\bin\libssl-3-x64.dll msiexec.exe File created C:\Program Files\OpenVPN\doc\openvpn.8.html msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpnserv.exe msiexec.exe File created C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.cat msiexec.exe File created C:\Program Files\OpenVPN\config-auto\README.txt msiexec.exe File created C:\Program Files\OpenVPN\include\tap-windows.h msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpn-gui.exe msiexec.exe File created C:\Program Files\OpenVPN\sample-config\client.ovpn msiexec.exe File created C:\Program Files\OpenVPN\doc\INSTALL-win32.txt msiexec.exe File created C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll msiexec.exe File created C:\Program Files\OpenVPN\bin\openvpnserv2.exe msiexec.exe File created C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.sys msiexec.exe File created C:\Program Files\OpenVPN\license.txt msiexec.exe File created C:\Program Files\OpenVPN\res\ovpn.ico msiexec.exe File created C:\Program Files\OpenVPN\sample-config\server.ovpn msiexec.exe File created C:\Program Files\OpenVPN\bin\tapctl.exe msiexec.exe File created C:\Program Files\OpenVPN\bin\vcruntime140.dll msiexec.exe - Drops file in Windows directory 41 IoCs
description ioc Process File created C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\openvpn.ico msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E} msiexec.exe File opened for modification C:\Windows\Installer\MSIF9B1.tmp msiexec.exe File created C:\Windows\inf\oem4.inf DrvInst.exe File created C:\Windows\INF\oem4.PNF MsiExec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIFD5B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFF8F.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\oem5.PNF MsiExec.exe File created C:\Windows\Installer\e58eaa9.msi msiexec.exe File opened for modification C:\Windows\Installer\e58eaa9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIEE43.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF952.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI398F.tmp msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\openvpn.ico msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log MsiExec.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI12BB.tmp msiexec.exe File opened for modification C:\Windows\inf\oem5.inf DrvInst.exe File created C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI399F.tmp msiexec.exe File created C:\Windows\inf\oem5.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSIF6C0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE36.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\e58eaab.msi msiexec.exe File opened for modification C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico msiexec.exe File created C:\Windows\INF\oem3.PNF MsiExec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI3A1D.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF8C5.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI1608.tmp msiexec.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2684 sc.exe 2004 sc.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial\Default svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe - Modifies registry class 57 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\" --command import \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.SampleCfg = "OpenVPN" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\DefaultIcon\ = "C:\\Program Files\\OpenVPN\\res\\ovpn.ico,0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenSSL = "\x06" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\TraceX Final\\tools\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\ = "OpenVPN Config File" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\ = "Import into OpenVPN-GUI" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\PackageName = "OpenVPN-2.6.14-I001-amd64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Service = "OpenVPN" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.OvpnDco = "Drivers" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI.OnLogon = "OpenVPN.GUI" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\ProductName = "OpenVPN 2.6.14-I001 amd64" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Version = "33949049" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TraceX Final\\tools\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ovpn\ = "OpenVPNFile" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\ProductIcon = "C:\\Windows\\Installer\\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\\openvpn.ico" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\EasyRSA = "\x06OpenSSL" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\ = "Start OpenVPN on this config file" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.ovpn msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.PLAP.Register = "\x06OpenVPN.Service" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\ = "import" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Documentation = "OpenVPN" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.Wintun = "Drivers" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\InstanceType = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn.exe\" --pause-exit --config \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.TAPWindows6 = "Drivers" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI = "OpenVPN" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command\ = "\"notepad.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\PackageCode = "22912DF0EEBE3A3498FA548D65979F16" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72\3FDCD1DCCACB33241ACCD5FAEEE106E4 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\open\command msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3016 msiexec.exe 3016 msiexec.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid 4 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4692 msiexec.exe Token: SeIncreaseQuotaPrivilege 4692 msiexec.exe Token: SeSecurityPrivilege 3016 msiexec.exe Token: SeCreateTokenPrivilege 4692 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4692 msiexec.exe Token: SeLockMemoryPrivilege 4692 msiexec.exe Token: SeIncreaseQuotaPrivilege 4692 msiexec.exe Token: SeMachineAccountPrivilege 4692 msiexec.exe Token: SeTcbPrivilege 4692 msiexec.exe Token: SeSecurityPrivilege 4692 msiexec.exe Token: SeTakeOwnershipPrivilege 4692 msiexec.exe Token: SeLoadDriverPrivilege 4692 msiexec.exe Token: SeSystemProfilePrivilege 4692 msiexec.exe Token: SeSystemtimePrivilege 4692 msiexec.exe Token: SeProfSingleProcessPrivilege 4692 msiexec.exe Token: SeIncBasePriorityPrivilege 4692 msiexec.exe Token: SeCreatePagefilePrivilege 4692 msiexec.exe Token: SeCreatePermanentPrivilege 4692 msiexec.exe Token: SeBackupPrivilege 4692 msiexec.exe Token: SeRestorePrivilege 4692 msiexec.exe Token: SeShutdownPrivilege 4692 msiexec.exe Token: SeDebugPrivilege 4692 msiexec.exe Token: SeAuditPrivilege 4692 msiexec.exe Token: SeSystemEnvironmentPrivilege 4692 msiexec.exe Token: SeChangeNotifyPrivilege 4692 msiexec.exe Token: SeRemoteShutdownPrivilege 4692 msiexec.exe Token: SeUndockPrivilege 4692 msiexec.exe Token: SeSyncAgentPrivilege 4692 msiexec.exe Token: SeEnableDelegationPrivilege 4692 msiexec.exe Token: SeManageVolumePrivilege 4692 msiexec.exe Token: SeImpersonatePrivilege 4692 msiexec.exe Token: SeCreateGlobalPrivilege 4692 msiexec.exe Token: SeCreateTokenPrivilege 4692 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4692 msiexec.exe Token: SeLockMemoryPrivilege 4692 msiexec.exe Token: SeIncreaseQuotaPrivilege 4692 msiexec.exe Token: SeMachineAccountPrivilege 4692 msiexec.exe Token: SeTcbPrivilege 4692 msiexec.exe Token: SeSecurityPrivilege 4692 msiexec.exe Token: SeTakeOwnershipPrivilege 4692 msiexec.exe Token: SeLoadDriverPrivilege 4692 msiexec.exe Token: SeSystemProfilePrivilege 4692 msiexec.exe Token: SeSystemtimePrivilege 4692 msiexec.exe Token: SeProfSingleProcessPrivilege 4692 msiexec.exe Token: SeIncBasePriorityPrivilege 4692 msiexec.exe Token: SeCreatePagefilePrivilege 4692 msiexec.exe Token: SeCreatePermanentPrivilege 4692 msiexec.exe Token: SeBackupPrivilege 4692 msiexec.exe Token: SeRestorePrivilege 4692 msiexec.exe Token: SeShutdownPrivilege 4692 msiexec.exe Token: SeDebugPrivilege 4692 msiexec.exe Token: SeAuditPrivilege 4692 msiexec.exe Token: SeSystemEnvironmentPrivilege 4692 msiexec.exe Token: SeChangeNotifyPrivilege 4692 msiexec.exe Token: SeRemoteShutdownPrivilege 4692 msiexec.exe Token: SeUndockPrivilege 4692 msiexec.exe Token: SeSyncAgentPrivilege 4692 msiexec.exe Token: SeEnableDelegationPrivilege 4692 msiexec.exe Token: SeManageVolumePrivilege 4692 msiexec.exe Token: SeImpersonatePrivilege 4692 msiexec.exe Token: SeCreateGlobalPrivilege 4692 msiexec.exe Token: SeCreateTokenPrivilege 4692 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4692 msiexec.exe Token: SeLockMemoryPrivilege 4692 msiexec.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4692 msiexec.exe 4692 msiexec.exe 4896 openvpn-gui.exe 4896 openvpn-gui.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4896 openvpn-gui.exe 4896 openvpn-gui.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3016 wrote to memory of 3808 3016 msiexec.exe 89 PID 3016 wrote to memory of 2920 3016 msiexec.exe 95 PID 3016 wrote to memory of 4336 3016 msiexec.exe 97 PID 3016 wrote to memory of 2524 3016 msiexec.exe 98 PID 3816 wrote to memory of 4496 3816 svchost.exe 100 PID 3816 wrote to memory of 4572 3816 svchost.exe 124 PID 3816 wrote to memory of 1224 3816 svchost.exe 134 PID 3816 wrote to memory of 4968 3816 svchost.exe 104 PID 2524 wrote to memory of 1748 2524 MsiExec.exe 108 PID 4896 wrote to memory of 1104 4896 openvpn-gui.exe 111 PID 3816 wrote to memory of 364 3816 svchost.exe 116 PID 2524 wrote to memory of 4696 2524 MsiExec.exe 117 PID 3816 wrote to memory of 2668 3816 svchost.exe 121 PID 2524 wrote to memory of 1056 2524 MsiExec.exe 122 PID 2524 wrote to memory of 2684 2524 MsiExec.exe 129 PID 2524 wrote to memory of 2004 2524 MsiExec.exe 131 PID 3808 wrote to memory of 2400 3808 MsiExec.exe 136 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\OpenVPN-2.6.14-I001-amd64.msi"1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4692
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 655A869C71713C65677BCF5EFBFBAB3C C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Program Files\OpenVPN\bin\openvpn-gui.exe"C:\Program Files\OpenVPN\bin\openvpn-gui.exe"3⤵
- Executes dropped EXE
PID:2400
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2920
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D71B533757D116E63F94695EA180AE5F2⤵
- Loads dropped DLL
PID:4336
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D5113C300F6746BFD0185388D791DBB2 E Global\MSI00002⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\System32\netsh.exenetsh interface set interface name="Local Area Connection" newname="OpenVPN Wintun"3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1748
-
-
C:\Windows\System32\netsh.exenetsh interface set interface name="Local Area Connection" newname="OpenVPN TAP-Windows6"3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4696
-
-
C:\Windows\System32\netsh.exenetsh interface set interface name="Local Area Connection" newname="OpenVPN Data Channel Offload"3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1056
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config OpenVPNService start= auto3⤵
- Launches sc.exe
PID:2684
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start OpenVPNService3⤵
- Launches sc.exe
PID:2004
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Windows\Temp\4d451349d91131f50af7085b6e80bc6d8220c1bece2ef45869a72feaadb94b9b\wintun.inf" "9" "48a789c27" "000000000000014C" "WinSta0\Default" "0000000000000164" "208" "C:\Windows\Temp\4d451349d91131f50af7085b6e80bc6d8220c1bece2ef45869a72feaadb94b9b"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4496
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Windows\Temp\0de154c1bb54bb1992941013964be0f9e4ed4c8f984f05a86dc86ed19fee7315\OemVista.inf" "9" "413ebe7cf" "0000000000000164" "WinSta0\Default" "0000000000000168" "208" "C:\Windows\Temp\0de154c1bb54bb1992941013964be0f9e4ed4c8f984f05a86dc86ed19fee7315"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4572
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.inf" "9" "4e1f3ffd3" "0000000000000168" "WinSta0\Default" "00000000000000FC" "208" "C:\Program Files\Common Files\ovpn-dco\Win10"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1224
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:9ef34515d755ec66:Wintun.Install:0.8.0.0:wintun," "42b53aaff" "000000000000017C"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4968
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\NET\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.27.0.0:root\tap0901," "433338203" "0000000000000168"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:364
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\NET\0002" "C:\Windows\INF\oem5.inf" "oem5.inf:c695c3de07ba2b5d:ovpn-dco_Device:1.2.1.0:ovpn-dco," "43b135903" "000000000000014C"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2668
-
-
C:\Program Files\OpenVPN\bin\openvpn-gui.exe"C:\Program Files\OpenVPN\bin\openvpn-gui.exe"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Program Files\OpenVPN\bin\openvpn.exeopenvpn --version2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:2608
-
C:\Program Files\OpenVPN\bin\openvpnserv.exe"C:\Program Files\OpenVPN\bin\openvpnserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4572
-
C:\Program Files\OpenVPN\bin\openvpnserv2.exe"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"1⤵
- Executes dropped EXE
PID:5064
-
C:\Program Files\OpenVPN\bin\openvpnserv2.exe"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"1⤵
- Executes dropped EXE
PID:1384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:1224
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58eaaa.rbs
- Size 876KB
- SHA256 f9907d4dc787d24848d61b21cff5ee1e775f3553e2b8315f489782d6b58eacdb
- MD5 6b9dd2258ede56a7cff982a6dcd4ecb1
- SHA1 9d597797a0c287bf908c84fa09b2f96c67c666de
- SHA512 2dcff1fdf53119ea4a0b72d2cb4daf549fb2fae299a8a5b027de38e8d69c5664347966b525097cbbab3ed59ac509c87be14dc81c70c8cee3cd956024db417ec6
- SSDEEP 24576:1C4LJNBjSblC4LJNBjSbHC4LJNBjSb9C4LJNBjSbL:dvB+JvB+7vB+BvB+H
- TLSH T164157D09B7D000F9EDB7463889674616E773780107749A9F03A4837AEF2F7D1A639B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win10\ovpn-dco.cat
- Size 11KB
- SHA256 26c54ce26cb43407855ba24d10fbb30a87e5a1a0a35536025a02cb003fe474f4
- MD5 5551203f3f1095335ff00421b16fd7e2
- SHA1 0d14402407d60952f631dffe35240de3a1f910cb
- SHA512 3c31b8f60bb59e4ac3c0cda8335af1918927c51b203c8b68f2601b390ad0bc0228cb9d5566dedef05ff38cabfce46eb3d54c52cd59c828bc17dcf0b1c24a8b08
- SSDEEP 192:aOLm9xJCxkJnEwKUNhYCns2owcLK+X01k9z3AB3CmByFGx:s0kmUNh3sK6R9zc3Cm+Gx
- TLSH T1E4322AEA9A2C01C2ED977C6083D8E9537C3E27CB1C5051AA21ABFA140CE73C8F71556E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win10\ovpn-dco.sys
- Size 89KB
- SHA256 2357e4d2007f346a3d2b3bf05115caeaf3eb069a70be654ce472be71e6f7fc75
- MD5 5e69b6c42467b2673101e592a2b28638
- SHA1 16d076f57b3cbdbe945c6666676823871f5c90d1
- SHA512 232e9441db8da52cd5e6f29baf5340b0540125074a7ccc9d4754762c56460b72327f89d6583a8afde71ed400433eb850e1eb2b9d5fc536d8f9c18992b83fa587
- SSDEEP 1536:b/+PHw1yLCA62eiARYLdBX0A0gA1j7ajEMB0khx+SmzH1CzcI:QlCWOYf0A0PO0kH+SSCYI
- TLSH T1B1930875A6E010D4F47B56B886B64E01BFB1BA522F33D6EF0410856D0F36BC88E3A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.inf
- Size 2KB
- SHA256 1f6c35bc11d910f91c32ea54894d0fddb0094876bdd526d04a9287d04d636242
- MD5 77da079a3665afc84d05c3d07bcaa0d0
- SHA1 3fbfafe2c08100f5b46b792398c2ecb9157760e9
- SHA512 10fcd8464c6aab386bf2f675175598764e0b784a898b7b450fef3d055ecf902c7a57ac0aef2725b9e6899146e4e9230c8677bfd2a8f18489b642fa6beca25507
- TLSH T19441F14A52C20FBD3B432D7596077BA2B9D6910050C8151AF18CDA468B8FF99B31B7EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll
- Size 4.6MB
- SHA256 71270ed463648bcbe45829cbc0ce3827faf3267e46d530ae0a82d9bc0c619ec0
- MD5 5984ea63df1671b1d174d4d957a7b483
- SHA1 3691290a86290533537593654db9e11b2bd15fac
- SHA512 04f087a1bce16c811eb6a4be318dc5846e5553f3b0d50318aa335bc46a262cfe177479ea06b637aa6934df1ae4a998e7b764df17d2efba0ef80ef302c05c57a2
- SSDEEP 98304:9gGN3UNaucJAWjXHJPx+s1CPwDvt3uF0nCc:6GN3UZcJAWjXpph1CPwDvt3uF0nCc
- TLSH T18E268C69A6BC0096D86A95BCC2D76227D371B41257F057CF2E284AF90F23FD426BB740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll
- Size 111KB
- SHA256 e2500ded6e44090f0c76528903269938a029bee206fde25adac040d6e3a124f7
- MD5 e5353f2c01b77b433ea518923b1b8dbd
- SHA1 fad48fbf2d115b5426b40fd52d51a8729a976462
- SHA512 b81ae3412a4312e0f499860586d866d47f41647441f5875e645ffa74f83aa2ef1569b5df6535ab347a89fd3b6bb6bc69558bca65336674f0459eeda167efeb34
- SSDEEP 1536:Usfoicdz0Suh6YcYwnIrHL6PS7ySVfPrZm8KAd0uM82FjE25YiL3nyj7LoNA:qdzA3ynIrHLye1VfPrZqE25RL3nyj/ou
- TLSH T1F5B30902BD846870D49AD33DEC62022BA3767890137657DF476260E92F93F96AD39F43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\libssl-3-x64.dll
- Size 818KB
- SHA256 c681893dd0c9f86e7f405792dec32adab33cb899cbd3b2ddda533e28f577ab6d
- MD5 10d4982726da7c122404f6d6f9bcd793
- SHA1 4e6861066218f0909b8ae851fbfe9ebe0b894e46
- SHA512 a7e3ce35d60ffba3072211e600bd91e4f0419673ad64471b6b94a537e4c908a02b6fee673ea55e95c22a2b4a2dcc967f56aba0ffb99a95a8875c9b4bda37e668
- SSDEEP 12288:OXxxYXIy6weQqYjq2NIUuXWGfcFTdsFgIMPA3AK8t72tJAh1z/VhEi:OXkIrjY+E4bWUgIMPA5S7KJAh1znt
- TLSH T12B053A69BBB8009DD876C13986938613E6F6B4563370EBDB0B648A7A0F637D4273D344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\openvpn-gui.exe
- Size 1.1MB
- SHA256 1f07550f3decbfd7c8737694001ee13c26de84ef498dc493d313a79db2080646
- MD5 75d5db58796acffda38dd0139a9aa15a
- SHA1 f1eeab1b9967f0ba54f12f6ead70a0ce85f597e2
- SHA512 d987ded834671be0894f5953a800947280b012288a2ec44fdcc7fc42dd08e70577ddd6f4c22118e18ebbf0fdca0c5054e8c11bbd3b104bd7c7f8b8f9056999bd
- SSDEEP 12288:wtlBCAQ/WWOn+wP/nQStD6Fo+41GqKqx8xmwApbn:wO/LOnBHQS4Fo+yGqKtobn
- TLSH T129457001B3F98118F5F3AB349DBA46526E3BBC815E34CA8E5295755E0A72B90DD30B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg
- Size 454B
- SHA256 18b542b3de918da103ea6d79f3be0c5af8349502dc9c673f2db5b6f05dc57d35
- MD5 2b7d47401bad3221ed6d92996d49f9f7
- SHA1 a3b8cbc667f5023e4a4dd8c50bc6ab78c51048de
- SHA512 dceafceeff05a61fde179dbdf13bc2b1243ee756028b1c8a96e311f279effbd9e2567f65f8ae063841ca2c4961f6b522553b9c7095daa94898ff5ed048607aa5
- TLSH T151F0DCF2CE079202DA91122D291606F147B64569758E0B92F181A3A86DFECE343FC08B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\OpenVPN\bin\openvpn.exe
- Size 1019KB
- SHA256 89479084f420ca55864c957a689971c327209d9c0e7ea4302df947e7cefff8c2
- MD5 1860b259b69d1b78e5f82013cb21af20
- SHA1 530eaff3d8d54b13b391a954082a9261bc1d0452
- SHA512 99b2d3c75d13ff436ac0bd380e770460f6a19162b1246ffc156b3fee7e68b94d393c0fcd6bca8986ac17d71864862b0ee3620a6354ab42046abc7aed42ff3dc2
- SSDEEP 24576:vMiKDhl3hB1g8QVNaEUQVdcRZehHDLUVvNrPMJomWa:vJKDhZhk8QVNadodKZeBiPUB
- TLSH T19A259D2A139911A9D8ABD078D6178013E772745423749AEB79BCCA142F17EF2B73EF40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\openvpnserv.exe
- Size 64KB
- SHA256 4d7ba182e89f2869b650ac80a34b8f347deb360a3872ee9dca130168b32c87fa
- MD5 f4bde1658456fca1af425a5ed35843d4
- SHA1 0392d4a64fc4110811f54d72ba8669da93eab338
- SHA512 37d83474bfbfbde3f333176b0ea0cbc287a41dbe3491e0eab6eecb9643158b53e878d020a83d362fb504218609050171920ade3b048a701259995f87cda37b6c
- SSDEEP 1536:mcWMro0WY0uA8EHzz0JZQaav3huc7Lo1gYf:yMdWYTpuzQZQaapuc/o1T
- TLSH T161532941A3E804D8F9B3AB78E9B21113DAB57D152B71C6CF4264C45E0F72BC1E978B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\tapctl.exe
- Size 41KB
- SHA256 d5aab270d61d7d1709e85ba81525be5948ae5bf397bb7b12a11e11ba0788ecd1
- MD5 bc1fec27a50d102d805f7cdb79272b50
- SHA1 562719ef2494b237f5ff164f952b5ea4e23e097d
- SHA512 a3c0e3c489775f704bd22ef1f01ee51615ed8ab5abd6f6e13667d117dead7a3c61810e95cfec13d0d994acdaa89312cfb1b2577ae59b2639ede75149115dcb03
- SSDEEP 768:uV7EIM5A5/2jrvnihtk591X3hZaZYiLo+Cc+2EsLB:uVQIkjrPihtk591XRZaZ7Lo+ys
- TLSH T189133B016BE90099E573573898B716276A777D512B70C6DF238CC22D0F63B80BE39B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpenVPN\bin\vcruntime140.dll
- Size 94KB
- SHA256 c51c64dfb7c445ecf0001f69c27e13299ddcfba0780efa72b866a7487b7491c7
- MD5 5797d2a762227f35cdd581ec648693a8
- SHA1 e587b804db5e95833cbd2229af54c755ee0393b9
- SHA512 5c4de4f65c0338f9a63b853db356175cae15c2ddc6b727f473726d69ee0d07545ac64b313c380548211216ea667caf32c5a0fd86f7abe75fc60086822bc4c92e
- SSDEEP 1536:yOHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1lLN:yOr/Z+jPYNV9H0Q8ecbjt1j
- TLSH T12F937C4A76A442B7D06BD274C1E34A5AF770B8408B7053CF03B6866A5F63BE05E3E356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40
- Size 1KB
- SHA256 1b3f69f6cd1888e131dc15d7f034052b71080cd18c9ef97c1113730aaae227b2
- MD5 6e187e303eeac283dfc34abab070ded3
- SHA1 1486fb5b61cb3b96f11b270e90f511e47baabe1d
- SHA512 a92ec418b9ad043ce3e33ac2f64420195b3759ffec86c79c1ce7559081b5858607a7599fddd13a295edb5eb3c1a316ee651cfadb25f5d2342944c6257544cd02
- TLSH T13A11F04A04947723A70A6F34D88BDC676EF2A34342D4CC0BD740D9C11522BC81F894F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433
- Size 727B
- SHA256 7ac23b2155174612d6da23804c2d302b011fe66b44763c9a06fd55a7343f49d3
- MD5 c9d1437506a5c85ae3ee15519c12688c
- SHA1 b56b9f239a38fbefeb6df295a87df9faa4ee1c0d
- SHA512 a9862fd654c294838d4e24dd006bfe7ad5883a469eb4cfc88888f4f2477b2974de511f9e2aa2a4855352ca3c0218f13343f207a2a0a1f0ac0573433b7a7d5473
- TLSH T101019903A9BCC2B36B33BD2574F0EB377450C2319DC9107F1C8694A9C94E701BD81665
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BA74182F76F15A9CF514DEF352303C95
- Size 737B
- SHA256 4b549b1e937e1c60655ef1336d47fc2ef7a14c55343ddf3fccc5df1e707ab27f
- MD5 47a4441dcabf6090217b018dcc64b666
- SHA1 2ccf6996bafac5a0027fb66cd7059e7ba1735969
- SHA512 cd736cf7420c4b39132d19dac16d31dab57aa3851ad00ea92f7c28f32ef7662f5c47ae96aedf067b062b4328e37ffa86f972146462bff09b060f1d831523e194
- TLSH T190016533092954A43DA94FC13A628E65D8F0C348DD99605486FBD14386B7BDBB29E1C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
- Size 252B
- SHA256 27abf6f31194629c31da6a6b84ba0cb684612f5348c106a731f07b2023726f31
- MD5 438ec0e949a33ddbcb3e02e12746ebd7
- SHA1 ca08b0128f899ada584e4893bcc4f0891f889aa7
- SHA512 c6a51da3e63fa8970965862562e1243cbf60aced5debabe8ba6a8dbecd0ce74255e2efe8b64a8e19c895c12756bb83a2ed26402a92d782c7cc9e27b0f55f6e08
- TLSH T1C1D0C710E7E50315F15615776A6145C1A761652DA541CF2D4BF1451E185AF54486050A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433
- Size 408B
- SHA256 eac24b8339e15489baf2530905bdacf2465b699258a3a2d4c7102eb514ff35d9
- MD5 c0218c0658182385107ec3161a4ced22
- SHA1 2b346b20b66617db79c12f1d8f1aa7ffb4b76264
- SHA512 e2bfd8720e3838d1bdc52269afa0fbcc6dbde223c4a8444a841ddfcc4b2aa6d3c88c326134771d298b118a3bc710806ac432bdeb15b3b82031351486df2f2efb
- TLSH T1E7E0263436FB056EF1F0E07843E79A22086AF64B0A09C37916D09759BB67A405DE2B70
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA74182F76F15A9CF514DEF352303C95
- Size 248B
- SHA256 d2329dcd14ff58626257feea4b0a257cdd3f86f6852978ce1526d2411e282d78
- MD5 df07529251a3737fb792c683f4f9af87
- SHA1 0e81730f2b550e377f15f5a02f3a12eb85a21642
- SHA512 a0bc1a3ee724a653361c88b0816982dec48d1ea2f73bfdbf0fd9da7eb84f52736135136793655c2897a70e87807f0c74a1670830022da6d9d08a7e67ee6f1579
- TLSH T1D0D0A9396BE90202F2A4213F9D7009516A2AA9AFA202CF0C0BF2021D1428F010D2190B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8B43.tmp
- Size 209KB
- SHA256 8351a40a632facd1f79a1bccfe8e32e88876a23065be1144621533700ecb05ad
- MD5 3037e214e0f9b25fc63d4d16f7c4c91d
- SHA1 b03dce2090033ca3029526485039b75a5aa4b488
- SHA512 437fd240c0af2afaa3a5a1791db4739dff04c7003f25f1bc512797cfffb7fc3e8377656b6eb8714a50b3189c2616b230a619730bc63628d9ab4bc214ce31de90
- SSDEEP 3072:l9FCdj6rw5iUeqEetAByXxqr8lyc8t5W6/eb7eUZxfZ/oR:l9FC4wuJeiByXwrtcO6ZVxoR
- TLSH T1C6248E09B7D100B9EDB78638CD678656E673780107609A9F03A08376EF2F7D1A63DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF8C5.tmp
- Size 275KB
- SHA256 fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f
- MD5 2232c07e354364e0eb1dc80024593826
- SHA1 65bb4232c0416cfb2c158bfc32a7732ad72cee72
- SHA512 f0d295565b209f4dedd2a79123fa54ff9b8cbb173f14463ab3d3707b8d87aad84b05c2898478ecc148e29d02fa07ddda9499795e0ceafc2982c0adbd570a3572
- SSDEEP 3072:A736bBrGsu4ldGrlmxElEmNoPl4+eDhIVJkRZ5Br/NbvcjKX5mMgQSeRocPvuocM:A736UWldGrlmxEDNMea+H5R/B/1lp4x
- TLSH T136548D41B7E404A6EC73C73499A39606FA3278411B70DAEF035082768F6B7D1AA3DB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF952.tmp
- Size 281KB
- SHA256 45e855461f5d1be28a2f88416603070bd1778055abdd06834ae58e97b7ddf53c
- MD5 718222e232d11298dfbabbc2b70d8b14
- SHA1 89fc560692111c2245694867b8772fd8969f46d2
- SHA512 9191961c28a7a4647ae8f9f9e1956d60b97f5f5c3e4e838d888bf78c1ea665e98e8e3c75cc1247a68a89b2413493ea6d39dbc60827eec919ddba0536d793c801
- SSDEEP 3072:sEcOO6pMedPCy5654WKlfE5qbHsfmYud8d2VCsOLlk1lHgQNvLvPMm88cYzdFOS:OOO6OedPjw58l85/grhSQNDsYz2
- TLSH T111549D45BF9504B6E8BBC1348AA74A82E772740203109A9F33AC97799F2F7D1663D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF9B1.tmp
- Size 143KB
- SHA256 2738720da0b6ce474ca6eb51a92372d047eca2d713c256f0cd6c147ac3a0db21
- MD5 84a1cc9540d5cdad74bc54f8090dd27a
- SHA1 c6f82d1491015457785ae0d365e7196d693d9a6b
- SHA512 9c25d6e7331844d01d732ac923e99c68f305749d92407c873cd09b451e59a8864001e308864fda319fa4a2bcae9dbe50682201c67901dce14272291dedecd2c8
- SSDEEP 3072:+1gnuc/GBdzVQqyIgt8DB7QKPw3hL6nCMfBXqpU:Bnuc/GBdJmIgtesKP+Lh+
- TLSH T154E37E17B7A400BBE5B78235C9635A06E772B81117219F9F03A443766F237D0AD3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58eaa9.msi
- Size 5.5MB
- SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
- MD5 1e150b4507fc951c8a23b08b85236cd2
- SHA1 3f6980947c16778efb3126193726c038453c85d6
- SHA512 2074822532d38e94c131ceb3b4b7a01379ea20b5d6e3fb85a6912a586b8e6f1ff5a4973c200087ccd5ecd17727acef2d5568e6afc9df392da5c1f1978b4cd3a8
- SSDEEP 98304:fEnzYKCLSBI0lGIOKv8k7VHTB87GnJ6tEGb7MrisWnB+A/yue/bjBe:z/LS9ZzVV87G2hbWij+xB/Re
- TLSH T128460101B6C10462EC678230C85E925AF2F27C5117A0D66FA2DCBF7CBF3B3A5526A751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 37KB
- SHA256 3cd662a9374a3dfadb39db8ed9639301f6f3252b2f22175c83e16413f73afe29
- MD5 1b75f091d3112ab3540c434d51d30551
- SHA1 2743db969db3b91a53a66bfc325d1bd1efdf14fb
- SHA512 c7a5c577180d2d72ca1f0401e69c03093567525d2a9fc60eeb82fef91f414ee57b8cf9906995ecb0c59350d15238aa20024c10703b8e5181f25525c4803b975c
- SSDEEP 768:qzlR8iKScu5eCPw1KG4fzQAfm6eN7TQggGFr5:qzlREScu5eCPw1KGiLfm6eN7TQggGFN
- TLSH T1D6032C4491DC8550C5F50AB2266DDE71C5AFA6CEB70B0EF670BC52189AC2B053FB60AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 37KB
- SHA256 c8658166a0c7fa6d3075c3a3e14e0beaad8c21f916bb6982f3df0156778178e5
- MD5 82255dc467eafe8015aefd245bacc433
- SHA1 7baf3cafebe4b4d6c2beb98b0f3c117488756a4c
- SHA512 06ff73d7ef739ef28ce1da3bb88d2d299e53002aa36587a9d68dfd4426f3adea3398ac3251ac60c2f90526b9c4fcea48751ed7546695b0699a5a270574408642
- SSDEEP 768:qzlR8iKScu5eCPw1KG4fzQAfm6eN7TQggGFry:qzlREScu5eCPw1KGiLfm6eN7TQggGFO
- TLSH T123032C4491DC8550C5F50AB2266DDE71C5AFA6CEB70B0EF670BC53189AC2B053FB60AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\0DE154~1\tap0901.cat
- Size 11KB
- SHA256 ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7
- MD5 71ecece58bb00bdc1e728ee28d7a5332
- SHA1 4305889415cf95662a30d024f1138f1af224cf42
- SHA512 9b23404d867fc4fd7c7beeba3768e8fed3113cc7430ec1bc9ca7faf6e6105388de7057b1402f9b4ba8fbc11e5fcd3afe14233721e8d15b6c0bed40f65aa5b58b
- SSDEEP 192:HxDuDjbfXJCKnEwKUNhYCy1QySaI8HNsAX01k9z3Aqcp9wdGEC:CXaUNh3auatHNsAR9zWZEC
- TLSH T1FF322AA2942C52C3ECABBC7043D4E9977C3E2BCB1950506A269FF7141DA73C8EB1516E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\0DE154~1\tap0901.sys
- Size 40KB
- SHA256 581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1
- MD5 1bb9772a05517e227d1dafd3936e8f66
- SHA1 d695ca5791a4b6a3509939aebdfaf5e229c6fbcf
- SHA512 3f1966038f91b887fe1a71474929bd87f3c75091846c6e9563f7424d3a7c19c908f1d874895341c61a868a616aba637e3d4188d4ebb7383087886a13a4dc0aa2
- SSDEEP 768:EGvByM5JLLvslmdu9lsECPURPNkilzdCH3C9zySb:EfM7VE88fkilzdCHOzySb
- TLSH T112038DD16AA814D1E8AA9874C7EBCE43F7B5B1430311AAEF0764D6691F23BD05637328
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\0de154c1bb54bb1992941013964be0f9e4ed4c8f984f05a86dc86ed19fee7315\OemVista.inf
- Size 7KB
- SHA256 1327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9
- MD5 6f5ffb58a9e406ab1643c890e2a198c6
- SHA1 3ff1faba00ac18a93e88a6f2bbfa747c9fdc7e0c
- SHA512 af29bc13cc02238208c51e4e95dd0a4445a952755635a9eab38aa77a5c087cc8e2025af55d8f3a0e9f2430baa91534e7f892bb71aa0ef72bab4483211a845b4b
- SSDEEP 192:wr8tW9yCTi314vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGBdkkzo3DcNSj6jvKFkPs7EQTXvtk
- TLSH T1F9F150681C83EE3A31FEE58557565EC7E24611823A172800355CFC549BBDD9FE33C92A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\4D4513~1\wintun.cat
- Size 9KB
- SHA256 602187e5470ddbdf9421045bb0515f358c88bf88f59fd8a886fb6373da5d0f82
- MD5 faba2ccb8fe366fd281ca6be6d2bb7c2
- SHA1 bb7bd32a21f3eba652fde24146387ffc5278143e
- SHA512 ec424a545e2598f299706499dab07b4d12b0734a52f928216a53bca2b7f384b97bd4fc092d7d68de636a75daf79ac392c4b49b7251ec011236de1659253d6214
- SSDEEP 192:6wRp8yDJCKE4uyK6iWPFWQFAnTz36ArNc4qnajr7NCo:L/iWPFRI64lrNt
- TLSH T10522F8E28A5C44C2E993ADB05398F5977C3E7BDB4C20906922ABF7650DD27C5E70843E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\4D4513~1\wintun.sys
- Size 37KB
- SHA256 eb58bf00df7b4f98334178e75df3348c609ea5c6c74cf7f185f363aa23976c8b
- MD5 1945d7d1f56b67ae1cad6ffe13a01985
- SHA1 2c1a369f9e12e5c6549439e60dd6c728bf1bffde
- SHA512 09af87898528eaa657d46c79b7c4ebc0e415478a421b0b97355294c059878178eb32e172979ee9b7c59126861d51a5831e337a96666c43c96cb1cf8f11bc0a0f
- SSDEEP 768:UwtoHKG2ZqGhg+Eqpg0bUORjj71PKgPrbHZIb4:UwtoHt2ZLg+zg5cv7ld7Zy4
- TLSH T1E1037DD2E6A868C2E973CE3151F5E523BD74B2612B20D5EF4511C4350FA3BC1EA7863A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\4d451349d91131f50af7085b6e80bc6d8220c1bece2ef45869a72feaadb94b9b\wintun.inf
- Size 1KB
- SHA256 44098408ab9611dd99a38e140c7fb1ca5dce6eb2d5f0d5e500547ac1ba5d235b
- MD5 8480579050970b0812cc3d9a1bce1340
- SHA1 edebebd090602f4eee375ad754c8566d4fda23cb
- SHA512 46de9202c3cf0ddbf19f9e0e02ec17530f2722abfa08669fd30a6095ce2342fa89a2cc59c1d47afd82b48c915bb95f4c6d16e7c21129a9c8f09c2bf239566933
- TLSH T1933135D954E10D693CD3322E77277F81E65C123041CA200EB6FD8559D64BCDFA654CAA
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 26610ec5fb3921eb4b07820b5741063b65ec14053eb927d3400f55773f22af85
- MD5 c23471ee80d8f3adb038a4d4a0c47b00
- SHA1 95744bdda58806adc8df85bb0d381084a0dbb83f
- SHA512 4f949de87f751fd8a49d71c0c43b113c3a1369c7e1049cbef21407c3c603712b822689484cfc0877ff308b9ee5663672928bc8dec57d642a11ad97921255a462
- SSDEEP 24576:lu8m+1zWdoO/vvTLbWzuGWKHiakzLlzi/FW9R8iF7kaiu0qOIPlqr1YRG:A
- TLSH T1AD47D42832F92210E7F79F3C68F0AA2749397D579C19DE8D45411F4E0921BB1E8B2F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3c4a2a3b-5485-4643-a5da-b6b75d217085}_OnDiskSnapshotProp
- Size 6KB
- SHA256 40533db0f99d75dfeda57d0ff48d9d9c5c4baddb721087c57f067781f1128f57
- MD5 b867450becb81918e1c0128ef6b1f2e2
- SHA1 cbba3886883c00d5b786726064c9630d25c32197
- SHA512 38027a43ae5de0c232a106f0e9975f0cb9dc24ea0e7b9725eb1868f6fb6d16a77be29109f64df35611ff6797770d09a880a62a2bb9e0ea9d00a996b44af5b001
- SSDEEP 96:Fqkhdeyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:0gIIb++ZVmN
- TLSH T131D189185AF54311E2B3AB3228F18557A477B911EF33CB8E0198238E6670910F976F5F
- MD5 SHA1 SHA512 SSDEEP TLSH