gafgyt | b9e524468ec5048568a79d4586bd4c162c9698e04fcf7b928c804dc107be7a56

Resubmissions

26/12/2023, 03:54

231226-egcffaacfk 10

26/12/2023, 03:18

26/12/2023, 03:10

26/12/2023, 02:49

25/12/2023, 23:42

25/12/2023, 15:43

25/12/2023, 15:36

Analysis

max time kernel
1581s
max time network
1248s
platform
windows10-1703_x64
resource
win10-20231220-en
resource tags

arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
submitted
26/12/2023, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirtualBox-6.0.24-139119-Win.exe
Size

162.6MB
MD5

bf0d15ed303a38875006ffea1fc08cd5
SHA1

26b9ea5d6b12d669ffb7b0e705f7119ef9fc1166
SHA256

b9e524468ec5048568a79d4586bd4c162c9698e04fcf7b928c804dc107be7a56
SHA512

56b67a8aaf8d321883ec168d9cb2fdc98ab95c8d8daf6066c5f727ca5a9b8cf25a0fcb83082a11f55a8e05c65991c85af98ddffff372e2307a20d3f681daa911
SSDEEP

3145728:MEHxTKgumdU38cEu4LQb443ZywG6YVWlRwx/jiYcsUYoYC3C1oH:MEHMxmlVLQVZVGqlRwx29sU3v33

Score

10^/10

gafgyt botnet link pdf persistence

Malware Config

Signatures

Detected Gafgyt variant 1 IoCs

resource	yara_rule
behavioral1/files/0x000100000000002a-1100.dat	family_gafgyt

Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
botnet gafgyt

Drops file in Drivers directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SETA14C.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETA14C.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETF77A.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxNetAdp6.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETFC0F.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETFC0F.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxNetLwf.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxDrv.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETA256.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETA256.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxUSBMon.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETF77A.tmp	MsiExec.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6F474206BCBB391BB82BA9E5DC0302DEF37AEBBE\Blob = 0300000001000000140000006f474206bcbb391bb82ba9e5dc0302def37aebbe0400000001000000100000002c3567a8535342474e8b4c4bc12317cb0f0000000100000014000000ecd4ebe2c1d886ef3d26207e08233bab3df5fa16140000000100000014000000580a4653e175d36e5870202641e146f432f375ce190000000100000010000000cb50e8f74b3c50accac55eec928e7e955c000000010000000400000000080000180000000100000010000000c7c2cda336016dcb1d1c518e4c192b4b4b0000000100000044000000430041003400340035003800450037003300360036004500390034004100330043003300410039004300310046004500350034003800420036004400320031005f00000020000000010000003b050000308205373082041fa003020102021005308b76ac2e15b29720fb4395f65f38300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3139303331393030303030305a170d3232303332333132303030305a308182310b3009060355040613025553310b3009060355040813024341311730150603550407130e526564776f6f642053686f726573311b3019060355040a13124f7261636c6520436f72706f726174696f6e31133011060355040b130a5669727475616c626f78311b3019060355040313124f7261636c6520436f72706f726174696f6e30820122300d06092a864886f70d01010105000382010f003082010a0282010100b6a7938229319f50f072fd8163a2be2f208e722c1a32b68119791855b85d392932c923f91149bbf7c887814d5c8ffc8a4b57b673460e267559953780cf2199a7d4e254ee073cd3b643470dc2c348f2e2d10a1cdf0f406a2af9a1672342fec867f1bb69e0727655e694887ce5f81ef8d7d9d45dc2f582a5b52a9a35268c3df011f1e7df9347dd3fe3b711e42fba4836e311c636a955a6a8dd5042642d98ac45b6e3d1c7a290d12443c290d951ca9d68b8050304313ab30260378f46095fe7b28984994be0a7af1cec371eeb4a226fd7962932592803759133b78633cb8199798c83d80606ecf9388d27b97f8fd34f9579e29cfb121ad53e9d5684fc0f4d2fed1b0203010001a38201b9308201b5301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e04160414580a4653e175d36e5870202641e146f432f375ce300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303306d0603551d1f046630643030a02ea02c862a687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d67312e63726c3030a02ea02c862a687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d67312e63726c304c0603551d2004453043303706096086480186fd6c0301302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533008060667810c01040130818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d010105050003820101003ce0fd90571775f8dce677d978cd8d2770927d79f13e57d0013e55ab908a269c984b5f4c9b334cc7d7a3702ba136cd31b40439084c7c21b85607014169540e30c29b703c581fceb6aaac22731507184df73e5af10e5a27ae080ee939aa2fcb7c8a16ee91f54015e5883b0267d4d83d6135492d18457a27ea3f6bf39fae9203fe88db01873f49b79098bf9e7ac4fd2f50ceeeddbfedb115e66821e785675b243b1998422d31bb30be339892ce2143dedaf90496bd46f97551cdbc495b6a452e77a834afe9f9f52d18459ece1651969d66d6fbe868a3eb5a443f3cefa69562570a9b1800bae8186c713766e196050996b32bd7e7effc719c1859784920916a72a5	DrvInst.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\K:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\N:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\S:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\X:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\G:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\Q:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\F:	VirtualBox.exe
File opened (read-only)	\??\A:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\L:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\O:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\T:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\V:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\Z:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\F:	chrome.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\U:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\P:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\R:	VirtualBox-6.0.24-139119-Win.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	VirtualBox-6.0.24-139119-Win.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	rundll32.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_AD8FECFC99082C943B86D4514C0092BF1FC01793\VBoxDrv.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed68ac04-381f-f446-8c6c-de9f59204139}\SETFB34.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\wfpcapture.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_7d950a8cf9a3217e\VBoxNetAdp6.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_739e9ec110147b31\netbrdg.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_872e96ff2944e3ea\VBoxUSB.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_960a76222168b3fa\ndiscap.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	rundll32.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b9c6c78-a859-3945-91a4-3b282920d27c}\SETF6CF.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_ded82fc1c2b41e6b\netvwififlt.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\DRVSTORE\VBoxDrv_AD8FECFC99082C943B86D4514C0092BF1FC01793\VBoxDrv.inf	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxUSBMon_992DC80DA34182DDBB3CB606D5A34D7DE1607936\VBoxUSBMon.sys	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f91f40e-3928-6642-b910-4f6b7ac4fd46}\SETA331.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8f91f40e-3928-6642-b910-4f6b7ac4fd46}\SETA331.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_286311b3ad406c73\netrass.PNF	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_AD8FECFC99082C943B86D4514C0092BF1FC01793\VBoxDrv.cat	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_872e96ff2944e3ea\VBoxUSB.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_7d950a8cf9a3217e\VBoxNetAdp6.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_9b48be32f09b1fb6\netnwifi.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed68ac04-381f-f446-8c6c-de9f59204139}\VBoxNetLwf.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ed68ac04-381f-f446-8c6c-de9f59204139}\SETFB35.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_ecd984f601508a74\netserv.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\DRVSTORE	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f91f40e-3928-6642-b910-4f6b7ac4fd46}\VBoxUSB.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b9c6c78-a859-3945-91a4-3b282920d27c}\VBoxNetAdp6.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f91f40e-3928-6642-b910-4f6b7ac4fd46}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b9c6c78-a859-3945-91a4-3b282920d27c}\SETF6D0.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_56290c9e296b5be9\netpacer.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{8f91f40e-3928-6642-b910-4f6b7ac4fd46}\SETA330.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	rundll32.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_AD8FECFC99082C943B86D4514C0092BF1FC01793\VBoxDrv.inf	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f91f40e-3928-6642-b910-4f6b7ac4fd46}\VBoxUSB.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b9c6c78-a859-3945-91a4-3b282920d27c}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed68ac04-381f-f446-8c6c-de9f59204139}\SETFB36.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed68ac04-381f-f446-8c6c-de9f59204139}\VBoxNetLwf.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_f229f597c65d5e8d\VBoxNetLwf.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f91f40e-3928-6642-b910-4f6b7ac4fd46}\SETA332.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_872e96ff2944e3ea\VBoxUSB.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b9c6c78-a859-3945-91a4-3b282920d27c}\VBoxNetAdp6.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_f229f597c65d5e8d\vboxnetlwf.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{8f91f40e-3928-6642-b910-4f6b7ac4fd46}\SETA332.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b9c6c78-a859-3945-91a4-3b282920d27c}\SETF6D0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_7d950a8cf9a3217e\VBoxNetAdp6.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ed68ac04-381f-f446-8c6c-de9f59204139}\SETFB36.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b9c6c78-a859-3945-91a4-3b282920d27c}\VBoxNetAdp6.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b9c6c78-a859-3945-91a4-3b282920d27c}\SETF6D1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_f229f597c65d5e8d\VBoxNetLwf.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_e610f6f65afdc230\netnb.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ed68ac04-381f-f446-8c6c-de9f59204139}\SETFB35.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_f229f597c65d5e8d\VBoxNetLwf.inf	DrvInst.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1688	VirtualBoxVM.exe
1688	VirtualBoxVM.exe
3096	VirtualBoxVM.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\redhat67_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_fa.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\msvcp100.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel5_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxWebSrv.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_es.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VMMRC.rc	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\install\vboxapi\VirtualBox_constants.py	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\msvcp100.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxHostChannel.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxREM.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_id.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_th.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_zh_TW.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5WinExtrasVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_fr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxTestOGL.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxGuestAdditions.iso	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_tr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_el.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_eu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxEFI32.fd	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_th.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_de.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_hr_HR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_sl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAuthSimple.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxCAPI.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\msvcr100.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxClient-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_cs.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\DbgPlugInDiggers.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ko.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxVMM.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxEFI64.fd	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hr_HR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\msvcr100.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxBalloonCtrl.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_uk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_hu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel3_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_id.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_lt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qoffscreen.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxGlobal.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetDHCP.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxRT-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_eu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ja.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_nl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDD.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxManage.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pl.qm	msiexec.exe

Drops file in Windows directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e589517.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\INF\oem1.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIA22C.tmp	msiexec.exe
File created	C:\Windows\Installer\{9EC88BBB-BAFD-4666-BFB1-5F737A76C055}\IconVirtualBox	msiexec.exe
File created	C:\Windows\Installer\e589519.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCB5.tmp	msiexec.exe
File created	C:\Windows\Installer\e589517.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB1D.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem5.inf	DrvInst.exe
File created	C:\Windows\INF\oem5.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI97B7.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\INF\oem0.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIFDA1.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA2E8.tmp	msiexec.exe
File created	C:\Windows\INF\oem4.PNF	svchost.exe
File opened for modification	C:\Windows\Installer\MSIFA9F.tmp	msiexec.exe
File created	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9EC88BBB-BAFD-4666-BFB1-5F737A76C055}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97F6.tmp	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIF6B6.tmp	msiexec.exe
File created	C:\Windows\INF\oem2.PNF	MsiExec.exe
File created	C:\Windows\INF\oem3.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI9AD7.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\{9EC88BBB-BAFD-4666-BFB1-5F737A76C055}\IconVirtualBox	msiexec.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe

Executes dropped EXE 8 IoCs

pid	Process
3064	VirtualBox.exe
1308	VBoxSVC.exe
4800	VBoxSDS.exe
2888	VirtualBox.exe
3820	VBoxSVC.exe
1700	VBoxSDS.exe
1688	VirtualBoxVM.exe
3096	VirtualBoxVM.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral1/files/0x000100000000002a-1100.dat	pdf_with_link_action

Loads dropped DLL 60 IoCs

pid	Process
4484	MsiExec.exe
504	MsiExec.exe
504	MsiExec.exe
504	MsiExec.exe
504	MsiExec.exe
504	MsiExec.exe
504	MsiExec.exe
504	MsiExec.exe
504	MsiExec.exe
4484	MsiExec.exe
3064	VirtualBox.exe
3064	VirtualBox.exe
3064	VirtualBox.exe
3064	VirtualBox.exe
3064	VirtualBox.exe
3064	VirtualBox.exe
3064	VirtualBox.exe
3064	VirtualBox.exe
3064	VirtualBox.exe
3064	VirtualBox.exe
3064	VirtualBox.exe
1308	VBoxSVC.exe
1308	VBoxSVC.exe
1308	VBoxSVC.exe
1308	VBoxSVC.exe
4800	VBoxSDS.exe
4800	VBoxSDS.exe
4800	VBoxSDS.exe
4800	VBoxSDS.exe
1308	VBoxSVC.exe
2888	VirtualBox.exe
2888	VirtualBox.exe
2888	VirtualBox.exe
2888	VirtualBox.exe
2888	VirtualBox.exe
2888	VirtualBox.exe
2888	VirtualBox.exe
2888	VirtualBox.exe
2888	VirtualBox.exe
2888	VirtualBox.exe
2888	VirtualBox.exe
3820	VBoxSVC.exe
3820	VBoxSVC.exe
3820	VBoxSVC.exe
3820	VBoxSVC.exe
1700	VBoxSDS.exe
1700	VBoxSDS.exe
1700	VBoxSDS.exe
1700	VBoxSDS.exe
3820	VBoxSVC.exe
1688	VirtualBoxVM.exe
1688	VirtualBoxVM.exe
1688	VirtualBoxVM.exe
1688	VirtualBoxVM.exe
1688	VirtualBoxVM.exe
1688	VirtualBoxVM.exe
1688	VirtualBoxVM.exe
1688	VirtualBoxVM.exe
1688	VirtualBoxVM.exe
1688	VirtualBoxVM.exe

Registers COM server for autorun 1 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32\ThreadingModel = "Free"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32	VirtualBox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32\ThreadingModel = "Free"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74AB5FFE-8726-4435-AA7E-876D705BCBA5}\LocalServer32\ = "\"C:\\Program Files\\Oracle\\VirtualBox\\VBoxSDS.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74AB5FFE-8726-4435-AA7E-876D705BCBA5}\LocalServer32	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74AB5FFE-8726-4435-AA7E-876D705BCBA5}\LocalServer32	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxC.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxC.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{74AB5FFE-8726-4435-AA7E-876D705BCBA5}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxProxyStub.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32\ = "\"C:\\Program Files\\Oracle\\VirtualBox\\VBoxSVC.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32	VirtualBox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x000100000000002a-1100.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133480368736973679"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C354A762-3FF2-4F2E-8F09-07382EE25088}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{97C78FCD-D4FC-485F-8613-5AF88BFCFCDC}\ProxyStubClsid32	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D5ABC823-04D0-4DB6-8D66-DC2F033120E1}\ProxyStubClsid32	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FAEF61E-6E15-4F71-A6A5-94E707FAFBCC}\ProxyStubClsid32	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E253EE8-477A-2497-6759-88B8292A5AF0}\ = "IEmulatedUSB"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B2F98F8-9641-4397-854A-040439D0114B}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92ED7B1A-0D96-40ED-AE46-A564D484325E}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADF292B0-92C9-4A77-9D35-E058B39FE0B9}\TypeLib	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B78DAEB-F52F-43B9-99E8-4A3C226CBE2D}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C39EF4D6-7532-45E8-96DA-EB5986AE76E4}\TypeLib	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5}\ = "INATNetworkChangedEvent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7C88B82-2330-44E3-B247-1421A018F9C1}\ = "IKeyboard"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C48F3401-4A9E-43F4-B7A7-54BD285E22F4}\NumMethods\ = "15"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAAF9016-1F04-4191-AA2F-1FAC9646AE4C}\ProxyStubClsid32	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B79DE686-EABD-4FA6-960A-F1756C99EA1C}\NumMethods\ = "14"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E91BB944-F211-4BD5-B44C-8F1D0BEAFA13}\NumMethods\ = "94"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{39B4E759-1EC0-4C0F-857F-FBE2A737A256}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9DB3A9E6-7F29-4AAE-A627-5A282C83092C}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD3E2654-A161-41F1-B583-4892F4A9D5D5}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ABE94809-2E88-4436-83D7-50F3E64D0503}\TypeLib	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D23A9CA3-42DA-C94B-8AEC-21968E08355D}\ = "IDnDSource"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F9B9E1CF-CB63-47A1-84FB-02C4894B89A9}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C365FB7B-4430-499F-92C8-8BED814A567A}\NumMethods\ = "17"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D3D5F1EE-BCB2-4905-A7AB-CC85448A742B}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{DBE11E5F-7F10-46E7-94C4-1E95BF4B6627}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBox\CurVer	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0447716-FF5A-4795-B57A-ECD5FFFA18A4}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{AB4164DB-C13E-4DAB-842D-61EE3F0C1E87}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBox\CLSID\ = "{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{20479EAF-D8ED-44CF-85AC-C83A26C95A4D}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24EEF068-C380-4510-BC7C-19314A7352F1}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E8F79A21-1207-4179-94CF-CA250036308F}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3934047325-4097474570-3437169968-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3934047325-4097474570-3437169968-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5}\NumMethods	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{334DF94A-7556-4CBC-8C04-043096B02D82}\NumMethods\ = "13"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67099191-32E7-4F6C-85EE-422304C71B90}\NumMethods\ = "8"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbox\Content Type = "application/x-virtualbox-vbox"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FAEF61E-6E15-4F71-A6A5-94E707FAFBCC}\TypeLib	VirtualBox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3934047325-4097474570-3437169968-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A5BBDB7D-8CE7-469F-A4C2-6476F581FF72}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{758D7EAC-E4B1-486A-8F2E-747AE346C3E9}\NumMethods\ = "23"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{872DA645-4A9B-1727-BEE2-5585105B9EED}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C365FB7B-4430-499F-92C8-8BED814A567A}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{22363CFC-07DA-41EC-AC4A-3DD99DB35594}\TypeLib	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB220201-2FD3-47E2-A5DC-2C2431D833CC}\NumMethods	VirtualBox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\VirtualBox.Session\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9B9E1CF-CB63-47A1-84FB-02C4894B89A9}\ = "IHostNameResolutionConfigurationChangeEvent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D55176E5-6730-4E9E-FC1F-A59B1F44F78F}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91f33d6f-e621-4f70-a77e-15f0e3c714d5}	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{b0a0904d-2f05-4d28-855f-488f96bad2b2}	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FE2DA40-5637-472A-9736-72019EABD7DE}\ProxyStubClsid32	VirtualBox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{21637B0E-34B8-42D3-ACFB-7E96DAF77C22}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81314D14-FD1C-411A-95C5-E9BB1414E632}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE8A0EB5-F4F4-4DD0-9D30-C89B873247EC}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4B301A9-5F86-4D65-AD1B-87CA284FB1C8}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DE887F2-B7DB-4616-AAC6-CFB94D89BA78}\NumMethods\ = "18"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D37FE88F-0979-486C-BAA1-3ABB144DC82D}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1D978B8-F7B7-4B05-900E-2A9253C00F51}\TypeLib	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC49259C-1C50-4353-97A5-0FD92E2CAAC2}\NumMethods	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6620DB85-44E0-CA69-E9E0-D4907CECCBE5}\ = "IGuestFsObjInfo"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8FAEF61E-6E15-4F71-A6A5-94E707FAFBCC}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{88394258-7006-40D4-B339-472EE3801844}\NumMethods\ = "13"	msiexec.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
3064	VirtualBox.exe
2888	VirtualBox.exe
1688	VirtualBoxVM.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1532	msiexec.exe
1532	msiexec.exe
3220	chrome.exe
3220	chrome.exe
1048	chrome.exe
1048	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3064	VirtualBox.exe
4452	chrome.exe
2888	VirtualBox.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found
636	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeIncreaseQuotaPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeSecurityPrivilege	1532	msiexec.exe
Token: SeCreateTokenPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeAssignPrimaryTokenPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeLockMemoryPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeIncreaseQuotaPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeMachineAccountPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeTcbPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeSecurityPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeTakeOwnershipPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeLoadDriverPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeSystemProfilePrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeSystemtimePrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeProfSingleProcessPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeIncBasePriorityPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeCreatePagefilePrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeCreatePermanentPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeBackupPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeRestorePrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeShutdownPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeDebugPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeAuditPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeSystemEnvironmentPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeChangeNotifyPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeRemoteShutdownPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeUndockPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeSyncAgentPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeEnableDelegationPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeManageVolumePrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeImpersonatePrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeCreateGlobalPrivilege	2552	VirtualBox-6.0.24-139119-Win.exe
Token: SeBackupPrivilege	3472	vssvc.exe
Token: SeRestorePrivilege	3472	vssvc.exe
Token: SeAuditPrivilege	3472	vssvc.exe
Token: SeBackupPrivilege	1532	msiexec.exe
Token: SeRestorePrivilege	1532	msiexec.exe
Token: SeRestorePrivilege	1532	msiexec.exe
Token: SeTakeOwnershipPrivilege	1532	msiexec.exe
Token: SeBackupPrivilege	4436	srtasks.exe
Token: SeRestorePrivilege	4436	srtasks.exe
Token: SeSecurityPrivilege	4436	srtasks.exe
Token: SeTakeOwnershipPrivilege	4436	srtasks.exe
Token: SeRestorePrivilege	1532	msiexec.exe
Token: SeTakeOwnershipPrivilege	1532	msiexec.exe
Token: SeRestorePrivilege	1532	msiexec.exe
Token: SeTakeOwnershipPrivilege	1532	msiexec.exe
Token: SeBackupPrivilege	4436	srtasks.exe
Token: SeRestorePrivilege	4436	srtasks.exe
Token: SeSecurityPrivilege	4436	srtasks.exe
Token: SeTakeOwnershipPrivilege	4436	srtasks.exe
Token: SeRestorePrivilege	1532	msiexec.exe
Token: SeTakeOwnershipPrivilege	1532	msiexec.exe
Token: SeRestorePrivilege	1532	msiexec.exe
Token: SeTakeOwnershipPrivilege	1532	msiexec.exe
Token: SeRestorePrivilege	1532	msiexec.exe
Token: SeTakeOwnershipPrivilege	1532	msiexec.exe
Token: SeRestorePrivilege	1532	msiexec.exe
Token: SeTakeOwnershipPrivilege	1532	msiexec.exe
Token: SeRestorePrivilege	1532	msiexec.exe
Token: SeTakeOwnershipPrivilege	1532	msiexec.exe
Token: SeRestorePrivilege	1532	msiexec.exe
Token: SeTakeOwnershipPrivilege	1532	msiexec.exe
Token: SeRestorePrivilege	1532	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2552	VirtualBox-6.0.24-139119-Win.exe
2552	VirtualBox-6.0.24-139119-Win.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	VirtualBox.exe
4452	chrome.exe
2888	VirtualBox.exe
2888	VirtualBox.exe
2888	VirtualBox.exe
1688	VirtualBoxVM.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 4436	1532	msiexec.exe	79
PID 1532 wrote to memory of 4436	1532	msiexec.exe	79
PID 1532 wrote to memory of 4484	1532	msiexec.exe	80
PID 1532 wrote to memory of 4484	1532	msiexec.exe	80
PID 1532 wrote to memory of 504	1532	msiexec.exe	81
PID 1532 wrote to memory of 504	1532	msiexec.exe	81
PID 1368 wrote to memory of 3100	1368	svchost.exe	83
PID 1368 wrote to memory of 3100	1368	svchost.exe	83
PID 3100 wrote to memory of 4692	3100	DrvInst.exe	84
PID 3100 wrote to memory of 4692	3100	DrvInst.exe	84
PID 1532 wrote to memory of 204	1532	msiexec.exe	85
PID 1532 wrote to memory of 204	1532	msiexec.exe	85
PID 1532 wrote to memory of 204	1532	msiexec.exe	85
PID 1368 wrote to memory of 832	1368	svchost.exe	88
PID 1368 wrote to memory of 832	1368	svchost.exe	88
PID 1368 wrote to memory of 1248	1368	svchost.exe	91
PID 1368 wrote to memory of 1248	1368	svchost.exe	91
PID 2552 wrote to memory of 3064	2552	VirtualBox-6.0.24-139119-Win.exe	92
PID 2552 wrote to memory of 3064	2552	VirtualBox-6.0.24-139119-Win.exe	92
PID 3220 wrote to memory of 3996	3220	chrome.exe	96
PID 3220 wrote to memory of 3996	3220	chrome.exe	96
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 1548	3220	chrome.exe	98
PID 3220 wrote to memory of 308	3220	chrome.exe	97
PID 3220 wrote to memory of 308	3220	chrome.exe	97
PID 3220 wrote to memory of 5076	3220	chrome.exe	101
PID 3220 wrote to memory of 5076	3220	chrome.exe	101
PID 3220 wrote to memory of 5076	3220	chrome.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirtualBox-6.0.24-139119-Win.exe
"C:\Users\Admin\AppData\Local\Temp\VirtualBox-6.0.24-139119-Win.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files\Oracle\VirtualBox\VirtualBox.exe
  "C:\Program Files\Oracle\VirtualBox\VirtualBox.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers COM server for autorun
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3064

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4436
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding ADE67222025F0E5DA3402C8F8C98F760
  2⤵
  - Loads dropped DLL
  PID:4484
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6CF638E39876CAFBB627D7FD3C6A77EF E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:504
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 093E227108184E218898A85367150C27 M Global\MSI0000
  2⤵
  PID:204

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3472

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.inf" "9" "48f6bcb47" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\Oracle\VirtualBox\drivers\USB\device"
  2⤵
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{64129d8f-412c-bb4a-a811-c68862b77f6f} Global\{6303e8e2-4db7-4f4b-9b16-53564a66bab5} C:\Windows\System32\DriverStore\Temp\{8f91f40e-3928-6642-b910-4f6b7ac4fd46}\VBoxUSB.inf C:\Windows\System32\DriverStore\Temp\{8f91f40e-3928-6642-b910-4f6b7ac4fd46}\VBoxUSB.cat
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    PID:4692
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf" "9" "473b17b7b" "000000000000017C" "WinSta0\Default" "0000000000000174" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:832
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf" "9" "431e52bcb" "000000000000019C" "WinSta0\Default" "00000000000001A0" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1248

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
- Drops file in Windows directory
PID:3480

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman
1⤵
PID:4268

C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe
"C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308

C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe
"C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates connected drives
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd8,0xdc,0xe0,0xb4,0xe4,0x7ffea4849758,0x7ffea4849768,0x7ffea4849778
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:2
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2768 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2760 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4468 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4636 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4788 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4452 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4564 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5144 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3128 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5584 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6040 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3892 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1520 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1460 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3856 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5304 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1376 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 --field-trial-handle=1836,i,12896119124803233656,9256912717245195245,131072 /prefetch:8
  2⤵
  PID:3512

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2836

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"F:\" -an -ai#7zMap18219:72:7zEvent31274
1⤵
PID:2548

C:\Program Files\Oracle\VirtualBox\VirtualBox.exe
"C:\Program Files\Oracle\VirtualBox\VirtualBox.exe"
1⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2888

C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe
"C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3820
- C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
  "C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe" --comment XP --startvm aaeb0119-b932-4206-a2ce-c4c9520dd431 --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\XP\Logs\VBoxHardening.log"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1688
- - C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
    60eaff78-4bdd-042d-2e72-669728efd737-suplib-2ndchild --comment XP --startvm aaeb0119-b932-4206-a2ce-c4c9520dd431 --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\XP\Logs\VBoxHardening.log"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Executes dropped EXE
    PID:3096

C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe
"C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:4028

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d0
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e589518.rbs

Filesize
68KB

MD5
2d246b62244108e4a6daac84fc9b1827

SHA1
cf1f858f5972ffc50fdb4979ff25e946e27ad4ce

SHA256
f6918ae0a223d7dbadac50e77461b0baf4843b45546aa96cdd61720382ab8b6d

SHA512
d025b8ca6d4ea7f3d6f72cf85a3ee02a0bba46acd62832db842403f419093b688e43623bbe9f20db935ee0710f516770380d5f8678158ad1742a9229b5893b7c

Download Submit
C:\PROGRA~1\Oracle\VIRTUA~1\drivers\USB\device\VBoxUSB.sys

Filesize
156KB

MD5
73b209dfea1e7618fc675b18237f2d86

SHA1
a7978c0d07de5857a6d00a060b0f826adf9665f4

SHA256
3f3b343e12f2bcd9bd39c4472dd08733f99d95f4010ac7962e6d84981352944e

SHA512
9ca8bcd4776ea4314de166ee8cb7826afc28a0e2fb243f197c3ca724e8cf011d91b0375b1d007e2a095cb6c5abc9f0b322a00ecfc667b9409136d7d5f59cbec3

Download Submit
C:\PROGRA~1\Oracle\VIRTUA~1\drivers\network\netadp6\VBoxNetAdp6.sys

Filesize
171KB

MD5
09cbefd2256c44c015139beac44321a8

SHA1
78ebaf53b28ba665613c5b7808900fc7de747719

SHA256
8af2427522dddfa4812e116889bcacd580d43e3cfc572e94cd148c3f2bb8a380

SHA512
f52b47a0d78a499b15c70b897cf79c5686794198836edf0dfcc45bc8a967b74402ff69ae50ddedd675e4a3b5564487c49c5be1bcac4cfcd8d5c0266fee3fc876

Download Submit
C:\PROGRA~1\Oracle\VIRTUA~1\drivers\network\netlwf\VBoxNetLwf.sys

Filesize
114KB

MD5
ce10d44b3060fa00b583d3cb9c46a31a

SHA1
5fd35208fd80b8299a1b918f5b68a3dd3bf7dd6c

SHA256
a0ac65f5b68eda85247433b0b9576709b8ec25a125dfa88dcb5bd09ee1c0a6ff

SHA512
a4c88679c41cd638366b257aca57bcfbbe969cdd50365618839cbb9c0e58b8c023ff0d5086985feac441f2eb28948552d58383b4acb44b96b8f6e5cbd89d7a72

Download Submit
C:\Program Files\Oracle\VirtualBox\MSVCR100.dll

Filesize
38KB

MD5
311971ae4c5c617fa62b2a8988b43bc3

SHA1
08a90270d6436b0c5d664f98d3d83de6f887872d

SHA256
fb54ad2bfdc976fff48a859b0437f2e7a1ea7b032f2d72d9a8781f2f6abb2b15

SHA512
732c7c30e5a367ec604359baf7a086ee6d7a4a92aa102bb6637341665bb8348995dea47f5e2a2698a4208772814808dbf2bc227e4d4d511996b5d7eac10ab3d7

Download Submit
C:\Program Files\Oracle\VirtualBox\VBoxGlobal.dll

Filesize
42KB

MD5
86c4bfad494a6336e96a8683a7911d75

SHA1
1e847b11dab315228a03889a0eaab840318d8b82

SHA256
b5c5074c14ca8f05abee5430fca470b331fce13376de4f6611f7cfde02d834cd

SHA512
1d32d4de27e97196fb4c1735d3b37a62d48aaa04bd3254091f797517bca67e366ecd14a89200fca7ae77a2f6192df292e3d094835e190e7e6ec720c1c1a07574

Download Submit
C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll

Filesize
154KB

MD5
afdd75d011c86943666a7bc55b1c5f2d

SHA1
d6c30bd56994b07ac00ad0ef43a8b98904ea1fd9

SHA256
3e0d28e68fb4736be8084c7a0285cb84fa967dcedf7e96267e24fe3c76c45415

SHA512
f915255e831d56fa55805dd792fef61c196f14dbcfb248059005c22abd4c4b36db0fb63d071b39c1edf10b845f845c181d703b3ca15731ea82722065494e3adb

Download Submit
C:\Program Files\Oracle\VirtualBox\VBoxRT.dll

Filesize
83KB

MD5
b5d9781afdc9e972ba6acacd6b14df9d

SHA1
412f399f4ba54f545386b4dcd2c0cd77882cce4d

SHA256
b9a65af75706c531a5e49450aa8a9fac047cb6127e2e4bdd5ec16c2779d07af0

SHA512
8083d521c7b7d2870d4330a829fc0b9ac981013d5c25f1ce76fa001c589157805e88c16b156b6fd37f5582735b998a3610e537dc0452a083fbd652d94bace68c

Download Submit
C:\Program Files\Oracle\VirtualBox\VirtualBox.exe

Filesize
278KB

MD5
e9563fb3c37d50b52367a379e58be100

SHA1
92fda0a2843fa9e5d38627c90e792f68c335434b

SHA256
e5624f6b9a04a9b6bf0435cf3a37b30bd15ba959af53bcaceddb960a4587c506

SHA512
6acba3d5b474a3da3fc498b599db02391b7991b636271a4159cfc4222891b769f3a504891d6eb60bd91a6382f8447ccb2514db1f4e335441e641a1c15f5d4d5f

Download Submit
C:\Program Files\Oracle\VirtualBox\VirtualBox.exe

Filesize
333KB

MD5
5cf41cb5bcf31ee836d324f9773bfabd

SHA1
ed7e269599762d009ec4e9e8b95643db7fc4907a

SHA256
214823708c29118651af6ae7316c616367f3b8f0219d09b37286df8730d8aad0

SHA512
eb4263b41adf3470488aa6866b7867471b29169797084291d08fc29bf3dc8863f276de2bcaa12c03597194798c008d686b28022bfeb4f0a32a16abb1cd8b4bd4

Download Submit
C:\Program Files\Oracle\VirtualBox\VirtualBox.exe

Filesize
183KB

MD5
206af40c00e71f08fa04bbae900f270b

SHA1
3b72abefa11745f8c43ff02fcd0d730445ca5221

SHA256
b37fc1c0788f819dec226c3df7bdeb411a6083e9121869a459c2e44327d3c213

SHA512
86873c599033d81b6d3cd4e50b67ab5b18ea2eab889db6459919cf11602cdf2ba48067260754bf015034e75fe648a07bc6ff6f1b7c497cf16a340d34adc7711c

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.inf

Filesize
2KB

MD5
b44f53e4454b113862bcc199fa209b86

SHA1
5cfa226b857f8107708600c970663a1aab418996

SHA256
cbedf31af96952471ed3970d1f0d83e673e23789de959d834149d17540c825c3

SHA512
31b88d30eba3f688847e88e5dda66b7eed9d5f61c29490f375b75b4b6890daf0fdf3a89208a895c92d553478a02a7b4b4a38074f168c5b2a4c1a6a3ef03ae973

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.cat

Filesize
16KB

MD5
9829a75c9e8b91eb17d293400b6b836f

SHA1
992dc80da34182ddbb3cb606d5a34d7de1607936

SHA256
3d69f3b5907d7339133baad9ed4651885aa60598adb2dc829bebdfd445a02e05

SHA512
20629f75bdafdd1663504b098d306f9e9422e3b8216af56142a57fdc7bc029fc2139cab6ea0c98c0cbedcd4478a90019da9d5bb11cbd44d68e0c9310d4309c7f

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.inf

Filesize
2KB

MD5
d80e6d22ffb4a33ad7f7d4e185890586

SHA1
09eb4c5bc7f5c227b5787454a502efcbb1b9fe7b

SHA256
ffe243e3a959ac3beae3c037bc0eab08f4ea5a5ea7edd82ab9e5bf2825f019db

SHA512
be3450cfe17efd9a08115bb5e924bd7f01363ab971c3f82748f52df21b274bdba16a3db1441fbf2796b4b33abeec5b94cc12a7ed462c5df11a28b96bf3b34b8c

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.sys

Filesize
97KB

MD5
fc6ea4b9adc03bf0d4b710fdcdddd4dc

SHA1
d59cf51823b86d68d5d6e14fd2f205fc9b920171

SHA256
707c9bb231e4098daf1c7be0663b42ea9945b86a09fba7fc5f6403f39604182a

SHA512
be3b0518e7366f2ed081282be5e165668292c96d12d59ec9cb1afebae263f27997de59a0ebc9720d5158340e8c9180df265335c2756d06473f9422a4ecc6721a

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.cat

Filesize
16KB

MD5
a515421a5113128407b7f11a0cd6a6a2

SHA1
ad8fecfc99082c943b86d4514c0092bf1fc01793

SHA256
f3fa07935106445cd9c57dbc36bcfb596c0685362dff085a0839abbbe06115e3

SHA512
cac49374aa50a56d9e75fcc9ac4eca2fef5602c0fced4bc928b241c44b538f0c4db0f83b25bc849e1c22de14b1efd20ce2c01fe9ab15964a42bd57816d31344a

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.inf

Filesize
2KB

MD5
e37aff88f5814ef132371fe9b2c285f0

SHA1
4883e7c37b975050566ec405ed137f24e096f827

SHA256
479ecc1701ffd90112e64facd5eedfcd0953940f8989c9e40b5d4df974e3c98f

SHA512
6ab62a693d6e2b4ea68c9d29458c763f34999dafc9af94eb9667ae1d40c72b8734254e49af81d0b0a2555a9077461ce00236dcbcefca1abedb3975911ea91c27

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.sys

Filesize
102KB

MD5
a9f3b38fdaaa5d629865d17ed3560e09

SHA1
3d9ed3599b64bbb1381417fbc418bf605f15a76b

SHA256
76f78989d197cc95815cf339c0851073b8a09fafb7ece94e7a7cdac3e9a1b225

SHA512
9f23bca7ff0b9edda87b46894067ddb805e221ed533c6fb29676aa839f370bda35b6d45daab7097b01258c81117fc3afcc02460a79cdeac0e028c0dc4f864609

Download Submit
C:\Program Files\Oracle\VirtualBox\x86\VBoxProxyStub-x86.dll

Filesize
94KB

MD5
02da97f775b2150eb3c498526892379d

SHA1
364537f9a5206c924d7908507503fdf090bb45b4

SHA256
f0c938201c90a49941988aa11541c0a6638bceaa70150d3cffcb4e153767fc6d

SHA512
5b1d9f5c23009883de69c20d074117f2515dfc51c5f672db813b5fca2ee659fe40d23f8c94d7c778e51d7f9b39baddee3e8762a863198eb34df63e3baeb5eb34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CA4458E7366E94A3C3A9C1FE548B6D21_B987CE411E5D0C51DB67F65D3191F84F

Filesize
471B

MD5
29c4d065f140dd257f9a78578c420ff2

SHA1
f33834d58805418a2920efbb2bccb2f05c193aab

SHA256
97b7ac0956c50c2fffa174ce08c6acfe65ffde6cde5d7025094df3bde7e4c311

SHA512
3928188be247258482682450b939b2ebaddb147a45e408661de6bf613907ec3a2d4cfa7f5f91e6d9884805bccdc3feba5c27f11d86393570dcee619848b5eabb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9

Filesize
471B

MD5
3adbfeb66ae087735a373144ea395379

SHA1
11df2772d8e57cc094d446fa2d4a22a65a052c2e

SHA256
56fc0bed27245295598f4a04948c086005015dc7b707d69bb8f6f1fac9b6c62d

SHA512
1c7122d0fb8b34ac74f36a94baaad18d77ae519af9a181ede1c2cf14aff64b81f11cfd0bdfce3e88447582488688a7d017cbc3b450b710272ccc4ab5c3c64375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CA4458E7366E94A3C3A9C1FE548B6D21_B987CE411E5D0C51DB67F65D3191F84F

Filesize
396B

MD5
ec6809e179791d74613d804dc47d1029

SHA1
b6785ace3d89bf23cd43829673705993ae5ff370

SHA256
afa1873a5af590577bf5a033632377bc6bbff2e88b5a6b49759917d998539ca0

SHA512
ea7afde9b97ef7b94e5ed1d2c1489d95449d259e1558606ffe0aceb8b637d6875ad52b05a9a6d1c2554e32eab143fedc9b84ca7db6f8b59acb3934210a2139b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9

Filesize
408B

MD5
0160d7e60ecbd5e3d01bb624d2f0ade8

SHA1
d799467868cb3a81bff5cb503752d2005c3186a8

SHA256
78bb484e0e194dd6ce907e04e243fe88124fb6af8399a7e78d7dc821ae12c233

SHA512
79e784bc157a296b5833ee435909d383d27d9208d6dbcaf65e588ad81903bb8537bf63528d7e9f176d1479b31e4dfe5f3a1244b3b6441713f179a43eb20b9a4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
8b5a856089a4856042bf116cf3a18f73

SHA1
f7fd4a82a8191a8ff987fb5bd49f57506907618f

SHA256
622697b4a2b501db1fe70f913e53a479f109c47b282cb5028b95474fce164535

SHA512
950a89fad67dde9478277e865f41d67af6b0162347e78953593db0b05736bbf7746fc50f57e6e74986935a42f7c56b34feaf0913682f3c3c9af5e81c0374d015

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
317a793e27174fc070c8bcfaebae5499

SHA1
ab092f219ef3f0b1311cb4c54e3fe3cdcff718d8

SHA256
e9c5891d63a2e67c6046b575cfb6554f20af0dd7c9fa958ec725f071670fdf07

SHA512
dc3ece6d6e413b077b9faf716f48af969da8f0b1b514594953c405361d1e229332a98a64a471cba458756e4d3f76f0774a3619f570f2a5c295f907d45f93a8bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
7e3831a83fcdf5fc231b15a513641015

SHA1
cb8150d48cc40372917437cd8687d9862e7c61a3

SHA256
e76439c94a092d1bd124ff69a4a6c4d5b3099779fd85f69ce34e65d8087d689e

SHA512
a79846a20236304d957c24c3a299ef6f3b99d817e117638b58f38941cd9f10f608d95882cdce447c98e3d30759bbba5d851d10c02e65312fcdfe7a701390c456

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
0e3b370550ffdce852f22d44784f8efa

SHA1
b9b68f2e933ecd5655cea1edd043277bd2e90f5a

SHA256
f98c3457eae4d579b2f6ad4e702e9d36ddd6197d55d3560012b137ffff217a6f

SHA512
37f9fd07ecbb183bb54e7be4129739e9a783cb4d7f9b4834de98bffcb82d09584f834ed0bd9c9fc777b14615146fb0de786d46a857eb3d2396148d11b3336d42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
8252f4c7b77e7400a2bc3b7c57e83aaf

SHA1
338e9c3cac415d2432caf72cd57dff409c7894e0

SHA256
d8e5036646daeb986096cc06083a359ed0d088852564bc46fc89362ed846ff80

SHA512
6ca9f83d54fbaba353b84365df4c1be334486fc2b169156432ffc3376a5874d8d5bd538dab1d104a73b94dd1062c33d56b33ea160ce09c713c44fe35cb4de04d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
81440062556fcb2787554bab5678bc9e

SHA1
371631a1efe4ff39068ca3888140bbbefb35d8fd

SHA256
98ebb434aa0c458843b66d0cb8fd9cc2344e17d32abf69fa1bfa404040e72ef1

SHA512
9aafa4e7f7877d407b0b0434453fe3e711da3a901f493fbd695057a41f9a97039139003be45eb05478f46c7f166b14a083413fe9a673685da1b1cf0d52ab07ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
62ec4a9ff96623184145a39ae594f9c8

SHA1
f5cb6a9584eb5f49e6b51b36be343162f0e20e3f

SHA256
3bb83228a962e61e642be7141c24ba6a17cf2417bb11a873745ecb1e7c365f26

SHA512
08f2119316e890114dd3e429e7c76411dd4dee51ec4cc78a246d77d46c4eb5c6984b32828312b419619778ac75aa7d20b0843a030fd7212068e4c05677039c5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
b93bf182db1faee23aac50ef70ae9b5e

SHA1
01e9b53748bc7d352e696ab81950d59d1aeae6b8

SHA256
2ec30c595a963df5653bfe2f3052320903593fcf76a7f073925b9ba48362313d

SHA512
acd9500852c2ba34ae70d38c82b3173375d6fdc006951fa88d8e159635f2e8a8eaf9159017596802c8ceabdf081c2fcb709d3b583eeda6245f37d81f26d7f6e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
dd196153488ee24b62790383aa209713

SHA1
1cdc6956675114811d93c8f4a20b2fa880d33470

SHA256
073ca9e17bcbdbc6ab3be616f6623b02807fa2cd989d0df0d472485748e75364

SHA512
0de207e9c3bfa14285042cd5c2a72deaa8c8a5db730f4655d5299d460ff47ccefce5dc07e80c1a160d379b250d6d2bdd011034127bd708d009cbd36d995aec78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
9ada6f49be6c8cd8c72f5d0b02529e71

SHA1
d0995888d28217335fd96f90ffdda4365ecf9b6a

SHA256
ad662a2a5e020f0905eb096ce2167d70e1967c381467acfb63d13a6855cfb5e3

SHA512
90c723cb4c6f68416e7dff34446302e2cf2eb2033fcbb9b06d38ddcb97dbde9ac39254cd3f9c0aed0c94567d83a10cc84a2eb2de23d2acb4e909298e1964164b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
728a69cd2057fe7b1f8db4b20ecf686e

SHA1
65f4a265072610ec9339694f5fb794a5fca902dc

SHA256
6c6f310fb7cdc66f8efa59954eacc551b061e6a6db2e677188a1286297419568

SHA512
65a7c61239979c48eae7d12158a247eb389432e07463db3bd80033b3425e35720e7ccfa3da7f1bbb8acd30e9af89aaa8286cf900761567b5e8de72f59e8d7c1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
982d6d24752d0c0d973f35969c4a2e5e

SHA1
24f5114c0b565a59712409be608383c2f3629de0

SHA256
58ea5fd40d89f239cad40a30588fd0642b81512ace56780dc73f2639c8042fae

SHA512
28abff0e412fe0f1f56b59cfa2f64034a56f5ef2a2dfa926155516975e0185d88fa7137d6b461b36d5691a9c4a0ecde6c0d95de6dd12a3e7ca278319c3e98ce5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
70f4184be4efa75e34909fcf4f7d12ef

SHA1
03f8cf72fa2bc8d8d9d75854cf1835a640d99ca0

SHA256
6fe2a87d19b4ffde304e6b134a72089d3761378c215b484c087fc90a46e008ea

SHA512
e72e74aaedc161994f41848f571d356c3eaaf412b821da921f85962d8d55254287b9d5df035062ed36b0a7e82b19c9997f3aeeec8858dbaa20e338d18e4f4c72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6ea84feb78245f34e66a8037f8488a47

SHA1
291549b65ab1c46c0fae253a719c01bec19ce71f

SHA256
0f41132c7989624fe7cb4ebeef2a5e66062d89ca5e97dff9895e880be83a33a6

SHA512
d25af3bbcf86e98ec213511bc6597a23236cc33be29f2e3dd0e22d6f333e309c170f0ff5faae83c762fdd2e7980e897db45ef5e9e9828698fddc7558d6165ad4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
de1355263c686ffcdc9756987e3a156b

SHA1
4fd41cb099075b79138c4c4e2dfb62bc4b3b78cb

SHA256
9666b2fecf4e54e910ed969bf079d2de99f023ae7404985d1f342c1158fc74e4

SHA512
bfc3929314e92ac4d86fe265c961ee02ec7031da5b3cbfc3bd6acb14325b48da7f32e515f7c9ecbb0e91472b4f80dce4f7111097003b6933c316237de4d3998a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4e4be99848c8e69c965433f936074188

SHA1
07ca9a92cf8eca92c99ed083b12566273870ae24

SHA256
4daea65f8032876156aece50921c140cb5710c7c87345d591a60597ba24919e9

SHA512
5dd7a11e3d945df23378e3857cd3d4a39c65eacec551d64372b6fbf25dcc7bd3d24fb436b06d6407edcc53caedb31ee58ab1fe238bb558c254b4906d09041d62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
e8d8ca0483845340d8ff1e5fc22263b8

SHA1
3ec5f8f1e81f2bf0a9aeaa3e3d36a9a93d6ec1fa

SHA256
bc945405e4cc8c9d2571b24dc67825d563a71e90eccc7340ebb48b7400ab3077

SHA512
8745de99d1c60b4fde4e50ce16f89219510ca4e523c3da9bf5f573da7a13291677f808986d06f9590074d10fa77f8eda5d38043d7a5f26a7655ed8e9a4c611e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
173404f037c3adb66fa45a5ebbbb29b8

SHA1
ad8bfa652492a3c2212a9ba26f68da0444bfffbc

SHA256
1dad2272a85fc2eafaf8311dfcc9c7d96920c5bb288ae0a4556f4e55aeb60c9a

SHA512
79c1e13881cf4ad859e7d5a5315798b7a3d887d1a70d3b02b7fab4fdb82bfb40cbb3209856957b5062e02356a234aa38b641aaba3404084aa625c3c7ac145192

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
be50e71b31696a688c332daba5311d5f

SHA1
5568c34135af8330990985f4d06d1bb136b22b2c

SHA256
9796166e915a01b52e74c2e7a65ad9b979f72bc91d8a6ddbe4f44cf01fe958f6

SHA512
724a5a1c3f0b22333818573c9e3adc95f07fa02c57f77dd4632f90a24a028ca21fef96e77924f40311e70cb2db121db015878ef3acca68b368318eda5b4b55c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
bceb6477461c4358a544fd68b01507ca

SHA1
1c3a60bf42edf9d9f05fff8a2b347f9b5164d9bc

SHA256
d0245d6a61f86302f327b6c311d5440a27f51afd7d90f47675781017de839d0e

SHA512
17f40151bd07f015833299911d8b8b713dd6775570cf96b879ddf41fe2a2b983b997fbd453e6be805bd4faca1134dbd8c808ba963c57630097ab70772b3a0caf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7ab6432e17deff8c87f2ab3c17d0f07a

SHA1
4c9087a1ea6691ff7e74147212d2d4a2f74e360e

SHA256
7391494cd003ba5b61f3fb61f4fe90a8cd12b80cfce7d8adccc4a5c152e53885

SHA512
3221bcebac6dd95e104a2b3e031bd6b22f6a4636c8cbe1516c23608968336a92470a92ce89af185299fb3366e6cb21479ed30d5b8ccbcae5e044ad992805738a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
bdd4591f2f84d0aeedc166a467315ff9

SHA1
ce085f949f16acde75e49fd943be1efeba33691a

SHA256
3f2bec5476c964fe95a28d491e5e9156fd3d913dc2923576159b5c2c7bd7362b

SHA512
7ce544b074060cc87494dcc2af8a3d574abab7afff2c8c5cde3b60d89d51932113436dda900712a1c40b7388d741f646a8e20763bd8e47727bd4d9a9fefb909f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
caf9c87c353dd5e9221ec8b61de484c4

SHA1
79283f805d97edf7028d571f2459a015a59eaef2

SHA256
4977cd60cb0c41d5606376d0e24568cad49348a838bbb44c098a3f2ea08cce33

SHA512
9c33f10e97e9066a78507b26c3f72682d65168765066d8a43921a0fc59316a48c2722b279cf083f5a85d870427f6261f54f3dad2fc153689d5d00d9dd4c65219

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
490d8314853a4f69f7ffa107f2aa1a22

SHA1
e0f05871937a2b7d2ebefba98dd56cc949d7b9c0

SHA256
af1cdfb01c6c0e66a9563ba6cc6379fbaaccf9fb0e8de44b6c2f07f3db0d0374

SHA512
6a70e5f9a75a18791f180cd1e914f5aa60f3a51358181c8c4c8e4cd0cce3364f669bf217a822408e0e2e7b684a626e8bc6d93340e0889bf1c5ffa47764e43029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
4682a9cc9f31f4ab3473ed013373744c

SHA1
0d4a9d13e22738d8fc59b549beb277a0c16e43eb

SHA256
1da4c89697d12b9f9acd1f19ec9435d32435e94f19ffed3e776384a0354d83e4

SHA512
339f6854c20d3ee24f29fab843f6ee86c45b1a8b9c93badb83e7f921bf5d1fd22ddf66b20387ab5a4646199c94f39c3daeda641a5a756640c38705c5e9da5460

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
bf57afc257321757eb1f671c3674df34

SHA1
d186c16a36874aa724793ec07e96aa13feb32751

SHA256
3cca22aee042d87ae5b27f4a17cb9928f623c6cec421063f069f74d530e70f7f

SHA512
764e8a85dcf2ca2271707f37dc697b9e0e8ad5f6c5e6e4f601f12edd9da1ced2fd08431b30ef27675a91c56c4c483b7c1a92dd08af1213bcca80445d8aa227c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
d2e1f106938f21673be3774915747d62

SHA1
89166c64ef9557def453a246255ed21c37faeef8

SHA256
777a95f072217bbde686a3fd59e78d237c7970fc1b1576d8030bb2eb87f24f21

SHA512
5e8b64ec2acc4d573cdce89819a73234207b7b986766d06ca5bf0bed9ee60c1080f1e1822acf1defaf678c70fe7a42f8c40a5974bffec32ea88e7fdc0d82b1fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
bdb2eeede9e84f915f6d00bb7a95108a

SHA1
5ce2cede4b2276f1f2db48523a030136a6b945f6

SHA256
0aa3b83ce5db50fb9de95e2d958c8070accd072abe9ca1f2b53099a466efcadb

SHA512
f5c4bc52e1f59f3df181e25ac366f6a756fc37ac2efc5855394d9d08eabf241a82d05d95a3efeccfee2d00ac9ef05dea5518f94db2d252b1db766a980a89d985

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
104KB

MD5
a4301a7f5e548d420f3d67567f5451d4

SHA1
f58c88f8183c67abc40cd24bfff23056d91eceba

SHA256
8810dfbf622295778248b5660b3893007ff539e51376f6d32847f7180fc5e21f

SHA512
278728c8f7025d86fe44e1569205bf1573ff917a7ca620d699286d8161e841ab34d4e8996487c7e672f6f534a7923b44b08fc2cea38bfaeab78519d0b2c21413

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
64KB

MD5
38bf0c8e703ee88366376826e3e5dc9e

SHA1
177d89968b539baa5d90397958643a50c92c615c

SHA256
5cc8660fa38b5c4535097cca196016a1402374f2629aaccd6f8e8e6e7f3e732b

SHA512
76e2e7021c1f844ba69ee058550224ae76d6c40158aa1bf0d4571d9e9d72ac2c0719ede85d19cafe7ed0ce1bb1b150d02b00d56ad07d5066b89662d91423b77b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
102KB

MD5
76b2b0a7919d8a8fed0a54601757ca52

SHA1
424ff241321ba29c47feb6558a61932cdb782ed8

SHA256
385329a3920a817239fa672b732c9e3b9a21755cecc97242a7b404401ab4bb9d

SHA512
accd660631d2487b7e7ac0d854ca3f5bc2b0954c05ce26d490b39d1e76ac0ab100682cbc509dc1dfe7d4b881675ed2ff34afe3760ac341f249b74f452e58480e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe62b6d7.TMP

Filesize
93KB

MD5
fa7bf1c4624c0cb3a73df1c6188e1ce2

SHA1
a9dcf0db2d6fae26dd738b376aa9657345ff007a

SHA256
670a3bde3224cf050086d5e4f38c6a07bc5d0d94ef0818c4af0a090f01980d32

SHA512
288c3497d5dc1465a2bcffce849b258dc90988161d175c78fa63970149a42c0c6daa03b572a4bdaf0eccf36bad35f70bfd0bda2be132f077735c73ed3463a6fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
13KB

MD5
1e6ca0d88bcb08793c5a791ea0921766

SHA1
3ede20779aa5e22a8dca3c83fc78e514d4947d6f

SHA256
6febeba920753cea3d48cecbaa43aa172c578fa233c58fda491537499c78f198

SHA512
11d71adb29ffb22a7a3446dc3e44f7b925c9c10831d29d73f936db55267672450f722e4857418b01bfc9f1348789f7935800d1722237d32b336b01a21ad9e26d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\VirtualBox\VirtualBox-6.0.24-r139119-MultiArch_amd64.msi

Filesize
80KB

MD5
5047ecba43e1ee71526d044653ef017d

SHA1
3519bcb7d609339210a1e013d829481c0e8cb20c

SHA256
37e9203acef40689ce8e0202e767db7bd2adb5f868f86d412af85ba285046794

SHA512
1707fc593f4ab2f0f4e95736c7193c09776d1e7eb03bbd6ab75a70eb94fe537a27e2f61fe6210906c326c024e9c1c151d93fc89099ca08d36077672b23133ad0

Download Submit
C:\Users\Admin\AppData\Local\Temp\VirtualBox\VirtualBox-6.0.24-r139119-MultiArch_amd64.msi

Filesize
488KB

MD5
157c8c54f9884dc1d6b5c960a3efae75

SHA1
2e66be3ea8c103673eb680abcfacbf94891a87c4

SHA256
fb3602ab14ad7445489be5df3dc9f294f12445d743ef614ccf695c59c9cbb59e

SHA512
81b8bc931a7fa3d71a74a88998a8a3f5839a5863f7c99a711e4e8b9140982c50f3021b028dc5ce0ebb4c807e46d939239e924c829196558fd02b48cb1defab29

Download Submit
C:\Users\Admin\AppData\Local\Temp\VirtualBox\common.cab

Filesize
419KB

MD5
282cbb2a4516c8ecab14c6a4a092c269

SHA1
4cb963e62653d7ad34661b66a55195363697ebd1

SHA256
ffa11f13bb0e8da763fe5511d89032d4e089255190db85956fe6a1958d1a41e3

SHA512
bf4d31ded58b8632e3d5515cf20f5bb5427a684a2ee4624505f711912ba9bbf1b2aa66d55719a00725006951ecf07ab89f028e704b2d5ce60573f5280242662d

Download Submit
C:\Windows\INF\oem4.PNF

Filesize
8KB

MD5
99fa566343cabdf3c1fe6bdedeb12adb

SHA1
ea43f18530a26858ef6ea4780ac6300a58ff6857

SHA256
275f45bb82a57a710cb2ee38c610a5f4fd09ed3bff5a50f23af907bd6101a493

SHA512
e69ee3a5ba1160e93d88aabc72192486c76e1f8c428155964edd1008763cd96799fcb80eb2c10b2e44b3aa167a777dbecdabd89bb3b27e6cb40d8c956ef3989c

Download Submit
C:\Windows\INF\oem4.inf

Filesize
3KB

MD5
e1af065fe51a6c5d89085adc59471087

SHA1
8b1573e61932032dcb4475f82c6015a354db3e90

SHA256
e934d27899c59d5f970d374663f33b7bbeec23b0d282d8c056d1a4fb7f1409f4

SHA512
cd80f271b969bf53b72a8370c621585fc38473e59030880f42dd9378258f437c449c66d4d0cf73946661f45874902f8994944b03fc59907bd8add0a4ad5c9b1b

Download Submit
C:\Windows\Installer\MSI9AD7.tmp

Filesize
195KB

MD5
a76d815eeaa3f1d4b954e4c60404ca9e

SHA1
8adfbf1e8f9d44044b611bf553cbe5c046a8f476

SHA256
98ec36f4677a1c45e11932a7fc7a78c718a0a9637872a9f5759b224457805726

SHA512
78adad9ebae1e951763c606c816883686dbb7e4cfb3e23cc9850f4a3eacc2806e168d7c54e9d85149077792978913721a972f1e8418348c335f18692d07483a3

Download Submit
C:\Windows\Installer\MSIA0D3.tmp

Filesize
204KB

MD5
6fff60b6f2f3df03e6222204763af921

SHA1
99e674b4967f1b2f585e4c77789ec91486eead7e

SHA256
0a54d478e5752a13b5bcf9e4fa396738b8ea4b6114a522bccf590b2fad0cad4e

SHA512
de80164d7e628e54c998152eb253a847d44c2570e91b8ca8d2a6eaa8802150bd951b864994f6c8a3a6020eb628becb79806df503998505eaf4ffcd76730321f2

Download Submit
C:\Windows\Installer\MSIA22C.tmp

Filesize
209KB

MD5
b1b7d8911eebb3de2a01891ed49a624c

SHA1
3d8c3a8ee1b7e71a169c5be46bd871cb5487fcb6

SHA256
fb19394be2d949981ee5073db563caa2d6a21bf4fef678d5745a081d2f2f80a7

SHA512
57fe75e51c0b9dde5f2e9cfa52fa0aa94bb062c6866920f20821dbd6f5fc3608faa7443898f61192c4c220ffa25b8781ac32fc10729582c7ffc2ab5ea46be09d

Download Submit
C:\Windows\Installer\MSIA2E8.tmp

Filesize
50KB

MD5
705bbb1aa2979c43e3bfacc928fbd745

SHA1
d68a256abff71ceb5ad3be8d713caab1b95f2a2b

SHA256
1f4d9ce86d7267e9a211ae8a93b2d21b540c83ae45ba6a025678c09b27bc459a

SHA512
4f506884f2dcb1f70b6947af80f244e5bfd9dac95ed0667dff0c6f9ca21d1819b23c107e88be1ce12a91d5c5bc05dc3b6d5186839b1a78c7acc94d3d0205f6bf

Download Submit
C:\Windows\Installer\MSIA2E8.tmp

Filesize
62KB

MD5
d62466ae54a16e0a01e6f8b9fa2ba5b0

SHA1
ae7a1fdcd6157893ad8145d4bb7cfffcfb53f1a6

SHA256
e24111fdd6db70f614feceb268feb161a37cbf2b986d72982ed81b5e7cdfd530

SHA512
5cb5055fc280b054f9fb5fda4217c10d38d1de40eda1d935d4f110212565d4bf51a8436455333c95b39ac0ebaf6bb6bc380662fa5cdf6006e0848280ec931bd6

Download Submit
C:\Windows\Installer\MSIF6B6.tmp

Filesize
149KB

MD5
84711acd160f6486c7a123220c1b6f0f

SHA1
babf9f702306b13945e298d169d5c4303f75e176

SHA256
ffebca15f7cd8cd387de340b64aed41c4b7c09b7c3b2c3b524e1bcd80dca9642

SHA512
c4a04acceed96f9c2e27f863b11f6c29b52b4bf04007dc46835a46e48167a25a9114ca51d560e924cf570049ab1dfb20d1b2d6dc102c508c40bb0cbe9941db3d

Download Submit
C:\Windows\Installer\MSIFA9F.tmp

Filesize
146KB

MD5
b2d6e6cdf200c9c20fc0b15f2f2294fd

SHA1
8cd136fcb373fc289533ff36ae9ef64c683f1142

SHA256
9b6e8f526079d46f47f891512b3d19321bf96ed63a726637e43f5d18ecb68c71

SHA512
558b107f97cc5fb5aaaa8b3907e54eaca74856b740f0956cd4a3568ab85f095a221c4c240afe4b0c3ca5944a0ddfe3cc0e9b109ed77a857295ea635044249ad8

Download Submit
C:\Windows\Installer\MSIFA9F.tmp

Filesize
98KB

MD5
40719d08eff1d10c0cfd9a1437ed7e45

SHA1
a1a3019e7e432092cd2399cb23f95aef2391dea9

SHA256
ad2a49205f1c5470a9f688e89a9df4f5d49526e575783925cf3a41421b6fb79b

SHA512
b053238ad91f56fc3de8e66d2595b24fe5bffc3950289228f6f766fbbf33b7194b14b2fdeb727f536c0531c4b7ff38345914526f40ed7f271d5d8f4a7d1ad1ed

Download Submit
C:\Windows\Installer\MSIFB1D.tmp

Filesize
143KB

MD5
489615b8f1386a9a214d805d52acace5

SHA1
4a55d2bccb679059376defcc2f99e6a452487ca4

SHA256
6115d1ca87a1664b949e8fb711bde0d7ccc0e8b009d928fbcaa86f8fbc60de5a

SHA512
6959b2ea90bcb01e2ce1d6fcc42a45a234449681127945066b82f1f8cc83e6f02771608b78fff1c03a944dd43f0384b4790b97df10bffb4578b994d96f8180a7

Download Submit
C:\Windows\Installer\MSIFCB5.tmp

Filesize
53KB

MD5
8d692721d42d33d63fe5d1bd1e8df62f

SHA1
c91f5312bae77048f7bf0fc93d86b83f285430f4

SHA256
fd6aa520f4ca5315bf925ab75f23c8c2285f456913d26143996ec57ede537f96

SHA512
1b5cc314158bda374bc5132b21e7f620e284ee5c59e045e2f31f42a911990860d29569041df187aaeb11f4863e9b4b671d3a8fd88b55fe317e88aad31187a4fd

Download Submit
C:\Windows\Installer\MSIFDA1.tmp

Filesize
24KB

MD5
336d5c1f4fd4920808404ac30bef0b42

SHA1
bf491b278169583aca3b7d46ee0f6621570c0801

SHA256
87290eb8e939cec19db0ad196307e9d7ee50f06cf60519a25dcfb82e6aea307b

SHA512
cfd80975d0662dfff502b3ce04ae0a3d41093f9eb84f2a8e8bc25f76b5567bb5317fccc9445e0f4d90c41d2b33e28c2907461f5ef27b6fd41f745af20f075219

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
187KB

MD5
6a617075c6511505d8c9eb48c921740a

SHA1
9cc674bcc7961e91a0021b7cd75feee5f5dc1fab

SHA256
935a77d9ce48721353e9960db93a0a6ce8ef4de89bb6cb550be815a36c875a49

SHA512
1895c965e9657ae74f79ff005e25db25ed35035ce6eae98035b933d6efb9d791a1ecd8bf8e5e23eb8fbe1261fae642538eeac986fcb56d1d7444003444f6b4fb

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
183KB

MD5
5eef8ca8d94c489639473546526afb61

SHA1
1ba740c7ffed5d292f79e585f70f745efbaa5b21

SHA256
fadcd3f041b829c24e41346969d96f200e0ae97855348f5bfbf4530e9b162ad7

SHA512
d73765168d5dbf077b7205b5d3a01893369fe0cb3f51b2ceb964624ed17736da825b1ca2da8232596246d55181673bc013015efe31e9967bae9e1a0d9bd92685

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
149KB

MD5
719fdc5f82554ebc0fb888977a64d952

SHA1
2448b7cf7aeb71ab6505f9e582a25287946e3f0d

SHA256
0f5f7b7090a3a9dae9f6fe869907fe1918b8cf4665dfc7e3867a677a96c5c552

SHA512
5ae9a91b7385f825054ef8ee27e433f2de4df872d41af5cfddbb3eaa9c123b193f0cc60a11d2c9a2f484589458a7fd9ad7f39bca4738f0d6ec3e06f62b578aed

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
79KB

MD5
f87c4de03ebca8983a3c274f76419df0

SHA1
9dcd0a6f9311a47bd83861406e38f6dd51b4d547

SHA256
de0526dceafa88006e18cd9ccd287029836cfba013d5013b6c9f0dc19316e5fd

SHA512
17b89962c1f25a0c63aebd783a6d1be4f03ec995ae7d5f80c6f5ccc9b8b5b82d943457aaf41fb7ec4f996b9cf39235210878d09ee62d4352e160e2a6ae502658

Download Submit
C:\Windows\System32\DRVSTORE\VBoxDrv_AD8FECFC99082C943B86D4514C0092BF1FC01793\VBoxDrv.sys

Filesize
105KB

MD5
86d71d8129b43714f778fd8722cd858e

SHA1
73bbf1373ce423d6ce59358aa3fde1605d6a49e4

SHA256
652ab5b05790450cd9667c89afa4d033bde6e757ffc6d0882cd0378a49c5d87b

SHA512
1aab51202318d6f486b997aa24fec7acf48414074332059ef809703bf40f25c6c572eb93a3de1b905e3f50cabef11b39923be96092abfdc2cb7a4041bae92d91

Download Submit
C:\Windows\System32\DRVSTORE\VBoxUSBMon_992DC80DA34182DDBB3CB606D5A34D7DE1607936\VBoxUSBMon.sys

Filesize
183KB

MD5
6618184ca8caec8ba3b66f7159332fcb

SHA1
f9d3c57959977ed4e0dda7ac22a84e93fe77f43a

SHA256
1357becf1fa1080191d1cf2b7931d94d7cc1c0b7f0aa7b56f15de9f199a05a82

SHA512
c9d270d07e690f06f87c3e65a68f60f4f6159b3552ccc02bda897b1e930a705d1eb81301fb1d887e990b7e5d861a298c20b8fdce2374affeca1153cbd8c9846f

Download Submit
C:\Windows\System32\DriverStore\Temp\{7b9c6c78-a859-3945-91a4-3b282920d27c}\VBoxNetAdp6.cat

Filesize
16KB

MD5
f2647f0c1badd3e90ab512f78cbdaf95

SHA1
279d2947b326af98ddc9c23f735e2750935d6d0d

SHA256
30fe619a086e2d0ad6b9c403da92096524e96e0094af16336c9d01e241ceedf7

SHA512
a2e12f2dfeabfcdee4a72bf3cefc5dc69ac652d1b9c11e43cb4050a087595a2b2781b23b3ac1eeab066191a4e3eadc52a2cff83b127cbe27754f032a2eb07244

Download Submit
C:\Windows\System32\DriverStore\Temp\{7b9c6c78-a859-3945-91a4-3b282920d27c}\VBoxNetAdp6.sys

Filesize
162KB

MD5
6d3984d202739dd7a4874b27aa538dc3

SHA1
edca04f62c2430b5b8b4d629654a99d4ebaad91e

SHA256
4ac0f93a290cf9d146f5aec9586a61d2b42684a703169239fcf54f5e06bd1bf9

SHA512
4cdbc663ff871f8bcbc3332c7b2233d4905585e036c58e16a1c909a4f588129fe1819f27448a756864b49542441688cc7ca5da7464e32736f11e95bd6ee1e435

Download Submit
C:\Windows\System32\DriverStore\Temp\{8f91f40e-3928-6642-b910-4f6b7ac4fd46}\VBoxUSB.cat

Filesize
16KB

MD5
5ae859ad22dbe33fb058c31d952ba4cb

SHA1
4b8f36c553eb578d31e7829b9caf652b3b106e7c

SHA256
2e4e76714714e30d8f13c747dd079fe55f9335214255da41ff0753f3260007a5

SHA512
e38923a8ca6208377d8f300678be3c49f4780d9827bb68c0f0dbdc065bdb246a781c9d96f1c42590999ff16a30caa313f3dc1bab94906ecdee345a544333a709

Download Submit
C:\Windows\System32\DriverStore\Temp\{8f91f40e-3928-6642-b910-4f6b7ac4fd46}\VBoxUSB.sys

Filesize
122KB

MD5
b279bc5486916480662780e021acc189

SHA1
79b60c06b314182be6773ab7503b01d6f62bcc60

SHA256
323ef7c7c93737bbeec5548f3a1094fd3beb64edaed7ebefab17d2109f9167e7

SHA512
887434409abc6e49a695c21e7e36323d2b991f780a0528c3503d527cb4744d0d980c2241e81fcaf6dd345e41dfdcb1e680b666187f67e00eecbfc906e468d493

Download Submit
C:\Windows\System32\DriverStore\Temp\{ed68ac04-381f-f446-8c6c-de9f59204139}\VBoxNetLwf.cat

Filesize
16KB

MD5
ae328f16744160402365a654e2ece060

SHA1
d8b200d646fa32f361f7f78dc75294aebefca788

SHA256
dfdee4a6a8eef471bde0ce0822c17e0eea6769594890fee463aae58ca11015ca

SHA512
290761dc74391ef786fab4c0604c952e234b97490db3d7b88c356dc679e3365ec0df8b73e061c714aff4c9e853f79755e27fd68494df70209a0f97f9f9888cfe

Download Submit
C:\Windows\System32\DriverStore\Temp\{ed68ac04-381f-f446-8c6c-de9f59204139}\VBoxNetLwf.inf

Filesize
3KB

MD5
2d3f64c93c9d62e32c5d43f1148751f0

SHA1
ee7346d61d9a42adabb7746cf68e7b98864d4d5c

SHA256
671c1fcd115197999a4310a47909dcb0337f14dfe720c46e586b0ff52d2e7227

SHA512
267197db25e4b2c7ff9e9ef5432d594fa99cbafdf81d48369202686675a579044663586a5db9b896df0011c6ac0d17d56e78db718f7bbec6f4222cb768a11dd1

Download Submit
C:\Windows\System32\DriverStore\Temp\{ed68ac04-381f-f446-8c6c-de9f59204139}\VBoxNetLwf.sys

Filesize
89KB

MD5
136a84ee6692f8aa53842793bf39e386

SHA1
e627f59f064fd87472728e421bea6b50994a3e98

SHA256
22710d9f57133bada2c246d5c8d241c4e774730331736c9cef2378eaa98217bb

SHA512
fec95cd54ad3a1a4de3d4660a52f4d417940868405cb2a5e205e2e82ab704f77ba3b4102735935439f0a4440d81e733853ec949cc38cd67e2a9c358529742bb2

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
147KB

MD5
7f462d30dcb4b176d7a7f19eda662bd6

SHA1
4af9884819c792f0f7fa626aa7fcbb3eb02d5538

SHA256
47148c9e950d5dd0347412b38185e086f21bc488f1ab3cd74a6148f76732aae4

SHA512
5f98a712646352aef19464839ecd2415decdf74f0bd889a7ac83849074edeeb852206fe763ee2f32f6e213a095de61fb67c3bfac94a59507f2fd9b0ed00c1f42

Download Submit
F:\Win XP SP3 2011 OLD COMPUTER.7z.crdownload

Filesize
4.9MB

MD5
91d1b483111cc42f34abf01f6f6447e7

SHA1
bc782145cf657203c2f3ddf2f79012abdeb9b2f7

SHA256
9a8d06a1aa13bf4ff87338e82b99efe32904f91c3de579b5b77585e415cf1930

SHA512
3629e6dcba7269ccab6efe23a3eb16491ef708ebd8d1f8621e0c7cf5d25fb9e7eb549a97721a6575fb8466b2a7032d96656cee2e3dfa35ceb09b76d51bd96935

Download Submit
F:\Win XP SP3 2011 OLD COMPUTER.vdi

Filesize
2.0MB

MD5
0e88e89d06bbcd1c177613ec570c7f92

SHA1
60c57dc80fa83e0436eb38dc82b85983aa7bbcdf

SHA256
0b33dc52549590c3025cb4d14dbc3e4b97926f919858622b7d00280aaea1026f

SHA512
fbc68a3348a065d35579e6fa825dce4e3bb32d4ba77cb5c2eac7272558178988e480506e6e6fae690cda9a42f843c22b32d0b544b61b00c37e09f456ece75f90

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
587KB

MD5
b76c1f9c904964fd4ec6cf6285b8c114

SHA1
7e84e6b99710a9af004cdd3fbe27429ceaf34459

SHA256
793c1e16c03d80a1c395f30c09b2695aeda62ae2e2f51d29fb1bb76f0c4419c0

SHA512
a71dcfe237a3a4d60bc165e620ed2fef4572f1507e04ce118bc2e0b9f63d9d76419647a7589e53602dee322f17cd3400a1590b92f6787c8c91e9ae998ffc8bc1

Download Submit
\??\Volume{b4c98594-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{53ec599c-3feb-47e7-8649-8bb2b352a17f}_OnDiskSnapshotProp

Filesize
5KB

MD5
ece5709643623baf8e0d3c9d8595e342

SHA1
fe99ddbc2f15cc216456afbe52c728177a1fc66a

SHA256
6aaddb052d16c24d5c7043fef90b4c5117c2783408eaf626d4cad2c1107b8296

SHA512
9f5f7c38a681f3acfad4ef41440b3a6e483b3a358b30bc31795a205969cfcad059c5abf92ef336190c54f61c71f91bc4272dc7a0689d91b12442fdb2cb02b1a6

Download Submit
\Program Files\Oracle\VirtualBox\VBoxRT.dll

Filesize
54KB

MD5
15994a87b765a44cba99c8af5f9cab1d

SHA1
6234c090b8b3003c0b59614184974a92fc6ba4d8

SHA256
8a4800bbc49e56138f431af833658912d5c7b3c41a929f176f61d4152ec6f63d

SHA512
f01858185aca231b2afad7e81387c6093157f033708dd8d95c52453a26560016fca0aa8297f3b65cefc6c75c0b8534b7fed3c30452b6c29869342b1244c9bb28

Download Submit
\Program Files\Oracle\VirtualBox\msvcr100.dll

Filesize
38KB

MD5
74f510b5801637cc2c42270874c6198b

SHA1
9b0721f39b4f78973618112e58fb53f313f9e0de

SHA256
0eaa201ecf0000036bc6a72f025fc6a776b1bb2c2a16c458cc92cb71f2f59fd8

SHA512
7c60d41b4b2f617bec44c9ff5f768aa1501efa3d38297ba503ee943627724a7ce5169063d21fa5f67eda6c0a8a2eefb1eef0a206a194346c6153dd19537eece8

Download Submit
\Windows\Installer\MSI97F6.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
\Windows\Installer\MSI9AD7.tmp

Filesize
136KB

MD5
a62b7a6acb61f72e2ab6c9231e2cefad

SHA1
cdad8c9ad093f86fe64c6045a14832a9453452ec

SHA256
41ff872fc2543fc68e96f49203891e3b601271c3216b197b3222ab2997a3d00c

SHA512
9c1bd3bfdfe29d446094aca8ee0290cd7375eb1b98a079314a377710e492d4108b6da9f96b0ab7a2295498b08a07d3475c0b77466bd0af7785d06529c08091c7

Download Submit
\Windows\Installer\MSIA0D3.tmp

Filesize
155KB

MD5
a0bf438056030cafbeede002d6f1d91c

SHA1
db896190d3b22cc7cf74df05f4d919680e754e07

SHA256
a00c2202cbffdb70b46e18dad9e6569e7a230af9981af17cdef1eb9b5f15a0d4

SHA512
06329cce90e8726ae1753650071a500d0664b583b150f312dfae8295f8258ce0ef36b271c892d61be250161d9f425d6bc390ec2e7a89f7289c49037fc0348d60

Download Submit
\Windows\Installer\MSIA22C.tmp

Filesize
112KB

MD5
eaa7f61a5ec9d018b5c3d48e753cf15c

SHA1
d34fd18b44105bc609bfb31664d995362b244dd8

SHA256
5c33e8a5b2fdbcea9de453f0ca3af2d8c7e048e1c9b3746b80735d7ddc1f63d0

SHA512
085cafc0a694527a3e408bf590fda361bc46fc7b42175c66d70e7ac4b85c9df204c0ec005a7ddb9d8b3b425fc95a9d6ee31e9e0dbe493bff87e1c943167fabc9

Download Submit
\Windows\Installer\MSIA2E8.tmp

Filesize
72KB

MD5
612140b8bf96c613c8ef7d8fb471520c

SHA1
04e7d10f19c1a6bbba0b56cb74ef0581a03f4b22

SHA256
d6d209255a01b8bfcec65a5a244b93c5b255b0c97919cc4cf1a41eee19b2f0e0

SHA512
85492fa9d3ef6a5b791dd0eb08bf06f505973a972a9938cdb87f0777cea79fd6fcd3be0ae980fb93a1173990c3aa0194a6157c0064f95417c2e2389b2f407f42

Download Submit
\Windows\Installer\MSIFA9F.tmp

Filesize
45KB

MD5
3699b8348680cd97ea8588f1b49a8908

SHA1
c601009d9caf6b65394c23fff288d1960cb7ba57

SHA256
58c43a23a460c13dc5f51a29c0e4c0bd25dec83aab8f31db02b060c483c2e231

SHA512
52cb1688f6fd1c2d5ed4987fd06bc45705039968c570255517438a3f59ec32c86a9cde0114d184b6132ebc177002bcb49cb718511eea224f715e56de01107d91

Download Submit
\Windows\Installer\MSIFB1D.tmp

Filesize
133KB

MD5
a208709b5a4d673be309ff829e2a37a3

SHA1
ce84147256fecab480bd691cf6da246fe6aa692b

SHA256
4403ee51001ebe43bf4d3a716988dae2a044fb3ab5987197734952282494b636

SHA512
a382940d132cfd2af3583848e8d131143e2e2f4b177130efdd5ec693d0d6ceb748a95e58237231b7b5b397759f7c0a9c3cbeda0300d826c008666a26ef66e982

Download Submit
\Windows\Installer\MSIFCB5.tmp

Filesize
75KB

MD5
83a101d0fd7aceb9f5addfd2531de375

SHA1
8cb4537dcdd4bb5295d2b89e61b1268ffd3d533d

SHA256
84413a224e13b75a2267b788333327dab6290a238d1fa1d9952dbd98eea7a024

SHA512
cb99a4926dce5e8e061c0e74e164a5c1c343f7e1cad8238035609a0e9c1aeed7562635a82725b131a3e3520992897bce1b6e3d4853a24f4ba008560d71154f26

Download Submit
\Windows\Installer\MSIFDA1.tmp

Filesize
45KB

MD5
f4a2894d65db54d976fb842c431fcb88

SHA1
12b5263b513afeb52775b2c4534cd88e3d2ee23b

SHA256
e85de87a3fac3a2578864b895c7566809a545632646e77df22f96c615ea49cdf

SHA512
cdfba28960e6357298bcc82d6e1902daaa9836a1a319c98d826aac9b59f5c3e5d0de169b32ec87b07a5d3afbe752e20bb62d0f6a6fcd57429a4a5293f144f6ab

Download Submit
memory/1688-1102-0x00007FF6F18B0000-0x00007FF6F19C5000-memory.dmp

Filesize
1.1MB

Download
memory/1688-1107-0x00007FFEA50B0000-0x00007FFEA5239000-memory.dmp

Filesize
1.5MB

Download
memory/1688-1110-0x00007FF6F18B0000-0x00007FF6F19C5000-memory.dmp

Filesize
1.1MB

Download
memory/2888-1080-0x000000005A9E0000-0x000000005AF41000-memory.dmp

Filesize
5.4MB

Download
memory/2888-1081-0x00007FF702800000-0x00007FF702A05000-memory.dmp

Filesize
2.0MB

Download
memory/2888-1079-0x00007FFEA18E0000-0x00007FFEA3C68000-memory.dmp

Filesize
35.5MB

Download
memory/3064-527-0x000000005AA00000-0x000000005AF61000-memory.dmp

Filesize
5.4MB

Download
memory/3064-529-0x00007FFEA12E0000-0x00007FFEA3668000-memory.dmp

Filesize
35.5MB

Download
memory/3064-528-0x00007FF70ED50000-0x00007FF70EF55000-memory.dmp

Filesize
2.0MB

Download
memory/3096-1103-0x00007FF6F18B0000-0x00007FF6F19C5000-memory.dmp

Filesize
1.1MB

Download
memory/3096-1104-0x00007FF6F18B0000-0x00007FF6F19C5000-memory.dmp

Filesize
1.1MB

Download