d1c544e1f137e4c985a470cd79450dc7a163cfa5dcda4b90960c2f5013c836d0

Analysis

max time kernel
143s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2022 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Box-x64.msi
Size

39.5MB
MD5

197f631b87b5f033e168db6f86991d8b
SHA1

10bd609e5072458f57dca689bfbf34c1a5f29ca2
SHA256

d1c544e1f137e4c985a470cd79450dc7a163cfa5dcda4b90960c2f5013c836d0
SHA512

e7b473fb91dac4d2512a97a26555eca95780150dc03c982965e041c950d2bc49af44bd7f6b2d95bce7a08a3a1d20a59fce84f09d5618b9efa24c96e61ea731c8
SSDEEP

786432:h35MzGfBrWnHB/AZMNC2IqdBN2AWd9TC8auNJv5bljJ/DsB8i52wGi+D+EtbPXPT:hSSAHB/ogC2/2hZCkJvnJbo308EtbfPs

Score

10^/10

adware persistence stealer

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

regsvr32.exestreem.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\CallbackTechMountNotificator-cbfsconnect2017 = "{9150DA06-8C69-42D0-9875-8D73D78D9414}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\CallbackTechMountNotificator-cbfsconnect2017 = "{9150DA06-8C69-42D0-9875-8D73D78D9414}"	streem.exe

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

4 4828 msiexec.exe
Drops file in Drivers directory 1 IoCs

Processes:

streem.exe

description ioc process

File created C:\Windows\system32\drivers\cbfsconnect2017.sys streem.exe
Executes dropped EXE 4 IoCs

Processes:

Box.Desktop.UpdateService.exestreem.exeBox.exeBoxUI.exe

pid process

1496 Box.Desktop.UpdateService.exe
4972 streem.exe
3388 Box.exe
3920 BoxUI.exe

flow	pid	process
4	4828	msiexec.exe

description	ioc	process
File created	C:\Windows\system32\drivers\cbfsconnect2017.sys	streem.exe

pid	process
1496	Box.Desktop.UpdateService.exe
4972	streem.exe
3388	Box.exe
3920	BoxUI.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies Shared Task Scheduler registry keys 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

regsvr32.exestreem.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{9150DA06-8C69-42D0-9875-8D73D78D9414} = "Virtual Storage Mount Notification"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	streem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{9150DA06-8C69-42D0-9875-8D73D78D9414} = "Virtual Storage Mount Notification"	streem.exe

Registers COM server for autorun 1 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

msiexec.exestreem.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345B91D6-935F-4773-9926-210C335241F9}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.28.292.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D0A4E1B-C25A-4AF8-8DA7-531929C02958}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9150DA06-8C69-42D0-9875-8D73D78D9414}\InprocServer32	streem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9150DA06-8C69-42D0-9875-8D73D78D9414}\InprocServer32\ = "C:\\Windows\\system32\\cbfsconnectMntNtf2017.dll"	streem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79A6F4BA-2BFB-440E-AF8D-22EDF5E041B6}\InprocServer32	streem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BBBCFB6-60E2-4C0F-BB31-10434068E2BE}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.28.292.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F178C11B-B6C5-4D71-B528-64381D2024FC}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{73C8BC94-4A51-413B-B927-829449EAFA75}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{8BBBCFB6-60E2-4C0F-BB31-10434068E2BE}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79A6F4BA-2BFB-440E-AF8D-22EDF5E041B6}\InprocServer32\ThreadingModel = "Apartment"	streem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2FFF193C-5891-4B26-B363-40D3B5257FE9}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{345B91D6-935F-4773-9926-210C335241F9}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345B91D6-935F-4773-9926-210C335241F9}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.28.292.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{73C8BC94-4A51-413B-B927-829449EAFA75}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BBBCFB6-60E2-4C0F-BB31-10434068E2BE}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2FFF193C-5891-4B26-B363-40D3B5257FE9}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2FFF193C-5891-4B26-B363-40D3B5257FE9}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.28.292.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{8D0A4E1B-C25A-4AF8-8DA7-531929C02958}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{73C8BC94-4A51-413B-B927-829449EAFA75}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.28.292.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2FFF193C-5891-4B26-B363-40D3B5257FE9}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D0A4E1B-C25A-4AF8-8DA7-531929C02958}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BBBCFB6-60E2-4C0F-BB31-10434068E2BE}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79A6F4BA-2BFB-440E-AF8D-22EDF5E041B6}\InprocServer32\ = "C:\\Windows\\system32\\cbfsconnectMntNtf2017.dll"	streem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{73C8BC94-4A51-413B-B927-829449EAFA75}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.28.292.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F178C11B-B6C5-4D71-B528-64381D2024FC}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F178C11B-B6C5-4D71-B528-64381D2024FC}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.28.292.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D0A4E1B-C25A-4AF8-8DA7-531929C02958}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.28.292.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9150DA06-8C69-42D0-9875-8D73D78D9414}\InprocServer32\ThreadingModel = "Apartment"	streem.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BoxUI.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BoxUI.exe\GlobalFlag = "512"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\streem.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\streem.exe\GlobalFlag = "512"	msiexec.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exerundll32.exeBox.Desktop.UpdateService.exerundll32.exerundll32.exestreem.exeregsvr32.exeMsiExec.exerundll32.exerundll32.exeexplorer.exeBox.exe

pid	process
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4944	MsiExec.exe
4704	rundll32.exe
4704	rundll32.exe
4704	rundll32.exe
1496	Box.Desktop.UpdateService.exe
1496	Box.Desktop.UpdateService.exe
1496	Box.Desktop.UpdateService.exe
1496	Box.Desktop.UpdateService.exe
4944	MsiExec.exe
2052	rundll32.exe
2052	rundll32.exe
2052	rundll32.exe
4944	MsiExec.exe
4700	rundll32.exe
4700	rundll32.exe
4700	rundll32.exe
4972	streem.exe
4972	streem.exe
2940	regsvr32.exe
1508	MsiExec.exe
2424	rundll32.exe
2424	rundll32.exe
2424	rundll32.exe
1508	MsiExec.exe
1808	rundll32.exe
1808	rundll32.exe
1808	rundll32.exe
1808	rundll32.exe
1808	rundll32.exe
4560	explorer.exe
4560	explorer.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe
3388	Box.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Box = "\"C:\\Program Files\\Box\\Box\\Box.exe\""	msiexec.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

streem.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini streem.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	streem.exe

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exeexplorer.exe

description	ioc	process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exestreem.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9150DA06-8C69-42D0-9875-8D73D78D9414}'	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9150DA06-8C69-42D0-9875-8D73D78D9414}'\ = "Virtual Storage Mount Notification"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9150DA06-8C69-42D0-9875-8D73D78D9414}'\NoInternetExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9150DA06-8C69-42D0-9875-8D73D78D9414}'	streem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9150DA06-8C69-42D0-9875-8D73D78D9414}'\ = "Virtual Storage Mount Notification"	streem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9150DA06-8C69-42D0-9875-8D73D78D9414}'\NoInternetExplorer = "1"	streem.exe

Drops file in System32 directory 6 IoCs

Processes:

streem.exe

description	ioc	process
File created	C:\Windows\system32\cbfsconnectMntNtf2017.dll	streem.exe
File created	C:\Windows\SysWOW64\cbfsconnectMntNtf2017.dll	streem.exe
File created	C:\Windows\system32\cbfsconnectevtmsg.dll	streem.exe
File opened for modification	C:\Windows\system32\cbfsconnectevtmsg.dll	streem.exe
File created	C:\Windows\system32\cbfsconnectNetRdr2017.dll	streem.exe
File created	C:\Windows\SysWOW64\cbfsconnectNetRdr2017.dll	streem.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exestreem.exe

description	ioc	process
File created	C:\Program Files\Box\Box\UI\ko-KR\BoxPrompt.resources.dll	msiexec.exe
File created	C:\Program Files\Box\Box\thrift\protocol\fastbinary.cp38-win_amd64.pyd	msiexec.exe
File created	C:\Program Files\Box\Box\FS\cf\BoxDrive.msix	msiexec.exe
File created	C:\Program Files\Box\Box\win32event.pyd	msiexec.exe
File created	C:\Program Files\Box\Box\UI\de-DE\BoxPrompt.resources.dll	msiexec.exe
File created	C:\Program Files\Box\Box\api-ms-win-core-console-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Box\Box\UI\it-IT\BoxPrompt.resources.dll	msiexec.exe
File created	C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\SHA1\vpnpbus.cat	streem.exe
File created	C:\Program Files\Box\Box\UI\de-DE\BoxUI.resources.dll	msiexec.exe
File created	C:\Program Files\Box\Box\FS\streem.exe	msiexec.exe
File created	C:\Program Files\Box\Box\UI\BoxUI.exe	msiexec.exe
File created	C:\Program Files\Box\Box\UI\CommandLine.dll	msiexec.exe
File created	C:\Program Files\Box\Box\api-ms-win-core-namedpipe-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Box\Box\UI\bn-IN\BoxPrompt.resources.dll	msiexec.exe
File created	C:\Program Files\Box\Box\UI\hi-IN\BoxPrompt.resources.dll	msiexec.exe
File created	C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\ia64\SHA1\vpnpbus.sys	streem.exe
File created	C:\Program Files\Box\Box\BoxSyncWindowsUI.dll	msiexec.exe
File created	C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe.config	msiexec.exe
File created	C:\Program Files\Box\Box\win32process.pyd	msiexec.exe
File created	C:\Program Files\Box\Box\UI\Microsoft.Web.WebView2.WinForms.dll	msiexec.exe
File created	C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\i386\vpnpbus.sys	streem.exe
File created	C:\Program Files\Box\Box\api-ms-win-core-errorhandling-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Box\Box\VCRUNTIME140.dll	msiexec.exe
File created	C:\Program Files\Box\Box\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\Box\Box\api-ms-win-crt-process-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Box\Box\UI\en-GB\BoxPrompt.resources.dll	msiexec.exe
File created	C:\Program Files\Box\Box\wrapt\_wrappers.cp38-win_amd64.pyd	msiexec.exe
File created	C:\Program Files\Box\Box\win32security.pyd	msiexec.exe
File created	C:\Program Files\Box\Box\UI\ru-RU\BoxUI.resources.dll	msiexec.exe
File created	C:\Program Files\Box\Box\BoxShellExt32-2.28.292.dll	msiexec.exe
File created	C:\Program Files\Box\Box\MetricsCollector.dll	msiexec.exe
File created	C:\Program Files\Box\Box\api-ms-win-core-memory-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Box\Box\_cffi_backend.cp38-win_amd64.pyd	msiexec.exe
File created	C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\i386\vpnpbus.cat	streem.exe
File created	C:\Program Files\Box\Box\_ctypes.pyd	msiexec.exe
File created	C:\Program Files\Box\Box\win32trace.pyd	msiexec.exe
File created	C:\Program Files\Box\Box\BoxLockedByOther.ico	msiexec.exe
File created	C:\Program Files\Box\Box\UI\da-DK\BoxPrompt.resources.dll	msiexec.exe
File created	C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\ia64\cbfsconnectNetRdr2017.dll	streem.exe
File created	C:\Program Files\Box\Box\_lzma.pyd	msiexec.exe
File created	C:\Program Files\Box\Box\api-ms-win-core-synch-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Box\Box\Box.exe	msiexec.exe
File created	C:\Program Files\Box\Box\sqlite3.dll	msiexec.exe
File created	C:\Program Files\Box\Box\_decimal.pyd	msiexec.exe
File created	C:\Program Files\Box\Box\api-ms-win-core-processthreads-l1-1-1.dll	msiexec.exe
File created	C:\Program Files\Box\Box\api-ms-win-core-rtlsupport-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Box\Box\api-ms-win-crt-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Box\Box\UI\hi-IN\BoxUI.resources.dll	msiexec.exe
File created	C:\Program Files\Box\Box\libssl-1_1.dll	msiexec.exe
File created	C:\Program Files\Box\Box\unicodedata.pyd	msiexec.exe
File created	C:\Program Files\Box\Box\InstallerHelper.exe.config	msiexec.exe
File created	C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\i386\vpnpbus.inf	streem.exe
File created	C:\Program Files\Box\Box\UI\runtimes\win-x64\native\WebView2Loader.dll	msiexec.exe
File created	C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\cbfsconnect2017.sys	streem.exe
File created	C:\Program Files\Box\Box\UI\es-ES\BoxUI.resources.dll	msiexec.exe
File created	C:\Program Files\Box\Box\UI\ja-JP\BoxUI.resources.dll	msiexec.exe
File created	C:\Program Files\Box\Box\_bz2.pyd	msiexec.exe
File created	C:\Program Files\Box\Box\api-ms-win-core-file-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Box\Box\UI\BoxPrompt.exe	msiexec.exe
File created	C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\ia64\SHA1\cbfsconnect2017.sys	streem.exe
File created	C:\Program Files\Box\Box\win32wnet.pyd	msiexec.exe
File created	C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe	msiexec.exe
File created	C:\Program Files\Box\Box\api-ms-win-core-datetime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Box\Box\api-ms-win-core-util-l1-1-0.dll	msiexec.exe

Drops file in Windows directory 61 IoCs

Processes:

rundll32.exemsiexec.exerundll32.exerundll32.exerundll32.exerundll32.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI2254.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D6547952CAF2F6346BC17655623553D0\2.28.292\vcruntime140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D6547952CAF2F6346BC17655623553D0\2.28.292\vccorlib140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\{2597456D-2FAC-436F-B61C-67552653350D}\ext_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AFF.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4F91.tmp-\Box.Desktop.Installer.CustomActions.dll	rundll32.exe
File created	C:\Windows\Installer\e571146.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D6547952CAF2F6346BC17655623553D0\2.28.292\msvcp140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3810.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{2597456D-2FAC-436F-B61C-67552653350D}\ext_3.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AFF.tmp-\Box.Desktop.Installer.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI534B.tmp-\Box.Updater.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI534B.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\{2597456D-2FAC-436F-B61C-67552653350D}\ext_3.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AFF.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1968.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2254.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\{2597456D-2FAC-436F-B61C-67552653350D}\boxicon_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI182D.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{2597456D-2FAC-436F-B61C-67552653350D}\ext_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{2597456D-2FAC-436F-B61C-67552653350D}\ext_2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1909.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D6547952CAF2F6346BC17655623553D0\2.28.292\concrt140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3810.tmp-\Box.Desktop.Installer.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4F91.tmp-\Box.Updater.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI534B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3810.tmp-\Box.Updater.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2254.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2254.tmp-\Box.Desktop.Installer.CustomActions.dll	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D6547952CAF2F6346BC17655623553D0\2.28.292\vcruntime140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\{2597456D-2FAC-436F-B61C-67552653350D}\ext.exe	msiexec.exe
File created	C:\Windows\Installer\{2597456D-2FAC-436F-B61C-67552653350D}\ext_4.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{2597456D-2FAC-436F-B61C-67552653350D}\boxicon_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F91.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1482.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1BF9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D6547952CAF2F6346BC17655623553D0	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D6547952CAF2F6346BC17655623553D0\2.28.292\concrt140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI534B.tmp-\Box.Desktop.Installer.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI534B.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e571146.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI17CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AFF.tmp-\Box.Updater.Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4F91.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{2597456D-2FAC-436F-B61C-67552653350D}\ext_4.exe	msiexec.exe
File created	C:\Windows\Installer\{2597456D-2FAC-436F-B61C-67552653350D}\ext.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3810.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2254.tmp-\Box.Updater.Common.dll	rundll32.exe
File created	C:\Windows\Installer\{2597456D-2FAC-436F-B61C-67552653350D}\ext_2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AFF.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4F91.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\SourceHash{2597456D-2FAC-436F-B61C-67552653350D}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D6547952CAF2F6346BC17655623553D0\2.28.292	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\D6547952CAF2F6346BC17655623553D0\2.28.292\vccorlib140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File created	C:\Windows\Installer\e571149.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\D6547952CAF2F6346BC17655623553D0\2.28.292\msvcp140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3810.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 63 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exevssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000045e03923b2b2bc3e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000045e039230000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090045e03923000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000045e0392300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000045e0392300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchApp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

Processes:

BoxUI.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	BoxUI.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	BoxUI.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\box.com	BoxUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\box.com\NumberOfSubdomains = "1"	BoxUI.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	BoxUI.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	BoxUI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Box.exe = "11000"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\BoxUI.exe = "11000"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL\BoxUI.exe = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\box.com	BoxUI.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	BoxUI.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\Box.exe = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl	msiexec.exe

Modifies data under HKEY_USERS 16 IoCs

Processes:

streem.exeBox.Desktop.UpdateService.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	streem.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	streem.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{2339e045-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	streem.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	streem.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	streem.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	streem.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	streem.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	streem.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Box.Desktop.UpdateService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "4"	streem.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{2339e045-0000-0000-0000-d01200000000}	streem.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	streem.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{2339e045-0000-0000-0000-d01200000000}\MaxCapacity = "15140"	streem.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeexplorer.exeregsvr32.exestreem.exeSearchApp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.boxnote\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gsheet\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.boxcanvas\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{345B91D6-935F-4773-9926-210C335241F9}\System.IsPinnedToNameSpaceTree = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2FFF193C-5891-4B26-B363-40D3B5257FE9}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{73C8BC94-4A51-413B-B927-829449EAFA75}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D6547952CAF2F6346BC17655623553D0	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D6547952CAF2F6346BC17655623553D0\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73C8BC94-4A51-413B-B927-829449EAFA75}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{888B4BB4-CE31-4C7F-8693-E90B0E34EE5D}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gslide\shell\open\command\ = "\"C:\\Program Files\\Box\\Box\\Box.exe\" --open-file=\"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8D0A4E1B-C25A-4AF8-8DA7-531929C02958}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BBBCFB6-60E2-4C0F-BB31-10434068E2BE}\ = "Box Drive Shell Extension Problem Icon Overlay"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D6547952CAF2F6346BC17655623553D0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9150DA06-8C69-42D0-9875-8D73D78D9414}\Programmable	streem.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2843"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73C8BC94-4A51-413B-B927-829449EAFA75}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2E1192D2-8667-4987-A464-824357FC4857}\2.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2E1192D2-8667-4987-A464-824357FC4857}\2.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2E1192D2-8667-4987-A464-824357FC4857}\2.0\HELPDIR\ = "C:\\Program Files\\Box\\Box\\Temp\\cbfsconnect2017-Box\\i386"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gslides\shell\open\ = "&Open"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{8D0A4E1B-C25A-4AF8-8DA7-531929C02958}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D6547952CAF2F6346BC17655623553D0\SourceList\Media\2 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79A6F4BA-2BFB-440E-AF8D-22EDF5E041B6}	streem.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1950"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1950"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.boxcanvas\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345B91D6-935F-4773-9926-210C335241F9}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.28.292.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{345B91D6-935F-4773-9926-210C335241F9}\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D6547952CAF2F6346BC17655623553D0\SourceList\PackageName = "Box-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gslides\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gslide\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gslide\ = "BoxDesktop.gslide"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gdoc\DefaultIcon\ = "C:\\Windows\\Installer\\{2597456D-2FAC-436F-B61C-67552653350D}\\ext.exe,0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2FFF193C-5891-4B26-B363-40D3B5257FE9}	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2843"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{345B91D6-935F-4773-9926-210C335241F9}\InProcServer32	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10281"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.boxnote\BoxDesktop.boxnote\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.boxnote\BoxDesktop.boxnote	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gdoc\shell\open\command\ = "\"C:\\Program Files\\Box\\Box\\Box.exe\" --open-file=\"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gdoc\DefaultIcon	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{345B91D6-935F-4773-9926-210C335241F9}\ShellFolder\FolderValueFlags = "40"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{8D0A4E1B-C25A-4AF8-8DA7-531929C02958}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{345B91D6-935F-4773-9926-210C335241F9}\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888B4BB4-CE31-4C7F-8693-E90B0E34EE5D}\TypeLib\ = "{2E1192D2-8667-4987-A464-824357FC4857}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.boxnote\ = "BoxDesktop.boxnote"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gdoc\shell\open\command\command = 4200280079002900300062005f00370062003900630042002c004e00430035002900700038002700500072006f00640075006300740046006500610074007500720065003e007d00460027005f004c006f0061005a00360039002c0065006d002d0066005400790052003f005e0020002d002d006f00700065006e002d00660069006c0065003d00220025003100220000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gslides\shell\open\command\command = 4200280079002900300062005f00370062003900630042002c004e00430035002900700038002700500072006f00640075006300740046006500610074007500720065003e007d00460027005f004c006f0061005a00360039002c0065006d002d0066005400790052003f005e0020002d002d006f00700065006e002d00660069006c0065003d00220025003100220000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gslide\BoxDesktop.gslide\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.boxcanvas	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2E1192D2-8667-4987-A464-824357FC4857}	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.boxcanvas\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

rundll32.exeBox.exeBoxUI.exe

pid process

2424 rundll32.exe
2424 rundll32.exe
3388 Box.exe
3388 Box.exe
3920 BoxUI.exe
3920 BoxUI.exe
3920 BoxUI.exe
3920 BoxUI.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

660

pid	process
2424	rundll32.exe
2424	rundll32.exe
3388	Box.exe
3388	Box.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe

pid	process
660

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exe

description	pid	process
Token: SeShutdownPrivilege	4828	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4828	msiexec.exe
Token: SeSecurityPrivilege	2668	msiexec.exe
Token: SeCreateTokenPrivilege	4828	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4828	msiexec.exe
Token: SeLockMemoryPrivilege	4828	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4828	msiexec.exe
Token: SeMachineAccountPrivilege	4828	msiexec.exe
Token: SeTcbPrivilege	4828	msiexec.exe
Token: SeSecurityPrivilege	4828	msiexec.exe
Token: SeTakeOwnershipPrivilege	4828	msiexec.exe
Token: SeLoadDriverPrivilege	4828	msiexec.exe
Token: SeSystemProfilePrivilege	4828	msiexec.exe
Token: SeSystemtimePrivilege	4828	msiexec.exe
Token: SeProfSingleProcessPrivilege	4828	msiexec.exe
Token: SeIncBasePriorityPrivilege	4828	msiexec.exe
Token: SeCreatePagefilePrivilege	4828	msiexec.exe
Token: SeCreatePermanentPrivilege	4828	msiexec.exe
Token: SeBackupPrivilege	4828	msiexec.exe
Token: SeRestorePrivilege	4828	msiexec.exe
Token: SeShutdownPrivilege	4828	msiexec.exe
Token: SeDebugPrivilege	4828	msiexec.exe
Token: SeAuditPrivilege	4828	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4828	msiexec.exe
Token: SeChangeNotifyPrivilege	4828	msiexec.exe
Token: SeRemoteShutdownPrivilege	4828	msiexec.exe
Token: SeUndockPrivilege	4828	msiexec.exe
Token: SeSyncAgentPrivilege	4828	msiexec.exe
Token: SeEnableDelegationPrivilege	4828	msiexec.exe
Token: SeManageVolumePrivilege	4828	msiexec.exe
Token: SeImpersonatePrivilege	4828	msiexec.exe
Token: SeCreateGlobalPrivilege	4828	msiexec.exe
Token: SeBackupPrivilege	5084	vssvc.exe
Token: SeRestorePrivilege	5084	vssvc.exe
Token: SeAuditPrivilege	5084	vssvc.exe
Token: SeBackupPrivilege	2668	msiexec.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeTakeOwnershipPrivilege	2668	msiexec.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeTakeOwnershipPrivilege	2668	msiexec.exe
Token: SeBackupPrivilege	5116	srtasks.exe
Token: SeRestorePrivilege	5116	srtasks.exe
Token: SeSecurityPrivilege	5116	srtasks.exe
Token: SeTakeOwnershipPrivilege	5116	srtasks.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeTakeOwnershipPrivilege	2668	msiexec.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeTakeOwnershipPrivilege	2668	msiexec.exe
Token: SeBackupPrivilege	5116	srtasks.exe
Token: SeRestorePrivilege	5116	srtasks.exe
Token: SeSecurityPrivilege	5116	srtasks.exe
Token: SeTakeOwnershipPrivilege	5116	srtasks.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeTakeOwnershipPrivilege	2668	msiexec.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeTakeOwnershipPrivilege	2668	msiexec.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeTakeOwnershipPrivilege	2668	msiexec.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeTakeOwnershipPrivilege	2668	msiexec.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeTakeOwnershipPrivilege	2668	msiexec.exe
Token: SeRestorePrivilege	2668	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msiexec.exeexplorer.exeBoxUI.exe

pid	process
4828	msiexec.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4828	msiexec.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
3920	BoxUI.exe
4560	explorer.exe
4560	explorer.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe

Suspicious use of SendNotifyMessage 58 IoCs

Processes:

explorer.exeBoxUI.exe

pid	process
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
4560	explorer.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe
3920	BoxUI.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

StartMenuExperienceHost.exeexplorer.exeSearchApp.exeBoxUI.exe

pid process

1408 StartMenuExperienceHost.exe
4560 explorer.exe
2368 SearchApp.exe
3920 BoxUI.exe
3920 BoxUI.exe
4560 explorer.exe

pid	process
1408	StartMenuExperienceHost.exe
4560	explorer.exe
2368	SearchApp.exe
3920	BoxUI.exe
3920	BoxUI.exe
4560	explorer.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

msiexec.exeMsiExec.exerundll32.exestreem.exeMsiExec.exeBox.exeBoxUI.exe

description	pid	process	target process
PID 2668 wrote to memory of 5116	2668	msiexec.exe	srtasks.exe
PID 2668 wrote to memory of 5116	2668	msiexec.exe	srtasks.exe
PID 2668 wrote to memory of 4124	2668	msiexec.exe	MsiExec.exe
PID 2668 wrote to memory of 4124	2668	msiexec.exe	MsiExec.exe
PID 2668 wrote to memory of 4124	2668	msiexec.exe	MsiExec.exe
PID 2668 wrote to memory of 4944	2668	msiexec.exe	MsiExec.exe
PID 2668 wrote to memory of 4944	2668	msiexec.exe	MsiExec.exe
PID 4944 wrote to memory of 4704	4944	MsiExec.exe	rundll32.exe
PID 4944 wrote to memory of 4704	4944	MsiExec.exe	rundll32.exe
PID 4944 wrote to memory of 2052	4944	MsiExec.exe	rundll32.exe
PID 4944 wrote to memory of 2052	4944	MsiExec.exe	rundll32.exe
PID 4944 wrote to memory of 4700	4944	MsiExec.exe	rundll32.exe
PID 4944 wrote to memory of 4700	4944	MsiExec.exe	rundll32.exe
PID 4700 wrote to memory of 4972	4700	rundll32.exe	streem.exe
PID 4700 wrote to memory of 4972	4700	rundll32.exe	streem.exe
PID 4972 wrote to memory of 2940	4972	streem.exe	regsvr32.exe
PID 4972 wrote to memory of 2940	4972	streem.exe	regsvr32.exe
PID 4972 wrote to memory of 2940	4972	streem.exe	regsvr32.exe
PID 2668 wrote to memory of 1508	2668	msiexec.exe	MsiExec.exe
PID 2668 wrote to memory of 1508	2668	msiexec.exe	MsiExec.exe
PID 1508 wrote to memory of 2424	1508	MsiExec.exe	rundll32.exe
PID 1508 wrote to memory of 2424	1508	MsiExec.exe	rundll32.exe
PID 1508 wrote to memory of 1808	1508	MsiExec.exe	rundll32.exe
PID 1508 wrote to memory of 1808	1508	MsiExec.exe	rundll32.exe
PID 2668 wrote to memory of 3388	2668	msiexec.exe	Box.exe
PID 2668 wrote to memory of 3388	2668	msiexec.exe	Box.exe
PID 2668 wrote to memory of 3388	2668	msiexec.exe	Box.exe
PID 3388 wrote to memory of 3920	3388	Box.exe	BoxUI.exe
PID 3388 wrote to memory of 3920	3388	Box.exe	BoxUI.exe
PID 3920 wrote to memory of 4560	3920	BoxUI.exe	explorer.exe
PID 3920 wrote to memory of 4560	3920	BoxUI.exe	explorer.exe
PID 3920 wrote to memory of 4560	3920	BoxUI.exe	explorer.exe
PID 3920 wrote to memory of 4560	3920	BoxUI.exe	explorer.exe
PID 3920 wrote to memory of 4560	3920	BoxUI.exe	explorer.exe
PID 3920 wrote to memory of 4560	3920	BoxUI.exe	explorer.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Box-x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4828

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Sets file execution options in registry
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6ABA82DCA7C042B02746543FB79AEB58
2⤵
- Loads dropped DLL
PID:4124

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 0AD0D2C9DDC5F049DFE0D094D795528C E Global\MSI0000
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4944

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI2254.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240591500 41 Box.Desktop.Installer.CustomActions!CustomActions.CustomActions.CreateFallbackDeviceIDKey
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4704

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI3810.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240597046 47 Box.Desktop.Installer.CustomActions!Box.Desktop.Installer.CustomActions.CloudFilesCustomActions.CloudFilesRegisterPackage
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2052

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI3AFF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240597765 55 Box.Desktop.Installer.CustomActions!Box.Desktop.Installer.CustomActions.CbfsInstallerCustomActions.InstallCbfs
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4700

C:\Program Files\Box\Box\FS\streem.exe
"C:\Program Files\Box\Box\FS\streem.exe" --install-cbfs --cbfs-cab-path "C:\Program Files\Box\Box\FS\cbfsconnect.cab"
4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Shared Task Scheduler registry keys
- Registers COM server for autorun
- Loads dropped DLL
- Drops desktop.ini file(s)
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4972

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe" /n /s /i:"cbfsconnect2017-Box" "C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\i386\cbfsconnectMntNtf2017.dll"
5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies Shared Task Scheduler registry keys
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2940

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding C1849C8C61D11A63CCFC181734CC9F3D
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI4F91.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240603328 73 Box.Desktop.Installer.CustomActions!CustomActions.CustomActions.KillExplorer
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2424

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI534B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240603968 83 Box.Desktop.Installer.CustomActions!CustomActions.CustomActions.GenerateDeviceId
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1808

C:\Program Files\Box\Box\Box.exe
"C:\Program Files\Box\Box\Box.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3388

C:\Program Files\Box\Box\ui\BoxUI.exe
"C:\Program Files\Box\Box\ui\BoxUI.exe" --product-name Box
3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe
"C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:1496

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -s -t 3960 -i 4972 -e 4972 -c 0
1⤵
PID:3992

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4560

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1408

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\Box\Box\FS\cbfsconnect.cab

Filesize
2.3MB

MD5
f3da6ed4a1d828a5f8eef8e22cd38218

SHA1
aec09f40d5f084b2c3773ee7f6ae360c637ba1f0

SHA256
0203524031ab865791a4ecc4b4f0eb36cb5748e5bafdc63b6a3f7fd8d218f659

SHA512
677a51b9fdf744a3e22071f47c13240ada1bcfec3fc9a0663b396b687eeee85795d15441bfba43b7f13fb5c79e9ed6e62a464854ee3d8556c89010a183c8e7d2

Download Submit
C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe

Filesize
97KB

MD5
7d8f08f685890b0e40fdd7a21dfe0ad9

SHA1
93167fc37e3055a6149ad5565ec68edf585bfdc6

SHA256
d4a89019f0845ea21a15967cad0b8715ae8e6d30a778799c3dd78b2556af0c19

SHA512
a23dad7a76f9979487101cd273c8141299b84abfb359b3f5b8ec06a11f5a251cd09c4b76262ece19857d4ba09390151243af9956f33a569e98d4a140d5bac4e4

Download Submit
C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe

Filesize
97KB

MD5
7d8f08f685890b0e40fdd7a21dfe0ad9

SHA1
93167fc37e3055a6149ad5565ec68edf585bfdc6

SHA256
d4a89019f0845ea21a15967cad0b8715ae8e6d30a778799c3dd78b2556af0c19

SHA512
a23dad7a76f9979487101cd273c8141299b84abfb359b3f5b8ec06a11f5a251cd09c4b76262ece19857d4ba09390151243af9956f33a569e98d4a140d5bac4e4

Download Submit
C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe.config

Filesize
177B

MD5
286202d79da1435a941f2371d0345422

SHA1
f021e5f88cf5eb6df93ced50cacb20fb7c6fba63

SHA256
4cd50576db84dbe9daee7e79013a9fc89678a81e7ff5bb1f7d8dd3f50419e7ad

SHA512
0bd8227af1a004ba561d4ae83d0b7fac9742ca29f19162b4c087b3728ef0144094548401de65636e6603e03e64a8f611354c9be1c848ecc29202e1d041841769

Download Submit
C:\Program Files\Box\Box\Box.Updater.Common.dll

Filesize
86KB

MD5
027e8273b53770bf982410a7afa6e880

SHA1
11f35d2171e29b296f084e3a7a8987d1667f28fd

SHA256
5e597a6f3aad3f7357fef009bba6be7d74e299f32af09c83d6e052084819c4f8

SHA512
d1db9098297e62f7d646f160ce36258b092e1ed008a2d7cbcea8a3df183cf47c512e4005785dbefa607925a52954681de08f01ecfe2db4617ea4244731aa0d59

Download Submit
C:\Program Files\Box\Box\Box.Updater.Common.dll

Filesize
86KB

MD5
027e8273b53770bf982410a7afa6e880

SHA1
11f35d2171e29b296f084e3a7a8987d1667f28fd

SHA256
5e597a6f3aad3f7357fef009bba6be7d74e299f32af09c83d6e052084819c4f8

SHA512
d1db9098297e62f7d646f160ce36258b092e1ed008a2d7cbcea8a3df183cf47c512e4005785dbefa607925a52954681de08f01ecfe2db4617ea4244731aa0d59

Download Submit
C:\Program Files\Box\Box\Box.Updater.Common.dll

Filesize
86KB

MD5
027e8273b53770bf982410a7afa6e880

SHA1
11f35d2171e29b296f084e3a7a8987d1667f28fd

SHA256
5e597a6f3aad3f7357fef009bba6be7d74e299f32af09c83d6e052084819c4f8

SHA512
d1db9098297e62f7d646f160ce36258b092e1ed008a2d7cbcea8a3df183cf47c512e4005785dbefa607925a52954681de08f01ecfe2db4617ea4244731aa0d59

Download Submit
C:\Program Files\Box\Box\FS\streem.exe

Filesize
5.4MB

MD5
815a5fda1f58f84785328a33839e38f4

SHA1
7522c72af3c90f55aea4fcb4bd770f584cbf3dc9

SHA256
f9b65dfa4307a3ff4c2dab7a58ac3faea51ccaf91eab7339945c4fba0f947562

SHA512
85264441011f778ff165c9c006d2643f87addcba3c31f4878ac55e39cf0cf159e99287b1fab4ce4d8b0b518e64630f856828887f57224eaec63f98c5a26c7023

Download Submit
C:\Program Files\Box\Box\Logger.dll

Filesize
1.5MB

MD5
a7712cf084ce60903b39d05ad5e54072

SHA1
94ffbb94ddf905cf29b4ed898b2b9ba1ad18e2fd

SHA256
363c9568cb818dea1fd4a865a1794cf6ad1399077dbf1ee897bc0c16035a2f2b

SHA512
7c477f35dc4c30394dd48fd5cc0116901e08fa0396f7cc943ed152ae983bdd2dd0acab59c8a8d9f521f3111432b70139cf7ebedc7d3fc8945729cf1a1a4a3824

Download Submit
C:\Program Files\Box\Box\Logger.dll

Filesize
1.5MB

MD5
a7712cf084ce60903b39d05ad5e54072

SHA1
94ffbb94ddf905cf29b4ed898b2b9ba1ad18e2fd

SHA256
363c9568cb818dea1fd4a865a1794cf6ad1399077dbf1ee897bc0c16035a2f2b

SHA512
7c477f35dc4c30394dd48fd5cc0116901e08fa0396f7cc943ed152ae983bdd2dd0acab59c8a8d9f521f3111432b70139cf7ebedc7d3fc8945729cf1a1a4a3824

Download Submit
C:\Program Files\Box\Box\MetricsCollector.dll

Filesize
1.7MB

MD5
225e12babb54c39f1fe76f9b1fb7b05d

SHA1
3d900fef1533c19e05bdbe60c1eaae65e981e237

SHA256
eea6c18d46d1cca34eb6b191ec4e0661b3900d2ea18b2de7750afb67fd7a2f9e

SHA512
b9d0921fe758a969665981aee937a79886fc3ae5e259ba75550b844044964472dd1297eec2544dec3b98403673a4c9b80b67557dd8854974a890acd4aba90f8c

Download Submit
C:\Program Files\Box\Box\MetricsCollector.dll

Filesize
1.7MB

MD5
225e12babb54c39f1fe76f9b1fb7b05d

SHA1
3d900fef1533c19e05bdbe60c1eaae65e981e237

SHA256
eea6c18d46d1cca34eb6b191ec4e0661b3900d2ea18b2de7750afb67fd7a2f9e

SHA512
b9d0921fe758a969665981aee937a79886fc3ae5e259ba75550b844044964472dd1297eec2544dec3b98403673a4c9b80b67557dd8854974a890acd4aba90f8c

Download Submit
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\i386\cbfsconnectMntNtf2017.dll

Filesize
161KB

MD5
a1f40342e2235096a44c4b5275f15920

SHA1
416419620501d2945f67d42b08e4f77a762f7d55

SHA256
584bea9e5a48f13ed73922eb2c716d1478a092bdc637cc16dbc432e119919ce6

SHA512
ed0ad14c9316f49f3a47b4a033c9410f84db742a0a3258d01797897103145c09d8a5be88405d30e2afe496301280e9bb746aa1a9a3258913ea98739e97213463

Download Submit
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\i386\cbfsconnectMntNtf2017.dll

Filesize
161KB

MD5
a1f40342e2235096a44c4b5275f15920

SHA1
416419620501d2945f67d42b08e4f77a762f7d55

SHA256
584bea9e5a48f13ed73922eb2c716d1478a092bdc637cc16dbc432e119919ce6

SHA512
ed0ad14c9316f49f3a47b4a033c9410f84db742a0a3258d01797897103145c09d8a5be88405d30e2afe496301280e9bb746aa1a9a3258913ea98739e97213463

Download Submit
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\SHA1\cbfsconnect2017.sys

Filesize
461KB

MD5
069c3a913dc0c06bcf7e01b6f0ba1a02

SHA1
7876cbf5c504894297fcd76ea66634b5d5fd48e1

SHA256
4ef226e535412c917f68b42773f540381cd0c16ab6ef6bedccd5f2751469af27

SHA512
1f89d4d3742cc7640ffedf5d2eb9bad811e855ce50e53b471967189e8feae09769937fbbbb4df931b33f1c99afef3b3a8043a5b86a87433c6bf6296effc5a558

Download Submit
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\SHA1\vpnpbus.cat

Filesize
11KB

MD5
bd142677d640d66b2250a14c23d48604

SHA1
2909ecf28d21d8f182727d7f195a83415413e82f

SHA256
110ad61efd1739cefb7d6b8795ee8f71c5c124a991bb4751d7dc8eaaaabe4510

SHA512
9171ed572b4c9eab0aaecdaa80c64e94f3061b92ec631020b240129078cabff1b4a2be20123d119a78810855004af0adaa213489328ad4c921b9ec167710e71b

Download Submit
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\SHA1\vpnpbus.inf

Filesize
3KB

MD5
1d992ea7dd85d14453fce31efccd880b

SHA1
158f0140bb1511d22845177f7995cc2a153be819

SHA256
586cc28d61aed1819c321014fa757623693d49b327ecbae3bd77d288850de84f

SHA512
435b5a496c452082ba8782c4d299e8d0d262b28c98356170f5eba5db0d6bdef79037781a9d862d0dad5620deb3310d96f9f4ce62feff705985abf1f6715e5215

Download Submit
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\SHA1\vpnpbus.sys

Filesize
19KB

MD5
365d3f5287499804093a7f2d87d7edc6

SHA1
8e33ceea8b7c04dd7375ffc912904712c8d0db76

SHA256
1f0d74127c21db1e3f1c51226c9b9d352982b89881acb50cdf6b66a655e702a6

SHA512
b2c0f3d932120fbd79e6260ab3c9e46decac3f92506e6e4a89e3183b5c4d175bae96b5c48ee99d12436fedb0fd8aa4c6b203789fcd7b6da94e20d445034fdf41

Download Submit
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\cbfsconnectMntNtf2017.dll

Filesize
187KB

MD5
a88907698c38b50a0048a41fa1099811

SHA1
bcb9e98f1bafd263599809935f7ee61e1baa2a9f

SHA256
82df2628a5b525a9f0ba529644c83ea8cb6a7ed894a84ab82448fed5c064d120

SHA512
3ecdba7241d793811792d33607cfbb673438166d217089710ef4040c380bae230a2c8e51b761c850780336d46e89529d2f1f1da543ed36a3733ff5f9f3c9ef32

Download Submit
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\cbfsconnectMntNtf2017.dll

Filesize
187KB

MD5
a88907698c38b50a0048a41fa1099811

SHA1
bcb9e98f1bafd263599809935f7ee61e1baa2a9f

SHA256
82df2628a5b525a9f0ba529644c83ea8cb6a7ed894a84ab82448fed5c064d120

SHA512
3ecdba7241d793811792d33607cfbb673438166d217089710ef4040c380bae230a2c8e51b761c850780336d46e89529d2f1f1da543ed36a3733ff5f9f3c9ef32

Download Submit
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\cbfsconnectNetRdr2017.dll

Filesize
266KB

MD5
e594d34304ddb09cb359a3e95e67c7a1

SHA1
31246ec8ffaa0931a21a325616a619e53897c40e

SHA256
e5b69b230afd24b6b5cfe8b82c0bab87b58adf4f93dbac6f7ffbe310bae16074

SHA512
d7bfb6c22c213f35d01be67e8f1241964fe56c423bd90228b96c14f4517cdea26d9f5b1654800a0623783328a50492092cc156550ea4e6e29382374daad86204

Download Submit
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\cbfsconnectNetRdr2017.dll

Filesize
266KB

MD5
e594d34304ddb09cb359a3e95e67c7a1

SHA1
31246ec8ffaa0931a21a325616a619e53897c40e

SHA256
e5b69b230afd24b6b5cfe8b82c0bab87b58adf4f93dbac6f7ffbe310bae16074

SHA512
d7bfb6c22c213f35d01be67e8f1241964fe56c423bd90228b96c14f4517cdea26d9f5b1654800a0623783328a50492092cc156550ea4e6e29382374daad86204

Download Submit
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\vpnpbus.cat

Filesize
11KB

MD5
4191ba3b87e91483abebf12e7dee9d14

SHA1
0f38f0b690ab401ce4db77b382818c818bd06ab3

SHA256
8ae7d389b8a48de07345b54fff2fcbdea02cad6ee51998a97abaee448d976055

SHA512
97746d79b85770f5e656b1110191ae0c1a298f2fa1a0a68ce501abdf839e398e7ac2068a1b484e34de7b6272b4e3597bd20264354cf42eb2f9237ab8256643f9

Download Submit
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\vpnpbus.inf

Filesize
3KB

MD5
1d992ea7dd85d14453fce31efccd880b

SHA1
158f0140bb1511d22845177f7995cc2a153be819

SHA256
586cc28d61aed1819c321014fa757623693d49b327ecbae3bd77d288850de84f

SHA512
435b5a496c452082ba8782c4d299e8d0d262b28c98356170f5eba5db0d6bdef79037781a9d862d0dad5620deb3310d96f9f4ce62feff705985abf1f6715e5215

Download Submit
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\vpnpbus.sys

Filesize
21KB

MD5
a53fdf6ced9f56a67dd479f75cbf237d

SHA1
f87f6cb3f27c468de9f2cbe7c8cdc6d5806afd72

SHA256
f513a07fe88a43b6b4a2cafb4f24e2a6e5cbbe27877f984776b0fb9e5397c41f

SHA512
9e9d123358c763721d2664f1e7bd5de3aeb6bd14f841a0b21bae957d2579b0f41f6ef04181b76fde422cc971cb953f2d6eaaac20551d3b42e732b256800c57cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
da5a9f149955d936a31dc5e456666aac

SHA1
195238d41c1e13448f349f43bb295ef2d55cb47a

SHA256
79ac574c7c45144bb35b59ff79c78dc59b66592715dea01b389e3620db663224

SHA512
60d7d1f5405470ba1e6b80066af2e78240acbea8db58b5a03660874605178aebaa9ce342ca97f17798109e7411e82466db5af064e39eaddc05410f2abe672f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1087D831978A422F28E1D1E590C230EB

Filesize
727B

MD5
b1d53fde6c0504ef36a7dd1d1ac8d06d

SHA1
f909a4c4a10a87bd867755e2c9747885536269d1

SHA256
896cdfb02e73d12bb56df3b8919784f48f033aa7fb8553f6ab135df9c953d6ce

SHA512
d3d18f4595998acfb66d5cd3ed5d61af598499eef8b506705b9063f996841014d8d7a8bd989ee23c5bb6441689e6ce07706c14de7378851535f044b9e99411be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
e16ae940b7bcfea2b04f09d179ae410d

SHA1
1e2bc3f93733aab8e3337adcff19036829b73bed

SHA256
52f32d49ac49db0b7d49020dfe463332e066efb83677c53d2643fda36e319d56

SHA512
3a788959faadba8f15808d599226e5011648c28d60db0538b20305fa212a354c987d60b2480954162130996c83ab86fc8076fcf492a96dc5aec0a1f173b7fb60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
430B

MD5
2ee134feb9a7c4bfcd84f87f99c339da

SHA1
501ac3551d30a88e39502561a2d32c631b021010

SHA256
b27134a434d43a549e8b941234587d46fd65e09cc3c84bf9ffb724727be01a30

SHA512
bd134810bd3c82fab2529891390892a5633c6a7df1933c69bf94c9a6b7a7f7eada35a1e30c40ffe4a96dd20de822608dc1329885e7b71ace94e493a559bfad94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1087D831978A422F28E1D1E590C230EB

Filesize
434B

MD5
e235a60e56c92e6a0a2517df667df5de

SHA1
83ebdb5352c5f9ae9a39b9ea497252c0fcb42183

SHA256
633a31b65fdc56e098cff28ed5f3f877cc7201f3efc8bf2aa75ef88b5f6aaa18

SHA512
ad227bf1280e1d4eb6b41f21e538ae98e0c9d6f6ee3e331b1e5eba85fc075389d8a405f2ba5b59410f1b21a3637395e5f1742ec99e6bf88713689537b1cab22a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
442B

MD5
657be7ce4614e6a38645f09834534daa

SHA1
6bad7f92e8b125f18e30627ba8709ee700490e47

SHA256
eeedbf3f08736866ee03a98f47c1a5e3aee2b1358a52735ce176baeba7d9d472

SHA512
3070c16c40e94c720c0f455ee75b513a7625bd08998cf695af9a11191ffd17e26c16c9cf5445ad33cc33f569805eb807f40363605c5963c853f35dac084529a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log

Filesize
651B

MD5
00bfeb783aeff425ce898d55718d506d

SHA1
aac7a973dc1f9ca7abc529c7ea37ad7eaf491b8f

SHA256
d06099ef43eb002055378b1b6d9853f9b1f891ada476932ba575d1f97065a580

SHA512
2209d5f4999cb36ebf26c6b8cb3195cc9fc0f0a103f4a28dd77b04605d7c6e79d47d806454c63b8d42bbe32864be7cdb56df3cccf71a6c27fe0b331d8304e1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6c1fd.LOG

Filesize
47KB

MD5
f95a59b0eeb617bc824320b1783d0d8f

SHA1
4a63d8c721d3bc6fa72e9ff6f77097d95c58829e

SHA256
b9d7d6b607a1369ad2bfa9a4b5940078c823c93b4c3f7d0885083e3c4967a9ab

SHA512
240fef1a81a0bf0d63b630fc35df30a8be2a940bccce7b4cba839e0495a1fee1b2e924bb0688f7317f0f71b888e5ad9823ca76d3ff221638b2cdd2091559ad3b

Download Submit
C:\Windows\Installer\MSI1482.tmp

Filesize
243KB

MD5
aaab8d3f7e9e8f143a17a0d15a1d1715

SHA1
8aca4e362e4cdc68c2f8f8f35f200126716f9c74

SHA256
fd3d6c50c3524063f7c28f815838e0fb06fd4ebff094e7b88902334abd463889

SHA512
1999224f57cd453d5d4d7d678144e0b719290ae925bb3574ce28ae787dc406a6b3df8e44475b12b9cdc0ff43d2979f626f08291304c66cdca536cd1897715c9a

Download Submit
C:\Windows\Installer\MSI1482.tmp

Filesize
243KB

MD5
aaab8d3f7e9e8f143a17a0d15a1d1715

SHA1
8aca4e362e4cdc68c2f8f8f35f200126716f9c74

SHA256
fd3d6c50c3524063f7c28f815838e0fb06fd4ebff094e7b88902334abd463889

SHA512
1999224f57cd453d5d4d7d678144e0b719290ae925bb3574ce28ae787dc406a6b3df8e44475b12b9cdc0ff43d2979f626f08291304c66cdca536cd1897715c9a

Download Submit
C:\Windows\Installer\MSI17CF.tmp

Filesize
243KB

MD5
aaab8d3f7e9e8f143a17a0d15a1d1715

SHA1
8aca4e362e4cdc68c2f8f8f35f200126716f9c74

SHA256
fd3d6c50c3524063f7c28f815838e0fb06fd4ebff094e7b88902334abd463889

SHA512
1999224f57cd453d5d4d7d678144e0b719290ae925bb3574ce28ae787dc406a6b3df8e44475b12b9cdc0ff43d2979f626f08291304c66cdca536cd1897715c9a

Download Submit
C:\Windows\Installer\MSI17CF.tmp

Filesize
243KB

MD5
aaab8d3f7e9e8f143a17a0d15a1d1715

SHA1
8aca4e362e4cdc68c2f8f8f35f200126716f9c74

SHA256
fd3d6c50c3524063f7c28f815838e0fb06fd4ebff094e7b88902334abd463889

SHA512
1999224f57cd453d5d4d7d678144e0b719290ae925bb3574ce28ae787dc406a6b3df8e44475b12b9cdc0ff43d2979f626f08291304c66cdca536cd1897715c9a

Download Submit
C:\Windows\Installer\MSI182D.tmp

Filesize
243KB

MD5
aaab8d3f7e9e8f143a17a0d15a1d1715

SHA1
8aca4e362e4cdc68c2f8f8f35f200126716f9c74

SHA256
fd3d6c50c3524063f7c28f815838e0fb06fd4ebff094e7b88902334abd463889

SHA512
1999224f57cd453d5d4d7d678144e0b719290ae925bb3574ce28ae787dc406a6b3df8e44475b12b9cdc0ff43d2979f626f08291304c66cdca536cd1897715c9a

Download Submit
C:\Windows\Installer\MSI182D.tmp

Filesize
243KB

MD5
aaab8d3f7e9e8f143a17a0d15a1d1715

SHA1
8aca4e362e4cdc68c2f8f8f35f200126716f9c74

SHA256
fd3d6c50c3524063f7c28f815838e0fb06fd4ebff094e7b88902334abd463889

SHA512
1999224f57cd453d5d4d7d678144e0b719290ae925bb3574ce28ae787dc406a6b3df8e44475b12b9cdc0ff43d2979f626f08291304c66cdca536cd1897715c9a

Download Submit
C:\Windows\Installer\MSI1909.tmp

Filesize
380KB

MD5
3eb31b9a689d506f3b1d3738d28ab640

SHA1
1681fe3bbdcbe617a034b092ea77249dd4c3e986

SHA256
3a7d9cdd6be9ce0e4d01e9894242b497536336bf1850fb0a814a369c8a189c46

SHA512
2598e39f4fd139775bbb040218af802db722d4dca99a4230edfde282362b433c5e30c15d5385063aa76bff916031b0e43586ef05d2ada4edc3c1410371b98e09

Download Submit
C:\Windows\Installer\MSI1909.tmp

Filesize
380KB

MD5
3eb31b9a689d506f3b1d3738d28ab640

SHA1
1681fe3bbdcbe617a034b092ea77249dd4c3e986

SHA256
3a7d9cdd6be9ce0e4d01e9894242b497536336bf1850fb0a814a369c8a189c46

SHA512
2598e39f4fd139775bbb040218af802db722d4dca99a4230edfde282362b433c5e30c15d5385063aa76bff916031b0e43586ef05d2ada4edc3c1410371b98e09

Download Submit
C:\Windows\Installer\MSI1968.tmp

Filesize
243KB

MD5
aaab8d3f7e9e8f143a17a0d15a1d1715

SHA1
8aca4e362e4cdc68c2f8f8f35f200126716f9c74

SHA256
fd3d6c50c3524063f7c28f815838e0fb06fd4ebff094e7b88902334abd463889

SHA512
1999224f57cd453d5d4d7d678144e0b719290ae925bb3574ce28ae787dc406a6b3df8e44475b12b9cdc0ff43d2979f626f08291304c66cdca536cd1897715c9a

Download Submit
C:\Windows\Installer\MSI1968.tmp

Filesize
243KB

MD5
aaab8d3f7e9e8f143a17a0d15a1d1715

SHA1
8aca4e362e4cdc68c2f8f8f35f200126716f9c74

SHA256
fd3d6c50c3524063f7c28f815838e0fb06fd4ebff094e7b88902334abd463889

SHA512
1999224f57cd453d5d4d7d678144e0b719290ae925bb3574ce28ae787dc406a6b3df8e44475b12b9cdc0ff43d2979f626f08291304c66cdca536cd1897715c9a

Download Submit
C:\Windows\Installer\MSI1C39.tmp

Filesize
548KB

MD5
f5cc49103be002b80429c0ebe73175b9

SHA1
8b7077a4348d2355a4470cbf53ffa524d3a28b9e

SHA256
5fad8ac0929c29ff522bde7025f17774f2e996137cb349844b9595250d457cba

SHA512
fe7f01ff6b9b476085961bf953f723e1ced8be9339802bfdb156bee3b20b0e5dce79726c5e40a7338beac35eceec5b516c46b8fd0f0722ed5d43ef2693be74a4

Download Submit
C:\Windows\Installer\MSI1C39.tmp

Filesize
548KB

MD5
f5cc49103be002b80429c0ebe73175b9

SHA1
8b7077a4348d2355a4470cbf53ffa524d3a28b9e

SHA256
5fad8ac0929c29ff522bde7025f17774f2e996137cb349844b9595250d457cba

SHA512
fe7f01ff6b9b476085961bf953f723e1ced8be9339802bfdb156bee3b20b0e5dce79726c5e40a7338beac35eceec5b516c46b8fd0f0722ed5d43ef2693be74a4

Download Submit
C:\Windows\Installer\MSI2254.tmp

Filesize
316KB

MD5
4bfe0aa88e19ab5ec0b61f8155ed3bab

SHA1
971ba3bf9e42b07041f25bea5fb3265eb554eaed

SHA256
5a39d6665195b314fb6f0130509de112be0973add8238c1d667c9a7ee97ecc7c

SHA512
5a21e18e9b41e5713cd3cf14a60fb181392313f96dc0ecffb244c0b3197d44e6cc47ec802a49cb403929a511e3e86bf157da39da6c5e9b34aae5e01165ba0b83

Download Submit
C:\Windows\Installer\MSI2254.tmp

Filesize
316KB

MD5
4bfe0aa88e19ab5ec0b61f8155ed3bab

SHA1
971ba3bf9e42b07041f25bea5fb3265eb554eaed

SHA256
5a39d6665195b314fb6f0130509de112be0973add8238c1d667c9a7ee97ecc7c

SHA512
5a21e18e9b41e5713cd3cf14a60fb181392313f96dc0ecffb244c0b3197d44e6cc47ec802a49cb403929a511e3e86bf157da39da6c5e9b34aae5e01165ba0b83

Download Submit
C:\Windows\Installer\MSI2254.tmp

Filesize
316KB

MD5
4bfe0aa88e19ab5ec0b61f8155ed3bab

SHA1
971ba3bf9e42b07041f25bea5fb3265eb554eaed

SHA256
5a39d6665195b314fb6f0130509de112be0973add8238c1d667c9a7ee97ecc7c

SHA512
5a21e18e9b41e5713cd3cf14a60fb181392313f96dc0ecffb244c0b3197d44e6cc47ec802a49cb403929a511e3e86bf157da39da6c5e9b34aae5e01165ba0b83

Download Submit
C:\Windows\Installer\MSI2254.tmp-\Box.Desktop.Installer.CustomActions.dll

Filesize
54KB

MD5
d2185e369e1dc4687a7fea38e486308d

SHA1
9b421c3bdb91d584d5286579f82114cc7040e8d8

SHA256
0fb9338b6c4b05eb345fd6cba3ff09568b369f700575e173097a7131dacda9a3

SHA512
1cf7c8a7f8fdf039f1ae3c7c1cc96f9eacaaf726bc92afb1958a22b23002fbc08156f182e52a8c1ca542a1ee153a3c869e873fbd0b100b8b41d3f1e10d3834c3

Download Submit
C:\Windows\Installer\MSI2254.tmp-\Box.Desktop.Installer.CustomActions.dll

Filesize
54KB

MD5
d2185e369e1dc4687a7fea38e486308d

SHA1
9b421c3bdb91d584d5286579f82114cc7040e8d8

SHA256
0fb9338b6c4b05eb345fd6cba3ff09568b369f700575e173097a7131dacda9a3

SHA512
1cf7c8a7f8fdf039f1ae3c7c1cc96f9eacaaf726bc92afb1958a22b23002fbc08156f182e52a8c1ca542a1ee153a3c869e873fbd0b100b8b41d3f1e10d3834c3

Download Submit
C:\Windows\Installer\MSI3810.tmp

Filesize
316KB

MD5
4bfe0aa88e19ab5ec0b61f8155ed3bab

SHA1
971ba3bf9e42b07041f25bea5fb3265eb554eaed

SHA256
5a39d6665195b314fb6f0130509de112be0973add8238c1d667c9a7ee97ecc7c

SHA512
5a21e18e9b41e5713cd3cf14a60fb181392313f96dc0ecffb244c0b3197d44e6cc47ec802a49cb403929a511e3e86bf157da39da6c5e9b34aae5e01165ba0b83

Download Submit
C:\Windows\Installer\MSI3810.tmp

Filesize
316KB

MD5
4bfe0aa88e19ab5ec0b61f8155ed3bab

SHA1
971ba3bf9e42b07041f25bea5fb3265eb554eaed

SHA256
5a39d6665195b314fb6f0130509de112be0973add8238c1d667c9a7ee97ecc7c

SHA512
5a21e18e9b41e5713cd3cf14a60fb181392313f96dc0ecffb244c0b3197d44e6cc47ec802a49cb403929a511e3e86bf157da39da6c5e9b34aae5e01165ba0b83

Download Submit
C:\Windows\Installer\MSI3810.tmp

Filesize
316KB

MD5
4bfe0aa88e19ab5ec0b61f8155ed3bab

SHA1
971ba3bf9e42b07041f25bea5fb3265eb554eaed

SHA256
5a39d6665195b314fb6f0130509de112be0973add8238c1d667c9a7ee97ecc7c

SHA512
5a21e18e9b41e5713cd3cf14a60fb181392313f96dc0ecffb244c0b3197d44e6cc47ec802a49cb403929a511e3e86bf157da39da6c5e9b34aae5e01165ba0b83

Download Submit
C:\Windows\Installer\MSI3810.tmp-\Box.Desktop.Installer.CustomActions.dll

Filesize
54KB

MD5
d2185e369e1dc4687a7fea38e486308d

SHA1
9b421c3bdb91d584d5286579f82114cc7040e8d8

SHA256
0fb9338b6c4b05eb345fd6cba3ff09568b369f700575e173097a7131dacda9a3

SHA512
1cf7c8a7f8fdf039f1ae3c7c1cc96f9eacaaf726bc92afb1958a22b23002fbc08156f182e52a8c1ca542a1ee153a3c869e873fbd0b100b8b41d3f1e10d3834c3

Download Submit
C:\Windows\Installer\MSI3810.tmp-\Box.Desktop.Installer.CustomActions.dll

Filesize
54KB

MD5
d2185e369e1dc4687a7fea38e486308d

SHA1
9b421c3bdb91d584d5286579f82114cc7040e8d8

SHA256
0fb9338b6c4b05eb345fd6cba3ff09568b369f700575e173097a7131dacda9a3

SHA512
1cf7c8a7f8fdf039f1ae3c7c1cc96f9eacaaf726bc92afb1958a22b23002fbc08156f182e52a8c1ca542a1ee153a3c869e873fbd0b100b8b41d3f1e10d3834c3

Download Submit
C:\Windows\Installer\MSI3AFF.tmp

Filesize
316KB

MD5
4bfe0aa88e19ab5ec0b61f8155ed3bab

SHA1
971ba3bf9e42b07041f25bea5fb3265eb554eaed

SHA256
5a39d6665195b314fb6f0130509de112be0973add8238c1d667c9a7ee97ecc7c

SHA512
5a21e18e9b41e5713cd3cf14a60fb181392313f96dc0ecffb244c0b3197d44e6cc47ec802a49cb403929a511e3e86bf157da39da6c5e9b34aae5e01165ba0b83

Download Submit
C:\Windows\Installer\MSI3AFF.tmp

Filesize
316KB

MD5
4bfe0aa88e19ab5ec0b61f8155ed3bab

SHA1
971ba3bf9e42b07041f25bea5fb3265eb554eaed

SHA256
5a39d6665195b314fb6f0130509de112be0973add8238c1d667c9a7ee97ecc7c

SHA512
5a21e18e9b41e5713cd3cf14a60fb181392313f96dc0ecffb244c0b3197d44e6cc47ec802a49cb403929a511e3e86bf157da39da6c5e9b34aae5e01165ba0b83

Download Submit
C:\Windows\Installer\MSI3AFF.tmp

Filesize
316KB

MD5
4bfe0aa88e19ab5ec0b61f8155ed3bab

SHA1
971ba3bf9e42b07041f25bea5fb3265eb554eaed

SHA256
5a39d6665195b314fb6f0130509de112be0973add8238c1d667c9a7ee97ecc7c

SHA512
5a21e18e9b41e5713cd3cf14a60fb181392313f96dc0ecffb244c0b3197d44e6cc47ec802a49cb403929a511e3e86bf157da39da6c5e9b34aae5e01165ba0b83

Download Submit
C:\Windows\Installer\MSI3AFF.tmp-\Box.Desktop.Installer.CustomActions.dll

Filesize
54KB

MD5
d2185e369e1dc4687a7fea38e486308d

SHA1
9b421c3bdb91d584d5286579f82114cc7040e8d8

SHA256
0fb9338b6c4b05eb345fd6cba3ff09568b369f700575e173097a7131dacda9a3

SHA512
1cf7c8a7f8fdf039f1ae3c7c1cc96f9eacaaf726bc92afb1958a22b23002fbc08156f182e52a8c1ca542a1ee153a3c869e873fbd0b100b8b41d3f1e10d3834c3

Download Submit
C:\Windows\Installer\MSI3AFF.tmp-\Box.Desktop.Installer.CustomActions.dll

Filesize
54KB

MD5
d2185e369e1dc4687a7fea38e486308d

SHA1
9b421c3bdb91d584d5286579f82114cc7040e8d8

SHA256
0fb9338b6c4b05eb345fd6cba3ff09568b369f700575e173097a7131dacda9a3

SHA512
1cf7c8a7f8fdf039f1ae3c7c1cc96f9eacaaf726bc92afb1958a22b23002fbc08156f182e52a8c1ca542a1ee153a3c869e873fbd0b100b8b41d3f1e10d3834c3

Download Submit
C:\Windows\Installer\MSI4F91.tmp

Filesize
316KB

MD5
4bfe0aa88e19ab5ec0b61f8155ed3bab

SHA1
971ba3bf9e42b07041f25bea5fb3265eb554eaed

SHA256
5a39d6665195b314fb6f0130509de112be0973add8238c1d667c9a7ee97ecc7c

SHA512
5a21e18e9b41e5713cd3cf14a60fb181392313f96dc0ecffb244c0b3197d44e6cc47ec802a49cb403929a511e3e86bf157da39da6c5e9b34aae5e01165ba0b83

Download Submit
C:\Windows\Installer\MSI4F91.tmp

Filesize
316KB

MD5
4bfe0aa88e19ab5ec0b61f8155ed3bab

SHA1
971ba3bf9e42b07041f25bea5fb3265eb554eaed

SHA256
5a39d6665195b314fb6f0130509de112be0973add8238c1d667c9a7ee97ecc7c

SHA512
5a21e18e9b41e5713cd3cf14a60fb181392313f96dc0ecffb244c0b3197d44e6cc47ec802a49cb403929a511e3e86bf157da39da6c5e9b34aae5e01165ba0b83

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
11.8MB

MD5
9d849f3ccb6350a62fb6b9b65dca1c57

SHA1
25821aed651e229e558f50e691f110e0d835d550

SHA256
2aa1a2721f370e04c83a7ae97f08f5a6c71b9451cb7ba60436c8b637a6eba742

SHA512
9e799e2385cfc106f747641640ca0314a6c8e9e41bb2b8be590a2392713dfa6417f744441d5a30a83e0decfcc119b104d1aa811d812ac80aed9e7f7a7db3169a

Download Submit
\??\Volume{2339e045-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e20b6669-6add-486a-8f4d-0ad7a949a4a6}_OnDiskSnapshotProp

Filesize
5KB

MD5
eb476b383015fa8276d03362ea2097b4

SHA1
7d3aaa40b3b2eefc66891001c24019467cc16635

SHA256
4e8bb558934d07803717a9adb9a6d91e99a9468a03a2e74f137cece98639cc67

SHA512
55b1f3ec0e01f7218460495a9a8f3803c66b1c06bd2bd16980c50b1ed07ba2287a9a1a5bc9935761c5bce4b86f7314261a01ac60aad5852dbed0b93764dc9417

Download Submit
memory/1496-176-0x000002566E570000-0x000002566E5AC000-memory.dmp

Filesize
240KB

Download
memory/1496-172-0x000002566D110000-0x000002566D128000-memory.dmp

Filesize
96KB

Download
memory/1496-168-0x000002566CCF0000-0x000002566CD0A000-memory.dmp

Filesize
104KB

Download
memory/1496-175-0x000002566E510000-0x000002566E522000-memory.dmp

Filesize
72KB

Download
memory/1496-179-0x00007FFCA98B0000-0x00007FFCAA371000-memory.dmp

Filesize
10.8MB

Download
memory/1496-225-0x00007FFCA98B0000-0x00007FFCAA371000-memory.dmp

Filesize
10.8MB

Download
memory/1508-215-0x0000000000000000-mapping.dmp

Download
memory/1808-222-0x00007FFCA98B0000-0x00007FFCAA371000-memory.dmp

Filesize
10.8MB

Download
memory/1808-221-0x000001645FD50000-0x000001645FD68000-memory.dmp

Filesize
96KB

Download
memory/1808-223-0x00007FFCA98B0000-0x00007FFCAA371000-memory.dmp

Filesize
10.8MB

Download
memory/1808-220-0x0000000000000000-mapping.dmp

Download
memory/2052-187-0x000001C175E80000-0x000001C175E8A000-memory.dmp

Filesize
40KB

Download
memory/2052-182-0x0000000000000000-mapping.dmp

Download
memory/2052-188-0x000001C175F20000-0x000001C175F46000-memory.dmp

Filesize
152KB

Download
memory/2052-189-0x00007FFCA98B0000-0x00007FFCAA371000-memory.dmp

Filesize
10.8MB

Download
memory/2368-272-0x0000019A60579000-0x0000019A6057D000-memory.dmp

Filesize
16KB

Download
memory/2368-277-0x0000019A6057D000-0x0000019A60580000-memory.dmp

Filesize
12KB

Download
memory/2368-250-0x0000019A5E4C0000-0x0000019A5E4E0000-memory.dmp

Filesize
128KB

Download
memory/2368-248-0x0000019A5E480000-0x0000019A5E4A0000-memory.dmp

Filesize
128KB

Download
memory/2368-279-0x0000019A6057D000-0x0000019A60580000-memory.dmp

Filesize
12KB

Download
memory/2368-273-0x0000019A60579000-0x0000019A6057D000-memory.dmp

Filesize
16KB

Download
memory/2368-274-0x0000019A60579000-0x0000019A6057D000-memory.dmp

Filesize
16KB

Download
memory/2368-280-0x0000019A6057D000-0x0000019A60580000-memory.dmp

Filesize
12KB

Download
memory/2368-278-0x0000019A6057D000-0x0000019A60580000-memory.dmp

Filesize
12KB

Download
memory/2368-275-0x0000019A60579000-0x0000019A6057D000-memory.dmp

Filesize
16KB

Download
memory/2368-271-0x0000019A60579000-0x0000019A6057D000-memory.dmp

Filesize
16KB

Download
memory/2424-219-0x00007FFCA98B0000-0x00007FFCAA371000-memory.dmp

Filesize
10.8MB

Download
memory/2424-218-0x0000000000000000-mapping.dmp

Download
memory/2940-202-0x0000000000000000-mapping.dmp

Download
memory/3388-228-0x00007FFCA98B0000-0x00007FFCAA371000-memory.dmp

Filesize
10.8MB

Download
memory/3388-252-0x0000026D6BE20000-0x0000026D6BE24000-memory.dmp

Filesize
16KB

Download
memory/3388-227-0x0000026D50E20000-0x0000026D50E50000-memory.dmp

Filesize
192KB

Download
memory/3388-224-0x0000000000000000-mapping.dmp

Download
memory/3388-229-0x0000026D6A530000-0x0000026D6A570000-memory.dmp

Filesize
256KB

Download
memory/3388-230-0x0000026D6BA40000-0x0000026D6BFE4000-memory.dmp

Filesize
5.6MB

Download
memory/3388-231-0x0000026D6B5A0000-0x0000026D6B5A8000-memory.dmp

Filesize
32KB

Download
memory/3388-232-0x0000026D6B5A0000-0x0000026D6B5A6000-memory.dmp

Filesize
24KB

Download
memory/3388-233-0x0000026D6B750000-0x0000026D6B8D6000-memory.dmp

Filesize
1.5MB

Download
memory/3388-236-0x0000026D6DC20000-0x0000026D6E148000-memory.dmp

Filesize
5.2MB

Download
memory/3388-239-0x0000026D6BD60000-0x0000026D6BD72000-memory.dmp

Filesize
72KB

Download
memory/3388-240-0x0000026D6BD80000-0x0000026D6BDA0000-memory.dmp

Filesize
128KB

Download
memory/3388-244-0x0000026D51069000-0x0000026D5106F000-memory.dmp

Filesize
24KB

Download
memory/3388-242-0x0000026D6BDE0000-0x0000026D6BE12000-memory.dmp

Filesize
200KB

Download
memory/3388-283-0x0000026D6BE20000-0x0000026D6BE24000-memory.dmp

Filesize
16KB

Download
memory/3388-282-0x0000026D51069000-0x0000026D5106F000-memory.dmp

Filesize
24KB

Download
memory/3388-266-0x00007FFCA98B0000-0x00007FFCAA371000-memory.dmp

Filesize
10.8MB

Download
memory/3388-226-0x00007FFCB9FF0000-0x00007FFCB9FFA000-memory.dmp

Filesize
40KB

Download
memory/3920-257-0x000001C2F8160000-0x000001C2F8178000-memory.dmp

Filesize
96KB

Download
memory/3920-270-0x000001CAF9ED0000-0x000001CAFA3F8000-memory.dmp

Filesize
5.2MB

Download
memory/3920-251-0x000001C2F7460000-0x000001C2F7474000-memory.dmp

Filesize
80KB

Download
memory/3920-255-0x00007FFCA98B0000-0x00007FFCAA371000-memory.dmp

Filesize
10.8MB

Download
memory/3920-256-0x000001C2F8130000-0x000001C2F815E000-memory.dmp

Filesize
184KB

Download
memory/3920-286-0x000001CAF9ED0000-0x000001CAFA3F8000-memory.dmp

Filesize
5.2MB

Download
memory/3920-260-0x000001C2F8590000-0x000001C2F8598000-memory.dmp

Filesize
32KB

Download
memory/3920-261-0x000001C2F8470000-0x000001C2F84A8000-memory.dmp

Filesize
224KB

Download
memory/3920-262-0x000001C2F8440000-0x000001C2F844E000-memory.dmp

Filesize
56KB

Download
memory/3920-263-0x000001C2F84E0000-0x000001C2F850E000-memory.dmp

Filesize
184KB

Download
memory/3920-264-0x000001C2F90A0000-0x000001C2F90FA000-memory.dmp

Filesize
360KB

Download
memory/3920-285-0x000001C2F5E39000-0x000001C2F5E3F000-memory.dmp

Filesize
24KB

Download
memory/3920-267-0x000001C2F5E39000-0x000001C2F5E3F000-memory.dmp

Filesize
24KB

Download
memory/3920-268-0x000001C2F95E0000-0x000001C2F9628000-memory.dmp

Filesize
288KB

Download
memory/3920-269-0x000001CAFD390000-0x000001CAFDB36000-memory.dmp

Filesize
7.6MB

Download
memory/3920-249-0x000001C2F5B50000-0x000001C2F5B5A000-memory.dmp

Filesize
40KB

Download
memory/3920-284-0x00007FFCA98B0000-0x00007FFCAA371000-memory.dmp

Filesize
10.8MB

Download
memory/3920-246-0x0000000000000000-mapping.dmp

Download
memory/3920-247-0x000001C2F53B0000-0x000001C2F5922000-memory.dmp

Filesize
5.4MB

Download
memory/4124-142-0x0000000000000000-mapping.dmp

Download
memory/4700-199-0x00007FFCA98B0000-0x00007FFCAA371000-memory.dmp

Filesize
10.8MB

Download
memory/4700-192-0x0000000000000000-mapping.dmp

Download
memory/4700-214-0x00007FFCA98B0000-0x00007FFCAA371000-memory.dmp

Filesize
10.8MB

Download
memory/4704-163-0x000002AC524A0000-0x000002AC524B2000-memory.dmp

Filesize
72KB

Download
memory/4704-164-0x00007FFCA98B0000-0x00007FFCAA371000-memory.dmp

Filesize
10.8MB

Download
memory/4704-160-0x000002AC52470000-0x000002AC5249E000-memory.dmp

Filesize
184KB

Download
memory/4704-158-0x0000000000000000-mapping.dmp

Download
memory/4944-155-0x0000000000000000-mapping.dmp

Download
memory/4972-196-0x0000000000000000-mapping.dmp

Download
memory/5116-133-0x0000000000000000-mapping.dmp

Download