86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
Size 2.9MB
Sample261014-px2elsvycy
SHA256 86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d
MD5 0525a8c7da934bfd281219f13232e1b7
SHA1 44dd95d1fd5475870e812d265b00a9cfbd387f30
SHA512 0ff9b988f04ccd217a0bccecbb32b52a68d56c593cfd81fe204c88b4e2f9d82e39f068cd27e5b91968e8ccff97f073da56712e4bc9ec466ad528d6867d03bbe3
SSDEEP 49152:toAMRFjec63fslZDP0O0Gdk0BQzGaIDao0DAnkTqFvw/cjRAVlXe/6D2LxR:t5ql63+Zzwl0BaGVeAvvwMU46Di/
TLSH
T1AEE5339080E051E3E7ED0A362F6AC0721B46166E47978B09E7357C1FEC23256DFBB295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3068	GafnVpnService.exe

Loads dropped DLL 10 IoCs

pid	Process
2448	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
2448	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
2448	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
2448	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
2448	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
2448	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
2448	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
2448	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
3068	GafnVpnService.exe
3068	GafnVpnService.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5040	takeown.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\GaFN\tray\menu.window.dark.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\tray\mode.smart.win.pending.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.Abstractions.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Diagnostics.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\tray\mode.split.win.error.dark.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.FileProviders.Physical.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\menu.close.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\tray\mode.global.on.win.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Hosting.Abstractions.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Logging.Configuration.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Logging.EventLog.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\bin\service\System.Diagnostics.EventLog.Messages.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\menu.window.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\tray\mode.global.win.pending.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\tray\mode.smart.win.error.dark.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\mode.split.off.win.dark.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\mode.split.win.error.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Logging.Debug.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\System.Diagnostics.EventLog.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\menu.close.dark.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\tray\mode.smart.on.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\mode.smart.win.off.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\tray\mode.smart.win.off.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\mode.split.win.error.dark.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Hosting.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Logging.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\System.ServiceProcess.ServiceController.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\tray\menu.window.dark.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\tray\mode.global.off.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\mode.global.win.off.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\mode.global.win.on.dark.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\mode.smart.on.win.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\tray\mode.smart.win.on.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\mode.split.off.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\bin\service\GafnVpnService.deps.json	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\menu.plane.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.Abstractions.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.Json.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.DependencyInjection.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Hosting.WindowsServices.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Options.ConfigurationExtensions.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\tray\mode.smart.on.win.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\mode.smart.win.pending.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\tray\mode.split.off.win.dark.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\mode.split.win.pending.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.CommandLine.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.DependencyInjection.Abstractions.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.DependencyInjection.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.FileProviders.Abstractions.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\mode.smart.off.win.dark.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Logging.Debug.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Options.ConfigurationExtensions.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\System.Diagnostics.EventLog.Messages.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\bin\service\YamlDotNet.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\YamlDotNet.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\scripts\dotnet-runtime.ps1	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\scripts\install-windows-vpn-service.ps1	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\mode.global.on.win.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\tray\menu.bolt.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.Binder.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File created	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Logging.EventLog.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\tray\menu.power-off.dark.png	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
File opened for modification	C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.DependencyInjection.Abstractions.dll	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3440	sc.exe
4460	sc.exe
5152	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1832	powershell.exe
3584	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GafnVpnService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GafnVpnService.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4820	dotnet.exe
1832	powershell.exe
3812	dotnet.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2448	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
2448	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
1832	powershell.exe
1832	powershell.exe
3584	powershell.exe
3584	powershell.exe
3068	GafnVpnService.exe
3068	GafnVpnService.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	3068	GafnVpnService.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1832	2448	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe	89
PID 1832 wrote to memory of 3812	1832	powershell.exe	91
PID 1832 wrote to memory of 2884	1832	powershell.exe	92
PID 2448 wrote to memory of 3584	2448	86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe	93
PID 3584 wrote to memory of 5040	3584	powershell.exe	95
PID 3584 wrote to memory of 4820	3584	powershell.exe	96
PID 3584 wrote to memory of 4428	3584	powershell.exe	97
PID 3584 wrote to memory of 3440	3584	powershell.exe	98
PID 3584 wrote to memory of 4460	3584	powershell.exe	99
PID 3584 wrote to memory of 5152	3584	powershell.exe	100

C:\Users\Admin\AppData\Local\Temp\86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe
"C:\Users\Admin\AppData\Local\Temp\86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\GaFN\windows\scripts\ensure-dotnet-runtime.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Program Files\dotnet\dotnet.exe
    "C:\Program Files\dotnet\dotnet.exe" --list-runtimes
    3⤵
    - System Time Discovery
    PID:3812
- - C:\Program Files\dotnet\dotnet.exe
    "C:\Program Files\dotnet\dotnet.exe" --info
    3⤵
    PID:2884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\GaFN\windows\scripts\install-windows-vpn-service.ps1" -UseContractDefaults -ServiceBinaryPath "C:\Program Files\GaFN\windows\bin\service\GafnVpnService.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\System32\takeown.exe" /F C:\ProgramData\GaFN /A
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5040
- - C:\Program Files\dotnet\dotnet.exe
    "C:\Program Files\dotnet\dotnet.exe" --list-runtimes
    3⤵
    - System Time Discovery
    PID:4820
- - C:\Program Files\dotnet\dotnet.exe
    "C:\Program Files\dotnet\dotnet.exe" --info
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" create GafnVpnService binPath= ""C:\ProgramData\GaFN\Service\GafnVpnService.exe" --service-name "GafnVpnService" --control-host "127.0.0.1" --control-port 52931 --control-secret-file "C:\ProgramData\GaFN\control.secret"" DisplayName= "GaFN Privileged Service" start= auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3440
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" description GafnVpnService "GaFN Privileged Service - manages the mihomo runtime with elevated permissions."
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4460
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" failure GafnVpnService reset= 86400 actions= restart/5000/restart/15000/restart/60000
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5152

C:\ProgramData\GaFN\Service\GafnVpnService.exe
C:\ProgramData\GaFN\Service\GafnVpnService.exe --service-name GafnVpnService --control-host 127.0.0.1 --control-port 52931 --control-secret-file C:\ProgramData\GaFN\control.secret
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gafn.exe

Path C:\Program Files\GaFN\gafn.exe
Size 8.1MB
SHA256 f0721f9f746fc3812bcac94490792153547ead8584cf9b7f3ff717bf8b1ba72e
MD5 b8ce796e78f4b383de45b4c25aad4657
SHA1 ee05bc0ed4bde9edab64862f7f6a8612a590ed62
SHA512 f6508def1be7a6c22120422ac6b19f4411ddd31c30723886d02d4d1dddf62635f37bb3c75621448ebaf40d97e7d61a354ca082a58e293ede2fc1e86c6ae307ac
SSDEEP 49152:TmmdXV07evBdA+hzBTo1qfYacrta4QWJB2e+SYhdhGLKsu2Fwa6pXbtroIlwrXtD:bqQyYxsB2e+SnC+g6/X+LlaUJr8hxSC
TLSH
T10B8618057F8A6C99D0CDCC70C24B8BA30E1130DB1A36F9AF89D616192F7E6B55F29358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GafnVpnService.deps.json

Path C:\Program Files\GaFN\windows\bin\service\GafnVpnService.deps.json
Size 27KB
SHA256 e57a5fa14206654ef5668388eb41fb9b14c7740f6d6251482b863cd513b6cdbb
MD5 1fadba2d1a12b7545fe6b800defa1b52
SHA1 a2aaab4c266b901a79685554cf23277d0d937ada
SHA512 6528a6593593ab315eafdc5dd777d9683c1ac704da25c374a674f5d38a2d231c4b1848ae79fe7308ce3fc53d167102c5ce635ea1106dd52b12e8b125258787ea
SSDEEP 192:QA6JVc7uV1vLVwaLLV0eBElPzCcTH6oU1z4DlGX0Yeg3FUbXNNWU9I:QA6EWFBBElPzCcTaal1hIUC
TLSH
T17DD20425E8485F634076FB99EDB94942F63943BB2104654A7CFD240C8F76BAAD093F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GafnVpnService.dll

Path C:\Program Files\GaFN\windows\bin\service\GafnVpnService.dll
Size 83KB
SHA256 ddb46b9c892450b7b1711ed14d0a8c802a7aab21bc71a4d633f8b22d7a69df8e
MD5 1a540eb68da2a51b27b0e42d24141d2d
SHA1 cf92a1c850afe31efd6a6ed519271c5dc6980bf5
SHA512 705e0f0b39bf8928405eac61743d1a9dc10c6cfddfa1093b1841768cbf8cd84bfdf48fe816d6e3ca46c5c0707b1b64b60d2b33b187e91b8a7286b312f50661fc
SSDEEP 1536:FWdnrM3ZW3b6w4GLcZljmuafED99IX2AK8W2TQrftx3dmmzPEu534yQttRA+iutN:FqkkcXPLbmmzPEm34NttRA+jnlki/dL
TLSH
T13683184467FC0A1BE2FE2BBCA87056104B76F5566573D3AE0E88709A98B7BC08D11773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GafnVpnService.exe

Path C:\Program Files\GaFN\windows\bin\service\GafnVpnService.exe
Size 148KB
SHA256 9466af979e9143424fc8632e6e9db6118b94aba2233c4e03b83484188d981088
MD5 e9ef1143f3769edac9fc1500089a65e0
SHA1 1604d3e7f00d9ddb2cc4f1d422cf6489d9ec7f86
SHA512 19fc71a3a6869bad472a7096b2a25de26c2d36387b468b756b4fc671683706f5130ad6d03d3436769107c92ee402d9e1d4f5e6fac4e1057f1a4f1a0dfa96905c
SSDEEP 3072:mqeXA/4yIbHkNPN+6H6xCYOiVUE265PJj:mvdHkNFdaxmVEvJ
TLSH
T1A8E33B07E2A851BDE1B7D679CD924D41FB7278598B71A7CF03504AB60E63BD0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GafnVpnService.pdb

Path C:\Program Files\GaFN\windows\bin\service\GafnVpnService.pdb
Size 30KB
SHA256 a24a0d43da01f2daa628bcf246993660f9fc587cbfd05c28b7e27451fbfc39b0
MD5 e0e2ca2546eb780a1664a40c250f44ca
SHA1 4e6d920a6ef98027b7840a8bde78f9fb7d36717c
SHA512 d8698aacac7c45dfb9aee5744a5b0388364150c064768b88c24e028905c6702a34017c806abbef1d39cabfdc9914ff27d16e1e8895e876994c3c168e7f891e4c
SSDEEP 768:1CanW/hWCRSqLZmS98HPxVbnTFp1HWVtDsxj9:n6hDRjNH0jTF32mR
TLSH
T18FD2E72B9789CE12CC27567698A3C048B634C2116706DF73F6DC75B9D8AF7C842B72A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GafnVpnService.runtimeconfig.json

Path C:\Program Files\GaFN\windows\bin\service\GafnVpnService.runtimeconfig.json
Size 340B
SHA256 28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306
MD5 253333997e82f7d44ea8072dfae6db39
SHA1 03b9744e89327431a619505a7c72fd497783d884
SHA512 56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2
TLSH
T114E02664CE006CA701FA727FC531C183EB30632700101891B4FC080C2F775B50112F5A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Extensions.Configuration.Abstractions.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.Abstractions.dll
Size 27KB
SHA256 fefcdb267a73099cb90e5af56b5ef2bca59bed974339b3a6810352bde23537a6
MD5 e1f852e450395bd9cad83625ca41afab
SHA1 8a5c6332c4208e319e648c8850ab709c82efe48d
SHA512 54fd5acaa24c426b42aee7b855b6614c9c1e2676d0f54683d4a2b059db7c9bda70988c6ceb43f488abc34759f575cbdb75c3f0649cf932cf5fa2f53a66cf2881
SSDEEP 384:Hxrv7hVmaET50kv96TG/FwzzRjz6qMvckxGMCWsfNWCx5kHRN78DuNNPR9zbKrQV:97hUaETSkXZp32No8D69zQGF
TLSH
T1C1C26C6953AC9327CCAB1F71F5F1D4412E36E7E27811DA2E589EF1090867B805B32729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.Binder.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.Binder.dll
Size 41KB
SHA256 beac12f7bba4e22cda2acd9ddfe944a4ed56abec414e084edd147bd5dad3c032
MD5 1900efbf41f8bb57151cc942ef2a1222
SHA1 8afa01360292efb640900a6cbcfad40b7f815776
SHA512 eeccb907965099846c684fe1584dab1cbf74f0810ac89806827d85f0f456221fd42f0ec27197e9314a76e3980f3e2ad441d889a6d7af042ac8258207bfec46c4
SSDEEP 768:JrGlacqrCJ6PTbIQG0mVdrxzMBnW+e9z2:Jrf3CJ6fIQG0kxzMFW+az
TLSH
T1E2134B1657E8C326F9FF0BB069B0E4954F76FAA26426D61C5C8D605D0C777808B223BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.CommandLine.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.CommandLine.dll
Size 24KB
SHA256 688ef791d4bb2e84839cfb28ec83772d561d958f6d0b20ca28be1c6efc9ea5f7
MD5 2ebdc0b72eafb372036911dbf7ea1a9e
SHA1 b4ce3f14ddbb8c0188c2f0b2f735512f3789df8d
SHA512 82ae8f62c6ea58eeb54e116e8258db90db55f6c376ef572f52b580194d5974ad66cf1c62b329a322d681a937a4214b67f9b4e273335a90db662f3d7c55bd0517
SSDEEP 384:4+6wnFbhCxwXaHsRJ0eDKfW9/nWCTb2HRN7jSR9zrZV:z6+FN04IcCSJ/i69zFV
TLSH
T10FB25B5697FC4217FDB70EB0A5B0E5452E39AB93AC21E62A185EB10C09B37804F7173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.EnvironmentVariables.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.EnvironmentVariables.dll
Size 20KB
SHA256 797b3034fd173caff0850cd580428a5f4aeb7da27bf03369ad7f2b0996019399
MD5 5636d243d19d4d7506cb8844458c3bdf
SHA1 4575623dc6fc5c43718657e9c775cc2b48830155
SHA512 b2176fa42bb1f20477102a1119adcf7b11c7e85dab1b5e6c937c5dd94d9e3068d8bbed7326d5c7c78a81f4705d3916a9d807e2522db75ea8114c05d52e55fd09
SSDEEP 384:gSz0UpsW+K0ihWQS9WUPeWVC5kHRN7/NNPR9zbKmhBP:gc0ULPUrVD99zbhBP
TLSH
T14AA23B8593BC8202F8BB2B70D6F9D5622C39FBD26811892E155DF10E1C67B94CB61B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.FileExtensions.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.FileExtensions.dll
Size 27KB
SHA256 acf5896d0f34fa1a43295797584b3805c24743ce25ee87538eeec83b012bbf4f
MD5 286b788d46e6b5379db22454b505bb7c
SHA1 43ccaf65099f28cb93716dd9d16f0ed4043b35c9
SHA512 430b62f8d74bd28b0eb1e80a6f956c82a1e57abde6995152cb745a619bdc872aaa2b5fcc0f4b2b5bba35d3b871604f911eeacd21f97d478cbb5cb8542be8ebbb
SSDEEP 384:U1LlqiKysfF+LY9PLIMXABPJqWqH6WIdX6HRN7G2MR9zFTY:kUiTQnwxsstWGn9zF
TLSH
T1A7C25C1287FC8213C8BF1B30F9B4D5465A35A7D76811E56E599DE00819B33C09F72BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.Json.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.Json.dll
Size 26KB
SHA256 15e1262880f263806a2808d750688739662323b20ccd9835222fff8c30899a4a
MD5 38eeb1691c133b414ea2061720c574e6
SHA1 263001a6a631974cf87c908a058941af79f5711c
SHA512 550404cd20978d8607efd5ccfda035f77b48e40a272f95323fe60a39c029d71efdf63999770ad221cadcf1ed5d9630762164533d66b9bd5e9f4146eac35331ee
SSDEEP 384:z6J1o5QgFMvUo0e1l6QUWkWJ2WFYA6VFHRN7aU9WR9zGZzP:k1sFMYhudFClA9zqzP
TLSH
T18BC26C5593ECC327E9BF1F3095B4D9452D39A7C26912EA1E099EE14A08773C08F3271A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.UserSecrets.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.UserSecrets.dll
Size 24KB
SHA256 206cad6a76676e1fe74e12cea23d92aa7ae3eb06217315617f6f267af1383e58
MD5 a01648a8751dd427461fa3fbd8096441
SHA1 f34c91eb09ecd37f35145defbdd6d10a88699919
SHA512 fc1cc0e36ca0b8364c5e06a8433a67ba219e2f52edfea74d104a39de9ab5d50a2864ffeebc53ee2803d799766314d05ac29dfebe7e32a5db030cf1b2e658f362
SSDEEP 384:R/sfDn/NGfzRxL1iF0gzE1L/W9yVCWVYA6VFHRN76l9WR9zGt:8lGlxc8NhFCl6y9zi
TLSH
T145B25B8AA3FC4322F97F0E32E579E4455E39BF969C12A62D049DA00D1877BC4DB31729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Configuration.dll
Size 42KB
SHA256 b5cd9da2c3364a5b201cecb0c80e25227d27ba44d96343d2894ff8ef3fd81550
MD5 ebf181ef6f8cbfdd9149d9d609059051
SHA1 05cd721a76c1afb00df1b6417e6b8b1a7f344e67
SHA512 fa2f59833721fb50500d89ae5a3c8c7474e247a684440c01bd30d46a8962cbcbe8f216d41bba9ebc075ac2e1ee19c37a46d0e1db922db23a3e261b5c68155877
SSDEEP 768:MLJOZTEW1WTsTeVnrI/yqCtHUafO+ukucyOgn9zT8B:MLJOpEQzTp/AX2+uMyOg9zTc
TLSH
T1D8135D5A63AC8B2BC67E0B76F5F0A9451F39D2477912E71E4C9EB09609273C04B1273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.Abstractions.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.DependencyInjection.Abstractions.dll
Size 62KB
SHA256 67fa4325000db017dc0c35829b416f024f042d24efb868bcf17a895ee6500a93
MD5 e61d0a82bb0deab84b3c1e75df6f5b0b
SHA1 f1b7207ffc54183e96ad1da76401f896a030dea1
SHA512 0f3cf57fd108ef397f510e6635dcc16568560c6d40600d80e27d2976d172b3ad8f43bc1970c771ca772090169333139be9ea00118958e1fbd47db395088b28bd
SSDEEP 1536:+DHW/pHp2Dp9edpX0Pnaw2oR7uhQDt8TIg6dKdQ1W6azK:qakQWDqTZ6dEQ1em
TLSH
T185533A6473F8677BCBEF4A70267650204B74BE471043F7163A6AC0B519A3BC84961EBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.DependencyInjection.dll
Size 90KB
SHA256 158761ce778e799949f3a3060c461b1055bb35f1f5a65eff0e42397849f09ecd
MD5 ec9754049bb1b696f4fdda765e55dc73
SHA1 8a06f022eb13670a06138811aa406177867253ed
SHA512 ef8f997221049a3c8faec3cfe3ae62fd689e60b3c675da2b7eb2f9740519a2984ff199e882931bc05ee9c8c884dce09c624e6f3684c7e456172cc7c0f1b78dd7
SSDEEP 1536:HikoH+bvkw5ZSHZrt1xDtSN6A3vMZ+t5TvZdGpNeCWWo/Ep4zB:CHH+bkwU5rW3vJtvZdG6CWx/Xd
TLSH
T151935C25A3EC4B26EAEF1574687440004FB5EA9B3103D74D6E94E4AD1EA3FC14B712B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Diagnostics.Abstractions.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Diagnostics.Abstractions.dll
Size 29KB
SHA256 9864dbcfdbfe395bbd64deec7568fdaf0cbc3850f0cd8f53e7359189bd158082
MD5 8c79f5fbf8ce8eb2dd851dea54735d1f
SHA1 5ad81d2a8e2e0fa8d44a5438edf9d834ec0517ec
SHA512 d4bb78fe5e191a9fbf42b1259d1267e205e5e59c3e6493ec18270dbfeea30e0c617447ef67c2df93e48beca85f995c20a093deb3a52dbcd4ee112001a708c069
SSDEEP 384:tzVZvGPhQTlrYouEsdS+YlOjqm6t4BWOXURWNYA6VFHRN7wsjR9zDmEf:tP+5QqnHNfG8FClwsF9zTf
TLSH
T16ED25C91DBBC9326EDBB1D31A6B4C4411A36C3976800E76E4DC8D40C1A33BE49A71B79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Diagnostics.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Diagnostics.dll
Size 34KB
SHA256 31e08b4e0018ee136d65dfcca8f655a1a74cf8841e6029044c99b2e75d5f59f0
MD5 85093d346f4610957b61ede039e2b51f
SHA1 870bf5320c82e509721f20b1ac541165a4a460ed
SHA512 ab445d141e79d710a2598562217c1a9964404f765eaee7d4788431ba96a24e772f25523ff3f6dd659119fee4ed4b39fa5a7da1d7980436bff5a56c9f109738be
SSDEEP 768:BCuMWVBZb1mpK3/uTYBmJf4zFClZF9z8u:BC6Ip0XWwhiJzX
TLSH
T1FCF24C5AB7AC432AC8BB2EB4FAF0C5422B39C6D36801F7595DDCD0990C677D44622379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.FileProviders.Abstractions.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.FileProviders.Abstractions.dll
Size 21KB
SHA256 f08b1f597abb3647ab6e844282ded763e6078dbef6dd54b9d956ca419fac42fe
MD5 504acfd4f683b6f4859d240c1f6cd749
SHA1 ae54915150997136f132bf61bdd9e7859f56d9bb
SHA512 a05f8507a8830ac33c45942bae06c49a23242f35b4c01b3d677f8fef0199c8cdbd956967bb73374bc52956d3bbfc82d422885800006c644d4c4aea4717287239
SSDEEP 384:ggH8Tv2So+MVV1CMHWs/hWuTb2HRN7TI+R9zJKhJ:ggcTvlGFtr/iMi9zEhJ
TLSH
T178A25C66DFA88362CCFA0E7064A4CD473D3DD7E75801E92E0999E1091EF3B849631B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.FileProviders.Physical.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.FileProviders.Physical.dll
Size 43KB
SHA256 9f67076c79a953f5068c0792114f9722527cfa17ed7414c73fd14833bfe59918
MD5 08ac1d14ad47498891953e40909fe293
SHA1 996492040743ce3af3734e07ed1610a6ab4ff375
SHA512 0a108f138dd52bb47892d836f0d54eeeac00e9218abc02964316e3bbfad25d54b095e4c7d7d676922246ad42998cb37745c7ce9cf4a7e0c30f7742d37d89cb08
SSDEEP 768:/0uMdRozKWWyAWxcnuHeHopdtU6LCxZF+dD/ic9zxz:/PMSeWWyZcnuHeIpdtUxZF+dTiUzR
TLSH
T13D138D22A3EC4317CAFE5BB029B0F5460735F3DB6102FB5E1D59B18A389378457606BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.FileSystemGlobbing.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.FileSystemGlobbing.dll
Size 44KB
SHA256 ed0855b522f09b5a9ddbb85de62042c25e07d10044086da8620c845de41e473c
MD5 470ad714b6cb486c3a64a918e72497a7
SHA1 13583e2627ff47fa64c192d8f91e06c4472e6cda
SHA512 6237af61b1f592fd10692906024fc970cd41f3db971c2a869aed392ad686a904edb19dae81cc247b691a26a7e5e554affdf0853b1e29938d6cea799e20343c77
SSDEEP 768:m0PO7gRE3x5o7UP04wqgYtqPRw02KO7I9Yfwbhgv5NFcEn9zT8n3:m02GE3xOwP04wqgYtm2nQY4Ngv5NFT96
TLSH
T1CC236C55E7AC8327CABE4B78B0F4A0400A39D667B422F34E4E8CF6895C737809661777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.Abstractions.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Hosting.Abstractions.dll
Size 50KB
SHA256 27f074952005f74ba37fc62756690255e5f743ff3f7426fcdeb65a0d6ec9ff77
MD5 4ae388e85a11208237ac6bafe218a321
SHA1 3bf99d2f7efa643bb4cd3b4e2d132539060b4878
SHA512 4b998257efb7689090806f1741adb8fd986e1be424b91e8c9370fbd9586e234449b8f01b634813c083c50b342079c79f050f1183470e45cabf2bd42b182fd902
SSDEEP 768:75xwFYTqU7GjPb6viCMVOm4e+X9CzJ67Mo7tKoV2nwsyQYvZt164yCmi3FbQY9zn:AFmqU7GjPb6axWFvTbQY9hiwzN
TLSH
T11833C64163F85225FAFB3F34B8F891658A39BD56BD34E62D058861DD09B3B80897073B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.WindowsServices.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Hosting.WindowsServices.dll
Size 29KB
SHA256 ff86f44f29d91df5a23ced211f19d20833e689eae30b2cfe023dad191494fba2
MD5 4526216f1669bb5baa83cb88822d9f63
SHA1 8414f35d5dfb034c8a07b479a258f7e6f3e75e63
SHA512 e45075ddfb15095aa2c7758784eb29d96661d55edd8589a0c6aa77bdec76c596b497e091ef70097d51c1f2b3bec36a1a7df0c1e8dec3d709b12324f72b807c1c
SSDEEP 384:Ib+w5ay/tkWwsiIYktF3rqaJ1eeRl9I0W7B+HWvX6HRN7vrBmo8R9zrvpa4P:qNuXYeXknloWv9moQ9zFP
TLSH
T1F8D22A4487B84353EEBF2E70EDB5D6451D39A7865801FF3A0AC8E0491C9B7C9DA3027A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Hosting.dll
Size 70KB
SHA256 22ce5576adec386f12cc92de15b38c85405995b4b0e6f610a00c918a72433f62
MD5 801c62d44095eafb0243ae19a57ffe91
SHA1 d6978dc2b7a3b4628d1d703cb9b365674ddcf0ab
SHA512 273697f7b18cdf1ffe6786a381ff99043657055bd58fb9c971802ee3fcb4059985d2eb10b8bfc8dffa223e5d43d16f9c63258a006bd191f17134ffa694312b86
SSDEEP 1536:Xxfx+lXPSWgC1Rp32bv6bbP75Sjhi09zS:BZ+p6AHlbbPcjh9m
TLSH
T1B2637C5253BC0713DBAF5AFAE8B4555A0A32974BA415F70D1DDDF0A808E77C00B2236B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Abstractions.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Logging.Abstractions.dll
Size 63KB
SHA256 45c22524218541717e4a0ade36847c1cda4921f5945b4975a1c78ddfe023d0b1
MD5 ecebc7bc0237ef9ed6c12b9c6a38d757
SHA1 fcb5492a4880763e727b5a5ba0156db023bdb2b9
SHA512 ca7392ce00dc5bc4a7b16022324a53ffab30cbf62ec73bfba8387667371e6a8f097379b454aa2a308d5b294ea85c8b90e447844c250c19e1863cff0faec17d0d
SSDEEP 768:mz7ouUrbVozuvO53ReiJdelmwSroV4RJJq5OkGkJJQiY2hsUBaIFClG9zu:1uOVozuMRhhq57QeBaUiSzu
TLSH
T133537D159BDC5377CBBE4C75E821D5834BB8D367A402D35B3CCCA428681BBC84A613BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Configuration.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Logging.Configuration.dll
Size 27KB
SHA256 372dcb44f6f9243346cb82db99bb01f27a0f3c8019902481bd45d65c311a732d
MD5 01a8c2ab486e995ee7ca23d4f786c9f7
SHA1 e6a68e5dc64c327efaaf95c88e1c8bc60fc487cb
SHA512 9e6a6da4342fc1ab34ac748ad349a5a6a9f0e87c9a0246321e788ca69d9b4d0d29ee4397c998f66d6dee60eaeeab30e1e95eb02037a4127466b5abc6daba3b4b
SSDEEP 768:2ZiSrZ7HGMjbJbvAcU7dFClJrVXC4dC9zVj3:2pt7HGelzQviTC4dezF3
TLSH
T183C23A965798536BECBB0E72F9F495416E39E7926410F62E1C9DF00908B73C09B3273A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Console.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Logging.Console.dll
Size 69KB
SHA256 d42da097bb5ef92a3eb9889726e5c231bb5d0d4ca7ca7132ed944514d52bec01
MD5 743b9ad9c66c2e44454b71e026ca50d7
SHA1 fb2c2c366bb5c72e1b1e8ce2ffe8f7ab0b21f21e
SHA512 6b548f9d68fb049bfef406fc252c282dde1aafe2110ca829bf8eaf400fe50c998d3cc57dd913e02028c157d4340d1600792754d6c0b8785d5534aeb3a4c4ab62
SSDEEP 768:kwj0b9108ypuuQwXi+uYTql2csO55555+VfF4MMv0nrtrGvAo92h9Hxsk5hIvT2n:kk05uO2csr4UJGyh9Rth9RMiiqzh
TLSH
T114636C161BDC8316DDBF4A74FCB085159F78FB93A902E7A71D84F098087BB848522B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Debug.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Logging.Debug.dll
Size 19KB
SHA256 3b1dc1ada5bfeb19fe4ba5225db9c9950dca250fb2daaac259b537c5d0894a65
MD5 7d6d6d756235e4047ed6056a74ea8247
SHA1 75ee676251ddf351e5923198949b277e551f8d09
SHA512 2ded804c113765fe67f4bb161c52908349bed96e0e96ab228e0642e5bbeaaf4048d4814756d1dde400c2baca75c53345a486e47317b94912eabbc69add2f4d54
SSDEEP 384:zVfk5CuC8P4mjWJIpVMWc/X6HRN7QNbZR9zdVR+2:zJECmg8AWQFT9zQ2
TLSH
T1AA925D919FAC5296ECBB1E70EBF4DA423D3DD7C25811AA1A058CD5080CA77C0DB3536E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.EventLog.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Logging.EventLog.dll
Size 25KB
SHA256 4913c4d4d3837176bcb830a8a76402873ada8c35050a3a93b29be092efddb335
MD5 dac813e8221d059d060e9927798fe6e8
SHA1 aac2bbb9b00f2e3acdaec8e4d6aef2e682add68f
SHA512 87492ed57bc730c27ac4baff9b36a434043440122e8f9077b559d7af23992fadfd52d448038b5bdf87914d1fa3369a5d3481f668dab92134a7fa150cb9afe7d6
SSDEEP 384:sK39j3mWjszWdsJdOBBgCV2VpUW2r4FWnYA6VFHRN7ic6R9zcLHHg/:s290Wd2EBQlKFCl929zb
TLSH
T17BC26C56ABAC631BDD6E0A30EBB5E5413D3DDBCB6800EA36098CFA091C537D45A2176C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.EventSource.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Logging.EventSource.dll
Size 33KB
SHA256 2c043ea968ecaefd7b935255a8db84d5666fb28a791c67d3555a611bc0c8b83c
MD5 88cccaf8c1882c21963f5d4cbcf69a63
SHA1 4234e32312441278653c2fbe28ac1c605e59dd88
SHA512 086b091cb88ed4144fcc5d48849246e26ee7d2713d84056b771d733bd96758e5b634478ab6609a07b51966115f57680c8d2d63f5f5ec7b2de02f704916906a4e
SSDEEP 384:pSupZ5W3lFhrJo6mz8z0TVHprQiWAIczKeG2bhjXK2701rXRNpvAW3gzUWFYA6VW:pSupZ5W1rFRoZXWNQdjOSzFClzUl9zL/
TLSH
T1AEF25D21E79C830BCCEA1D74F674E981053ADBC73421EB5E5A88A5880D737D5972273A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Logging.dll
Size 49KB
SHA256 b2cfba2e05ee89a91e9bc9cf112468a5f4fa05d1a77ea81c131ea656f3d133c2
MD5 973cbb386eeeac6ec135977655f69d44
SHA1 51edce77394f087e71abb47fe86c6092488d13ee
SHA512 14b6cfed2082bd7184118ea4b519fd31b192a6d1b0bbf2d9796b7cf47d56cc9b4a4129e0d1cb15306f244352906a6dc14ffb748d1e745ac471e8d782c9b41515
SSDEEP 768:c4byNvwqX2LvG84aSBWZNSYv6VmTygGPSikiw64yw64pbdez7+Ts7XTfl3l37WqX:ctd2C9aC+EYYbgGB4pmOYlVLWqKzg
TLSH
T1A9336C4053AC6327DEAE1E34F9F8A4450E39D7566402EB6B5FCDB0950CB37D486212BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Options.ConfigurationExtensions.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Options.ConfigurationExtensions.dll
Size 22KB
SHA256 b9ea7bb70bfecf5c649f2559300fce232729257cfdb4221dc96f1ea778227353
MD5 7614fb667570cefa80663bed67a296c0
SHA1 6bc007ef8b70222ff136a7ec4d0b96741ff0a9c8
SHA512 fe26b2af3abff2f966f163899a669d58b916cf983faf9add5d4a1626acb5eedce6d167725c679bdf7068a95e7f9e1f70e8bdff916ff711fb45deebd192de5739
SSDEEP 384:wvKGKA3a66KxTfdzWzP0W6Tb2HRN7A6aR9zrLJ:iKG/L1c8/iA6W9zXJ
TLSH
T1F4A25C559B988313EDBB1E70EAB1D4427D3AD7966810E52B09CEF1480C67788DB3233E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Options.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Options.dll
Size 63KB
SHA256 5e01894cbc0661bacb8ca8f485a40d5ee4e02f28fef58007668a0276431b4693
MD5 18638600345307f00b51037bdf4374a1
SHA1 e8fca245a2b9a21589bfe18526c97c22939abf1b
SHA512 6a15b951c71d03ea49677ef3bc4f0095cb78cf2180e2199422da4497e3e3bc7004272e10ad4b2dfad27948f4c94e843f9617bfe6ddd3fa5bca4cd10bf1618b09
SSDEEP 1536:UahqHoZX+NmzYUGrCUidKHPhwMEbBolCixzZr:UYXfFGrCLQvhwME+l7tr
TLSH
T1C1536C05E7888712DEFF8931B4ACB6620F30C35BF507B76745EDE95429233908E6563A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Primitives.dll

Path C:\Program Files\GaFN\windows\bin\service\Microsoft.Extensions.Primitives.dll
Size 42KB
SHA256 446ff16e903e7479558816e213a3adee9a1c1adad65a56d853801b10933e29d7
MD5 f45226e320f41097397b1ba7468c2d1c
SHA1 1181845c7d16ac4c525eec67ec3a6dcfaa78a433
SHA512 417466f57fa8c6d942be5d86b14da5915d507dfbd7aa8d2700b4dd79a9668897a6a6abaab225be45076bdb8d86ccf4777bb3c699b4002a081e4407604f4e2f87
SSDEEP 768:CKEGbmbB0QERF7v6EtkKS+1ke97a1O33ttBOP7yW5yfyqTuia+15OFyx/iCL9zRv:CpGe0QERFhkKSM7ag33ttBOP7yVfHTuu
TLSH
T132135B52B79C8333CEFE9E34A4A4D1442A38939A7923EB5E5488E4651C737C4873227F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.EventLog.Messages.dll

Path C:\Program Files\GaFN\windows\bin\service\System.Diagnostics.EventLog.Messages.dll
Size 782KB
SHA256 dbfb7c81fb62a0bd3f77da92496640f179e96dd0c1a41a0d3c5d2a2445a3be46
MD5 dcccb11f247d3fe5477527ae58d04a78
SHA1 d9531bdf50e01ef6e282917e89c5ac2518733b2e
SHA512 bd4db6293507b579311506e00c6bf378b8c4930b1483e37eac7c516667f8b66844528c3207ed786307cffe8568485f86f65621a8ef43b70688e97dd7fa89b905
SSDEEP 192:yKir7PFWxNzx95jmHnhWgN7awWrhlXefqg7i1X01k9z3AkZVlb7:yhrKX6HRN7ueR7i1R9z7Zrn
TLSH
T1AB05F6A18F748346CF661870BE99FBF22B3D43C70941942616CAE9543C533B8AE252FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.EventLog.dll

Path C:\Program Files\GaFN\windows\bin\service\System.Diagnostics.EventLog.dll
Size 168KB
SHA256 8343020e3752dc8fae7598816570aa30b041f835412a76dac7f65b229ed9532b
MD5 12b57a03b46b41b6b2b77d5be09e25f9
SHA1 7f566ec6906f1c93ed70a6bc906839b2fc4fc6d8
SHA512 4ac42946774dbe7b49614cf060322729c97e57161719437a18c23a8343d0cd67a64c8b19c37b7894a37f90d76d20d9ba0318aea6031616a895a9ec0d2e5c9016
SSDEEP 3072:QrhmwRaA+Z/TIW5mFQOWWka+EjaVF2QRTI+baf6I:QwNhMPm/Wka+tpbct
TLSH
T19AF37E6473EC4B0EE7FF2B34F9B060558776B996AD32E71D498058AD0A63BC09A11373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ServiceProcess.ServiceController.dll

Path C:\Program Files\GaFN\windows\bin\service\System.ServiceProcess.ServiceController.dll
Size 85KB
SHA256 46328ad334942a6f2b0fd331ee632f06c51eefb2a7ba18ffe264513847e9c3bd
MD5 f6a8a2b0312cc5561f5a571db5871046
SHA1 c24d774d45cfb471730e08a3cd3956963e63d89e
SHA512 10dbc58f11944ddb25ba9906dcdee869ef6b7d8b036b6ee26a6cd4e8c611e3c8a393c5859d653fdacdd674a6836ff24dc412ad713cc37ea44ec8407e3459be0d
SSDEEP 1536:F7PttVwhUdeeIzkSmM7AuFvTb6wsN0pSFWlCz1:FlBe/ISmM7AgCwsNKSFOCh
TLSH
T18483190063F8036AFAFB1F747CB2952209397F56AA35E72D1A84519D09F2BC48A31777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YamlDotNet.dll

Path C:\Program Files\GaFN\windows\bin\service\YamlDotNet.dll
Size 293KB
SHA256 4fa072043bf289f0cbea622ac72c825991c924ad26537c0414699f4fec9a6cd1
MD5 9a4f7e574592e4630287909d508a865c
SHA1 a92bab56f53ea25de1eb3618d64c5186389211d8
SHA512 5676b34b3d68e9a0089eb5a68000a1807c95ee271242ab92083723b2ec65733b36bad49a47fb72de5053d0e72d6f9dc8754505c1459e0c39339f5ae82342990d
SSDEEP 3072:GA/atOZpgZ0DsLsEgfXvbvOVsoiMF/RZdtX6y8V7gFUbybQJQbIqyY9b35EVX4r1:GA/HZpgZdsEsAFHsIU2UVcJES+2N3wC
TLSH
T137543D0373AD432AEBEF67F9F8B0129547B9FC26A0B9E78D1D8594E51C527904A007B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

framework-dependent.flag

Path C:\Program Files\GaFN\windows\bin\service\framework-dependent.flag
Size 4B
SHA256 2e61c33c4194e3b0927bd34aa0b087174c57cf7c7b262822a077cb554fa2ca3b
MD5 5b7fa415f69a387c3c8716063adf57f6
SHA1 557c70aa8be235494ae74e2bdc0103e44331fb44
SHA512 197a3574aeebcbfe1ca8411bec288332a0ddb1f32e207f0b372031cbf310a43e078059aedffb8decc71ba415afb90fae8f259490070157f4198ee980f5487a8b
MD5 SHA1 SHA512

Submit Download

service-manifest.json

Path C:\Program Files\GaFN\windows\bin\service\service-manifest.json
Size 4KB
SHA256 b64850f3a975552676d56828bc95a2ccd2453ab495cabcf59177fc2920436c95
MD5 eafbb6404bf7faa83ecc13f710aba882
SHA1 8371e32200143264254f619b57a17d46f2507800
SHA512 0d262d886cf00f9b0bffabccfd68b74cbb56b0464b2e0fb9bdb7a9559d980b457973b12ac84514847e672be6b2ca923d2496b9a26a64120f564c0e03271b16ab
SSDEEP 96:lRQ9URquh/J/7B1/avkp+Gi1XAKhfUwcYpqcdVG8ljRsHxxppTNmsZQD5JCjsEYr:lRQ2RTxeUys3Qlv5Ve3H4l7zt5
TLSH
T1F1915674ED485A63403AD2C2EEC44CC89A3F43736904B9582EAD254C4EFE7BE51B7A64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-runtime.ps1

Path C:\Program Files\GaFN\windows\scripts\dotnet-runtime.ps1
Size 1KB
SHA256 bbc3add4c9f1c6e1e228a6567a32ee1273a6ea345400aefe1ee3ea6da5d3387c
MD5 d924c172b483399e9417eb2459432741
SHA1 a46c5cc78737607e64f0f8e7895d37c070206ec2
SHA512 65476a2a3e859e4fc31417f11f29ba4e4240d3ddccb5c0bc535c3c811d51995a6ddc560cd62b556a04ab12867d9c010ae99f8be02121073e4a9f9a7ce5b2b7c5
TLSH
T18631521DA88490332ED3725D0B4E188023AF954B1D0A575CB3CD51B8EF62FBA42BC6F9
MD5 SHA1 SHA512 TLSH

Submit Download

ensure-dotnet-runtime.ps1

Path C:\Program Files\GaFN\windows\scripts\ensure-dotnet-runtime.ps1
Size 3KB
SHA256 3d5b3426cdec949d448de5f7e07bc653c023543ad9a2abc62f32153ba499a995
MD5 6a62077d3dc98f3a2a46fa394d54d391
SHA1 43e08da286647f020b70658a009b140c72036f84
SHA512 b82197b49abeff8a19715dadf9347118bb11b64b784d1be973a55eb937ee457653062cca94dc8ff11e73e4a155fc5e8a473f87960bf183eb8e8fd8d8db7d2a3e
TLSH
T15851850EDAD021727D53238F09E901C6F759806F85185A98749D628DFFD247E82E93DB
MD5 SHA1 SHA512 TLSH

Submit Download

install-windows-vpn-service.ps1

Path C:\Program Files\GaFN\windows\scripts\install-windows-vpn-service.ps1
Size 17KB
SHA256 269decee154e471c1305bc1503a0837fde8ad0d93940cef93a7b0f74fa341437
MD5 ede119b484162f68534c7905ee0036ef
SHA1 18e8a22fc7aadf8eb86e69054a9c509192a79a6e
SHA512 74ca1fbb1c71dc3230cc01f7209348fd6d7e5a40b73d01f88c0edc9c86209c9d071f98382810cfbc1c5e136a7eccb439f2e3b029edf6c560d507f788f11c7a6c
SSDEEP 384:94WFiOaPut9vmDRwxFojVFFIxAe6zYiaGXZleqoXsT/:mWAwt9veRwxiV7eMXaGXWqv
TLSH
T18E82D710B7D155F10A83029AED8B911A7A2E405F511D2B10BBEFD2C5BFE1C3E43B62D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service-contract.json

Path C:\Program Files\GaFN\windows\service-contract.json
Size 136B
SHA256 74380d2891330e23fdb7b224d1c8c66deaf7dffe45a99c2acde3fb8375073d51
MD5 c8524adac6a502103d032b7d5e712b37
SHA1 92c38f1d2f916c3a52172239d2f43db2a482a6ab
SHA512 a994a02530ab8a3fdcd173c50663e046228903f46b05007fd07636b6e824fbd312924f716bd661e40908692b07066ba9acfea6ff75277ea1d41439c825b7730c
TLSH
T167C04C7C85A182F602E142892D1355219014F9199199313A5FD31D4921DD96B106291C
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 17f34d7897149287b06ca33013f558427dc5d097f7e88fc780b44b619a03e9f8
MD5 a815ca1f8db17ba495e462b71c4a5941
SHA1 4f8ddffc54dcec0390513e0a1d7be30b84e31f6e
SHA512 ec616eb9202b818fd7544b636d43310f76beebad578887ade754bdbbbdcabe37a083ddf583c5e46da818f61d07bb90a7a7857a18060dfa50f96ae02d4b538c86
SSDEEP 384:X1eB1GMQ1i0GW14bAXjL/+geCDmhGKQjr/5IA/F4Rkughtpdrs/2LvHb20PbhWkG:FeOMA6WiMTL/+dhDOIAN6G/rPzDPbhW/
TLSH
T10B82A768113F6DC7D8D122B411D602FBFBE4E088AA755198FE27CD2F1C90FBB5AA1524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_o1olh5p5.i5n.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o1olh5p5.i5n.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc836.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsc836.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc836.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc836.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc836.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1832-233-0x00000000064E0000-0x0000000006502000-memory.dmp

Download

memory/1832-221-0x00000000057B0000-0x00000000057D2000-memory.dmp

Download

memory/1832-229-0x0000000005F90000-0x0000000005FDC000-memory.dmp

Download

memory/1832-228-0x0000000005F50000-0x0000000005F6E000-memory.dmp

Download

memory/1832-227-0x0000000005AE0000-0x0000000005E3B000-memory.dmp

Download

memory/1832-222-0x0000000005850000-0x00000000058B6000-memory.dmp

Download

memory/1832-234-0x0000000007690000-0x0000000007C4A000-memory.dmp

Download

memory/1832-224-0x00000000729D0000-0x000000007318C000-memory.dmp

Download

memory/1832-223-0x00000000058C0000-0x0000000005926000-memory.dmp

Download

memory/1832-231-0x0000000007030000-0x00000000070C6000-memory.dmp

Download

memory/1832-219-0x00000000729D0000-0x000000007318C000-memory.dmp

Download

memory/1832-220-0x0000000005130000-0x000000000577A000-memory.dmp

Download

memory/1832-218-0x0000000002730000-0x0000000002766000-memory.dmp

Download

memory/1832-217-0x00000000729E2000-0x00000000729E3000-memory.dmp

Download

memory/1832-232-0x0000000006480000-0x000000000649A000-memory.dmp

Download

memory/1832-237-0x00000000082D0000-0x000000000894C000-memory.dmp

Download

memory/1832-239-0x00000000729D0000-0x000000007318C000-memory.dmp

Download

memory/3068-297-0x000001C000600000-0x000001C00089E000-memory.dmp

Download

memory/3584-247-0x0000000007D30000-0x0000000007EF2000-memory.dmp

Download

memory/3584-249-0x0000000009390000-0x00000000098BC000-memory.dmp

Download