11b6efc10d7c3e6ee0ce6d95d9b1dc6f6d164dc342673b44e413ba382ee963b0

Analysis

max time kernel
150s
max time network
59s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JapanVPN-Windows-0.2.9.exe
Size 39.2MB
Sample261023-arssysbh98
SHA256 11b6efc10d7c3e6ee0ce6d95d9b1dc6f6d164dc342673b44e413ba382ee963b0
MD5 b7ab2d9231aed7e693eef3427c1c3cf7
SHA1 5c0d355582360463fb9a1d5e6034490660bc8519
SHA512 b12c9cd047ff5eb360d5cfc65dccc73415acca3919041c1a5f44e105331b3845bd925cdecc67d496928a33f37a114ab53fd3a489b48bbf882e9bc96044622907
SSDEEP 393216:CIvt1WGbDf4klSwYzeEiXPlh6kJ3XK+otFVTLyRrB6jwCVYJVedBolEZd9UkYSTM:LLpYqEQljvotF28cs9NVnShtYDnbyS83
TLSH
T16797337FB28B703DE02A46357973E254943BAB6199024C56CBF5C88CDF215B11E3EA87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery execution installer

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\JapanVPN\tunnel\arm64\wireguard.exe	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-ZU7O79BB67.tmp	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\zh-Hant\System.Windows.Forms.Primitives.resources.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Text.Encoding.CodePages.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Threading.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Diagnostics.Tracing.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\es\Microsoft.VisualBasic.Forms.resources.dll	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-19CR31S4SX.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-OR61VKGG82.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\de\is-WU13POAIKX.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\pl\is-TWCYSKNEVB.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-CQSR298Q40.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-I7ILEZE3W8.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-6X1RMFJTK1.tmp	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\msquic.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.IO.Compression.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Xml.Serialization.dll	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-6EIUY3XSC0.tmp	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Collections.NonGeneric.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.IO.Packaging.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Runtime.Serialization.Formatters.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Private.DataContractSerialization.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Security.Cryptography.Cng.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\ja\System.Windows.Forms.Design.resources.dll	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-JZVWDRZFOS.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-UMSPUDOOMF.tmp	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\netstandard.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Diagnostics.TextWriterTraceListener.dll	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-3AZCJQCGD0.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\cs\is-Z2I3LG65H7.tmp	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Xml.XmlDocument.dll	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\pt-BR\is-S9GAYDUVP9.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\zh-Hans\is-CKE6UXRDUX.tmp	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Security.Cryptography.Pkcs.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Windows.Forms.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\zh-Hans\System.Windows.Forms.resources.dll	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-V9HDYAX69T.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\de\is-98SRQJ7EK9.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\fr\is-6FNQRLIXPO.tmp	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Globalization.Calendars.dll	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-6P1N33M5ZH.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-BDQRCEF5YD.tmp	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.ServiceProcess.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\mscordbi.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Linq.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Threading.Channels.dll	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-91ZVHPXP7W.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\unins000.msg	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-VQO27BYS25.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-1KTYRHDBTF.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-A7DEB9H2RX.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-J72XWMGF3B.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-LQORD50LP5.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-S5ZCQLCX2E.tmp	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.IO.FileSystem.Primitives.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Security.Cryptography.X509Certificates.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Security.Cryptography.Xml.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Transactions.Local.dll	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-R09K1LNBE3.tmp	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-36M40X0Z3S.tmp	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Private.Windows.GdiPlus.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Reflection.Metadata.dll	JapanVPN-Windows-0.2.9.tmp
File opened for modification	C:\Program Files\JapanVPN\System.Xml.Linq.dll	JapanVPN-Windows-0.2.9.tmp
File created	C:\Program Files\JapanVPN\is-MAQJDTCWPO.tmp	JapanVPN-Windows-0.2.9.tmp

Executes dropped EXE 2 IoCs

pid	Process
936	JapanVPN-Windows-0.2.9.tmp
2068	JapanVPN.exe

Loads dropped DLL 41 IoCs

pid	Process
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe
2068	JapanVPN.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 21 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2656	powershell.exe
3320	powershell.exe
4772	powershell.exe
1844	powershell.exe
5836	powershell.exe
6040	powershell.exe
3328	powershell.exe
2772	powershell.exe
5020	powershell.exe
5864	powershell.exe
5920	powershell.exe
3768	powershell.exe
4312	powershell.exe
1236	powershell.exe
300	powershell.exe
2912	powershell.exe
2344	powershell.exe
1408	powershell.exe
3548	powershell.exe
4724	powershell.exe
4972	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	JapanVPN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	JapanVPN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JapanVPN-Windows-0.2.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JapanVPN-Windows-0.2.9.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5488-0-0x00000000004F0000-0x00000000005E0000-memory.dmp	innosetup
behavioral2/memory/5488-8-0x00000000004F0000-0x00000000005E0000-memory.dmp	innosetup
behavioral2/memory/5488-893-0x00000000004F0000-0x00000000005E0000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
936	JapanVPN-Windows-0.2.9.tmp
936	JapanVPN-Windows-0.2.9.tmp
2772	powershell.exe
2772	powershell.exe
5020	powershell.exe
5020	powershell.exe
5864	powershell.exe
5864	powershell.exe
5864	powershell.exe
300	powershell.exe
300	powershell.exe
300	powershell.exe
2912	powershell.exe
2912	powershell.exe
2912	powershell.exe
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
2344	powershell.exe
2344	powershell.exe
2344	powershell.exe
5920	powershell.exe
5920	powershell.exe
5920	powershell.exe
6040	powershell.exe
6040	powershell.exe
6040	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
3548	powershell.exe
3548	powershell.exe
3768	powershell.exe
3768	powershell.exe
3320	powershell.exe
3320	powershell.exe
4312	powershell.exe
4312	powershell.exe
4772	powershell.exe
4772	powershell.exe
4724	powershell.exe
4724	powershell.exe
1236	powershell.exe
1236	powershell.exe
3328	powershell.exe
3328	powershell.exe
1844	powershell.exe
1844	powershell.exe
5836	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	JapanVPN.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	5864	powershell.exe
Token: SeDebugPrivilege	300	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	5920	powershell.exe
Token: SeDebugPrivilege	6040	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	3768	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	5836	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
936	JapanVPN-Windows-0.2.9.tmp
2068	JapanVPN.exe
2068	JapanVPN.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2068	JapanVPN.exe
2068	JapanVPN.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5488 wrote to memory of 936	5488	JapanVPN-Windows-0.2.9.exe	89
PID 936 wrote to memory of 2068	936	JapanVPN-Windows-0.2.9.tmp	90
PID 2068 wrote to memory of 2772	2068	JapanVPN.exe	91
PID 2772 wrote to memory of 3760	2772	powershell.exe	93
PID 3760 wrote to memory of 4336	3760	csc.exe	94
PID 2068 wrote to memory of 5020	2068	JapanVPN.exe	95
PID 5020 wrote to memory of 3560	5020	powershell.exe	97
PID 3560 wrote to memory of 5232	3560	csc.exe	98
PID 2068 wrote to memory of 5864	2068	JapanVPN.exe	100
PID 5864 wrote to memory of 5208	5864	powershell.exe	102
PID 5208 wrote to memory of 5412	5208	csc.exe	103
PID 2068 wrote to memory of 300	2068	JapanVPN.exe	104
PID 300 wrote to memory of 4376	300	powershell.exe	106
PID 4376 wrote to memory of 2144	4376	csc.exe	107
PID 2068 wrote to memory of 2912	2068	JapanVPN.exe	108
PID 2912 wrote to memory of 3020	2912	powershell.exe	110
PID 3020 wrote to memory of 4880	3020	csc.exe	111
PID 2068 wrote to memory of 4972	2068	JapanVPN.exe	112
PID 4972 wrote to memory of 572	4972	powershell.exe	114
PID 572 wrote to memory of 3588	572	csc.exe	115
PID 2068 wrote to memory of 2656	2068	JapanVPN.exe	116
PID 2656 wrote to memory of 2404	2656	powershell.exe	118
PID 2404 wrote to memory of 4116	2404	csc.exe	119
PID 2068 wrote to memory of 2344	2068	JapanVPN.exe	120
PID 2344 wrote to memory of 1496	2344	powershell.exe	122
PID 1496 wrote to memory of 2904	1496	csc.exe	123
PID 2068 wrote to memory of 5920	2068	JapanVPN.exe	125
PID 5920 wrote to memory of 2676	5920	powershell.exe	127
PID 2676 wrote to memory of 1696	2676	csc.exe	128
PID 2068 wrote to memory of 6040	2068	JapanVPN.exe	129
PID 6040 wrote to memory of 2816	6040	powershell.exe	131
PID 2816 wrote to memory of 5740	2816	csc.exe	132
PID 2068 wrote to memory of 1408	2068	JapanVPN.exe	133
PID 1408 wrote to memory of 4588	1408	powershell.exe	135
PID 4588 wrote to memory of 4728	4588	csc.exe	136
PID 2068 wrote to memory of 3548	2068	JapanVPN.exe	137
PID 3548 wrote to memory of 3924	3548	powershell.exe	139
PID 3924 wrote to memory of 1244	3924	csc.exe	140
PID 2068 wrote to memory of 3768	2068	JapanVPN.exe	141
PID 3768 wrote to memory of 248	3768	powershell.exe	143
PID 248 wrote to memory of 5940	248	csc.exe	144
PID 2068 wrote to memory of 3320	2068	JapanVPN.exe	145
PID 3320 wrote to memory of 1248	3320	powershell.exe	147
PID 1248 wrote to memory of 5036	1248	csc.exe	148
PID 2068 wrote to memory of 4312	2068	JapanVPN.exe	149
PID 4312 wrote to memory of 2932	4312	powershell.exe	151
PID 2932 wrote to memory of 5152	2932	csc.exe	152
PID 2068 wrote to memory of 4772	2068	JapanVPN.exe	153
PID 4772 wrote to memory of 5756	4772	powershell.exe	155
PID 5756 wrote to memory of 1624	5756	csc.exe	156
PID 2068 wrote to memory of 4724	2068	JapanVPN.exe	157
PID 4724 wrote to memory of 3736	4724	powershell.exe	159
PID 3736 wrote to memory of 2260	3736	csc.exe	160
PID 2068 wrote to memory of 1236	2068	JapanVPN.exe	161
PID 1236 wrote to memory of 4604	1236	powershell.exe	163
PID 4604 wrote to memory of 6024	4604	csc.exe	164
PID 2068 wrote to memory of 3328	2068	JapanVPN.exe	165
PID 3328 wrote to memory of 3420	3328	powershell.exe	167
PID 3420 wrote to memory of 4884	3420	csc.exe	168
PID 2068 wrote to memory of 1844	2068	JapanVPN.exe	169
PID 1844 wrote to memory of 832	1844	powershell.exe	171
PID 832 wrote to memory of 1716	832	csc.exe	172
PID 2068 wrote to memory of 5836	2068	JapanVPN.exe	173

C:\Users\Admin\AppData\Local\Temp\JapanVPN-Windows-0.2.9.exe
"C:\Users\Admin\AppData\Local\Temp\JapanVPN-Windows-0.2.9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5488
- C:\Users\Admin\AppData\Local\Temp\is-1BBNMSIHXP.tmp\JapanVPN-Windows-0.2.9.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1BBNMSIHXP.tmp\JapanVPN-Windows-0.2.9.tmp" /SL5="$50020,39829236,923648,C:\Users\Admin\AppData\Local\Temp\JapanVPN-Windows-0.2.9.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Program Files\JapanVPN\JapanVPN.exe
    "C:\Program Files\JapanVPN\JapanVPN.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o5ufsmyq\o5ufsmyq.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3760
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9466.tmp" "c:\Users\Admin\AppData\Local\Temp\o5ufsmyq\CSC52B0D160205942E9B3E23EEACD2F3915.TMP"
        6⤵
        
        PID:4336
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5020
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aa1zrjto\aa1zrjto.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3560
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE55.tmp" "c:\Users\Admin\AppData\Local\Temp\aa1zrjto\CSC5960AC0351C74952A75C7E2CFEFB314.TMP"
        6⤵
        
        PID:5232
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5864
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\10xhbso4\10xhbso4.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5208
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD20C.tmp" "c:\Users\Admin\AppData\Local\Temp\10xhbso4\CSC6831944C65884F8BACE69D396B5FCFD9.TMP"
        6⤵
        
        PID:5412
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:300
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kel2p0qd\kel2p0qd.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4376
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE526.tmp" "c:\Users\Admin\AppData\Local\Temp\kel2p0qd\CSC2E2BA3CFF17A47098B87A37781B8E0F4.TMP"
        6⤵
        
        PID:2144
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2912
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\adj0frur\adj0frur.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3020
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF9C7.tmp" "c:\Users\Admin\AppData\Local\Temp\adj0frur\CSC257DC4D0504D4DEDB4646CAA7FF733B.TMP"
        6⤵
        
        PID:4880
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4972
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4rqjzcm1\4rqjzcm1.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:572
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA4.tmp" "c:\Users\Admin\AppData\Local\Temp\4rqjzcm1\CSC945A76DC3B8A4F028EA18D54AB5C1219.TMP"
        6⤵
        
        PID:3588
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f0mgqhqp\f0mgqhqp.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2404
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FED.tmp" "c:\Users\Admin\AppData\Local\Temp\f0mgqhqp\CSCFA4811E29881486495847DD9F2D46D3.TMP"
        6⤵
        
        PID:4116
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2344
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\31xtilyy\31xtilyy.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1496
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES345F.tmp" "c:\Users\Admin\AppData\Local\Temp\31xtilyy\CSCB37323C29AB8420FBB7526ECD58D53.TMP"
        6⤵
        
        PID:2904
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5920
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ufnqzs0q\ufnqzs0q.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2676
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4807.tmp" "c:\Users\Admin\AppData\Local\Temp\ufnqzs0q\CSCD9333EFE212E45FEA550119BF641EF4.TMP"
        6⤵
        
        PID:1696
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:6040
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\thwymnsp\thwymnsp.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2816
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A95.tmp" "c:\Users\Admin\AppData\Local\Temp\thwymnsp\CSCE531C62C2878432DA0B3A942EC53288.TMP"
        6⤵
        
        PID:5740
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1408
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kkmydyet\kkmydyet.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4588
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EB9.tmp" "c:\Users\Admin\AppData\Local\Temp\kkmydyet\CSC37A98FC3EAA348898DFBF39F13BE56F4.TMP"
        6⤵
        
        PID:4728
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3548
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ggaylou1\ggaylou1.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3924
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES828F.tmp" "c:\Users\Admin\AppData\Local\Temp\ggaylou1\CSC483C6CF283D941739BFB8A5A9DD95CB2.TMP"
        6⤵
        
        PID:1244
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nympqiwl\nympqiwl.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:248
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES959A.tmp" "c:\Users\Admin\AppData\Local\Temp\nympqiwl\CSC4761881CE92B4330AC18AA7C14EA99F3.TMP"
        6⤵
        
        PID:5940
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4u14f5rt\4u14f5rt.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1248
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA8E4.tmp" "c:\Users\Admin\AppData\Local\Temp\4u14f5rt\CSC2BC763DED3974DB9A44CD32E26482DA6.TMP"
        6⤵
        
        PID:5036
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4312
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2ydpbq10\2ydpbq10.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2932
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBCF8.tmp" "c:\Users\Admin\AppData\Local\Temp\2ydpbq10\CSCCB965D90AEBE40228D4968EE51177DF5.TMP"
        6⤵
        
        PID:5152
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4772
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dagmx2tu\dagmx2tu.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5756
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCFE4.tmp" "c:\Users\Admin\AppData\Local\Temp\dagmx2tu\CSCE9E2F5A3399149108E1D22317819B1F4.TMP"
        6⤵
        
        PID:1624
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4724
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t4sm23ly\t4sm23ly.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3736
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE37C.tmp" "c:\Users\Admin\AppData\Local\Temp\t4sm23ly\CSC47BC5FFCF2E54CCB8D306E9020C4BC1C.TMP"
        6⤵
        
        PID:2260
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1236
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x0fkckgi\x0fkckgi.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4604
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF781.tmp" "c:\Users\Admin\AppData\Local\Temp\x0fkckgi\CSC9E777FE7F9D242B9B42CEA3A24ADD6.TMP"
        6⤵
        
        PID:6024
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fpb5jign\fpb5jign.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3420
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB18.tmp" "c:\Users\Admin\AppData\Local\Temp\fpb5jign\CSC48F5B92794C41A9AAD7E2764CF24BEF.TMP"
        6⤵
        
        PID:4884
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1844
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ule1sn2z\ule1sn2z.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:832
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1DF4.tmp" "c:\Users\Admin\AppData\Local\Temp\ule1sn2z\CSCEDBA882E716544A790299CFDA2D3FE63.TMP"
        6⤵
        
        PID:1716
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\JapanVPN\JapanVPN.ps1" inspect -WireGuardPath "C:\Program Files\JapanVPN\tunnel\amd64\wireguard.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5836
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i5d2iulf\i5d2iulf.cmdline"
        5⤵
        
        PID:504
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES31CA.tmp" "c:\Users\Admin\AppData\Local\Temp\i5d2iulf\CSCC8668A54E0F4B3A9987E3A99AE1C4D4.TMP"
        6⤵
        
        PID:4448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Accessibility.dll

Path C:\Program Files\JapanVPN\Accessibility.dll
Size 20KB
SHA256 8a445cfd0d566a0bfbebd30ba3cd1bab449c73f22f40dc4aba499bf96a2f0850
MD5 749a8afd67af39fe3d3cf71f9f41ac9e
SHA1 65ffa0324cfdf3cee1f8ae18807ad10e80c7a945
SHA512 94c4a7f012e68b81a4c9c9f2d0f064a56cc2f65436056ec94d2cf04f08e9a77c59ff166ddfefeec360a407d0460219479b49e792de28b9c561bc425e2beed053
SSDEEP 384:iqBmy0h68SGRQOcHiDW3/WI8ZlN9rj/R9zRbC:MOHOcH1yrjZ9zA
TLSH
T14E924B83F658A152DCAB6AB16998EA063F39E3815912CF27185CF24D0E137C1CF62739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JapanVPN.deps.json

Path C:\Program Files\JapanVPN\JapanVPN.deps.json
Size 31KB
SHA256 31e71caede9c5a728e3f46fc500ff5aff6baa7083fdc617000a7d7c57830f3ce
MD5 e00b611b22a42112d295038fd498c887
SHA1 ef73b0dc6803ceb74f3ccf138296c24ec59beb3d
SHA512 852750e829fd7cf6f46b474b7f30391576cf56b99fc7de030ddd4cbaa8989fc128c83774ce89ab0b56d592c42d39e6eab6e6a3071f531cbfcc1b132f0883b5ce
SSDEEP 384:XnUgfpazhsVvw+MfV6UfwH4f4mNo421nxPqM5N7UP4:X4QwMDy4
TLSH
T159E28327CA604AA6083593E678B996F4E365032F3045084EB4FC381DEF77B7A0759B79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JapanVPN.dll

Path C:\Program Files\JapanVPN\JapanVPN.dll
Size 284KB
SHA256 c6c54bf1049549cc431469ce101a83e31dba58a493db5105e44112d685fbe6eb
MD5 fe58ea5225d14c9b24239f6049508a44
SHA1 1c1694bef9c727e0311b1733c376f6429b6e13aa
SHA512 069204fbfe174008cd318e157544d6fd7b7c8e5bfed2f70f3a55d89c5ea6bc9bcf0c3f9e98faabc214715231eb2691625a30145216ac77d09a4222b3613fd895
SSDEEP 6144:Byhnmt1UlY162ChvJ6kUtobL41kAtTOhLJ6kUtobL41kAtTV:MhGQvJ6kcoH6tNULJ6kcoH6tNV
TLSH
T13354F15077EC551BEABBAB38ECB15005DE3ABA271560D25C355CA1CC2FB2B80CC617A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JapanVPN.exe

Path C:\Program Files\JapanVPN\JapanVPN.exe
Size 257KB
SHA256 5b4b5cb4f61bbf8097777a1db34c73fef6a02a148b739b9b1882f3377b2e1ca8
MD5 8d3cccf3810708e86d9bbd61d9477c96
SHA1 e0a8c04a557164f94a83478c56f101b30f19dee3
SHA512 dadb0da846f7cff77c5d5b1fbebf456bd636c4c2caf112d0f8f18b86a39256e868fff5c6ad82ffec2c880fd56da67a990abe1d91fd268c105a3cfdfaaccaca63
SSDEEP 6144:zHRu7F1nQnB8KK8DhDJ6kUtobL41kAtTY:zxOF1JKbDJ6kcoH6tNY
TLSH
T1B8449F13A7A851BFE1B3D639C9928941FB7278564BB1A7CF03504AB60F677D09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JapanVPN.runtimeconfig.json

Path C:\Program Files\JapanVPN\JapanVPN.runtimeconfig.json
Size 529B
SHA256 2556f3e7cb7f562c3139a4c08ea55a28fba36f396a1ff2e49f1aa66aa27adaa3
MD5 7a0e9a0fb4b5b61795e200373b9cb0b2
SHA1 00ddf5e6be1c655277d98cbc213582b3546c0427
SHA512 29ae2068fcec4a59926c44b7a1d7e4a00b4651f76ff13c6d78f674d9e821cbb683d9e63f004aa6d31369324c1e0df01df3ef85c3769d88060eece7a67f29643b
TLSH
T17FF0277ACA107D7718B57379D536C182EB30572B50041D82B9FC0C1C6F776B61212F95
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Win32.Primitives.dll

Path C:\Program Files\JapanVPN\Microsoft.Win32.Primitives.dll
Size 15KB
SHA256 6c21472b0ae2f9b484a97614fad5485a22f18f9f19ee1adb9ceb3ed8ddb072d7
MD5 1133e0c426161c2b805743358b6c59c5
SHA1 6080b7c514416722d893866568db633df1025d3e
SHA512 b65766bc590e76e8f1b08df94d4b7a249a9ad0da414a74b4d71f0d4487d7bc15d5729858d57004e5647deceb7a2082e5b26b31e156fd423a4085fe8a2cb83263
SSDEEP 384:ZWv2dF/GuVDKWh0pWImZlNUoxR9zxVaOo+:EvKGuV+o79zTU+
TLSH
T194624BD2D72C8107EDE7AE70AAA5DE833C3867C74D509A5A1595F4091CA33C1EB3163E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.SystemEvents.dll

Path C:\Program Files\JapanVPN\Microsoft.Win32.SystemEvents.dll
Size 113KB
SHA256 78eca75a0ddacdf6015f5414f9fee56a970f9f21b94b1c6a0e5dbb974ae8b48b
MD5 242c40c10fc351e3e32fedce8d6d9b0c
SHA1 89c55591a03d6a1e8921052811cfe254569b0f26
SHA512 e115df1cb7f1fd6f5d019777012bb07c5ceaea5c6e969df329a435d4234f6d0265f17a5d4d0e7b89a01cd53234051c438656ba4772e0a9919148debf8964958a
SSDEEP 1536:ISCJY+bLqTY4W7BeNLejX/tDlZsWhdcf1TbUcBIM6ey24zCJ:IXp2WledQXZQWhdc9SM6ey242J
TLSH
T168B31C1173E80614F5FB6E36A9B25911893BF892A731EBAF0085449D0F72FC1EA75363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Concurrent.dll

Path C:\Program Files\JapanVPN\System.Collections.Concurrent.dll
Size 225KB
SHA256 082f4bc0da1141eb65111b6da633d75624adfb7bb067d7ee90c5622c8b30885b
MD5 8dd5db3429385f9030d89215cd14d361
SHA1 f9caa43aa3b381fe76b193db568d8a5b0af5f2ce
SHA512 007599253418fb63db724798c9c734bff5cd51052519e0d596a8b78becaff9af5ddcf03a750099f27aa93dd932ee05874afd33ddfb17bdebe01d4e1ed13e97ed
SSDEEP 3072:G4Lq9jhKD6tVDNKTs4Vzof/HQLvB76qSa2ymYQraEN7Azg902iN+sPxNnUnZGAzl:1q9jY6LUTs4eQV76qOc28NnUnZGAbV
TLSH
T1DC344A16638C0B93F9AE463D95A3C5039733A55B1312D3EF13E8A5841EA7BC17EBB112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.NonGeneric.dll

Path C:\Program Files\JapanVPN\System.Collections.NonGeneric.dll
Size 101KB
SHA256 aa4d5216d066c91cb489f63c6cbfcaf1f47b6e74e070db45639d3460454fc60b
MD5 4a7454d14f15d1c2fcee4bca9abc9e97
SHA1 006266f12c2e7cdcb95bd5fafecdd5cc25162890
SHA512 e89acf1cd5149390da5cc0c0567b0eb0f52fc96694e6d605d07fc027debca44bba4946c587368f2e2a362ac5a713b7109dad71a9d2a2cff7deb75f8552d2a833
SSDEEP 1536:mIZCdIo/uGITwigm/gF79JjI1RHPFvbWDySjzji:mFdIo/ulTZgm/0QRHPFvMlj3i
TLSH
T118A3382D739C4722D6AAA2BC90978906E370F5E32722D6DF5008548E1FA7BC1C6F3167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Specialized.dll

Path C:\Program Files\JapanVPN\System.Collections.Specialized.dll
Size 101KB
SHA256 e31af1f866e880844e027be59f545b9a6b34108e0b0680ebe3fbc19a53070819
MD5 be26cbfb9706c8356a565ebc1c883b18
SHA1 56ae2c4ae35006a3b78757d642738f252ed87333
SHA512 c5560a1acc6c5c0cb33294bfeaaad3df60ad8c248f3524471d788895db1daac1fb92710780069d24a8eff2dcfcc6b2939adb9cdce1342f387e0451b956fcecf4
SSDEEP 1536:7LY1yipoBwR72GUFFDE3A0giv9EywNwjNYlDurBXzxGz87Q:7L8poOR9U3MM4jNYlDurBXFGY7Q
TLSH
T1D4A34A2873CC8B20CB7A92FC91A38942E774F1D31752E6CF594894496E977C0867B26F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Program Files\JapanVPN\System.Collections.dll
Size 289KB
SHA256 df6f2037eabee28100184e92f7536427ba2f086c1110629804d466b124bc4d54
MD5 e4d11024a5af2fa5f6cad5b53c6d7dc9
SHA1 63b20f606535fb168f6d16a394295d513c778638
SHA512 7aef97f0a656d424aa7ff4f87b5177952f71d982eaadfa05a3089533ad4ef5661f4a88e03303bbfffad54c4c1f53d2939efa50a641c4e2cc6605fb482eecf8e0
SSDEEP 3072:43UwvuGeTbinDHdY81uFqzK4s2QMsf0r3p9dJ2SAmnp8SFK0gwsDim1OLI6mFkeU:m0G4ODj1Fe4eL8ph2wC0acL+1U
TLSH
T172544A1873888725FDBF41BAE593C122E1B990938350A2CB47BDF6509FDFBD12AB6015
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.EventBasedAsync.dll

Path C:\Program Files\JapanVPN\System.ComponentModel.EventBasedAsync.dll
Size 45KB
SHA256 cc84fe814ef5e58271d83193e328f8ec220efd4696d90af9a7c4690c10451495
MD5 1b610bd3fb571350aae3bac5e468c298
SHA1 38624afba6782ee92253fe8ef836af045448cb1d
SHA512 2fcde72cb7fdb9f54f58ac954930bc6484597b9b278cf383581658f24cebd3e1290a43b5ca45348b647e71a4b17d9da6e4cdfe61c03b831cca88693841edf498
SSDEEP 384:r6WnwWIJB/eNRYdWBFEWmsZiZHlRq1bVMyQmXDX6O88+aEZ4j5wVtNFmK8Efc1Ek:n2vjF41F8IVcF8EEwArjZ9z3D
TLSH
T1B7235AB1439C4232FA671A7DD2A28E229A78FB8A974297CF1454D30D1EE37D1837216D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Program Files\JapanVPN\System.ComponentModel.Primitives.dll
Size 77KB
SHA256 1e2451184c287409ea25acde3c90f25950bf34d16458a6e52a94ca4292434f62
MD5 4af300956d79f83956749a2a5c330bf1
SHA1 7e83fdd37997723687e3303e1a6714374544556d
SHA512 a95eb050258c608d944874c69b7f302968c26696bbc004c910d8807d80f4dd9979bccbe790be574593adb7e88eeaa164ad2f54da2d85dfcad4802d80bec64271
SSDEEP 1536:EyRLdlpyxFkIkSyypSM2VLIGOYu2nC248tL1zR:EelUxFJVy+hgLVO52C24m11
TLSH
T178734A1813E80319EBAD567C96B399109570F5871323D9CF8690D91E6F8B7C2F272A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.TypeConverter.dll

Path C:\Program Files\JapanVPN\System.ComponentModel.TypeConverter.dll
Size 749KB
SHA256 10dae312a6697718f8ce3dfcdb17d6ae4b74687c765d74d50de8a8e69e08f5e7
MD5 4a2401fabe7fef5706167189ac1ab9a9
SHA1 a0ef133762da18afdf328c3370741800d26b281d
SHA512 05770c7db6206f593141fb7f7062c88a46cc8794991e6158c51d7f3258eeafc320066a2121b67f30bf43520b0bef0f35719c825eef87acae2a0ded870f9493e0
SSDEEP 12288:wcYuiFN1PMRRlkR9Vfyo+/9e+/yP9WD4Tq0WbL2/q8m5JK+4rBvq+IQYVXilgG1d:Mpul8dr+/9e+/o+mq0WbBZ4rBvxYYOy
TLSH
T175F47C19ABD86931D7BF82BEC6230912D171D893A375C6CB2694DD852FC37C0A2B1772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.dll

Path C:\Program Files\JapanVPN\System.ComponentModel.dll
Size 29KB
SHA256 e3b6f75864ee944898540937c1f300e04f44a1b2729516f0bbf948589a8b14b2
MD5 6758fd9716b2c25d3480ed110d6fb40a
SHA1 1a9cb96c2f175423b95b9208fd4dec12915b17b6
SHA512 3f0c463b3b29b20407e6bedd960a213152bc877adb5a7479dc0fbf9e7ba4a4015f189f1e8921354e4a5eefca5e2cc9cee47b761844061981a518ba7a2d664a2d
SSDEEP 192:gW31WIfB0GMB1SY7+Avx4PYN9WF+GBTBWsea8WhYvz5j4HsX01k9z3A7kweZsw:gW31WIfB0G4Sk+A4PYmlN4PR9zCIv
TLSH
T117D25DA6C7A88202DD964E709BADDA437D3CB3C59E02866B0296F54D0D53BC4EB3153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Console.dll

Path C:\Program Files\JapanVPN\System.Console.dll
Size 165KB
SHA256 3b85daf02a3d9ed99b84bb1c639fe8b1ced46d8d157fa56f525f6b8c5be43b3e
MD5 1efb4df998fcd49aecd4c493ecb5293a
SHA1 fbbc7d94f7585b1d2efcd877f2601459498eccb5
SHA512 2c23d666a8799a69d09ab065e8299f7d65af862fba88aafeed97067538af704e953354275d4e1dfb49bc92f1c1be112bca23199aa2a7c49129413401bed89651
SSDEEP 3072:s/J8LvmBrfHk4xul4nhu7v9QglEXRc47TU:+fBrfDxu829kA
TLSH
T1BAF36B2A97DD6527D77F86B845930701D733B8A60306E6EB418188981F93BC3FB716A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Common.dll

Path C:\Program Files\JapanVPN\System.Drawing.Common.dll
Size 901KB
SHA256 2e4785b9ce61bb16c90b9be94894e61ae8672afdc137f1b0f4e64c1de8bd1639
MD5 5346960b95b4e36be0b7e95da949191e
SHA1 71250fa59a443e67f8126fbeba3d8c33f29ced87
SHA512 54afd7fb6060d78eb7857284d4186deb2ef9b34e52cd2b4991a2849e61d60010980093f167d74e51ae2c5d92c2e176a808283e12c604fb0753b5a4e511120cff
SSDEEP 24576:uZjiE3Q8vxVDAFYNqK/AkWXQEzNQVTYwgpb:ukE3Q8vxVkzkWpzNQVTQF
TLSH
T1DD156B27A3D40E16D92ED2F9D18B4812D631E4859722D1CB0984DD793F47BE3EA3B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Primitives.dll

Path C:\Program Files\JapanVPN\System.Drawing.Primitives.dll
Size 129KB
SHA256 17585b32ca91bac8ccff2ef1c6ddf62ee9ea5efc552928c3a9d1b868394246e9
MD5 caa3b3428771f391736240346ec9acb4
SHA1 b4b46c7d062ef3c43869c32beda9a96578c35834
SHA512 0ff1d0cc80c252a522a1182ef1ff71320329e8aafd9b6db3f62b92d59d39cfa45bb5802949042e640104fd2ab4e5548fe72d664563b337cf94d1d6afa1b75b14
SSDEEP 1536:DI20lprkER8jX5hXIT/9p5Qnl5v4fiBSwEAlXxApxVr1aC2RL8lUpVVNVBYzV:DcprkS8jX5hXIT/azoiB5BiqRLr7TAp
TLSH
T11AD3396AF35489ACEE79527C62A75477CE39F1460312D0DF8886448C9F12BD8F6B10FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Program Files\JapanVPN\System.Memory.dll
Size 157KB
SHA256 f8f9d38efd6b0de30954d6bf1f353e9617bfb36d3d245c013a3b12be9f6bd88a
MD5 e4713f24bcf42de027702cca61edb548
SHA1 61d84a84b8b2bbe1492875afa6714d4ae36ad7f7
SHA512 adf6b577173f212889cc34c0ed1e90fd833a2e9b8f723ea2705b01658be9a8b1bb29c6f96855c2c5425c5e3bb2d8a633fcf6ce9c085d2ff0b2f88a9f5fd02de0
SSDEEP 3072:mcbIWUQJ8tT49EggVul1co8s2pwaGrpXDXPjT/hd7b4y:7kMhpV6waGrdPH5d7N
TLSH
T1F2F34A1BD3980227E92FC6BA8B5AC602EF337515D30191CB44D4DA486F53BE1BFB6522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Numerics.Vectors.dll

Path C:\Program Files\JapanVPN\System.Numerics.Vectors.dll
Size 15KB
SHA256 a9a980ee33ed0c798a5e1960c4557521f465ac9e0987dfd2c3049d53b1f2fa5a
MD5 35b501eef9ca053a61545b5372f256ec
SHA1 b6e069c3a847c0d6ef53b4776cf390d65a4238bf
SHA512 e829948795a43c8010c3fc3d1b69ca629ddcdb75c9660a06de238ab6312e31070f00f21b43483fe9e53a4c9d29d997b24b6921319b38a0136c952c4a5d23b85c
SSDEEP 192:evvpijxzHzWdBWI2WCWKie1BzBWseawWwJqthuFwleX01k9z3Asq6c+s8J:evvwzHzWdBWI+ZlNXUwleR9zjq6c+sC
TLSH
T1C0624992DB6C8257FD976EB05AB4DE833D3CA7C64C52966A1599F1182C233C0EF31638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Program Files\JapanVPN\System.Private.CoreLib.dll
Size 15.3MB
SHA256 1125acc8106c43fc8bad2d203c4c4485df6182d292846c2fff415c1040c54678
MD5 65ab87caa6fad6300656a7e67ef90880
SHA1 53d3543dcbdbcbe877a4bde23163b23432b07dd2
SHA512 160b7e2880aba7011463c768a67f5d44c3816f2979ec5830a1f6393bbfa8ba2bd4cdbe1f483f5232b6a06b08645f2856c9a1a757081c724cbb44257d6752d3a1
SSDEEP 196608:nSB8Fw8j0czR1GXgmFE8TROH0nhg6pf4u7Q7RoVsC6YSKFpUjq:SB8FjFzR1tmFE4OH0nhguff5PN
TLSH
T10AF6AE10D3D88F5AE13BC77C8177C626EA71F892532656C70595EA883F23BD0633B6A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Windows.Core.dll

Path C:\Program Files\JapanVPN\System.Private.Windows.Core.dll
Size 1.8MB
SHA256 1af707e6489ebe4847651b2820c858b77fe2c08995831678b4c631aea23e9978
MD5 022a5d27612d082336d9d9a21857daa8
SHA1 6c6d117d7a56a9630fcdb42524bac78cf18c6a94
SHA512 b8a392ed6f4cf38d39848e149398d303406c4269ca09ee2214a24baa228dd079c5f90d8d1e651d0bdab61501f885e6ab4b7ca1a6cbdc1351a9c15de8680f1e3d
SSDEEP 24576:N0tAqckTTzTmoyi9X6KPucrhs4Dcl5KGgXV+ldGK+Th1IuqW0J774:ozTmti9X6KPucFnWGK+Th1Xqdo
TLSH
T19F955D14AE4A7798FD1B897450634640C1706A8763A3EFE740C5F8942922BD3EFFF1A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Windows.GdiPlus.dll

Path C:\Program Files\JapanVPN\System.Private.Windows.GdiPlus.dll
Size 417KB
SHA256 59efe4aecd13b14d210af5d5c3c372b67fe39e862485f9d5a8d213096741e5f7
MD5 f6cf43c13974e5bc4fe37b7f7f755853
SHA1 7934cb95c357bbf00f14e51583dc77f0bd820c1f
SHA512 835b926416a2665eac0bf1ab88d080fa4dc3a62dcdc453df06b49da354c8957682b0f57168da92e10f45135ace91d9f7aad1ad0384a0cc2904f073a943a670f3
SSDEEP 3072:QlArkmADjoC/q8VLuU2N3v+bX85DvITRuXo8VxIkOy86hx238aO8nT+DOtZKv+QQ:yrDjTJGusdAT13HLX5KE
TLSH
T1259485257B011529FB3BCE79868A9940C2607D1BB792E9C742C14D867B73FC7E336682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Program Files\JapanVPN\System.Runtime.InteropServices.dll
Size 109KB
SHA256 e5eb1679f3579c9141e2bb9dbdce62624a623f38d299805cc1de07bacd21841f
MD5 eb8efe51e4b0c08806c481396176a639
SHA1 40f678ddaa3d9d0be2d76910a73beb7b7e5e8db7
SHA512 8d7bf648fd701603d1ed86a09e58291f2e43b646fbfec1e1eed23a8b33be3c1bb2a743d3bd17412f4b7d5226b23e9593a2d910914b5c0fd958b444e641b4d46e
SSDEEP 1536:6QCquAttQMxLPQtvC+zucKb2EW4udNY/w2yVvOHugu94RHPXF20g9zwn:6QCHStQMZ4vg2E5udNY42ypaugPc9sn
TLSH
T114B328207BD8863ADA5A87389C336D10CDB3FAC65322A2CF4584849D0FD77C567727A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.Loader.dll

Path C:\Program Files\JapanVPN\System.Runtime.Loader.dll
Size 15KB
SHA256 9b9b2a4f0358d9146e76178ddb87d019be380c78baa7dac853493d45df089f03
MD5 c449d2ff082febedce8cb381c7466dde
SHA1 6810d3c42651bc02dbb7d3656d77b596f1eaad85
SHA512 397e44d9abbadedf790ddcea7d645c712ba8e9c93240569b348d6bbfd21b8f0b43ebebab8b75812b7ea8bd017144e3fb801b84f1d0c1d81936790c3727f6d331
SSDEEP 192:IWhNxtPsWnGWIzWCWKie1BzBWseawWoN/trbuK/X01k9z3A7Jqlfe:IWNtPsWnGWIXZlNiFriSR9zcJqlfe
TLSH
T13A625BE2876C9213EEAB5EB09AB4DE837D38B7C64851D95B049AF0191C533C1EB3123D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Program Files\JapanVPN\System.Runtime.dll
Size 43KB
SHA256 76be53624f64b23d0249dfa0bbe85390086de7c44bfd490642ea86c6faaf44af
MD5 dd6fd06a80e9d90a12b8c7a3ccf0d3a3
SHA1 c60f31d35665c6640fd6aad1fca94a7ef09e6613
SHA512 18a10132b5d1ca4dfd5b349e8ba12693bf56a0a8d15e17cb82eeae7d01b95348edbc92cf3a3b1ececc385f19453daac79e028c2b6b589e92fd3fc01eef440554
SSDEEP 768:yJShN9Yzl50v4boRiPYVbugVJ22Ez2s9zkd:yJmN9Yzl50v4boRS022ESkzkd
TLSH
T16D13D6A1EE289233CCCA93B29CB3A4801EF173C244760D75556FD73664ABB89563637C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Program Files\JapanVPN\System.Text.Json.dll
Size 1.8MB
SHA256 fa99f413be21ed5f484a09093fe5f0beba7de3062cf9cc9f847dbf8108dba55a
MD5 f6d1d8e2d65698ff2d1f658cead9cf35
SHA1 94fe04ac63ea1638adac63e54d081222888fd663
SHA512 ca3eb95082dbacea84d89b352caed15f13e676cc3668d0e78f92bd47e8df8cb289f46ab13ed118ac3ccce7635c0f358550623ab491c6426ddce2b433a6f47e80
SSDEEP 49152:14aVOE7kEkWCwr8QsUJwwLBpbp95ZSfbfA:LVfZsUJTzZSfk
TLSH
T12B957C11E3EC5227C96ED2BA80138122D671A1025312D6CBAC58FD8A7F43BD1D776DBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Thread.dll

Path C:\Program Files\JapanVPN\System.Threading.Thread.dll
Size 15KB
SHA256 ce71949bb1ea67b686e799128582015ebf8758f1107e59e43f342ece3f662930
MD5 191e118586803775c61d1a03c41d63c4
SHA1 477a76ebcb165b1ef9df647cfdbe35d98e26d3dc
SHA512 6dd35d403b1ce38d5645e7d6b08706094050b04b01afb97f7c6d871ee88eb19e9b9486a40d981cc258e42c93ec4e4242ed130505d1841566a67b7123a39111b4
SSDEEP 192:LS6z4dEpjxUYKoUWd7WIcWF+GBTBWseaAWHMMAAUYX01k9z3AahhhAiw:G6z2EbUYKoUWd7WIRlNtMMgYR9z5hhA
TLSH
T10E625CA6C7AC8143EDA62E7056B8CAC33D3DB7C299608A5615D2F1092C573C4DF3163E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Program Files\JapanVPN\System.Threading.dll
Size 81KB
SHA256 6c32ed1bf8067e4169e8feddd15e6489b89d19d1c7aae1520a551b57745d0a60
MD5 e092010e1fb5dd0b1201c968abf080e6
SHA1 e78446bb91c2f89f4ab672ca2a2c6d0a4fdf1631
SHA512 8931f25c8f3798a56ae5d2f120dbf0cc39b2e17186ab2516dd1d9c4164b3693eacc75b7685f4d34aa79b55bb34dcd84800b079f2e93623d0b24961b6d196b9b8
SSDEEP 1536:IaylBo2tUTogxqwXAXXG9Rtd5bFF9o6sion/zW:InlBo4UkgIwXeW9RtHJF9o6Lon/q
TLSH
T1A4836B1173E8091AFBBB47B9DAB36905C171FED21B11D2CF005A920D1FA7BC496B21A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Forms.Primitives.dll

Path C:\Program Files\JapanVPN\System.Windows.Forms.Primitives.dll
Size 3.5MB
SHA256 3eca2d3db1960ee9b2a86fb40489a185f51be55e722584f667a631e6a7ef82e1
MD5 b98bef8f77e0a782928b518b262cf1de
SHA1 6ef956b4e91e3641c95e73382f13bb9aa70e38d0
SHA512 50bf5d0b452621e5cef92cda3e65788413b1747bdc62f006611a7e95e0ec12c1dede117b41bf823419abf5ea7ad3d73dff889d69f588ba0426b99e39840c5bbb
SSDEEP 24576:lhQqsc9uClFTfx2zxHPxAz44j9YnTqIna+LUyb0UKoOsPqYo4CgdQO0PrHaN:lUCvJ2vlaZ+PqYo4aHaN
TLSH
T10EF5061513845F1BFE2ECA3A86954540A2A0B85BB702F6C355C15DA63E73FE3F27E092
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Forms.dll

Path C:\Program Files\JapanVPN\System.Windows.Forms.dll
Size 13.1MB
SHA256 28cbefb565c6b19998bff06ef568389c53bd2c00b2d437d1b1995f73d4aad7e4
MD5 99a83b21f10c234e360d3c8908f7238d
SHA1 098bf4d7e44aef09faa340d094d02903e602b5cc
SHA512 a77b05201cd0bbab06824a2ea3eb4503aedc5bc393adaa94fa64afcf149d8dd3579bf60446d0c6b718f937baa85adc5ad335f35824fa1ba19587cd80417fa9c2
SSDEEP 98304:6trOult6UE84dU0Ln3DPIO3VaUUKUvdrvgHtBBLNxoEt:INl0TzPIO3VaUUKUvdrvgPBYo
TLSH
T12CD63A5262DCBD95C2398278F37343E1E7ACDC168361D2CF0A90BD152A7AA8379363D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\Program Files\JapanVPN\clrjit.dll
Size 2.0MB
SHA256 0749d8fc8e944d0576e1bb47120f87add8f875e5cd8968995633063fc79256f6
MD5 91c601bfa2cd2025addde57d6fcdd82f
SHA1 dd5c24d0729f53386ac968e7176dbe207a89f55d
SHA512 92ceb44522a7c1117ca85da5699c3a68e6c438082155ef4d2aac58145a16b4df9759f210004b918a16300955de58889995299a0a2e9a9ab4ef33acf0786d1458
SSDEEP 49152:OChDIhDQldlc4hbGQxxc8do1cZzoDMKpP+KKOYkzBMQyxX+2WXi8oWDdFo1oNI:OEYClc4haQxxc/uZzoDZ+KKO/zVGu2ia
TLSH
T174A5AE47A2B900FCD06F9634C6174A17EBB2B8051771DBDF03F04A966F23BA2296E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\Program Files\JapanVPN\coreclr.dll
Size 4.4MB
SHA256 128aee8c62a673d64739e585e3876b61133571cec83a46240a62581d5465639b
MD5 7a4f8614679dd4483d88215f54e35428
SHA1 bc706007430e6213dcfd18149e487f5df9f017dc
SHA512 90fba91f795603897590237a5305871ae249e475b324870f0f2a7cf88451b6a8ba9ec78ea0181fa18d400cf64149659901ad68d68086f440152c98e698ff4553
SSDEEP 49152:m3Z7vXstHcoY/clfYkjB01PW/e0b7b7b7b7bu7b7b7b7b731n9s71L/iPGHOfKVs:M7fstvl6wc7uPYWYC1i
TLSH
T1C4268D56B2BD00DDC4B6D1B8C6D74917FAB238491338DBEB02644A661F27BE16A3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\JapanVPN\hostfxr.dll
Size 370KB
SHA256 838591885c5396fb0588a3aedc2f3e841d3afc67570868b1bce615264005a44c
MD5 6a3b9c4600fc05e0275d7b1ab20a9ae5
SHA1 0601e1db524cca08efe8dc63d1cd5dea23fdab78
SHA512 c1401763882b408c66940fe4c1f9729746086dc471664f4c643403932843b551994dabb56e1099f7f75092e779ae6b5a56684a3cde82efc65716f1553b9a646e
SSDEEP 6144:hal9vjNggqbRRdaUzIS64W+/zvZ0UCVvfpdAl0FsGxilKmkRAwBAO/Ux62CUHFhb:hFRAOOnpa2vD3Q9Bqk
TLSH
T147841816D3E8057CF0B79678DAB29902EB727C494BB0E5DF139088651E73BD09A39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\Program Files\JapanVPN\hostpolicy.dll
Size 369KB
SHA256 e92a2e71eeeaf7c574e905935b3e3724ef29bade44317659dbe06f505e99dbe0
MD5 10d0786927018fffb019bfd445ad3d9b
SHA1 c19dd3e6017d8cf0ca8084c87ad01d57604388d1
SHA512 709fce701554b4e65b3a9fa60665391c8ea30f3bdd22e06032b9ab4d7825b414d58b8dd0f2c3b47f105ddbe34874378202e297337a19b849fea8cdf019508221
SSDEEP 6144:Os0pbUUvKO9fssrJDpMBqyiNluCZO7ptsPB7dGd2b1ucZaLr9H/VLuxJb/FDtaDb:OrFvKOHlKcyiB8HB+UDwKkEFT/X
TLSH
T117842916D6EC007CF0B7E679CAB28901EB727C4947B196DF139099A61E73BD09E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-SVXZU77PZ4.tmp

Path C:\Program Files\JapanVPN\is-SVXZU77PZ4.tmp
Size 1.3MB
SHA256 86c29a7b945525135de16c3dcb71e3b8517848c459cbb21395b352d4e6bba09c
MD5 ae07f51b1de6dfefecc54d70a85889f0
SHA1 7b5fc1a1beb42afb2d3adc07bc43f7afed21a6b8
SHA512 23963d6a2e14b3e226b53ba7b0de9f022fdf49c1463c34bd3fd5c0180432433043bdf275992ab4292bb0aa40070a7e8b7dad43a77a8bf1073fff04e1155fc8ba
SSDEEP 24576:vAPmRdpMfSHeSSl9pRF3SEsqJCUkMGt84y1zSgpl2gBSSoGjsgDF:imRdpMfSHd8RSELkMGty
TLSH
T1C6555B56D6BC4499CEB9D0F8C547491FEBB13811033466EF46A48B192F3BBE66ABC310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_qx5u2grf.h5k.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qx5u2grf.h5k.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

JapanVPN-Windows-0.2.9.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-1BBNMSIHXP.tmp\JapanVPN-Windows-0.2.9.tmp
Size 4.2MB
SHA256 99d6bc6ece5661650b8ed26a9b6dad5a814c8b2c3dad9effe11c8251ed18471c
MD5 3b123357c2bd9d495006813749baee3a
SHA1 7b6d83c36d8b1c1e1db67fea670322bce83323b6
SHA512 632cd162c6cf45ff9abaa7b6fa37c80c6d5f3d0bfa8da7c5069c286bc82d84b7933cf48f89fb6d7666deeef1eaed3572dafca54d4ca1dfffd1f3a6865b8f03db
SSDEEP 98304:v9SZUvl30aj90ZFcvdQ0hdgvminQLMj+JL333TW:cItJj90Z6RgKwd
TLSH
T14D268F03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF4095C4F396416D3A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kel2p0qd.0.cs

Path C:\Users\Admin\AppData\Local\Temp\kel2p0qd\kel2p0qd.0.cs
Size 2KB
SHA256 535873d82525e7b56705e43e8b63790f811ced5671395ed9a0eda5ac81ec2207
MD5 b97e69594835165c890907085d2584ff
SHA1 e6d6f309199929a613be7d6f7ba848e3c6815dbb
SHA512 bfdfc961863bdb4f5476527abc6294e22e53ee5de87733d04977093af48d0ddf5c1e85a8e6e281a50149fb7d239ddd331b04668b3b1517875530058a26858559
TLSH
T1B3410F500E05922E18F3A93D9ECCC148F567813317EA4E16797D5F601FB1501E3B9E96
MD5 SHA1 SHA512 TLSH

Submit Download

memory/300-977-0x0000016C6D1E0000-0x0000016C6D1E8000-memory.dmp

Download

memory/936-6-0x0000000003150000-0x0000000003151000-memory.dmp

Download

memory/936-357-0x0000000000D40000-0x000000000118B000-memory.dmp

Download

memory/936-12-0x0000000000D40000-0x000000000118B000-memory.dmp

Download

memory/936-10-0x0000000003150000-0x0000000003151000-memory.dmp

Download

memory/936-9-0x0000000000D40000-0x000000000118B000-memory.dmp

Download

memory/936-890-0x0000000000D40000-0x000000000118B000-memory.dmp

Download

memory/936-865-0x0000000000D40000-0x000000000118B000-memory.dmp

Download

memory/1236-1132-0x00000220F52E0000-0x00000220F52E8000-memory.dmp

Download

memory/1408-1054-0x00000211F3E20000-0x00000211F3E28000-memory.dmp

Download

memory/1844-1154-0x000002182E5E0000-0x000002182E5E8000-memory.dmp

Download

memory/2344-1021-0x000001516A950000-0x000001516A958000-memory.dmp

Download

memory/2656-1010-0x000001A299B10000-0x000001A299B18000-memory.dmp

Download

memory/2772-944-0x00000238DE530000-0x00000238DEA58000-memory.dmp

Download

memory/2772-934-0x00000238DD7E0000-0x00000238DD802000-memory.dmp

Download

memory/2772-943-0x00000238DDE30000-0x00000238DDFF2000-memory.dmp

Download

memory/2772-942-0x00000238DD7D0000-0x00000238DD7D8000-memory.dmp

Download

memory/2912-988-0x000001407BD30000-0x000001407BD38000-memory.dmp

Download

memory/3320-1087-0x00000287E9350000-0x00000287E9358000-memory.dmp

Download

memory/3328-1143-0x00000190FB730000-0x00000190FB738000-memory.dmp

Download

memory/3548-1065-0x00000277A21D0000-0x00000277A21D8000-memory.dmp

Download

memory/3768-1076-0x0000029E91FE0000-0x0000029E91FE8000-memory.dmp

Download

memory/4312-1099-0x00000205686D0000-0x00000205686D8000-memory.dmp

Download

memory/4724-1121-0x00000163DB5A0000-0x00000163DB5A8000-memory.dmp

Download

memory/4772-1110-0x000001C47F970000-0x000001C47F978000-memory.dmp

Download

memory/4972-999-0x0000028366F80000-0x0000028366F88000-memory.dmp

Download

memory/5020-955-0x0000020738A60000-0x0000020738A68000-memory.dmp

Download

memory/5488-0-0x00000000004F0000-0x00000000005E0000-memory.dmp

Download

memory/5488-893-0x00000000004F0000-0x00000000005E0000-memory.dmp

Download

memory/5488-8-0x00000000004F0000-0x00000000005E0000-memory.dmp

Download

memory/5836-1165-0x0000019DDDF40000-0x0000019DDDF48000-memory.dmp

Download

memory/5864-966-0x0000021F31C00000-0x0000021F31C08000-memory.dmp

Download

memory/5920-1032-0x000002646EEA0000-0x000002646EEA8000-memory.dmp

Download

memory/6040-1043-0x00000290AE730000-0x00000290AE738000-memory.dmp

Download