62608774b218119e487551279c98eb02f142c36b69c4b69191a99632bd1fa632

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 21:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

62608774b218119e487551279c98eb02f142c36b69c4b69191a99632bd1fa632.exe
Size

2.9MB
MD5

dec604ab31fac94baa2d716e293d49a9
SHA1

93fc15b86d059d7a57e2c7e1917d583a539256bf
SHA256

62608774b218119e487551279c98eb02f142c36b69c4b69191a99632bd1fa632
SHA512

45d439c253cd650db1307572d481fdbb3b36994ca6ef8997c3b2cbeba16ed59899dfe4ec645c78a68a3c05442f8299f1724c0c0dd7df85eb236c80b5cebd14e2
SSDEEP

49152:DnAZUF+5FGhV30nF7EEc/aa/+UsPzI6HzAxHKntkLAxcvLrnnIF:0ZUF+COFgBcc6H0JjLAmnI

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\VmtkmMouFiltr_0.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET870B.tmp	DrvInst.exe
File created	C:\Windows\system32\DRIVERS\SET870B.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\VmtkmHid_0.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\drivers\SET9AF8.tmp	DrvInst.exe
File created	C:\Windows\system32\drivers\SET9AF8.tmp	DrvInst.exe

Executes dropped EXE 2 IoCs

pid	Process
2916	devcon.exe
1076	devcon.exe

Loads dropped DLL 2 IoCs

pid	Process
2896	cmd.exe
2896	cmd.exe

Drops file in System32 directory 43 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1da31cad-954a-2230-e894-2a1ee80e3459}\VmtkmHid_0.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1da31cad-954a-2230-e894-2a1ee80e3459}\SET843E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmtkmhid_0.inf_amd64_neutral_aaf954d05a2c7d7f\vmtkmhid_0.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	devcon.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{10b64297-c24e-05e6-3eb8-563cbbc48e54}\SET8BFB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{10b64297-c24e-05e6-3eb8-563cbbc48e54}\vmtkmmoufiltr_0.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	devcon.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{10b64297-c24e-05e6-3eb8-563cbbc48e54}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1da31cad-954a-2230-e894-2a1ee80e3459}\SET843E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1da31cad-954a-2230-e894-2a1ee80e3459}\vmtkmhid_0.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1da31cad-954a-2230-e894-2a1ee80e3459}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{10b64297-c24e-05e6-3eb8-563cbbc48e54}\SET8BFA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{10b64297-c24e-05e6-3eb8-563cbbc48e54}\SET8C0C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{10b64297-c24e-05e6-3eb8-563cbbc48e54}\SET8C0C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{10b64297-c24e-05e6-3eb8-563cbbc48e54}\VmtkmMouFiltr_0.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1da31cad-954a-2230-e894-2a1ee80e3459}\SET843D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	devcon.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hidserv.inf_amd64_neutral_f2223e39f37c69f3\hidserv.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	devcon.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vmtkmmoufiltr_0.inf_amd64_neutral_75b639d4ffc4e70a\vmtkmmoufiltr_0.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{10b64297-c24e-05e6-3eb8-563cbbc48e54}\VmtkmHid_0.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{10b64297-c24e-05e6-3eb8-563cbbc48e54}\SET8BFB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1da31cad-954a-2230-e894-2a1ee80e3459}\SET843F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1da31cad-954a-2230-e894-2a1ee80e3459}\SET843F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	devcon.exe
File created	C:\Windows\System32\DriverStore\Temp\{1da31cad-954a-2230-e894-2a1ee80e3459}\SET843D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1da31cad-954a-2230-e894-2a1ee80e3459}\VmtkmHid_0.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmtkmmoufiltr_0.inf_amd64_neutral_75b639d4ffc4e70a\vmtkmmoufiltr_0.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	devcon.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vmtkmhid_0.inf_amd64_neutral_aaf954d05a2c7d7f\vmtkmhid_0.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{10b64297-c24e-05e6-3eb8-563cbbc48e54}\SET8BFA.tmp	DrvInst.exe

Drops file in Windows directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\setuperr.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\setupact.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\hidserv.PNF	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem2.PNF	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\setupact.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\setuperr.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\setupact.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File created	C:\Windows\INF\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\setuperr.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem3.PNF	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2916	devcon.exe
Token: SeLoadDriverPrivilege	2916	devcon.exe
Token: SeRestorePrivilege	1804	DrvInst.exe
Token: SeRestorePrivilege	1804	DrvInst.exe
Token: SeRestorePrivilege	1804	DrvInst.exe
Token: SeRestorePrivilege	1804	DrvInst.exe
Token: SeRestorePrivilege	1804	DrvInst.exe
Token: SeRestorePrivilege	1804	DrvInst.exe
Token: SeRestorePrivilege	1804	DrvInst.exe
Token: SeRestorePrivilege	1804	DrvInst.exe
Token: SeLoadDriverPrivilege	1804	DrvInst.exe
Token: SeLoadDriverPrivilege	1804	DrvInst.exe
Token: SeRestorePrivilege	2216	DrvInst.exe
Token: SeRestorePrivilege	2216	DrvInst.exe
Token: SeRestorePrivilege	2216	DrvInst.exe
Token: SeRestorePrivilege	2216	DrvInst.exe
Token: SeRestorePrivilege	2216	DrvInst.exe
Token: SeRestorePrivilege	2216	DrvInst.exe
Token: SeRestorePrivilege	2216	DrvInst.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	2308	DrvInst.exe
Token: SeRestorePrivilege	2556	DrvInst.exe
Token: SeRestorePrivilege	2556	DrvInst.exe
Token: SeRestorePrivilege	2556	DrvInst.exe
Token: SeRestorePrivilege	2556	DrvInst.exe
Token: SeRestorePrivilege	2556	DrvInst.exe
Token: SeRestorePrivilege	2556	DrvInst.exe
Token: SeRestorePrivilege	2556	DrvInst.exe
Token: SeRestorePrivilege	624	DrvInst.exe
Token: SeRestorePrivilege	624	DrvInst.exe
Token: SeRestorePrivilege	624	DrvInst.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	62608774b218119e487551279c98eb02f142c36b69c4b69191a99632bd1fa632.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2896	2204	62608774b218119e487551279c98eb02f142c36b69c4b69191a99632bd1fa632.exe	29
PID 2204 wrote to memory of 2896	2204	62608774b218119e487551279c98eb02f142c36b69c4b69191a99632bd1fa632.exe	29
PID 2204 wrote to memory of 2896	2204	62608774b218119e487551279c98eb02f142c36b69c4b69191a99632bd1fa632.exe	29
PID 2204 wrote to memory of 2896	2204	62608774b218119e487551279c98eb02f142c36b69c4b69191a99632bd1fa632.exe	29
PID 2204 wrote to memory of 2896	2204	62608774b218119e487551279c98eb02f142c36b69c4b69191a99632bd1fa632.exe	29
PID 2204 wrote to memory of 2896	2204	62608774b218119e487551279c98eb02f142c36b69c4b69191a99632bd1fa632.exe	29
PID 2204 wrote to memory of 2896	2204	62608774b218119e487551279c98eb02f142c36b69c4b69191a99632bd1fa632.exe	29
PID 2896 wrote to memory of 2916	2896	cmd.exe	31
PID 2896 wrote to memory of 2916	2896	cmd.exe	31
PID 2896 wrote to memory of 2916	2896	cmd.exe	31
PID 2896 wrote to memory of 2916	2896	cmd.exe	31
PID 2896 wrote to memory of 1076	2896	cmd.exe	38
PID 2896 wrote to memory of 1076	2896	cmd.exe	38
PID 2896 wrote to memory of 1076	2896	cmd.exe	38
PID 2896 wrote to memory of 1076	2896	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\62608774b218119e487551279c98eb02f142c36b69c4b69191a99632bd1fa632.exe
"C:\Users\Admin\AppData\Local\Temp\62608774b218119e487551279c98eb02f142c36b69c4b69191a99632bd1fa632.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\Driver_Setup.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exe
    devcon install VmtkmHid_0.inf "{8FBC4165-480D-4230-B1DF-7B86F3E5A3CC}\HID_DEVICE"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exe
    devcon update VmtkmMouFiltr_0.inf "HID\Vid_1bcf&Pid_05e3&Col02"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:1076

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{70c7bfe7-432c-4853-589f-8a015fa1ce5e}\vmtkmhid_0.inf" "9" "6f780c9bb" "0000000000000340" "WinSta0\Default" "00000000000003CC" "208" "c:\users\admin\appdata\local\temp\filedef20160419\x64"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\INF\oem2.inf" "vmtkmhid_0.inf:Vendor.NTamd64:VHidMini.Inst:1.0.0.1:{8fbc4165-480d-4230-b1df-7b86f3e5a3cc}\hid_device" "6f780c9bb" "0000000000000340" "00000000000005D8" "00000000000005D4"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col03\1&2d595ca7&0&0002" "" "" "6d847c53b" "0000000000000000" "0000000000000340" "000000000000066C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col04\1&2d595ca7&0&0003" "" "" "69a97a5bb" "0000000000000000" "000000000000061C" "000000000000063C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col01\1&2d595ca7&0&0000" "" "" "653a8043f" "0000000000000000" "0000000000000624" "0000000000000628"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col02\1&2d595ca7&0&0001" "" "" "615f7e4bf" "0000000000000000" "0000000000000598" "00000000000005EC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col05\1&2d595ca7&0&0004" "" "" "65ce78637" "0000000000000000" "0000000000000630" "00000000000005D8"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1980

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Windows\system32\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{fb669872-0889-4020-b284-360d3cafce62} "(null)"
1⤵
PID:1996

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7a798bf7-5ac8-3fdf-f54d-9418b0dd9c1a}\vmtkmmoufiltr_0.inf" "9" "658dbf7d3" "000000000000068C" "WinSta0\Default" "00000000000006B4" "208" "c:\users\admin\appdata\local\temp\filedef20160419\x64"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1808

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col06\1&2d595ca7&0&0005" "" "" "61f3766b7" "0000000000000000" "000000000000066C" "0000000000000340"
1⤵
- Drops file in Windows directory
PID:1088

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col07\1&2d595ca7&0&0006" "" "" "6e1874733" "0000000000000000" "000000000000063C" "000000000000061C"
1⤵
- Drops file in Windows directory
PID:1924

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "HID\VID_1BCF&PID_05E3&COL02\1&2D595CA7&0&0001" "C:\Windows\INF\oem3.inf" "vmtkmmoufiltr_0.inf:UASSOFT.NTamd64:HIDUAS_Inst:1.0.0.0:hid\vid_1bcf&pid_05e3&col02" "658dbf7d3" "00000000000006B4" "00000000000005EC" "00000000000005FC"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\Driver_Setup.bat

Filesize
148B

MD5
ffb0bbd1166100b72cc3823baa152b2f

SHA1
dab9d0aee5ab7f2995feeacdbc6bf7710a372f0f

SHA256
f107b57123cb427fce8d635f19e63483819d48876adf9ddc05174af80cce4229

SHA512
dabe236a5df5f7d62dc8df9d8c8faf6ef27db96c43caf61d13aba5e9e9f82a5f9aa5e1fa92d239580da7e62356991c6e76f9884c66380f0e53cac68a89658fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\Driver_Setup.bat

Filesize
148B

MD5
ffb0bbd1166100b72cc3823baa152b2f

SHA1
dab9d0aee5ab7f2995feeacdbc6bf7710a372f0f

SHA256
f107b57123cb427fce8d635f19e63483819d48876adf9ddc05174af80cce4229

SHA512
dabe236a5df5f7d62dc8df9d8c8faf6ef27db96c43caf61d13aba5e9e9f82a5f9aa5e1fa92d239580da7e62356991c6e76f9884c66380f0e53cac68a89658fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\VmtkmHid_0.inf

Filesize
3KB

MD5
ac2a7db4b61118498e6d74e302335c2b

SHA1
85da16e595b994cd6e3cdcedc2ae2e5068a5640e

SHA256
20ba09ccf6d435af296bbe9e84212538094ea064128052d737f6884265de05d0

SHA512
25b0ab141032643e7c871066d909b4e331991d55ec602c6b4166ffbab3aa43a1535aae92159ac16d7fb81c5885c3f26518b5b4c2224dd26ac8534f349b2898e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exe

Filesize
87KB

MD5
41ba1bbdd9284e49701ee94a3f446c33

SHA1
6d5bd532a0f9a3bf7005edeb53b4aba2d30a0c99

SHA256
c65d9acba88d2c56422ec4aba235b0ae25bb3261bf400cd30efe11de0c4330e4

SHA512
dc55452698966b77c157a81eb458984b17e3e3a0d3ff885479f7c823b847eb739a07782f140ced12eac75fdddd7416f923c885a9d8e8b0a10010fc07bef3da45

Download Submit
C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exe

Filesize
87KB

MD5
41ba1bbdd9284e49701ee94a3f446c33

SHA1
6d5bd532a0f9a3bf7005edeb53b4aba2d30a0c99

SHA256
c65d9acba88d2c56422ec4aba235b0ae25bb3261bf400cd30efe11de0c4330e4

SHA512
dc55452698966b77c157a81eb458984b17e3e3a0d3ff885479f7c823b847eb739a07782f140ced12eac75fdddd7416f923c885a9d8e8b0a10010fc07bef3da45

Download Submit
C:\Users\Admin\AppData\Local\Temp\{70C7B~1\VmtkmHid_0.sys

Filesize
11KB

MD5
15be41abe19a4c66d9e94ff5afee1822

SHA1
e47dca6ade9843a5ee6d6f100d12bcc06bee5f06

SHA256
da484327e2601a56f90d2ad2a040150171548fe8aeac8332c8f27c9ac6054fbb

SHA512
dcec2d963cee7c26190686c93cd28b4fa17d4c54ca0cf1e231603dc445a17685f43d4fab5e0d1e6b1e6b2bc8aac5617542068064d9639f150e6e77e2e2709c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\{70c7bfe7-432c-4853-589f-8a015fa1ce5e}\VmtkmHid_0.cat

Filesize
8KB

MD5
69d398d45035ea070ad1d950947b8258

SHA1
f389482e8f547f08f6637005cb0312ab1c94a9cb

SHA256
f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097

SHA512
6186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be

Download Submit
C:\Users\Admin\AppData\Local\Temp\{70c7bfe7-432c-4853-589f-8a015fa1ce5e}\vmtkmhid_0.inf

Filesize
3KB

MD5
ac2a7db4b61118498e6d74e302335c2b

SHA1
85da16e595b994cd6e3cdcedc2ae2e5068a5640e

SHA256
20ba09ccf6d435af296bbe9e84212538094ea064128052d737f6884265de05d0

SHA512
25b0ab141032643e7c871066d909b4e331991d55ec602c6b4166ffbab3aa43a1535aae92159ac16d7fb81c5885c3f26518b5b4c2224dd26ac8534f349b2898e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{70c7bfe7-432c-4853-589f-8a015fa1ce5e}\vmtkmhid_0.inf

Filesize
3KB

MD5
ac2a7db4b61118498e6d74e302335c2b

SHA1
85da16e595b994cd6e3cdcedc2ae2e5068a5640e

SHA256
20ba09ccf6d435af296bbe9e84212538094ea064128052d737f6884265de05d0

SHA512
25b0ab141032643e7c871066d909b4e331991d55ec602c6b4166ffbab3aa43a1535aae92159ac16d7fb81c5885c3f26518b5b4c2224dd26ac8534f349b2898e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{7A798~1\VmtkmMouFiltr_0.sys

Filesize
7KB

MD5
3eb7619b8440e9a003c4a5a9b8acde33

SHA1
5c1d6bbe9ac62e8ce9bb5432b711fdc2e4e3b94f

SHA256
784287759ef05e815b2c486f7bc6af5077d1c9c86c4ef921e8b2039634f667a0

SHA512
eaa73dd2e6a65dff50b6a1ae1b3c3155e68849c5339c89d543e58b4ac34dbd4173e00d6deaf12b47bfe491cd001f0f3b04634364a4fb0acc73070da10ae7a0f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{7a798bf7-5ac8-3fdf-f54d-9418b0dd9c1a}\VmtkmHid_0.cat

Filesize
8KB

MD5
69d398d45035ea070ad1d950947b8258

SHA1
f389482e8f547f08f6637005cb0312ab1c94a9cb

SHA256
f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097

SHA512
6186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be

Download Submit
C:\Users\Admin\AppData\Local\Temp\{7a798bf7-5ac8-3fdf-f54d-9418b0dd9c1a}\vmtkmmoufiltr_0.inf

Filesize
2KB

MD5
c96843464c7474150b481cb5f0075c22

SHA1
9fb1a53cbe5c6e9adcb3fd061fc9f292a648a1e5

SHA256
006850d8035f5e776c34ceaf90d292b8ff83e9457e5b32e118e6d5b4a755ca40

SHA512
303bd7f8e9c04f755eb3e0bce867a16be10dbfccc25e98e4e12fa9d51241bb67e27dcac8c0ec0eebc1a20c043cd3e78e0766b879b3ffb69e00bdfe31f07dc0d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{7a798bf7-5ac8-3fdf-f54d-9418b0dd9c1a}\vmtkmmoufiltr_0.inf

Filesize
2KB

MD5
c96843464c7474150b481cb5f0075c22

SHA1
9fb1a53cbe5c6e9adcb3fd061fc9f292a648a1e5

SHA256
006850d8035f5e776c34ceaf90d292b8ff83e9457e5b32e118e6d5b4a755ca40

SHA512
303bd7f8e9c04f755eb3e0bce867a16be10dbfccc25e98e4e12fa9d51241bb67e27dcac8c0ec0eebc1a20c043cd3e78e0766b879b3ffb69e00bdfe31f07dc0d4

Download Submit
C:\Windows\INF\oem2.inf

Filesize
3KB

MD5
ac2a7db4b61118498e6d74e302335c2b

SHA1
85da16e595b994cd6e3cdcedc2ae2e5068a5640e

SHA256
20ba09ccf6d435af296bbe9e84212538094ea064128052d737f6884265de05d0

SHA512
25b0ab141032643e7c871066d909b4e331991d55ec602c6b4166ffbab3aa43a1535aae92159ac16d7fb81c5885c3f26518b5b4c2224dd26ac8534f349b2898e0

Download Submit
C:\Windows\INF\oem3.inf

Filesize
2KB

MD5
c96843464c7474150b481cb5f0075c22

SHA1
9fb1a53cbe5c6e9adcb3fd061fc9f292a648a1e5

SHA256
006850d8035f5e776c34ceaf90d292b8ff83e9457e5b32e118e6d5b4a755ca40

SHA512
303bd7f8e9c04f755eb3e0bce867a16be10dbfccc25e98e4e12fa9d51241bb67e27dcac8c0ec0eebc1a20c043cd3e78e0766b879b3ffb69e00bdfe31f07dc0d4

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
194KB

MD5
95ce2b51013d0e24413aa625e186e643

SHA1
2e01f8d67351a934c0d46d5e7f519de1fba94011

SHA256
cabb8ee66f16b32aeffebf9cce0b0d3348560cd1f73de30fe870df6a84a3f101

SHA512
13ebb31d582143d7536299c38f977129d393a488e73f1180a45000963279dce16430fc2f5f8eeae23ac0768ae183dcd88495e0601f54b310d884961b25cbcb7b

Download Submit
C:\Windows\System32\DRIVER~1\FILERE~1\VMTKMH~1.INF\VmtkmHid_0.sys

Filesize
11KB

MD5
15be41abe19a4c66d9e94ff5afee1822

SHA1
e47dca6ade9843a5ee6d6f100d12bcc06bee5f06

SHA256
da484327e2601a56f90d2ad2a040150171548fe8aeac8332c8f27c9ac6054fbb

SHA512
dcec2d963cee7c26190686c93cd28b4fa17d4c54ca0cf1e231603dc445a17685f43d4fab5e0d1e6b1e6b2bc8aac5617542068064d9639f150e6e77e2e2709c41

Download Submit
C:\Windows\System32\DRIVER~1\FILERE~1\VMTKMM~1.INF\VmtkmMouFiltr_0.sys

Filesize
7KB

MD5
3eb7619b8440e9a003c4a5a9b8acde33

SHA1
5c1d6bbe9ac62e8ce9bb5432b711fdc2e4e3b94f

SHA256
784287759ef05e815b2c486f7bc6af5077d1c9c86c4ef921e8b2039634f667a0

SHA512
eaa73dd2e6a65dff50b6a1ae1b3c3155e68849c5339c89d543e58b4ac34dbd4173e00d6deaf12b47bfe491cd001f0f3b04634364a4fb0acc73070da10ae7a0f5

Download Submit
C:\Windows\System32\DriverStore\FileRepository\hidserv.inf_amd64_neutral_f2223e39f37c69f3\hidserv.PNF

Filesize
19KB

MD5
1b05c4888466cf3d3b9e85dc60e53cad

SHA1
c3e849dc86eab7aa82b60db1bfb64e5da7b7cec4

SHA256
bdf0c71bea3f0c4cf9ec782a99ce27684560a7209eb73fbd273deb6407de0ff3

SHA512
b5cc36f663465038c815a938b71891ac407f6a5b09a7a8b4902936fac4f32d617ff51ce8840306b0cb5b5c1df1b3a8060b892aa32c7a42c47a03aed0b3c05cd3

Download Submit
C:\Windows\System32\DriverStore\FileRepository\vmtkmhid_0.inf_amd64_neutral_aaf954d05a2c7d7f\VmtkmHid_0.cat

Filesize
8KB

MD5
69d398d45035ea070ad1d950947b8258

SHA1
f389482e8f547f08f6637005cb0312ab1c94a9cb

SHA256
f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097

SHA512
6186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be

Download Submit
C:\Windows\System32\DriverStore\FileRepository\vmtkmhid_0.inf_amd64_neutral_aaf954d05a2c7d7f\vmtkmhid_0.PNF

Filesize
9KB

MD5
0eb551bb3f3029f6b6bcd671378a2e4d

SHA1
92faa6ffde431539ffdd30dbded72fbe6b93a6ba

SHA256
7e2bcb6a34a613423ba4d35f1082f882b6cfdfeb5d7d7c1d01ada6db7bb52a9e

SHA512
092868a5f4092dab99fa703cfb51d596eabc0897f517131b33511af0b9679eb2c1ec837fe32e1ee5a615dc7fed0577edeb5b33d1bb455158a8923123541e343c

Download Submit
C:\Windows\System32\DriverStore\FileRepository\vmtkmmoufiltr_0.inf_amd64_neutral_75b639d4ffc4e70a\VmtkmHid_0.cat

Filesize
8KB

MD5
69d398d45035ea070ad1d950947b8258

SHA1
f389482e8f547f08f6637005cb0312ab1c94a9cb

SHA256
f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097

SHA512
6186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be

Download Submit
C:\Windows\System32\DriverStore\FileRepository\vmtkmmoufiltr_0.inf_amd64_neutral_75b639d4ffc4e70a\vmtkmmoufiltr_0.PNF

Filesize
8KB

MD5
94c0ca7716bf71cbcfaf0ff68831c85b

SHA1
46fdbbf01f7287c2f111c1376c6337084e5eaca3

SHA256
1c67a2b25352d3b5f4cd1b6f3a5d3032d0d5e57ed8e92b1d95f76f82541d2c91

SHA512
a66c9773b8004fbe103f6336cb8b0269112f46e267ebe20287feedb16e5b83a6b5227a8964e8bc8cdbb9f2c8eb52931db1052dae1203a6fdc3e8988cc4190872

Download Submit
C:\Windows\System32\DriverStore\INFCACHE.1

Filesize
1.4MB

MD5
102d2ae87203f7d9dddfa0f3e366d139

SHA1
95920dca218b0340347c333e573014cdde63627e

SHA256
43f51ef9a62396019ac910efc29fcd191a6b49bc85a0a55e8225fe51ec3499b1

SHA512
c4e80d55eca9eadd82757525e921f1754782398ae231c8b9cbc72fdc9b35aaf75b15de78a14f6ff859b60680d5687027902a08f82d6a7c20a90d98beaeb7c919

Download Submit
C:\Windows\System32\DriverStore\INFCACHE.1

Filesize
1.4MB

MD5
3154dc345e62670e5ba13da592fe917c

SHA1
fe0c6bfdc748434c4db10a28b4109a7f1f4085a1

SHA256
4d4d7ce55558b62269ed207e599479670daef850aa7d1c1edbbfadc1609261ba

SHA512
30a17b4cb2c07120c6e61e145cf165dce0dc764fad0f8c341d8ee3ebadc559b0a693a73112413ccce436eb1f1d450cc0b99ace444152b7fc6f88e58203d1b824

Download Submit
C:\Windows\System32\DriverStore\Temp\{10b64297-c24e-05e6-3eb8-563cbbc48e54}\SET8C0C.tmp

Filesize
7KB

MD5
3eb7619b8440e9a003c4a5a9b8acde33

SHA1
5c1d6bbe9ac62e8ce9bb5432b711fdc2e4e3b94f

SHA256
784287759ef05e815b2c486f7bc6af5077d1c9c86c4ef921e8b2039634f667a0

SHA512
eaa73dd2e6a65dff50b6a1ae1b3c3155e68849c5339c89d543e58b4ac34dbd4173e00d6deaf12b47bfe491cd001f0f3b04634364a4fb0acc73070da10ae7a0f5

Download Submit
C:\Windows\System32\DriverStore\Temp\{1da31cad-954a-2230-e894-2a1ee80e3459}\SET843D.tmp

Filesize
8KB

MD5
69d398d45035ea070ad1d950947b8258

SHA1
f389482e8f547f08f6637005cb0312ab1c94a9cb

SHA256
f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097

SHA512
6186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be

Download Submit
C:\Windows\System32\DriverStore\Temp\{1da31cad-954a-2230-e894-2a1ee80e3459}\SET843F.tmp

Filesize
11KB

MD5
15be41abe19a4c66d9e94ff5afee1822

SHA1
e47dca6ade9843a5ee6d6f100d12bcc06bee5f06

SHA256
da484327e2601a56f90d2ad2a040150171548fe8aeac8332c8f27c9ac6054fbb

SHA512
dcec2d963cee7c26190686c93cd28b4fa17d4c54ca0cf1e231603dc445a17685f43d4fab5e0d1e6b1e6b2bc8aac5617542068064d9639f150e6e77e2e2709c41

Download Submit
C:\Windows\setupact.log

Filesize
21KB

MD5
cadb0848dc8962cb2beddedc0d89e0c8

SHA1
2c8bcba4f50083d265a1795372a4457611800c47

SHA256
9cdce47c5077d0d3016236e492a41ea8d64d0af15aab5a423493296291db8215

SHA512
16daa4d54b5894b1506f901b64b6f2b7e57dc995144f7a4decebb05d2e1570b4a7b0d9a45f58317a19d164301e416bbf846f79e3790ecacf0a80410ec4317242

Download Submit
C:\Windows\setupact.log

Filesize
21KB

MD5
97fc7426be165fe00c622e979a0769b0

SHA1
a9ed63a1c71569a26299cce78a063bc4136790ee

SHA256
37c1ea964ee3c6f8bac2d50abc76c0ff3f78e5976c27adc433a81fbc9f4d84d7

SHA512
bc2969a1ade37a078ab3bab53a85aeb260a3fcb5a28d1fca4d698cb1aa528ddf40b4f669a01ca2f5fde861e1401f5340f6a1ee0b230b240f1d8ea41e54b73351

Download Submit
\??\c:\users\admin\appdata\local\temp\FILEDE~1\x64\VMTKMH~1.SYS

Filesize
11KB

MD5
15be41abe19a4c66d9e94ff5afee1822

SHA1
e47dca6ade9843a5ee6d6f100d12bcc06bee5f06

SHA256
da484327e2601a56f90d2ad2a040150171548fe8aeac8332c8f27c9ac6054fbb

SHA512
dcec2d963cee7c26190686c93cd28b4fa17d4c54ca0cf1e231603dc445a17685f43d4fab5e0d1e6b1e6b2bc8aac5617542068064d9639f150e6e77e2e2709c41

Download Submit
\??\c:\users\admin\appdata\local\temp\FILEDE~1\x64\VMTKMM~1.SYS

Filesize
7KB

MD5
3eb7619b8440e9a003c4a5a9b8acde33

SHA1
5c1d6bbe9ac62e8ce9bb5432b711fdc2e4e3b94f

SHA256
784287759ef05e815b2c486f7bc6af5077d1c9c86c4ef921e8b2039634f667a0

SHA512
eaa73dd2e6a65dff50b6a1ae1b3c3155e68849c5339c89d543e58b4ac34dbd4173e00d6deaf12b47bfe491cd001f0f3b04634364a4fb0acc73070da10ae7a0f5

Download Submit
\??\c:\users\admin\appdata\local\temp\filedef20160419\x64\VmtkmHid_0.cat

Filesize
8KB

MD5
69d398d45035ea070ad1d950947b8258

SHA1
f389482e8f547f08f6637005cb0312ab1c94a9cb

SHA256
f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097

SHA512
6186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be

Download Submit
\??\c:\users\admin\appdata\local\temp\filedef20160419\x64\vmtkmmoufiltr_0.inf

Filesize
2KB

MD5
c96843464c7474150b481cb5f0075c22

SHA1
9fb1a53cbe5c6e9adcb3fd061fc9f292a648a1e5

SHA256
006850d8035f5e776c34ceaf90d292b8ff83e9457e5b32e118e6d5b4a755ca40

SHA512
303bd7f8e9c04f755eb3e0bce867a16be10dbfccc25e98e4e12fa9d51241bb67e27dcac8c0ec0eebc1a20c043cd3e78e0766b879b3ffb69e00bdfe31f07dc0d4

Download Submit
\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exe

Filesize
87KB

MD5
41ba1bbdd9284e49701ee94a3f446c33

SHA1
6d5bd532a0f9a3bf7005edeb53b4aba2d30a0c99

SHA256
c65d9acba88d2c56422ec4aba235b0ae25bb3261bf400cd30efe11de0c4330e4

SHA512
dc55452698966b77c157a81eb458984b17e3e3a0d3ff885479f7c823b847eb739a07782f140ced12eac75fdddd7416f923c885a9d8e8b0a10010fc07bef3da45

Download Submit
\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exe

Filesize
87KB

MD5
41ba1bbdd9284e49701ee94a3f446c33

SHA1
6d5bd532a0f9a3bf7005edeb53b4aba2d30a0c99

SHA256
c65d9acba88d2c56422ec4aba235b0ae25bb3261bf400cd30efe11de0c4330e4

SHA512
dc55452698966b77c157a81eb458984b17e3e3a0d3ff885479f7c823b847eb739a07782f140ced12eac75fdddd7416f923c885a9d8e8b0a10010fc07bef3da45

Download Submit
memory/2204-1-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2204-0-0x00000000002A0000-0x0000000000365000-memory.dmp

Filesize
788KB

Download
memory/2204-198-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2204-211-0x00000000002A0000-0x0000000000365000-memory.dmp

Filesize
788KB

Download
memory/2204-212-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2204-213-0x00000000002A0000-0x0000000000365000-memory.dmp

Filesize
788KB

Download