177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe
Size

3.0MB
MD5

cf1f9790e227603e43e7afd6faf8465a
SHA1

8651e3f8979f7af2309383198d598e98cbe49fd5
SHA256

177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde
SHA512

dcf67f09fd5dd09de095b04856a92be773628f622112d3da2d8f8451964e819ecaddaffa5187b364673dd1b640ca7021e671e1159f352abb25c6e42aa1dc592e
SSDEEP

49152:SVNf5NhtdLrS44r9HVrafeQ6mW5OaNxbH/51ufYkNnKOnnIF:6Nf5xdJCxL5OQZHh14ZTnI

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET69EA.tmp	DrvInst.exe
File created	C:\Windows\system32\DRIVERS\SET69EA.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\VmtkmHid_0.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\drivers\SET83EF.tmp	DrvInst.exe
File created	C:\Windows\system32\drivers\SET83EF.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\drivers\VmtkmMouFiltr_0.sys	DrvInst.exe

Executes dropped EXE 2 IoCs

pid	Process
1280	devcon.exe
2712	devcon.exe

Loads dropped DLL 2 IoCs

pid	Process
2816	cmd.exe
2816	cmd.exe

Drops file in System32 directory 43 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{6b1a9f82-e593-0db1-0c8e-9106c27d6c6a}\SET6F68.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{03ef4242-ecf3-38bf-543a-831786bd9064}\SET6450.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03ef4242-ecf3-38bf-543a-831786bd9064}\SET6451.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	devcon.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6b1a9f82-e593-0db1-0c8e-9106c27d6c6a}	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	devcon.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03ef4242-ecf3-38bf-543a-831786bd9064}\VmtkmHid_0.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6b1a9f82-e593-0db1-0c8e-9106c27d6c6a}\SET6F57.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6b1a9f82-e593-0db1-0c8e-9106c27d6c6a}\vmtkmmoufiltr_0.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03ef4242-ecf3-38bf-543a-831786bd9064}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6b1a9f82-e593-0db1-0c8e-9106c27d6c6a}\VmtkmMouFiltr_0.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vmtkmhid_0.inf_amd64_neutral_aaf954d05a2c7d7f\vmtkmhid_0.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6b1a9f82-e593-0db1-0c8e-9106c27d6c6a}\VmtkmHid_0.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03ef4242-ecf3-38bf-543a-831786bd9064}\SET6450.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03ef4242-ecf3-38bf-543a-831786bd9064}\vmtkmhid_0.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmtkmhid_0.inf_amd64_neutral_aaf954d05a2c7d7f\vmtkmhid_0.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hidserv.inf_amd64_neutral_f2223e39f37c69f3\hidserv.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	devcon.exe
File created	C:\Windows\System32\DriverStore\Temp\{6b1a9f82-e593-0db1-0c8e-9106c27d6c6a}\SET6F57.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vmtkmmoufiltr_0.inf_amd64_neutral_75b639d4ffc4e70a\vmtkmmoufiltr_0.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	devcon.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03ef4242-ecf3-38bf-543a-831786bd9064}\SET644F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{03ef4242-ecf3-38bf-543a-831786bd9064}\SET6451.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	devcon.exe
File created	C:\Windows\System32\DriverStore\Temp\{6b1a9f82-e593-0db1-0c8e-9106c27d6c6a}\SET6F18.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmtkmmoufiltr_0.inf_amd64_neutral_75b639d4ffc4e70a\vmtkmmoufiltr_0.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6b1a9f82-e593-0db1-0c8e-9106c27d6c6a}\SET6F68.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{03ef4242-ecf3-38bf-543a-831786bd9064}\SET644F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03ef4242-ecf3-38bf-543a-831786bd9064}\VmtkmHid_0.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	devcon.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6b1a9f82-e593-0db1-0c8e-9106c27d6c6a}\SET6F18.tmp	DrvInst.exe

Drops file in Windows directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\setuperr.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\setupact.log	DrvInst.exe
File opened for modification	C:\Windows\INF\hidserv.PNF	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\INF\oem3.PNF	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\setuperr.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\setuperr.log	DrvInst.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\setupact.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem2.PNF	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\setupact.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\INF\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	2524	DrvInst.exe
Token: SeRestorePrivilege	1280	devcon.exe
Token: SeLoadDriverPrivilege	1280	devcon.exe
Token: SeRestorePrivilege	1944	DrvInst.exe
Token: SeRestorePrivilege	1944	DrvInst.exe
Token: SeRestorePrivilege	1944	DrvInst.exe
Token: SeRestorePrivilege	1944	DrvInst.exe
Token: SeRestorePrivilege	1944	DrvInst.exe
Token: SeRestorePrivilege	1944	DrvInst.exe
Token: SeRestorePrivilege	1944	DrvInst.exe
Token: SeRestorePrivilege	1944	DrvInst.exe
Token: SeLoadDriverPrivilege	1944	DrvInst.exe
Token: SeLoadDriverPrivilege	1944	DrvInst.exe
Token: SeRestorePrivilege	1984	DrvInst.exe
Token: SeRestorePrivilege	1984	DrvInst.exe
Token: SeRestorePrivilege	1984	DrvInst.exe
Token: SeRestorePrivilege	1984	DrvInst.exe
Token: SeRestorePrivilege	1984	DrvInst.exe
Token: SeRestorePrivilege	1984	DrvInst.exe
Token: SeRestorePrivilege	1984	DrvInst.exe
Token: SeRestorePrivilege	528	DrvInst.exe
Token: SeRestorePrivilege	528	DrvInst.exe
Token: SeRestorePrivilege	528	DrvInst.exe
Token: SeRestorePrivilege	528	DrvInst.exe
Token: SeRestorePrivilege	528	DrvInst.exe
Token: SeRestorePrivilege	528	DrvInst.exe
Token: SeRestorePrivilege	528	DrvInst.exe
Token: SeRestorePrivilege	1704	DrvInst.exe
Token: SeRestorePrivilege	1704	DrvInst.exe
Token: SeRestorePrivilege	1704	DrvInst.exe
Token: SeRestorePrivilege	1704	DrvInst.exe
Token: SeRestorePrivilege	1704	DrvInst.exe
Token: SeRestorePrivilege	1704	DrvInst.exe
Token: SeRestorePrivilege	1704	DrvInst.exe
Token: SeRestorePrivilege	324	DrvInst.exe
Token: SeRestorePrivilege	324	DrvInst.exe
Token: SeRestorePrivilege	324	DrvInst.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1660	2220	177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe	29
PID 2220 wrote to memory of 1660	2220	177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe	29
PID 2220 wrote to memory of 1660	2220	177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe	29
PID 2220 wrote to memory of 1660	2220	177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe	29
PID 1660 wrote to memory of 2584	1660	cmd.exe	30
PID 1660 wrote to memory of 2584	1660	cmd.exe	30
PID 1660 wrote to memory of 2584	1660	cmd.exe	30
PID 1660 wrote to memory of 2584	1660	cmd.exe	30
PID 2220 wrote to memory of 2816	2220	177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe	31
PID 2220 wrote to memory of 2816	2220	177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe	31
PID 2220 wrote to memory of 2816	2220	177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe	31
PID 2220 wrote to memory of 2816	2220	177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe	31
PID 2220 wrote to memory of 2816	2220	177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe	31
PID 2220 wrote to memory of 2816	2220	177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe	31
PID 2220 wrote to memory of 2816	2220	177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe	31
PID 2816 wrote to memory of 1280	2816	cmd.exe	33
PID 2816 wrote to memory of 1280	2816	cmd.exe	33
PID 2816 wrote to memory of 1280	2816	cmd.exe	33
PID 2816 wrote to memory of 1280	2816	cmd.exe	33
PID 2816 wrote to memory of 2712	2816	cmd.exe	40
PID 2816 wrote to memory of 2712	2816	cmd.exe	40
PID 2816 wrote to memory of 2712	2816	cmd.exe	40
PID 2816 wrote to memory of 2712	2816	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe
"C:\Users\Admin\AppData\Local\Temp\177af7777f47a4820a4acf160625e3321bdd61fcfe319062ef32593ee8c86dde.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con cols=17 lines=11
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\mode.com
    mode con cols=17 lines=11
    3⤵
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\Driver_Setup.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exe
    devcon install VmtkmHid_0.inf "{8FBC4165-480D-4230-B1DF-7B86F3E5A3CC}\HID_DEVICE"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exe
    devcon update VmtkmMouFiltr_0.inf "HID\Vid_1bcf&Pid_05e3&Col02"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:2712

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5ae3373b-00d1-11ef-53eb-210a76ba3228}\vmtkmhid_0.inf" "9" "6f780c9bb" "00000000000004C8" "WinSta0\Default" "0000000000000300" "208" "c:\users\admin\appdata\local\temp\filedef20160419\x64"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\INF\oem2.inf" "vmtkmhid_0.inf:Vendor.NTamd64:VHidMini.Inst:1.0.0.1:{8fbc4165-480d-4230-b1df-7b86f3e5a3cc}\hid_device" "6f780c9bb" "00000000000004C8" "00000000000003DC" "00000000000005B4"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col01\1&2d595ca7&0&0000" "" "" "653a8043f" "0000000000000000" "00000000000005B4" "00000000000005D0"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col03\1&2d595ca7&0&0002" "" "" "6d847c53b" "0000000000000000" "00000000000005B0" "00000000000005CC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:528

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col04\1&2d595ca7&0&0003" "" "" "69a97a5bb" "0000000000000000" "000000000000060C" "0000000000000600"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col02\1&2d595ca7&0&0001" "" "" "615f7e4bf" "0000000000000000" "000000000000063C" "0000000000000638"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:324

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{41ed29db-53ce-7424-074b-67270ce9b254}\vmtkmmoufiltr_0.inf" "9" "658dbf7d3" "000000000000066C" "WinSta0\Default" "0000000000000668" "208" "c:\users\admin\appdata\local\temp\filedef20160419\x64"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:368

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col05\1&2d595ca7&0&0004" "" "" "65ce78637" "0000000000000000" "00000000000005F0" "0000000000000688"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1356

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col06\1&2d595ca7&0&0005" "" "" "61f3766b7" "0000000000000000" "00000000000005CC" "00000000000005B0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2064

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\Vid_1bcf&Pid_05e3&Col07\1&2d595ca7&0&0006" "" "" "6e1874733" "0000000000000000" "0000000000000604" "00000000000003DC"
1⤵
- Drops file in Windows directory
PID:1856

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Windows\system32\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{5a1cd712-d80d-45b3-88dc-b74f32610573} "(null)"
1⤵
PID:1376

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "HID\VID_1BCF&PID_05E3&COL02\1&2D595CA7&0&0001" "C:\Windows\INF\oem3.inf" "vmtkmmoufiltr_0.inf:UASSOFT.NTamd64:HIDUAS_Inst:1.0.0.0:hid\vid_1bcf&pid_05e3&col02" "658dbf7d3" "000000000000066C" "000000000000063C" "0000000000000650"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\Driver_Setup.bat

Filesize
148B

MD5
ffb0bbd1166100b72cc3823baa152b2f

SHA1
dab9d0aee5ab7f2995feeacdbc6bf7710a372f0f

SHA256
f107b57123cb427fce8d635f19e63483819d48876adf9ddc05174af80cce4229

SHA512
dabe236a5df5f7d62dc8df9d8c8faf6ef27db96c43caf61d13aba5e9e9f82a5f9aa5e1fa92d239580da7e62356991c6e76f9884c66380f0e53cac68a89658fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\Driver_Setup.bat

Filesize
148B

MD5
ffb0bbd1166100b72cc3823baa152b2f

SHA1
dab9d0aee5ab7f2995feeacdbc6bf7710a372f0f

SHA256
f107b57123cb427fce8d635f19e63483819d48876adf9ddc05174af80cce4229

SHA512
dabe236a5df5f7d62dc8df9d8c8faf6ef27db96c43caf61d13aba5e9e9f82a5f9aa5e1fa92d239580da7e62356991c6e76f9884c66380f0e53cac68a89658fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\VmtkmHid_0.inf

Filesize
3KB

MD5
ac2a7db4b61118498e6d74e302335c2b

SHA1
85da16e595b994cd6e3cdcedc2ae2e5068a5640e

SHA256
20ba09ccf6d435af296bbe9e84212538094ea064128052d737f6884265de05d0

SHA512
25b0ab141032643e7c871066d909b4e331991d55ec602c6b4166ffbab3aa43a1535aae92159ac16d7fb81c5885c3f26518b5b4c2224dd26ac8534f349b2898e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exe

Filesize
87KB

MD5
41ba1bbdd9284e49701ee94a3f446c33

SHA1
6d5bd532a0f9a3bf7005edeb53b4aba2d30a0c99

SHA256
c65d9acba88d2c56422ec4aba235b0ae25bb3261bf400cd30efe11de0c4330e4

SHA512
dc55452698966b77c157a81eb458984b17e3e3a0d3ff885479f7c823b847eb739a07782f140ced12eac75fdddd7416f923c885a9d8e8b0a10010fc07bef3da45

Download Submit
C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exe

Filesize
87KB

MD5
41ba1bbdd9284e49701ee94a3f446c33

SHA1
6d5bd532a0f9a3bf7005edeb53b4aba2d30a0c99

SHA256
c65d9acba88d2c56422ec4aba235b0ae25bb3261bf400cd30efe11de0c4330e4

SHA512
dc55452698966b77c157a81eb458984b17e3e3a0d3ff885479f7c823b847eb739a07782f140ced12eac75fdddd7416f923c885a9d8e8b0a10010fc07bef3da45

Download Submit
C:\Users\Admin\AppData\Local\Temp\{41ED2~1\VmtkmMouFiltr_0.sys

Filesize
7KB

MD5
3eb7619b8440e9a003c4a5a9b8acde33

SHA1
5c1d6bbe9ac62e8ce9bb5432b711fdc2e4e3b94f

SHA256
784287759ef05e815b2c486f7bc6af5077d1c9c86c4ef921e8b2039634f667a0

SHA512
eaa73dd2e6a65dff50b6a1ae1b3c3155e68849c5339c89d543e58b4ac34dbd4173e00d6deaf12b47bfe491cd001f0f3b04634364a4fb0acc73070da10ae7a0f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{41ed29db-53ce-7424-074b-67270ce9b254}\VmtkmHid_0.cat

Filesize
8KB

MD5
69d398d45035ea070ad1d950947b8258

SHA1
f389482e8f547f08f6637005cb0312ab1c94a9cb

SHA256
f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097

SHA512
6186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be

Download Submit
C:\Users\Admin\AppData\Local\Temp\{41ed29db-53ce-7424-074b-67270ce9b254}\vmtkmmoufiltr_0.inf

Filesize
2KB

MD5
c96843464c7474150b481cb5f0075c22

SHA1
9fb1a53cbe5c6e9adcb3fd061fc9f292a648a1e5

SHA256
006850d8035f5e776c34ceaf90d292b8ff83e9457e5b32e118e6d5b4a755ca40

SHA512
303bd7f8e9c04f755eb3e0bce867a16be10dbfccc25e98e4e12fa9d51241bb67e27dcac8c0ec0eebc1a20c043cd3e78e0766b879b3ffb69e00bdfe31f07dc0d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{41ed29db-53ce-7424-074b-67270ce9b254}\vmtkmmoufiltr_0.inf

Filesize
2KB

MD5
c96843464c7474150b481cb5f0075c22

SHA1
9fb1a53cbe5c6e9adcb3fd061fc9f292a648a1e5

SHA256
006850d8035f5e776c34ceaf90d292b8ff83e9457e5b32e118e6d5b4a755ca40

SHA512
303bd7f8e9c04f755eb3e0bce867a16be10dbfccc25e98e4e12fa9d51241bb67e27dcac8c0ec0eebc1a20c043cd3e78e0766b879b3ffb69e00bdfe31f07dc0d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5AE33~1\VmtkmHid_0.sys

Filesize
11KB

MD5
15be41abe19a4c66d9e94ff5afee1822

SHA1
e47dca6ade9843a5ee6d6f100d12bcc06bee5f06

SHA256
da484327e2601a56f90d2ad2a040150171548fe8aeac8332c8f27c9ac6054fbb

SHA512
dcec2d963cee7c26190686c93cd28b4fa17d4c54ca0cf1e231603dc445a17685f43d4fab5e0d1e6b1e6b2bc8aac5617542068064d9639f150e6e77e2e2709c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5ae3373b-00d1-11ef-53eb-210a76ba3228}\VmtkmHid_0.cat

Filesize
8KB

MD5
69d398d45035ea070ad1d950947b8258

SHA1
f389482e8f547f08f6637005cb0312ab1c94a9cb

SHA256
f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097

SHA512
6186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5ae3373b-00d1-11ef-53eb-210a76ba3228}\vmtkmhid_0.inf

Filesize
3KB

MD5
ac2a7db4b61118498e6d74e302335c2b

SHA1
85da16e595b994cd6e3cdcedc2ae2e5068a5640e

SHA256
20ba09ccf6d435af296bbe9e84212538094ea064128052d737f6884265de05d0

SHA512
25b0ab141032643e7c871066d909b4e331991d55ec602c6b4166ffbab3aa43a1535aae92159ac16d7fb81c5885c3f26518b5b4c2224dd26ac8534f349b2898e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5ae3373b-00d1-11ef-53eb-210a76ba3228}\vmtkmhid_0.inf

Filesize
3KB

MD5
ac2a7db4b61118498e6d74e302335c2b

SHA1
85da16e595b994cd6e3cdcedc2ae2e5068a5640e

SHA256
20ba09ccf6d435af296bbe9e84212538094ea064128052d737f6884265de05d0

SHA512
25b0ab141032643e7c871066d909b4e331991d55ec602c6b4166ffbab3aa43a1535aae92159ac16d7fb81c5885c3f26518b5b4c2224dd26ac8534f349b2898e0

Download Submit
C:\Windows\INF\oem2.inf

Filesize
3KB

MD5
ac2a7db4b61118498e6d74e302335c2b

SHA1
85da16e595b994cd6e3cdcedc2ae2e5068a5640e

SHA256
20ba09ccf6d435af296bbe9e84212538094ea064128052d737f6884265de05d0

SHA512
25b0ab141032643e7c871066d909b4e331991d55ec602c6b4166ffbab3aa43a1535aae92159ac16d7fb81c5885c3f26518b5b4c2224dd26ac8534f349b2898e0

Download Submit
C:\Windows\INF\oem3.inf

Filesize
2KB

MD5
c96843464c7474150b481cb5f0075c22

SHA1
9fb1a53cbe5c6e9adcb3fd061fc9f292a648a1e5

SHA256
006850d8035f5e776c34ceaf90d292b8ff83e9457e5b32e118e6d5b4a755ca40

SHA512
303bd7f8e9c04f755eb3e0bce867a16be10dbfccc25e98e4e12fa9d51241bb67e27dcac8c0ec0eebc1a20c043cd3e78e0766b879b3ffb69e00bdfe31f07dc0d4

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
192KB

MD5
18f65b78a18723eebeb04a854065a73c

SHA1
953b3ede481fb9978508d00bfbf8401499832936

SHA256
fe15e1fdbed818acba4744d3bf255c682c896fca44bf6c1767baf94c94a07f6b

SHA512
49ff66d4884350a3e5983ee73159f0cc8319e053c53dcca6acdca03f18d55bfa2b89170d828269e9edc659708c2faf0495a02ef2194ef30d035347f59dcd26c5

Download Submit
C:\Windows\System32\DRIVER~1\FILERE~1\VMTKMH~1.INF\VmtkmHid_0.sys

Filesize
11KB

MD5
15be41abe19a4c66d9e94ff5afee1822

SHA1
e47dca6ade9843a5ee6d6f100d12bcc06bee5f06

SHA256
da484327e2601a56f90d2ad2a040150171548fe8aeac8332c8f27c9ac6054fbb

SHA512
dcec2d963cee7c26190686c93cd28b4fa17d4c54ca0cf1e231603dc445a17685f43d4fab5e0d1e6b1e6b2bc8aac5617542068064d9639f150e6e77e2e2709c41

Download Submit
C:\Windows\System32\DRIVER~1\FILERE~1\VMTKMM~1.INF\VmtkmMouFiltr_0.sys

Filesize
7KB

MD5
3eb7619b8440e9a003c4a5a9b8acde33

SHA1
5c1d6bbe9ac62e8ce9bb5432b711fdc2e4e3b94f

SHA256
784287759ef05e815b2c486f7bc6af5077d1c9c86c4ef921e8b2039634f667a0

SHA512
eaa73dd2e6a65dff50b6a1ae1b3c3155e68849c5339c89d543e58b4ac34dbd4173e00d6deaf12b47bfe491cd001f0f3b04634364a4fb0acc73070da10ae7a0f5

Download Submit
C:\Windows\System32\DriverStore\FileRepository\hidserv.inf_amd64_neutral_f2223e39f37c69f3\hidserv.PNF

Filesize
19KB

MD5
1b05c4888466cf3d3b9e85dc60e53cad

SHA1
c3e849dc86eab7aa82b60db1bfb64e5da7b7cec4

SHA256
bdf0c71bea3f0c4cf9ec782a99ce27684560a7209eb73fbd273deb6407de0ff3

SHA512
b5cc36f663465038c815a938b71891ac407f6a5b09a7a8b4902936fac4f32d617ff51ce8840306b0cb5b5c1df1b3a8060b892aa32c7a42c47a03aed0b3c05cd3

Download Submit
C:\Windows\System32\DriverStore\FileRepository\vmtkmhid_0.inf_amd64_neutral_aaf954d05a2c7d7f\VmtkmHid_0.cat

Filesize
8KB

MD5
69d398d45035ea070ad1d950947b8258

SHA1
f389482e8f547f08f6637005cb0312ab1c94a9cb

SHA256
f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097

SHA512
6186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be

Download Submit
C:\Windows\System32\DriverStore\FileRepository\vmtkmhid_0.inf_amd64_neutral_aaf954d05a2c7d7f\vmtkmhid_0.PNF

Filesize
9KB

MD5
a9f6c217185786682cb426f01a128843

SHA1
3071499d2603edb3391fefbbe8d65f34a7f0f6e8

SHA256
e5b95c3f8d08f921ebb84c96eeb7acd027f3516ecd968d9de38de1b9cf65b35c

SHA512
e59144e72e4b80baad0b2bb90afa6ea3dd483a3ab41d61d5e3d7c2dc512f6b91c20f1941dee4e5e8e4b438a62c8c9ce2cd7962bc42dbe7133ce2242dd5689f1a

Download Submit
C:\Windows\System32\DriverStore\FileRepository\vmtkmmoufiltr_0.inf_amd64_neutral_75b639d4ffc4e70a\VmtkmHid_0.cat

Filesize
8KB

MD5
69d398d45035ea070ad1d950947b8258

SHA1
f389482e8f547f08f6637005cb0312ab1c94a9cb

SHA256
f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097

SHA512
6186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be

Download Submit
C:\Windows\System32\DriverStore\FileRepository\vmtkmmoufiltr_0.inf_amd64_neutral_75b639d4ffc4e70a\vmtkmmoufiltr_0.PNF

Filesize
8KB

MD5
bdaa6e88ad8241663f277f5f2f7321db

SHA1
97a93ce60d41665a68598d452bc898f36988184b

SHA256
613ae318236457042980c1f897f6627b43dc2450e732535b86423995068cb093

SHA512
de732093d0d47717284a7b8e333d58c28e33ff1912a2f2a6f2b2cf9005c4ba3361c253a6f1c525322f60f4bc80ce5b96aa3c96f28e1b0ba3a3a455a3fff6ae18

Download Submit
C:\Windows\System32\DriverStore\INFCACHE.1

Filesize
1.4MB

MD5
ba50c213cec4fcf296bc077aeece1a9c

SHA1
2ebfef4bd25d83d8308b3bc7f05e3b55d9f4c92a

SHA256
7bef24fac842beb4e667fea5bfccc45c314d3dcd67acfaaa4ed6398bb34994ad

SHA512
1405e1e08ce977353138af3ec9247e1448d37beaee05a4eaefa1899ac7cb4f7e77e16823df85c8358468c30210fca020f325f6cee3605c9464c9ce8b846b3088

Download Submit
C:\Windows\System32\DriverStore\INFCACHE.1

Filesize
1.4MB

MD5
eceae945546c29854b426ed04da06d36

SHA1
d5efbbfb572c2b3a2ae006d2e0611430c776bad1

SHA256
3c8bc47cd8023266b9b91297803b7b26e22a7916ba05512f8b2df3524963859d

SHA512
ae28806613464d3021c62bea8b82304de567ccff4b12494633dc234343c4b12fcb34018140dea595f76ca9514a9a236157f8b85d8fe582e719b3ad9a2251e95c

Download Submit
C:\Windows\System32\DriverStore\Temp\{03ef4242-ecf3-38bf-543a-831786bd9064}\SET644F.tmp

Filesize
8KB

MD5
69d398d45035ea070ad1d950947b8258

SHA1
f389482e8f547f08f6637005cb0312ab1c94a9cb

SHA256
f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097

SHA512
6186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be

Download Submit
C:\Windows\System32\DriverStore\Temp\{03ef4242-ecf3-38bf-543a-831786bd9064}\SET6451.tmp

Filesize
11KB

MD5
15be41abe19a4c66d9e94ff5afee1822

SHA1
e47dca6ade9843a5ee6d6f100d12bcc06bee5f06

SHA256
da484327e2601a56f90d2ad2a040150171548fe8aeac8332c8f27c9ac6054fbb

SHA512
dcec2d963cee7c26190686c93cd28b4fa17d4c54ca0cf1e231603dc445a17685f43d4fab5e0d1e6b1e6b2bc8aac5617542068064d9639f150e6e77e2e2709c41

Download Submit
C:\Windows\System32\DriverStore\Temp\{6b1a9f82-e593-0db1-0c8e-9106c27d6c6a}\SET6F68.tmp

Filesize
7KB

MD5
3eb7619b8440e9a003c4a5a9b8acde33

SHA1
5c1d6bbe9ac62e8ce9bb5432b711fdc2e4e3b94f

SHA256
784287759ef05e815b2c486f7bc6af5077d1c9c86c4ef921e8b2039634f667a0

SHA512
eaa73dd2e6a65dff50b6a1ae1b3c3155e68849c5339c89d543e58b4ac34dbd4173e00d6deaf12b47bfe491cd001f0f3b04634364a4fb0acc73070da10ae7a0f5

Download Submit
C:\Windows\setupact.log

Filesize
21KB

MD5
8db976c0c7304e332a28c6d791ca0eb4

SHA1
87d820c240b730547a2ddc0ee8ff76ff2573ddd1

SHA256
47e493c6eda1622c452c0fa4c22171bdb85a0b0fde69deb23094cec3296c9459

SHA512
8a78bf8ccf2e7ef2588350f4bed64f331ef3510393b79b13f2c2d5383829c28365eb10f1a80b55911b4cbc5304f14b81b394c9d8a9bec9dc6009b1f1e04bbb19

Download Submit
C:\Windows\setupact.log

Filesize
21KB

MD5
f129a53051ace67d4aff8a494d591f5d

SHA1
d1f6ff44a87d1a7d7d72871116096bcb357e3547

SHA256
8483caecc2f635d1376e8a799d41bc779168a6f0a023f8b1f48acd5c9524011c

SHA512
88cc0b82824d02d0421bf6432be80d63ca20c9438ffadab1128b3253f4271e05f07f9a0c32768268a46da1570494f526afeef502b4d96797bce82099385523a3

Download Submit
\??\c:\users\admin\appdata\local\temp\FILEDE~1\x64\VMTKMH~1.SYS

Filesize
11KB

MD5
15be41abe19a4c66d9e94ff5afee1822

SHA1
e47dca6ade9843a5ee6d6f100d12bcc06bee5f06

SHA256
da484327e2601a56f90d2ad2a040150171548fe8aeac8332c8f27c9ac6054fbb

SHA512
dcec2d963cee7c26190686c93cd28b4fa17d4c54ca0cf1e231603dc445a17685f43d4fab5e0d1e6b1e6b2bc8aac5617542068064d9639f150e6e77e2e2709c41

Download Submit
\??\c:\users\admin\appdata\local\temp\FILEDE~1\x64\VMTKMM~1.SYS

Filesize
7KB

MD5
3eb7619b8440e9a003c4a5a9b8acde33

SHA1
5c1d6bbe9ac62e8ce9bb5432b711fdc2e4e3b94f

SHA256
784287759ef05e815b2c486f7bc6af5077d1c9c86c4ef921e8b2039634f667a0

SHA512
eaa73dd2e6a65dff50b6a1ae1b3c3155e68849c5339c89d543e58b4ac34dbd4173e00d6deaf12b47bfe491cd001f0f3b04634364a4fb0acc73070da10ae7a0f5

Download Submit
\??\c:\users\admin\appdata\local\temp\filedef20160419\x64\VmtkmHid_0.cat

Filesize
8KB

MD5
69d398d45035ea070ad1d950947b8258

SHA1
f389482e8f547f08f6637005cb0312ab1c94a9cb

SHA256
f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097

SHA512
6186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be

Download Submit
\??\c:\users\admin\appdata\local\temp\filedef20160419\x64\vmtkmmoufiltr_0.inf

Filesize
2KB

MD5
c96843464c7474150b481cb5f0075c22

SHA1
9fb1a53cbe5c6e9adcb3fd061fc9f292a648a1e5

SHA256
006850d8035f5e776c34ceaf90d292b8ff83e9457e5b32e118e6d5b4a755ca40

SHA512
303bd7f8e9c04f755eb3e0bce867a16be10dbfccc25e98e4e12fa9d51241bb67e27dcac8c0ec0eebc1a20c043cd3e78e0766b879b3ffb69e00bdfe31f07dc0d4

Download Submit
\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exe

Filesize
87KB

MD5
41ba1bbdd9284e49701ee94a3f446c33

SHA1
6d5bd532a0f9a3bf7005edeb53b4aba2d30a0c99

SHA256
c65d9acba88d2c56422ec4aba235b0ae25bb3261bf400cd30efe11de0c4330e4

SHA512
dc55452698966b77c157a81eb458984b17e3e3a0d3ff885479f7c823b847eb739a07782f140ced12eac75fdddd7416f923c885a9d8e8b0a10010fc07bef3da45

Download Submit
\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exe

Filesize
87KB

MD5
41ba1bbdd9284e49701ee94a3f446c33

SHA1
6d5bd532a0f9a3bf7005edeb53b4aba2d30a0c99

SHA256
c65d9acba88d2c56422ec4aba235b0ae25bb3261bf400cd30efe11de0c4330e4

SHA512
dc55452698966b77c157a81eb458984b17e3e3a0d3ff885479f7c823b847eb739a07782f140ced12eac75fdddd7416f923c885a9d8e8b0a10010fc07bef3da45

Download Submit
memory/2220-183-0x0000000000440000-0x0000000000505000-memory.dmp

Filesize
788KB

Download
memory/2220-0-0x0000000000440000-0x0000000000505000-memory.dmp

Filesize
788KB

Download
memory/2220-1-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2220-199-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2220-212-0x0000000000440000-0x0000000000505000-memory.dmp

Filesize
788KB

Download