Overview

overview

8

Static

static

3

TraceX Fin...er.bat

windows10-2004-x64

6

TraceX Fin...er.bat

windows11-ltsc_2024-x64

3

TraceX Fin...rs.ps1

windows10-2004-x64

3

TraceX Fin...rs.ps1

windows11-ltsc_2024-x64

3

TraceX Fin...ds.ps1

windows10-2004-x64

3

TraceX Fin...ds.ps1

windows11-ltsc_2024-x64

3

TraceX Fin...ds.ps1

windows10-2004-x64

3

TraceX Fin...ds.ps1

windows11-ltsc_2024-x64

3

TraceX Fin...ss.ps1

windows10-2004-x64

3

TraceX Fin...ss.ps1

windows11-ltsc_2024-x64

8

TraceX Fin...id.ps1

windows10-2004-x64

3

TraceX Fin...id.ps1

windows11-ltsc_2024-x64

3

TraceX Fin...ds.ps1

windows10-2004-x64

3

TraceX Fin...ds.ps1

windows11-ltsc_2024-x64

3

TraceX Fin...nt.ps1

windows10-2004-x64

3

TraceX Fin...nt.ps1

windows11-ltsc_2024-x64

8

TraceX Fin...ls.ps1

windows10-2004-x64

3

TraceX Fin...ls.ps1

windows11-ltsc_2024-x64

8

TraceX Fin...pn.ps1

windows10-2004-x64

8

TraceX Fin...pn.ps1

windows11-ltsc_2024-x64

8

TraceX Fin...er.ps1

windows10-2004-x64

3

TraceX Fin...er.ps1

windows11-ltsc_2024-x64

8

TraceX Fin...me.ps1

windows10-2004-x64

3

TraceX Fin...me.ps1

windows11-ltsc_2024-x64

3

TraceX Fin...64.exe

windows10-2004-x64

1

TraceX Fin...64.exe

windows11-ltsc_2024-x64

1

TraceX Fin...er.ps1

windows10-2004-x64

3

TraceX Fin...er.ps1

windows11-ltsc_2024-x64

3

TraceX Fin...64.msi

windows10-2004-x64

8

TraceX Fin...64.msi

windows11-ltsc_2024-x64

8

TraceX Fin...er.exe

windows10-2004-x64

6

TraceX Fin...er.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    899s
  • max time network
    555s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 07:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TraceX Final/tools/OpenVPN-2.6.14-I001-amd64.msi
  • Size 5.5MB
  • Sample260816-jsc9bsshpa
  • SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceprivilege_escalationransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in Drivers directory 9 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 23 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 27 IoCs
  • Drops file in Windows directory 41 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 47 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\OpenVPN-2.6.14-I001-amd64.msi"
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:5456
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5872
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 0ACA654DF66CD0863FD2C77EDFF6BA28 C
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Program Files\OpenVPN\bin\openvpn-gui.exe
        "C:\Program Files\OpenVPN\bin\openvpn-gui.exe"
        3⤵
        • Executes dropped EXE
        PID:6080
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1760
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 6969C07A4ACBBD276D1F2B62114B65C5
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1460
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 2ED124935B97413DEC1EB492C9310B9C E Global\MSI0000
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1356
        • C:\Windows\System32\netsh.exe
          netsh interface set interface name="Local Area Connection" newname="OpenVPN Wintun"
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:2976
        • C:\Windows\System32\netsh.exe
          netsh interface set interface name="Local Area Connection" newname="OpenVPN TAP-Windows6"
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:4588
        • C:\Windows\System32\netsh.exe
          netsh interface set interface name="Local Area Connection" newname="OpenVPN Data Channel Offload"
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:4700
        • C:\Windows\System32\sc.exe
          "C:\Windows\System32\sc.exe" config OpenVPNService start= auto
          3⤵
          • Launches sc.exe
          PID:4300
        • C:\Windows\System32\sc.exe
          "C:\Windows\System32\sc.exe" start OpenVPNService
          3⤵
          • Launches sc.exe
          PID:5908
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2352
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "1" "C:\Windows\Temp\0e500d14764f8ee75770139f2ad5648775670ec8efd2e35ed3f485da046b02ea\wintun.inf" "9" "47fc06ff7" "00000000000001A4" "WinSta0\Default" "00000000000001A8" "208" "C:\Windows\Temp\0e500d14764f8ee75770139f2ad5648775670ec8efd2e35ed3f485da046b02ea"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2704
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "1" "C:\Windows\Temp\aa16470d7ceedb295351257ef533fc4898073e49a90cd160361ab8c7653c502e\OemVista.inf" "9" "43119041b" "0000000000000164" "WinSta0\Default" "0000000000000138" "208" "C:\Windows\Temp\aa16470d7ceedb295351257ef533fc4898073e49a90cd160361ab8c7653c502e"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:5328
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "1" "C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf" "9" "4e746adf3" "0000000000000138" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\Common Files\ovpn-dco\Win11"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:5192
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "11" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.inf" "oem1.inf:9ef34515d755ec66:Wintun.Install:0.8.0.0:wintun," "42b53aaff" "0000000000000164" "d1d5"
      1⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      PID:1052
    • C:\Program Files\OpenVPN\bin\openvpn-gui.exe
      "C:\Program Files\OpenVPN\bin\openvpn-gui.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5168
      • C:\Program Files\OpenVPN\bin\openvpn.exe
        openvpn --version
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5016
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
      1⤵
      • Modifies data under HKEY_USERS
      PID:5332
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "11" "ROOT\NET\0001" "C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\oemvista.inf" "oem2.inf:3beb73aff103cc24:tap0901.ndi:9.27.0.0:root\tap0901," "433338203" "00000000000001A4" "d1d5"
      1⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      PID:4076
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "11" "ROOT\NET\0002" "C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.inf" "oem3.inf:c695c3de07ba2b5d:ovpn-dco_Device:1.2.1.0:ovpn-dco," "43b135903" "0000000000000170" "d1d5"
      1⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      PID:5244
    • C:\Program Files\OpenVPN\bin\openvpnserv.exe
      "C:\Program Files\OpenVPN\bin\openvpnserv.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2916
    • C:\Program Files\OpenVPN\bin\openvpnserv2.exe
      "C:\Program Files\OpenVPN\bin\openvpnserv2.exe"
      1⤵
      • Executes dropped EXE
      PID:2472
    • C:\Program Files\OpenVPN\bin\openvpnserv2.exe
      "C:\Program Files\OpenVPN\bin\openvpnserv2.exe"
      1⤵
      • Executes dropped EXE
      PID:1540
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:4724
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1704
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:6104
          • C:\Windows\System32\reg.exe
            "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v OPENVPN-GUI /t REG_SZ /d "C:\Program Files\OpenVPN\bin\openvpn-gui.exe"
            3⤵
            • Adds Run key to start application
            • Modifies registry key
            PID:4588
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3488
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3232
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
        1⤵
          PID:6032

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e59a1a6.rbs
              • Path C:\Config.Msi\e59a1a6.rbs
              • Size 876KB
              • SHA256 0e8d548df8134aeb49fdf2c772cb5681f17c14f65192854734af73178d5e7371
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ovpn-dco.cat
              • Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win11\ovpn-dco.cat
              • Size 11KB
              • SHA256 8c9456aeacd5566234519b5b34ceecd0f7ebb22f6813747e595f5945517ec438
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ovpn-dco.sys
              • Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win11\ovpn-dco.sys
              • Size 90KB
              • SHA256 2c2958dac6f36922ae094705e058bf6470e1622b31318fb9fe0db5457e383f45
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ovpn-dco.inf
              • Path C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf
              • Size 2KB
              • SHA256 1f6c35bc11d910f91c32ea54894d0fddb0094876bdd526d04a9287d04d636242
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Program Files\OpenVPN\bin\VCRUNTIME140.dll
              • Size 94KB
              • SHA256 c51c64dfb7c445ecf0001f69c27e13299ddcfba0780efa72b866a7487b7491c7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libcrypto-3-x64.dll
              • Path C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll
              • Size 4.6MB
              • SHA256 71270ed463648bcbe45829cbc0ce3827faf3267e46d530ae0a82d9bc0c619ec0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libpkcs11-helper-1.dll
              • Path C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll
              • Size 111KB
              • SHA256 e2500ded6e44090f0c76528903269938a029bee206fde25adac040d6e3a124f7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libssl-3-x64.dll
              • Path C:\Program Files\OpenVPN\bin\libssl-3-x64.dll
              • Size 818KB
              • SHA256 c681893dd0c9f86e7f405792dec32adab33cb899cbd3b2ddda533e28f577ab6d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              openvpn-gui.exe
              • Path C:\Program Files\OpenVPN\bin\openvpn-gui.exe
              • Size 1.1MB
              • SHA256 1f07550f3decbfd7c8737694001ee13c26de84ef498dc493d313a79db2080646
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              openvpn-plap-install.reg
              • Path C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg
              • Size 454B
              • SHA256 18b542b3de918da103ea6d79f3be0c5af8349502dc9c673f2db5b6f05dc57d35
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              openvpn.exe
              • Path C:\Program Files\OpenVPN\bin\openvpn.exe
              • Size 1019KB
              • SHA256 89479084f420ca55864c957a689971c327209d9c0e7ea4302df947e7cefff8c2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              openvpnserv.exe
              • Path C:\Program Files\OpenVPN\bin\openvpnserv.exe
              • Size 64KB
              • SHA256 4d7ba182e89f2869b650ac80a34b8f347deb360a3872ee9dca130168b32c87fa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              openvpnserv2.exe
              • Path C:\Program Files\OpenVPN\bin\openvpnserv2.exe
              • Size 23KB
              • SHA256 d1e995a2d32e7833a369aa849e8b877162e07c1a161c6dccb95ca2052fc8b1e7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tapctl.exe
              • Path C:\Program Files\OpenVPN\bin\tapctl.exe
              • Size 41KB
              • SHA256 d5aab270d61d7d1709e85ba81525be5948ae5bf397bb7b12a11e11ba0788ecd1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 599B
              • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              MSI2EA7.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\MSI2EA7.tmp
              • Size 209KB
              • SHA256 8351a40a632facd1f79a1bccfe8e32e88876a23065be1144621533700ecb05ad
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSIB3C8.tmp
              • Path C:\Windows\Installer\MSIB3C8.tmp
              • Size 275KB
              • SHA256 fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSIB436.tmp
              • Path C:\Windows\Installer\MSIB436.tmp
              • Size 281KB
              • SHA256 45e855461f5d1be28a2f88416603070bd1778055abdd06834ae58e97b7ddf53c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSIB495.tmp
              • Path C:\Windows\Installer\MSIB495.tmp
              • Size 143KB
              • SHA256 2738720da0b6ce474ca6eb51a92372d047eca2d713c256f0cd6c147ac3a0db21
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e59a1a5.msi
              • Path C:\Windows\Installer\e59a1a5.msi
              • Size 5.5MB
              • SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dberr.txt
              • Path C:\Windows\System32\CatRoot2\dberr.txt
              • Size 75KB
              • SHA256 bde2a898765b0f92431e5643e27b48070424e34b3619a063de39fac3bdbf8798
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dberr.txt
              • Path C:\Windows\System32\CatRoot2\dberr.txt
              • Size 75KB
              • SHA256 c91e250ebd6513fe453a3a4aa4ea9a0a69e6fb34532d97b2089ce3fd4e0c2880
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              oemvista.inf_amd64_ba3e477187f1080b.ini
              • Path C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b.ini
              • Size 421B
              • SHA256 6d104556af1dd4ea03a3877f6abe705a141c14ef12cacb444aa6336f393f29c5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ovpn-dco.inf_amd64_b737bb7e846ccda6.ini
              • Path C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6.ini
              • Size 420B
              • SHA256 49c88f63243f71a3a4e0e176d8834c6a6dc46e6e4ae2d1a1f50691e5f477d7e4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              wintun.inf_amd64_def3401515466414.ini
              • Path C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414.ini
              • Size 415B
              • SHA256 989b43c6ae55d5d99f2a513c3ed222cd47975dde77f3aee7a215ec723aac59fe
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              wintun.cat
              • Path C:\Windows\Temp\0E500D~1\wintun.cat
              • Size 9KB
              • SHA256 602187e5470ddbdf9421045bb0515f358c88bf88f59fd8a886fb6373da5d0f82
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wintun.sys
              • Path C:\Windows\Temp\0E500D~1\wintun.sys
              • Size 37KB
              • SHA256 eb58bf00df7b4f98334178e75df3348c609ea5c6c74cf7f185f363aa23976c8b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wintun.inf
              • Path C:\Windows\Temp\0e500d14764f8ee75770139f2ad5648775670ec8efd2e35ed3f485da046b02ea\wintun.inf
              • Size 1KB
              • SHA256 44098408ab9611dd99a38e140c7fb1ca5dce6eb2d5f0d5e500547ac1ba5d235b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              tap0901.cat
              • Path C:\Windows\Temp\AA1647~1\tap0901.cat
              • Size 11KB
              • SHA256 ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tap0901.sys
              • Path C:\Windows\Temp\AA1647~1\tap0901.sys
              • Size 40KB
              • SHA256 581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OemVista.inf
              • Path C:\Windows\Temp\aa16470d7ceedb295351257ef533fc4898073e49a90cd160361ab8c7653c502e\OemVista.inf
              • Size 7KB
              • SHA256 1327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              metadata-2
              • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
              • Size 26.1MB
              • SHA256 36cf2bea9b1193d5e494956a96794bf48bfc06c6fefd70c8cab5396cf1a466f6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {31ebf165-9bf5-49dc-a6e0-74337ee2a463}_OnDiskSnapshotProp
              • Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{31ebf165-9bf5-49dc-a6e0-74337ee2a463}_OnDiskSnapshotProp
              • Size 6KB
              • SHA256 d6505dde8a12b37c36dfaa500e0a2254cd7d58fdd0eb0cb3d036bf35f8b322eb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/2472-391-0x0000000000A80000-0x0000000000A8A000-memory.dmp
              Download

              memory/3232-472-0x0000022E1DBC0000-0x0000022E1DBE0000-memory.dmp
              Download

              memory/3232-437-0x0000022E0AFE0000-0x0000022E0B000000-memory.dmp
              Download

              memory/3232-438-0x0000022E1D820000-0x0000022E1D920000-memory.dmp
              Download

              memory/3232-428-0x0000022E09650000-0x0000022E09750000-memory.dmp
              Download

              memory/3232-427-0x0000022E09650000-0x0000022E09750000-memory.dmp
              Download

              memory/3232-447-0x0000022E0D7A0000-0x0000022E0D7C0000-memory.dmp
              Download

              memory/3232-426-0x0000022E09650000-0x0000022E09750000-memory.dmp
              Download

              memory/6104-624-0x000000000A3A0000-0x000000000A3F0000-memory.dmp
              Download