Analysis Overview
SHA256
83accb81725dea5372a13799d6d77ba9769de7c985506220e52cbc9acbe5e3d6
Threat Level: Known bad
The file BoxDrive.msi was found to be: Known bad.
Malicious Activity Summary
Adds autorun key to be loaded by Explorer.exe on startup
Drops file in Drivers directory
Modifies Shared Task Scheduler registry keys
Enumerates connected drives
Installs/modifies Browser Helper Object
Blocklisted process makes network request
Sets file execution options in registry
Modifies Installed Components in the registry
Adds Run key to start application
Drops desktop.ini file(s)
Drops file in System32 directory
Drops file in Program Files directory
Loads dropped DLL
Drops file in Windows directory
Registers COM server for autorun
Executes dropped EXE
Enumerates physical storage devices
Uses Task Scheduler COM API
Modifies data under HKEY_USERS
Uses Volume Shadow Copy service COM API
Suspicious use of FindShellTrayWindow
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious behavior: LoadsDriver
Suspicious use of SendNotifyMessage
Suspicious use of AdjustPrivilegeToken
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Checks SCSI registry key(s)
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-03 14:48
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-03 14:47
Reported
2024-05-03 14:49
Platform
win7-20240221-en
Max time kernel
33s
Max time network
39s
Command Line
Signatures
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\Y: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\G: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\R: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\W: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\L: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\P: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\M: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\A: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\E: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\N: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Q: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\S: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\W: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\H: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\K: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\P: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\S: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\T: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\I: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\J: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\L: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\V: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\T: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\I: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\A: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\H: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\O: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\R: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\U: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\B: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\J: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\N: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\V: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\E: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\O: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\U: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\X: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\B: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\K: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Q: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\G: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\M: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\X: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Y: | C:\Windows\system32\msiexec.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\Installer\f76ef20.msi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSIF366.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSIF4FC.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSIF56A.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\INF\setupapi.ev3 | C:\Windows\system32\DrvInst.exe | N/A |
| File opened for modification | C:\Windows\INF\setupapi.ev1 | C:\Windows\system32\DrvInst.exe | N/A |
| File opened for modification | C:\Windows\INF\setupapi.dev.log | C:\Windows\system32\DrvInst.exe | N/A |
| File created | C:\Windows\Installer\f76ef20.msi | C:\Windows\system32\msiexec.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\MsiExec.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\MsiExec.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\MsiExec.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeCreateTokenPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeAssignPrimaryTokenPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeMachineAccountPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeCreatePermanentPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeChangeNotifyPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSyncAgentPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeEnableDelegationPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeCreateGlobalPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\DrvInst.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\DrvInst.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\DrvInst.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\DrvInst.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\DrvInst.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\DrvInst.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\DrvInst.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\system32\DrvInst.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\system32\DrvInst.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\system32\DrvInst.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2432 wrote to memory of 1044 | N/A | C:\Windows\system32\msiexec.exe | C:\Windows\syswow64\MsiExec.exe |
| PID 2432 wrote to memory of 1044 | N/A | C:\Windows\system32\msiexec.exe | C:\Windows\syswow64\MsiExec.exe |
| PID 2432 wrote to memory of 1044 | N/A | C:\Windows\system32\msiexec.exe | C:\Windows\syswow64\MsiExec.exe |
| PID 2432 wrote to memory of 1044 | N/A | C:\Windows\system32\msiexec.exe | C:\Windows\syswow64\MsiExec.exe |
| PID 2432 wrote to memory of 1044 | N/A | C:\Windows\system32\msiexec.exe | C:\Windows\syswow64\MsiExec.exe |
| PID 2432 wrote to memory of 1044 | N/A | C:\Windows\system32\msiexec.exe | C:\Windows\syswow64\MsiExec.exe |
| PID 2432 wrote to memory of 1044 | N/A | C:\Windows\system32\msiexec.exe | C:\Windows\syswow64\MsiExec.exe |
Uses Volume Shadow Copy service COM API
Processes
C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\BoxDrive.msi
C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A0" "000000000000032C"
C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 99B2C0C96EB6ADAD5FC75ED0D9F5A418
Network
Files
C:\Users\Admin\AppData\Local\Temp\Cab9771.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\Local\Temp\Tar9967.tmp
| MD5 | 9c0c641c06238516f27941aa1166d427 |
| SHA1 | 64cd549fb8cf014fcd9312aa7a5b023847b6c977 |
| SHA256 | 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f |
| SHA512 | 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06 |
C:\Users\Admin\AppData\Local\Temp\MSI693e6.LOG
| MD5 | c2860e0f503d396e3896c9d93d6a2718 |
| SHA1 | bca7dec315aee05e898dbb46720a55f1af5af9f6 |
| SHA256 | 3d0682d8516f5eb075b2e4e4c2a19de26a83159f418665af11b96908fa09dfe4 |
| SHA512 | 8999664cf065ca1fcea54f0e83a1d518a8d0531408df244a1148a86fb2f97b2edfc2c599c68f138e7fb66f89b9a20b9ebbe9417f4dabef5e342e839f05f99e19 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1087D831978A422F28E1D1E590C230EB
| MD5 | b827c0223a5704c213036aa89af6aed5 |
| SHA1 | 8b81ef1759d6adae7c80efbb0dff16550b6ce205 |
| SHA256 | e0bad2a4c5815d0b4ac6dd7dbf34d0840748d93c15e63f27e11b4e22ecf3a5c5 |
| SHA512 | a4a8afe443b7a67fce38b5c425b8947f02bad37f47e8d1cd23123e1875e7fb321fc57f4137bbd265c19fd45de056970ebe9e6497d5d2356c8ae492e420bab165 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1087D831978A422F28E1D1E590C230EB
| MD5 | 9a889556a1c53e963580b182b0ab5528 |
| SHA1 | c4147e8b13254146bd93b4009431ad975fe2cf13 |
| SHA256 | 393de7f7a60bf2b495436969b0887405d4b71aa72be1c1b0043d7fc07ed90bee |
| SHA512 | a3e6e9cce10277ae7a8489eedc3a5ffb5478fa099bad79e8064922c124368ace5e6915f9ecb3966d6bb62911454ff4b1dc6360137e775527f9b56f0e9a934a55 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
| MD5 | 4cc06221809fafdb51ce64735524350f |
| SHA1 | 03f34273352731e39d8fb4a37b2e6cdfe380c085 |
| SHA256 | 1ac03a272dc172a2efb8b016bedb313fc6a4402933547b153fabce7004747a48 |
| SHA512 | 56a98572c948861c0b10f1376f3e11bbff570339928fe833064b6ea4832b4666c0c8002c38209271b0f5cd20c4fc985b6a3297343a1f1ffbd3233be07ad8bffa |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
| MD5 | f8699353f382c50f44dc378a2e6a46a2 |
| SHA1 | 0539dc41e809df984ad335046a720ae1592b8a65 |
| SHA256 | 2d37df3ad33714cdf8e2be95eee8ff3d83707b2529293333dbc099622687604a |
| SHA512 | 6c6cf211914b23ed6a4aa96f7d896807562d02aa3ce65b11434d6318b705f85836a43fdb93cd2a5b912143762babe4f876c00e267a7b5c6209c343b2a498bd32 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
| MD5 | d190fb454568a217de72a718d2b6f945 |
| SHA1 | 9bc15378a293032d990f44a2cc47913f57d22dfb |
| SHA256 | c3082d52dac402dba2000b4ec3f94baa6ac0b92cc9ec0165e25000effa5e2464 |
| SHA512 | 9350839b154854f3535333f55c67d14c6aeb60ba4e4f1871e0931ffc63ddd1751df75aba99bfa8f8abf1f6fe9dba93cfb9d07543760d9a7fefff03067bd36518 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
| MD5 | cde74142ef4413092f64c03160f0aa97 |
| SHA1 | 645c2bcf4cfa438217961de05c88c8cbb4e59568 |
| SHA256 | b7da957110668f1f073fc943a7753017b340aca60b5f54e4f7607962bd80d18e |
| SHA512 | 4adb3759f42fb9c0723eaa959fae79693d7c8fd1d7d67aff5afef076ebe6d58eccdb74f4521eb5ccdb647dea0978b04674c5c59a394d553fd93f1ec98c03d61f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 871fb7781d2697f399dead4593dc5749 |
| SHA1 | b3108265cb10167808fab12ca8763b1879b25e07 |
| SHA256 | 392cd44fa2d7cd3e635011fe698568cf7d85adcbf7f62714e92f8aea86756e0b |
| SHA512 | faed0a67b9febe9725dc7c02878c6af1df772c57e5001368d6ac28abf434271fda65331488b53abfc8cf35ef0061fb1acd4273f2c42e35f43c30723abfb41200 |
C:\Windows\Installer\MSIF366.tmp
| MD5 | aaab8d3f7e9e8f143a17a0d15a1d1715 |
| SHA1 | 8aca4e362e4cdc68c2f8f8f35f200126716f9c74 |
| SHA256 | fd3d6c50c3524063f7c28f815838e0fb06fd4ebff094e7b88902334abd463889 |
| SHA512 | 1999224f57cd453d5d4d7d678144e0b719290ae925bb3574ce28ae787dc406a6b3df8e44475b12b9cdc0ff43d2979f626f08291304c66cdca536cd1897715c9a |
C:\Windows\Installer\MSIF56A.tmp
| MD5 | 3eb31b9a689d506f3b1d3738d28ab640 |
| SHA1 | 1681fe3bbdcbe617a034b092ea77249dd4c3e986 |
| SHA256 | 3a7d9cdd6be9ce0e4d01e9894242b497536336bf1850fb0a814a369c8a189c46 |
| SHA512 | 2598e39f4fd139775bbb040218af802db722d4dca99a4230edfde282362b433c5e30c15d5385063aa76bff916031b0e43586ef05d2ada4edc3c1410371b98e09 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-03 14:47
Reported
2024-05-03 14:51
Platform
win10v2004-20240426-en
Max time kernel
54s
Max time network
151s
Command Line
Signatures
Adds autorun key to be loaded by Explorer.exe on startup
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\CallbackTechMountNotificator-cbfsconnect2017 = "{448226EA-4783-46A7-93E4-1140F13ACDD0}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\CallbackTechMountNotificator-cbfsconnect2017 = "{448226EA-4783-46A7-93E4-1140F13ACDD0}" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\system32\drivers\cbfsconnect2017.sys | C:\Program Files\Box\Box\FS\streem.exe | N/A |
Modifies Shared Task Scheduler registry keys
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{448226EA-4783-46A7-93E4-1140F13ACDD0} = "Virtual Storage Mount Notification" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{448226EA-4783-46A7-93E4-1140F13ACDD0} = "Virtual Storage Mount Notification" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler | C:\Program Files\Box\Box\FS\streem.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Box = "\"C:\\Program Files\\Box\\Box\\Box.exe\"" | C:\Windows\system32\msiexec.exe | N/A |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
Drops desktop.ini file(s)
| Description | Indicator | Process | Target |
| File opened for modification | C:\$RECYCLE.BIN\S-1-5-18\desktop.ini | C:\Program Files\Box\Box\FS\streem.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\Y: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\O: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\I: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\L: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\B: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\S: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\D: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\F: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\L: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\V: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Y: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\V: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\F: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\F: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\N: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\T: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\E: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\D: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\F: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\W: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\J: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\M: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\H: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\J: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\P: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\H: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Q: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\T: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\D: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\I: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\U: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\X: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\G: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\A: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\G: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\D: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\M: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\U: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\D: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\W: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\D: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\D: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\E: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Q: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\R: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\P: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\S: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\B: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\F: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\K: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\K: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\F: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\F: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\D: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\A: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\N: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\F: | C:\Windows\explorer.exe | N/A |
| File opened (read-only) | \??\O: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\R: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\X: | C:\Windows\system32\msiexec.exe | N/A |
Installs/modifies Browser Helper Object
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{448226EA-4783-46A7-93E4-1140F13ACDD0}'\ = "Virtual Storage Mount Notification" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{448226EA-4783-46A7-93E4-1140F13ACDD0}'\NoInternetExplorer = "1" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{448226EA-4783-46A7-93E4-1140F13ACDD0}' | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{448226EA-4783-46A7-93E4-1140F13ACDD0}'\ = "Virtual Storage Mount Notification" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{448226EA-4783-46A7-93E4-1140F13ACDD0}'\NoInternetExplorer = "1" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{448226EA-4783-46A7-93E4-1140F13ACDD0}' | C:\Windows\SysWOW64\regsvr32.exe | N/A |
Modifies Installed Components in the registry
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Active Setup\Installed Components | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Active Setup\Installed Components | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Active Setup\Installed Components | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Active Setup\Installed Components | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Active Setup\Installed Components | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Active Setup\Installed Components | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Active Setup\Installed Components | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Active Setup\Installed Components | C:\Windows\explorer.exe | N/A |
Sets file execution options in registry
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BoxUI.exe | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BoxUI.exe\GlobalFlag = "512" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\streem.exe | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\streem.exe\GlobalFlag = "512" | C:\Windows\system32\msiexec.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\system32\cbfsconnectevtmsg.dll | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| File opened for modification | C:\Windows\system32\cbfsconnectevtmsg.dll | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| File created | C:\Windows\system32\cbfsconnectMntNtf2017.dll | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| File created | C:\Windows\SysWOW64\cbfsconnectMntNtf2017.dll | C:\Program Files\Box\Box\FS\streem.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\Box\Box\_lzma.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\bn-IN\BoxUI.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\win32ts.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\es-ES\BoxPrompt.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\libcrypto-1_1.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\WixToolset.Dtf.WindowsInstaller.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\SyncUIIPC.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\BoxShellExtShim-2.37.142.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\i386\SHA1\vpnpbus.sys | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| File created | C:\Program Files\Box\Box\_decimal.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\BoxSyncing.ico | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\da-DK\BoxPrompt.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\wow64sup.exe | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| File created | C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\ia64\SHA1\cbfsconnect2017.sys | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| File created | C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\i386\vpnpbus.cat | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| File created | C:\Program Files\Box\Box\win32api.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\BoxProblem.ico | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\sv-SE\BoxUI.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\win32com\shell\shell.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\hi-IN\BoxPrompt.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\cbfsconnectevtmsg.dll | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| File created | C:\Program Files\Box\Box\_win32sysloader.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\unicodedata.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\nb-NO\BoxPrompt.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\md.cp310-win_amd64.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\_ctypes.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\_socket.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\es-ES\BoxUI.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\Box_console_logging_enabled.exe.manifest | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\win32trace.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\da-DK\BoxUI.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\InstallerHelper.exe.config | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\win32process.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\en-GB\BoxPrompt.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\Microsoft.Web.WebView2.Wpf.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\vpnpbus.sys | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| File created | C:\Program Files\Box\Box\PostureCheck.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\tr-TR\BoxUI.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\pyexpat.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\BoxSynced.ico | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\ru-RU\BoxPrompt.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\libffi-7.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\ia64\cbfsconnectNetRdr2017.dll | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| File created | C:\Program Files\Box\Box\win32cred.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\ru-RU\BoxUI.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\BoxLockedByOther.ico | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\BoxPrompt.exe.config | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\fr-FR\BoxPrompt.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\FS\cf\BoxDrive.msix | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\nb-NO\BoxUI.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\_elementtree.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\_cffi_backend.cp310-win_amd64.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\Box.exe.manifest | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\ko-KR\BoxUI.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\ja-JP\BoxPrompt.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\cbfsconnectNetRdr2017.dll | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| File created | C:\Program Files\Box\Box\FS\cbfsconnect.cab | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\de-DE\BoxPrompt.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\_bz2.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\runtimes\win-x64\native\WebView2Loader.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\wrapt\_wrappers.cp310-win_amd64.pyd | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\de-DE\BoxUI.resources.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\BoxShellExt-2.37.142.dll | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Program Files\Box\Box\UI\BoxUI.exe | C:\Windows\system32\msiexec.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI7C06.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI7D02.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI92E3.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI92E3.tmp-\Box.Desktop.Installer.CustomActions.dll | C:\Windows\system32\rundll32.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI7EBA.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI8053.tmp-\WixToolset.Dtf.WindowsInstaller.dll | C:\Windows\system32\rundll32.exe | N/A |
| File opened for modification | C:\Windows\Installer\$PatchCache$\Managed\540FCC7EF34D75B4488F1B21AE8A1363 | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\$PatchCache$\Managed\540FCC7EF34D75B4488F1B21AE8A1363\2.37.142\concrt140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33 | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI891E.tmp-\WixToolset.Dtf.WindowsInstaller.dll | C:\Windows\system32\rundll32.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI7D12.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI7ECB.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\{E7CCF045-D43F-4B57-84F8-B112EAA83136}\boxicon_1.exe | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI891E.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI943B.tmp-\Box.Updater.Common.dll | C:\Windows\system32\rundll32.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI7D42.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI92E3.tmp-\CustomAction.config | C:\Windows\system32\rundll32.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI92E3.tmp-\WixToolset.Dtf.WindowsInstaller.dll | C:\Windows\system32\rundll32.exe | N/A |
| File created | C:\Windows\Installer\SourceHash{E7CCF045-D43F-4B57-84F8-B112EAA83136} | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\$PatchCache$\Managed\540FCC7EF34D75B4488F1B21AE8A1363\2.37.142\vccorlib140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33 | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\{E7CCF045-D43F-4B57-84F8-B112EAA83136}\ext_4.exe | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\{E7CCF045-D43F-4B57-84F8-B112EAA83136}\ext_2.exe | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\{E7CCF045-D43F-4B57-84F8-B112EAA83136}\ext_2.exe | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI891E.tmp-\CustomAction.config | C:\Windows\system32\rundll32.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI943B.tmp-\WixToolset.Dtf.WindowsInstaller.dll | C:\Windows\system32\rundll32.exe | N/A |
| File opened for modification | C:\Windows\Installer\{E7CCF045-D43F-4B57-84F8-B112EAA83136}\ext_1.exe | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI891E.tmp-\Box.Updater.Common.dll | C:\Windows\system32\rundll32.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI8053.tmp-\CustomAction.config | C:\Windows\system32\rundll32.exe | N/A |
| File opened for modification | C:\Windows\Installer\$PatchCache$\Managed\540FCC7EF34D75B4488F1B21AE8A1363\2.37.142\vcruntime140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33 | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI92E3.tmp-\Box.Updater.Common.dll | C:\Windows\system32\rundll32.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI943B.tmp-\Box.Desktop.Installer.CustomActions.dll | C:\Windows\system32\rundll32.exe | N/A |
| File created | C:\Windows\Installer\e577a7f.msi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI8053.tmp-\Box.Updater.Common.dll | C:\Windows\system32\rundll32.exe | N/A |
| File opened for modification | C:\Windows\Installer\$PatchCache$\Managed\540FCC7EF34D75B4488F1B21AE8A1363\2.37.142 | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\$PatchCache$\Managed\540FCC7EF34D75B4488F1B21AE8A1363\2.37.142\vcruntime140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33 | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\{E7CCF045-D43F-4B57-84F8-B112EAA83136}\ext_3.exe | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\{E7CCF045-D43F-4B57-84F8-B112EAA83136}\boxicon_1.exe | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\ | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI8053.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\{E7CCF045-D43F-4B57-84F8-B112EAA83136}\ext.exe | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI943B.tmp-\CustomAction.config | C:\Windows\system32\rundll32.exe | N/A |
| File opened for modification | C:\Windows\Installer\$PatchCache$\Managed\540FCC7EF34D75B4488F1B21AE8A1363\2.37.142\msvcp140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33 | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\$PatchCache$\Managed\540FCC7EF34D75B4488F1B21AE8A1363\2.37.142\vccorlib140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33 | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\{E7CCF045-D43F-4B57-84F8-B112EAA83136}\ext_3.exe | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI8053.tmp-\Box.Desktop.Installer.CustomActions.dll | C:\Windows\system32\rundll32.exe | N/A |
| File created | C:\Windows\Installer\{E7CCF045-D43F-4B57-84F8-B112EAA83136}\ext_1.exe | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\{E7CCF045-D43F-4B57-84F8-B112EAA83136}\ext_4.exe | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI891E.tmp-\Box.Desktop.Installer.CustomActions.dll | C:\Windows\system32\rundll32.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI943B.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\e577a83.msi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\e577a7f.msi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI7CC2.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\inprogressinstallinfo.ipi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\$PatchCache$\Managed\540FCC7EF34D75B4488F1B21AE8A1363\2.37.142\concrt140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33 | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\$PatchCache$\Managed\540FCC7EF34D75B4488F1B21AE8A1363\2.37.142\msvcp140.dll.A5C49E27_90D3_35F6_A5E8_DB6F691C3C33 | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\{E7CCF045-D43F-4B57-84F8-B112EAA83136}\ext.exe | C:\Windows\system32\msiexec.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe | N/A |
| N/A | N/A | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| N/A | N/A | C:\Program Files\Box\Box\Box.exe | N/A |
| N/A | N/A | C:\Program Files\Box\Box\ui\BoxUI.exe | N/A |
Loads dropped DLL
Registers COM server for autorun
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{83FBE3B2-E43E-4A5A-BE16-4D03809CBEBF}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.37.142.dll" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BBBCFB6-60E2-4C0F-BB31-10434068E2BE}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.37.142.dll" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D0A4E1B-C25A-4AF8-8DA7-531929C02958}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{448226EA-4783-46A7-93E4-1140F13ACDD0}\InprocServer32 | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D0A4E1B-C25A-4AF8-8DA7-531929C02958}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D0A4E1B-C25A-4AF8-8DA7-531929C02958}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.37.142.dll" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{73C8BC94-4A51-413B-B927-829449EAFA75}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{73C8BC94-4A51-413B-B927-829449EAFA75}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.37.142.dll" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.37.142.dll" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9B7F473B-371C-467C-AB78-9AF19E8AC373}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.37.142.dll" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID\{8D0A4E1B-C25A-4AF8-8DA7-531929C02958}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9B7F473B-371C-467C-AB78-9AF19E8AC373}\InprocServer32\ = "C:\\Windows\\system32\\cbfsconnectMntNtf2017.dll" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F178C11B-B6C5-4D71-B528-64381D2024FC}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.37.142.dll" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{448226EA-4783-46A7-93E4-1140F13ACDD0}\InprocServer32\ThreadingModel = "Apartment" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BBBCFB6-60E2-4C0F-BB31-10434068E2BE}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BBBCFB6-60E2-4C0F-BB31-10434068E2BE}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID\{2FFF193C-5891-4B26-B363-40D3B5257FE9}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2FFF193C-5891-4B26-B363-40D3B5257FE9}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{83FBE3B2-E43E-4A5A-BE16-4D03809CBEBF}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345B91D6-935F-4773-9926-210C335241F9}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.37.142.dll" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID\{73C8BC94-4A51-413B-B927-829449EAFA75}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{73C8BC94-4A51-413B-B927-829449EAFA75}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID\{F178C11B-B6C5-4D71-B528-64381D2024FC}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F178C11B-B6C5-4D71-B528-64381D2024FC}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{448226EA-4783-46A7-93E4-1140F13ACDD0}\InprocServer32\ = "C:\\Windows\\system32\\cbfsconnectMntNtf2017.dll" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID\{83FBE3B2-E43E-4A5A-BE16-4D03809CBEBF}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{83FBE3B2-E43E-4A5A-BE16-4D03809CBEBF}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID\{345B91D6-935F-4773-9926-210C335241F9}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345B91D6-935F-4773-9926-210C335241F9}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2FFF193C-5891-4B26-B363-40D3B5257FE9}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID\{8BBBCFB6-60E2-4C0F-BB31-10434068E2BE}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2FFF193C-5891-4B26-B363-40D3B5257FE9}\InProcServer32\ = "C:\\Program Files\\Box\\Box\\BoxShellExtShim-2.37.142.dll" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9B7F473B-371C-467C-AB78-9AF19E8AC373}\InprocServer32 | C:\Program Files\Box\Box\FS\streem.exe | N/A |
Enumerates physical storage devices
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A | C:\Windows\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters | C:\Windows\system32\vssvc.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities | C:\Windows\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 | C:\Windows\explorer.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Box.exe = "11000" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL\BoxUI.exe = "1" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\GPU | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\GPU | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\GPU | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\Box.exe = "1" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\GPU | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\GPU | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\GPU | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\GPU | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\GPU | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\BoxUI.exe = "11000" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\GPU | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\GPU | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\GPU | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Internet Explorer\GPU | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key deleted | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "1" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{b97ed4d9-0000-0000-0000-d01200000000}\MaxCapacity = "14116" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{b97ed4d9-0000-0000-0000-d01200000000} | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{b97ed4d9-0000-0000-0000-d01200000000}\NukeOnDelete = "0" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key deleted | \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections | C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gdoc | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345B91D6-935F-4773-9926-210C335241F9}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID\{83FBE3B2-E43E-4A5A-BE16-4D03809CBEBF} | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{448226EA-4783-46A7-93E4-1140F13ACDD0} | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.boxnote\shell\ = "open" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\boxdrive\ = "URL:BoxDrive" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\540FCC7EF34D75B4488F1B21AE8A1363\VCRedist10 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\540FCC7EF34D75B4488F1B21AE8A1363 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\MuiCache | C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\.gslides\ = "BoxDesktop.gslides" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\.boxcanvas\ = "BoxDesktop.boxcanvas" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\boxdrive\shell\open\command\ = "C:\\Program Files\\Box\\Box\\Box.exe --handle-uri=%1" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.boxcanvas\shell\ = "open" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83FBE3B2-E43E-4A5A-BE16-4D03809CBEBF}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC}\ = "Box Drive Shell Extension Synced Icon Overlay" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\540FCC7EF34D75B4488F1B21AE8A1363\DeploymentFlags = "3" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings | C:\Windows\explorer.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff | C:\Windows\explorer.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888B4BB4-CE31-4C7F-8693-E90B0E34EE5D}\TypeLib\ = "{2E1192D2-8667-4987-A464-824357FC4857}" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID\{04B9BDFA-0C53-4F36-A77F-51F53E3EF3EC} | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540404634-651139247-2967210625-1000\{099576F6-A27C-46A2-BAAB-CD651A5AE378} | C:\Windows\explorer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gslide\shell\ = "open" | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.boxcanvas\BoxDesktop.boxcanvas | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\document/boxnote | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\boxdrive\DefaultIcon\ = "C:\\Program Files\\Box\\Box\\Box.exe,1" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B927815-D431-48B1-A746-6FF91FB35431}\InProcServer32 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU | C:\Windows\explorer.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\MuiCache | C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gsheet\shell\open\command\command = 69004c0055005200730030005e004000360040006a0037006700210029007900320054004b003500500072006f00640075006300740046006500610074007500720065003e007d00460027005f004c006f0061005a00360039002c0065006d002d0066005400790052003f005e0020002d002d006f00700065006e002d00660069006c0065003d00220025003100220000000000 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\BoxDesktop.gsheet\DefaultIcon | C:\Windows\system32\msiexec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{73C8BC94-4A51-413B-B927-829449EAFA75}\InProcServer32\ThreadingModel = "Apartment" | C:\Windows\system32\msiexec.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total | C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7F473B-371C-467C-AB78-9AF19E8AC373}\ = "VSMntNtfOverlayIcon Class" | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{448226EA-4783-46A7-93E4-1140F13ACDD0}\InprocServer32\ = "C:\\Windows\\system32\\cbfsconnectMntNtf2017.dll" | C:\Program Files\Box\Box\FS\streem.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.gslide\BoxDesktop.gslide\ShellNew | C:\Windows\system32\msiexec.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\system32\rundll32.exe | N/A |
| N/A | N/A | C:\Program Files\Box\Box\Box.exe | N/A |
| N/A | N/A | C:\Program Files\Box\Box\Box.exe | N/A |
| N/A | N/A | C:\Program Files\Box\Box\ui\BoxUI.exe | N/A |
| N/A | N/A | C:\Program Files\Box\Box\ui\BoxUI.exe | N/A |
| N/A | N/A | C:\Program Files\Box\Box\ui\BoxUI.exe | N/A |
| N/A | N/A | C:\Program Files\Box\Box\ui\BoxUI.exe | N/A |
Suspicious behavior: LoadsDriver
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeCreateTokenPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeAssignPrimaryTokenPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeMachineAccountPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeCreatePermanentPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeChangeNotifyPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSyncAgentPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeEnableDelegationPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeCreateGlobalPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Processes
C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\BoxDrive.msi
C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 09FE29DA96C71A43D515B33A70D51608
C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 3A6E43827C089845EC5CC7F7C991F8EB E Global\MSI0000
C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI8053.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240615562 41 Box.Desktop.Installer.CustomActions!CustomActions.CustomActions.CreateFallbackDeviceIDKey
C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe
"C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe"
C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI891E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240617781 47 Box.Desktop.Installer.CustomActions!Box.Desktop.Installer.CustomActions.CbfsInstallerCustomActions.InstallCbfs
C:\Program Files\Box\Box\FS\streem.exe
"C:\Program Files\Box\Box\FS\streem.exe" --install-cbfs --cbfs-cab-path "C:\Program Files\Box\Box\FS\cbfsconnect.cab"
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe" /n /s /i:"cbfsconnect2017-Box" "C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\i386\cbfsconnectMntNtf2017.dll"
C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -s -t 1692 -i 2552 -e 2552 -c 0
C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 3F2938D949EBCB2E3F4D4C246E5CE4F6
C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI92E3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240620312 65 Box.Desktop.Installer.CustomActions!CustomActions.CustomActions.KillExplorer
C:\Windows\explorer.exe
explorer.exe
C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI943B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240620609 75 Box.Desktop.Installer.CustomActions!CustomActions.CustomActions.GenerateDeviceId
C:\Program Files\Box\Box\Box.exe
"C:\Program Files\Box\Box\Box.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Program Files\Box\Box\ui\BoxUI.exe
"C:\Program Files\Box\Box\ui\BoxUI.exe" --product-name Box
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
C:\Windows\explorer.exe
explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 159.113.53.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn07.boxcdn.net | udp |
| US | 104.18.34.223:443 | cdn07.boxcdn.net | tcp |
| US | 8.8.8.8:53 | 223.34.18.104.in-addr.arpa | udp |
| US | 104.18.34.223:443 | cdn07.boxcdn.net | tcp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 65.139.73.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.56.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\MSI74a67.LOG
| MD5 | 3fe472256006f6545cda7b6373b2bef8 |
| SHA1 | 0bb70c4145af1e44ed9d9093af584153152d6053 |
| SHA256 | 63c0502c131730dd736bdd5a4bfb47096b3be7e4ddadbf40d74f485c7fdd5beb |
| SHA512 | 0d5e75b1d997df8116962fed0d04f847abaa89ca1129a3544205e6f38e151b54f9c701ff40f055b84414bcd1d86a4bfc82d50b82c437aece32e6ddef6fbd9835 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1087D831978A422F28E1D1E590C230EB
| MD5 | b827c0223a5704c213036aa89af6aed5 |
| SHA1 | 8b81ef1759d6adae7c80efbb0dff16550b6ce205 |
| SHA256 | e0bad2a4c5815d0b4ac6dd7dbf34d0840748d93c15e63f27e11b4e22ecf3a5c5 |
| SHA512 | a4a8afe443b7a67fce38b5c425b8947f02bad37f47e8d1cd23123e1875e7fb321fc57f4137bbd265c19fd45de056970ebe9e6497d5d2356c8ae492e420bab165 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1087D831978A422F28E1D1E590C230EB
| MD5 | d84b3dc0c8db57fa20e25668fd0bea44 |
| SHA1 | d1be73ac88dc218b669397a1a97a365b88c6ed7e |
| SHA256 | 424d879c102be6d6c24657517384b48ce7a69713adc0a6eab80efeddf3ab39bb |
| SHA512 | a332f4057c73aaed89fc0f876219425cd008bf88a394bdc4341526b34df7d0e48624762fd9698b552fc45ae58456b1b8cb0ab961473141e97a39903a2e536269 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
| MD5 | 4cc06221809fafdb51ce64735524350f |
| SHA1 | 03f34273352731e39d8fb4a37b2e6cdfe380c085 |
| SHA256 | 1ac03a272dc172a2efb8b016bedb313fc6a4402933547b153fabce7004747a48 |
| SHA512 | 56a98572c948861c0b10f1376f3e11bbff570339928fe833064b6ea4832b4666c0c8002c38209271b0f5cd20c4fc985b6a3297343a1f1ffbd3233be07ad8bffa |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
| MD5 | b133eeb653e605196f61227b8e314187 |
| SHA1 | 3af734f0bb0e9e7faa7440f65d7eaa7809b210e8 |
| SHA256 | 22d1e8e3dc5581a8a20fd23f7a2cb3eb1212b61d1dd2d173386cb844b44fabc1 |
| SHA512 | b3849356f20c3e9c525eec325847204663b5b64cd232882ac333f68bed65ea7124fce9eea545ba7ddac456cbdb7774457287852f8cb36f0e5cbafd00540a23ee |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
| MD5 | d190fb454568a217de72a718d2b6f945 |
| SHA1 | 9bc15378a293032d990f44a2cc47913f57d22dfb |
| SHA256 | c3082d52dac402dba2000b4ec3f94baa6ac0b92cc9ec0165e25000effa5e2464 |
| SHA512 | 9350839b154854f3535333f55c67d14c6aeb60ba4e4f1871e0931ffc63ddd1751df75aba99bfa8f8abf1f6fe9dba93cfb9d07543760d9a7fefff03067bd36518 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
| MD5 | 624cc0e831f74a45d42a1d73165349f3 |
| SHA1 | 1d7fd6d5705e650e31a0daa0d4968e42996cfb0d |
| SHA256 | e7efbec5f09409b10cf0c18648fedff82801eebd410a994aa12367cbc820fd2e |
| SHA512 | 1e3e9f51d0f1b07f6f51850aabdaedf0f59143c9bd4ec573ea7bb0e9cab157f2b7c8bece3a32f65a7ccf3b93698e3c8a60675b0aa3a6baae363ecdcbe4375dfb |
C:\Windows\Installer\MSI7C06.tmp
| MD5 | aaab8d3f7e9e8f143a17a0d15a1d1715 |
| SHA1 | 8aca4e362e4cdc68c2f8f8f35f200126716f9c74 |
| SHA256 | fd3d6c50c3524063f7c28f815838e0fb06fd4ebff094e7b88902334abd463889 |
| SHA512 | 1999224f57cd453d5d4d7d678144e0b719290ae925bb3574ce28ae787dc406a6b3df8e44475b12b9cdc0ff43d2979f626f08291304c66cdca536cd1897715c9a |
C:\Windows\Installer\MSI7D12.tmp
| MD5 | 3eb31b9a689d506f3b1d3738d28ab640 |
| SHA1 | 1681fe3bbdcbe617a034b092ea77249dd4c3e986 |
| SHA256 | 3a7d9cdd6be9ce0e4d01e9894242b497536336bf1850fb0a814a369c8a189c46 |
| SHA512 | 2598e39f4fd139775bbb040218af802db722d4dca99a4230edfde282362b433c5e30c15d5385063aa76bff916031b0e43586ef05d2ada4edc3c1410371b98e09 |
C:\Windows\Installer\MSI7ECB.tmp
| MD5 | f5cc49103be002b80429c0ebe73175b9 |
| SHA1 | 8b7077a4348d2355a4470cbf53ffa524d3a28b9e |
| SHA256 | 5fad8ac0929c29ff522bde7025f17774f2e996137cb349844b9595250d457cba |
| SHA512 | fe7f01ff6b9b476085961bf953f723e1ced8be9339802bfdb156bee3b20b0e5dce79726c5e40a7338beac35eceec5b516c46b8fd0f0722ed5d43ef2693be74a4 |
C:\Windows\Installer\MSI8053.tmp
| MD5 | edf90f2ea63e5115762abdbedd00f3b7 |
| SHA1 | 8c4c761078157c37ac99bdf22e17899502d681ba |
| SHA256 | 396e7167d7293a12476bda4d5ea765505b0a94bd5647a1a3e345ef6998966c0f |
| SHA512 | 4db2f6d0b31179e64e5d0be01ccb222503dd435b6b5305a47e9af64aac7049b6782ef428fb764ee2e26d62f0afcd6fe904d7a6476d596f42f1f19eeeea312a97 |
memory/3764-62-0x000002065E3F0000-0x000002065E424000-memory.dmp
C:\Windows\Installer\MSI8053.tmp-\Box.Desktop.Installer.CustomActions.dll
| MD5 | a6ef110b6bd9dcdd5aabe3e02f221d05 |
| SHA1 | b18493803432fbec3e90ae21eab7b0bda055605f |
| SHA256 | 939c373030bbbe74c7e4198e9ac405a174ad7a4956179c8a5590123c128ec0ba |
| SHA512 | 1ac40e54614e514da6ed33e997fcec79528bea22b640b5478d925f1b42db7645e38014c2a4ddb3b80eabac22942783741782d85e140e345bbf553e9ac7085728 |
memory/3764-66-0x000002065E430000-0x000002065E442000-memory.dmp
C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe
| MD5 | 0319cdeb5b8458573a382e8c685a6c48 |
| SHA1 | 017c6c009363ecc7a6779c8a066392bfe893513d |
| SHA256 | 986388438eda07d9b13cb9af9a716c4303be923502b589e91f93e32f1879528a |
| SHA512 | f46806a133d6b5c0c8605da808703f7eb6d782a4efdb938af003c4bea4ec6d2bfae1950631a3f9206ade3ae83e6cf83275b58c74bdc966374f9fc0e72c776c06 |
C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe.config
| MD5 | 028858153f24c95c36cd53c07cac46da |
| SHA1 | 64b279cee7d4bf262fc48b570053a5b4707a32ad |
| SHA256 | c7e2c1cf5f11deaea818badcec637913ff438b6cea3d9209c86fc42bb49620d1 |
| SHA512 | 6aaddf6aadfd8aae4c0eb967081bed6a5314b04418d0d68860f2ad21eaed2d1a1de7fd08293477e90eda949f985559567d3241253e014ae05bd1e3705b612011 |
memory/1276-235-0x000001CFE9240000-0x000001CFE925A000-memory.dmp
C:\Program Files\Box\Box\Box.Updater.Common.dll
| MD5 | 962d71f8bf4987a4f9223affbdb44394 |
| SHA1 | b892c04d3a2dc3ce24127f8a1c1812875f704be6 |
| SHA256 | ba101155809fd2554b4d12d0efac9d98daaa4690a9fe1416b8c132a3590407dd |
| SHA512 | 28befe9b78548b21fdde3e2f5895b051ec1751f40717226a5b652272c983aab13dc98b1dfa295107532f66395767e7779063c397cba310719cc61bfdec6675f8 |
C:\Program Files\Box\Box\Logger.dll
| MD5 | ee779c656c9c7c73750ec089cee6e09d |
| SHA1 | a18a85f33de0f36c6dcf6520d5029217df93ae45 |
| SHA256 | 3c9a2e7799be97c6a13157ad59354137748a99d7ec78ac1adb24c628ae40f3a2 |
| SHA512 | 15ada016746ef6b808ef7d1db973b984a236e5857d1fcfeeb429f91f5f763599080ba800a0ce016e76cc76605c963c91c7301fefeec97e33dc90223244fbc090 |
memory/1276-239-0x000001CFE9BB0000-0x000001CFE9BC8000-memory.dmp
memory/1276-242-0x000001CFEA700000-0x000001CFEA712000-memory.dmp
memory/1276-243-0x000001CFEA760000-0x000001CFEA79C000-memory.dmp
C:\Program Files\Box\Box\MetricsCollector.dll
| MD5 | 5780d77ec1e66d912addb476707088cf |
| SHA1 | 946914109496b67311332d89b4b494c6fee8fcc1 |
| SHA256 | 294fe25a2d1213fe24a5826bc8cedb762870a8f87a09a4c0275334ec23a6b1e9 |
| SHA512 | 292909a299b62e8acfe927f182ee93e30a830c4382b51856b1f3fc40ff26e6e9207a4d642afbbc22b486fa129b90abca4edb2bb24c1beda95bd4d367e18c3107 |
C:\Windows\Installer\e577a83.msi
| MD5 | f3d4ffbd09835fbafd035fc68f7ec5f1 |
| SHA1 | 527197ada4a805889297e021371d3065a390bb9b |
| SHA256 | 83accb81725dea5372a13799d6d77ba9769de7c985506220e52cbc9acbe5e3d6 |
| SHA512 | d69453d0f9a30ba92bb002bcaab0506a8a093f6dca599fe4f23a3dfe0b9f59a02e4b6186027077f4b9f6dffa7194c94d5dd07b67eecc1077a286f3b806ee6ae9 |
C:\Windows\Installer\MSI891E.tmp-\CustomAction.config
| MD5 | e1cdaa76ff312fc2bbe5ba00bf962d3d |
| SHA1 | ceaa689246f56cde2539b38e58bc9c8327261c90 |
| SHA256 | 25c34915dae931917d9cf8a9b7b96b2983b44898b5037dca05dd4c9c65fe497f |
| SHA512 | 98062f0354742b7a6f723c088f9f3471f710a88af77c22c8648b56ff1144417d6b35122db3cbe9a5c903dfd6361cdebf9773cf7c5418aa15ef4c636a2e7e00dc |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
| MD5 | 00bfeb783aeff425ce898d55718d506d |
| SHA1 | aac7a973dc1f9ca7abc529c7ea37ad7eaf491b8f |
| SHA256 | d06099ef43eb002055378b1b6d9853f9b1f891ada476932ba575d1f97065a580 |
| SHA512 | 2209d5f4999cb36ebf26c6b8cb3195cc9fc0f0a103f4a28dd77b04605d7c6e79d47d806454c63b8d42bbe32864be7cdb56df3cccf71a6c27fe0b331d8304e1ff |
C:\Windows\Installer\MSI891E.tmp-\WixToolset.Dtf.WindowsInstaller.dll
| MD5 | b82b13d16e7f3d3607026f61b7295224 |
| SHA1 | d17b76907ea442b6cc5a79361a8fcec91075e20d |
| SHA256 | bcc548e72b190d8f39dcb19538444e2576617a21caba6adcb4116511e1d2ddee |
| SHA512 | be8c0b8b585fc77693e7481ca5d3f57a8b213c1190782fd4700676af9c0b671523c1a4fa58f15947a14c1ff6d4cda65d7353c6ba848a3a247dfcda864869e93f |
C:\Program Files\Box\Box\FS\streem.exe
| MD5 | e45625f419879ed9b83d4b9993ecafca |
| SHA1 | 9843d897a98c787e60ee3f3e26fb15a65fb8fad5 |
| SHA256 | 2d3e6fef5f6bd72d668c3eac3ec0c9f260708ef1464a0e55a34ffa02cd3edbba |
| SHA512 | 7f4c03bd67b8eba02c64e159110f7689321ce47376cd02a952883af34a0b7a8e05cf98da3db084e0924b7ffcd2e2e51aa99b486fb5466e06c57e7a3a44e34b48 |
C:\Program Files\Box\Box\FS\cbfsconnect.cab
| MD5 | f3da6ed4a1d828a5f8eef8e22cd38218 |
| SHA1 | aec09f40d5f084b2c3773ee7f6ae360c637ba1f0 |
| SHA256 | 0203524031ab865791a4ecc4b4f0eb36cb5748e5bafdc63b6a3f7fd8d218f659 |
| SHA512 | 677a51b9fdf744a3e22071f47c13240ada1bcfec3fc9a0663b396b687eeee85795d15441bfba43b7f13fb5c79e9ed6e62a464854ee3d8556c89010a183c8e7d2 |
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\ia64\SHA1\vpnpbus.inf
| MD5 | 1d992ea7dd85d14453fce31efccd880b |
| SHA1 | 158f0140bb1511d22845177f7995cc2a153be819 |
| SHA256 | 586cc28d61aed1819c321014fa757623693d49b327ecbae3bd77d288850de84f |
| SHA512 | 435b5a496c452082ba8782c4d299e8d0d262b28c98356170f5eba5db0d6bdef79037781a9d862d0dad5620deb3310d96f9f4ce62feff705985abf1f6715e5215 |
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\cbfsconnectevtmsg.dll
| MD5 | 136bf75c3339446ba1edafcbf40b3a34 |
| SHA1 | 3efcc1d5325b978508258dc6c5069986a645add9 |
| SHA256 | e49a24a201c9433f4f8168f278325c94ff83a5f69cae9eb58223f0053cfbb433 |
| SHA512 | fa80c93ee03e51dc8d9e0838d5af436a319dba5e6f0f5b35a4c04be3312ceefe94e7547e90e3737bd676134f397578ef82ac25efb23de60e0055b52cfb7aa7bb |
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\cbfsconnectMntNtf2017.dll
| MD5 | a88907698c38b50a0048a41fa1099811 |
| SHA1 | bcb9e98f1bafd263599809935f7ee61e1baa2a9f |
| SHA256 | 82df2628a5b525a9f0ba529644c83ea8cb6a7ed894a84ab82448fed5c064d120 |
| SHA512 | 3ecdba7241d793811792d33607cfbb673438166d217089710ef4040c380bae230a2c8e51b761c850780336d46e89529d2f1f1da543ed36a3733ff5f9f3c9ef32 |
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\i386\cbfsconnectMntNtf2017.dll
| MD5 | a1f40342e2235096a44c4b5275f15920 |
| SHA1 | 416419620501d2945f67d42b08e4f77a762f7d55 |
| SHA256 | 584bea9e5a48f13ed73922eb2c716d1478a092bdc637cc16dbc432e119919ce6 |
| SHA512 | ed0ad14c9316f49f3a47b4a033c9410f84db742a0a3258d01797897103145c09d8a5be88405d30e2afe496301280e9bb746aa1a9a3258913ea98739e97213463 |
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\cbfsconnect2017.sys
| MD5 | a375c776b4b4e7148bd13a5bb1c9b360 |
| SHA1 | 8753f5dfb7a4dc9938d1c5ee008dbd6fc8344a12 |
| SHA256 | 6852854b5edba760ffe1fb159f71a9c0c95b9e0bfc12e335fd9e6bdff6a9b38d |
| SHA512 | c161082a58ba93ffe2c4be4ac68d79502cc61f0e1a7548b50c707ee6f794f780b462cf9e1381d9ba3106df86ca59b0ff49e9bdb57f1b612945fcdb568fd5be6f |
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\SHA1\cbfsconnect2017.sys
| MD5 | 069c3a913dc0c06bcf7e01b6f0ba1a02 |
| SHA1 | 7876cbf5c504894297fcd76ea66634b5d5fd48e1 |
| SHA256 | 4ef226e535412c917f68b42773f540381cd0c16ab6ef6bedccd5f2751469af27 |
| SHA512 | 1f89d4d3742cc7640ffedf5d2eb9bad811e855ce50e53b471967189e8feae09769937fbbbb4df931b33f1c99afef3b3a8043a5b86a87433c6bf6296effc5a558 |
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\vpnpbus.sys
| MD5 | a53fdf6ced9f56a67dd479f75cbf237d |
| SHA1 | f87f6cb3f27c468de9f2cbe7c8cdc6d5806afd72 |
| SHA256 | f513a07fe88a43b6b4a2cafb4f24e2a6e5cbbe27877f984776b0fb9e5397c41f |
| SHA512 | 9e9d123358c763721d2664f1e7bd5de3aeb6bd14f841a0b21bae957d2579b0f41f6ef04181b76fde422cc971cb953f2d6eaaac20551d3b42e732b256800c57cd |
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\vpnpbus.cat
| MD5 | 4191ba3b87e91483abebf12e7dee9d14 |
| SHA1 | 0f38f0b690ab401ce4db77b382818c818bd06ab3 |
| SHA256 | 8ae7d389b8a48de07345b54fff2fcbdea02cad6ee51998a97abaee448d976055 |
| SHA512 | 97746d79b85770f5e656b1110191ae0c1a298f2fa1a0a68ce501abdf839e398e7ac2068a1b484e34de7b6272b4e3597bd20264354cf42eb2f9237ab8256643f9 |
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\SHA1\vpnpbus.sys
| MD5 | 365d3f5287499804093a7f2d87d7edc6 |
| SHA1 | 8e33ceea8b7c04dd7375ffc912904712c8d0db76 |
| SHA256 | 1f0d74127c21db1e3f1c51226c9b9d352982b89881acb50cdf6b66a655e702a6 |
| SHA512 | b2c0f3d932120fbd79e6260ab3c9e46decac3f92506e6e4a89e3183b5c4d175bae96b5c48ee99d12436fedb0fd8aa4c6b203789fcd7b6da94e20d445034fdf41 |
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\SHA1\vpnpbus.cat
| MD5 | bd142677d640d66b2250a14c23d48604 |
| SHA1 | 2909ecf28d21d8f182727d7f195a83415413e82f |
| SHA256 | 110ad61efd1739cefb7d6b8795ee8f71c5c124a991bb4751d7dc8eaaaabe4510 |
| SHA512 | 9171ed572b4c9eab0aaecdaa80c64e94f3061b92ec631020b240129078cabff1b4a2be20123d119a78810855004af0adaa213489328ad4c921b9ec167710e71b |
C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\cbfsconnectNetRdr2017.dll
| MD5 | e594d34304ddb09cb359a3e95e67c7a1 |
| SHA1 | 31246ec8ffaa0931a21a325616a619e53897c40e |
| SHA256 | e5b69b230afd24b6b5cfe8b82c0bab87b58adf4f93dbac6f7ffbe310bae16074 |
| SHA512 | d7bfb6c22c213f35d01be67e8f1241964fe56c423bd90228b96c14f4517cdea26d9f5b1654800a0623783328a50492092cc156550ea4e6e29382374daad86204 |
C:\Config.Msi\e577a82.rbs
| MD5 | f1002d6e669a0a7997255ddfbb532215 |
| SHA1 | acf10d86818cc0409e3dc28fffb5aa0e08285d64 |
| SHA256 | bc0b811c065c822212a3a410c99c4939f06bd2f370155394db167b9561810471 |
| SHA512 | 5d5f5edf59f09e6f05076adbea5b5f9f9c2a2fb6b399047df3d4fffbe03c48fbab201c833225393c038ae5558ade4e4c929ee5533aecaaf4d704679901626867 |
C:\Windows\Installer\MSI943B.tmp-\Box.Updater.Common.dll
| MD5 | f1170452ec89f42a8193a701d11f8c3a |
| SHA1 | fc7d338df199388b28ff1729cad6784b89e4fad1 |
| SHA256 | 8ffe528b83fa646928c038a7c89f97224a555510e035623c66ac024c4eac6216 |
| SHA512 | 206e51a03b223540f5a5e3c1e3f341db93d24d4f1356d4fe2cd6f5c4025cc4227840486b5fc2d57dfbd68638d74ef1054ab31c9b06bcba97da3f77fa371afc6c |
memory/4992-411-0x000001853B270000-0x000001853B288000-memory.dmp
memory/4648-426-0x000001F14AD70000-0x000001F14AD7A000-memory.dmp
memory/4648-427-0x00007FFB42C10000-0x00007FFB42C1A000-memory.dmp
memory/4648-428-0x000001F14AE70000-0x000001F14AEDC000-memory.dmp
memory/4648-429-0x000001F14AE40000-0x000001F14AE5A000-memory.dmp
memory/4648-430-0x000001F14AE30000-0x000001F14AE38000-memory.dmp
memory/4648-431-0x000001F14AE70000-0x000001F14AE78000-memory.dmp
memory/4648-432-0x000001F1642D0000-0x000001F1642F2000-memory.dmp
memory/4648-433-0x000001F14B0D0000-0x000001F14B0D8000-memory.dmp
memory/4648-434-0x000001F164340000-0x000001F164380000-memory.dmp
memory/4648-440-0x000001F165B00000-0x000001F1660A4000-memory.dmp
memory/4648-445-0x000001F1656F0000-0x000001F16578C000-memory.dmp
memory/4648-446-0x000001F1657E0000-0x000001F165966000-memory.dmp
memory/4648-447-0x000001F163EB0000-0x000001F163EB8000-memory.dmp
C:\Users\Admin\AppData\Local\Box\Box\data\analytics_metrics.db
| MD5 | a7f4a7c3ab35aef02184311b01c85152 |
| SHA1 | 65823393cf5f1d815146cbd641a351eabd47b242 |
| SHA256 | e05c67635b6fe4cce8e56c8f0beba05c1346d96bb5514ae65e5273a3e821b7bb |
| SHA512 | c1c2e1daa9ab5be77b48a36190c9d9017c827fe3ca75d454c6d6976eda724762e7c2dd70c579205bd8b018022ef5b670e03d1d2326e029e09dfb6d17a3baeef4 |
memory/4648-469-0x000001F164320000-0x000001F164328000-memory.dmp
memory/4648-470-0x000001F166E70000-0x000001F167398000-memory.dmp
memory/4648-473-0x000001F164350000-0x000001F164362000-memory.dmp
memory/4648-474-0x000001F165750000-0x000001F165770000-memory.dmp
memory/4648-475-0x000001F166940000-0x000001F166972000-memory.dmp
memory/2016-476-0x000001EA18EE0000-0x000001EA196D2000-memory.dmp
memory/2016-477-0x000001EA19A80000-0x000001EA19A8A000-memory.dmp
memory/2016-478-0x000001EA19AB0000-0x000001EA19AC4000-memory.dmp
memory/2016-479-0x000001EA34120000-0x000001EA34154000-memory.dmp
memory/2016-480-0x000001EA340E0000-0x000001EA340F8000-memory.dmp
memory/2016-481-0x000001EA34950000-0x000001EA34958000-memory.dmp
memory/2016-482-0x000001EA34830000-0x000001EA34868000-memory.dmp
memory/2016-483-0x000001EA34800000-0x000001EA3480E000-memory.dmp
memory/4356-484-0x0000000009C20000-0x0000000009FD1000-memory.dmp
memory/2016-485-0x000001EA348A0000-0x000001EA348CE000-memory.dmp
memory/2016-486-0x000001EA352C0000-0x000001EA3531A000-memory.dmp
C:\Users\Admin\AppData\Local\Box\Box\data\cacert.pem
| MD5 | bd67b12dcc1719175086227313e39934 |
| SHA1 | caa654d35c8ceee571408e08511eee147a844b4b |
| SHA256 | fb31aaccade1e5f401aab044837a8f74eb9ba67f16ff62a2f7a1f722d46df2cb |
| SHA512 | b2af6a63ad7f0483e1cb5ca111bd873a9cbb37c0ab89735a3ec15613b3fd5ee15473aa74da6442e10e852136a93fe36be431e7ec018d1622568891ae013f4492 |
memory/4908-492-0x00000000048E0000-0x00000000048E1000-memory.dmp
memory/3952-498-0x0000022C776A0000-0x0000022C776C0000-memory.dmp
memory/3952-512-0x0000022C77660000-0x0000022C77680000-memory.dmp
memory/3952-529-0x0000022C77A70000-0x0000022C77A90000-memory.dmp
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133592213349592849.txt
| MD5 | f15e48d6ade40dc3e14929ff9f19c838 |
| SHA1 | b8a08e2d9db4c663cc7e7b394f057d7f485c27c8 |
| SHA256 | aa05f1e0bb345bea088627d73a45a9b65ff5a66431c936c4f4acd15bcd000437 |
| SHA512 | c3a20526a02cccbda3864ac16a530070136c008fc45abf2cf6436d42e8834683c3a537d3505251901309449dcdebae81be8780ef9a269f858c19cc915395f0b8 |
memory/4908-662-0x000000000AE40000-0x000000000B1F1000-memory.dmp
memory/1412-664-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/4796-666-0x00000245CFA00000-0x00000245CFB00000-memory.dmp
memory/4796-671-0x00000245D0B60000-0x00000245D0B80000-memory.dmp
memory/4796-693-0x00000245D0F20000-0x00000245D0F40000-memory.dmp
memory/4796-681-0x00000245D0B20000-0x00000245D0B40000-memory.dmp
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\M1A8XLO2\microsoft.windows[1].xml
| MD5 | d41119748cb5d1d2b33c6ac63d425110 |
| SHA1 | 6dbcfa37860a490beae2c8d95bc2a2290b323495 |
| SHA256 | 6448a8580ce1994365ec765d296896e96261e4039537300dc67c8d7f523d8b0b |
| SHA512 | 9f4242889858cb996e7f72c3baaa9af2dbccc09a3531ca9ed24ebe82e2c54e210278092ebc1ef8cd6c73cc51a6c6744f0cc799808a75add2a22e7e648084d478 |
memory/1412-807-0x000000000A5B0000-0x000000000A961000-memory.dmp
memory/4588-809-0x0000000004510000-0x0000000004511000-memory.dmp
memory/4284-811-0x000001BC10700000-0x000001BC10800000-memory.dmp
memory/4284-812-0x000001BC10700000-0x000001BC10800000-memory.dmp
memory/4284-816-0x000001BC11800000-0x000001BC11820000-memory.dmp
memory/4284-837-0x000001BC11BC0000-0x000001BC11BE0000-memory.dmp
memory/4284-823-0x000001BC115B0000-0x000001BC115D0000-memory.dmp
memory/4588-956-0x000000000A880000-0x000000000AC31000-memory.dmp
memory/5696-958-0x0000000002800000-0x0000000002801000-memory.dmp
memory/6124-960-0x0000012E5A220000-0x0000012E5A320000-memory.dmp
memory/6124-965-0x0000012E5B170000-0x0000012E5B190000-memory.dmp
memory/6124-974-0x0000012E5B130000-0x0000012E5B150000-memory.dmp
memory/6124-987-0x0000012E5B740000-0x0000012E5B760000-memory.dmp
memory/5696-1108-0x0000000009630000-0x00000000099E1000-memory.dmp
memory/4080-1110-0x0000000004880000-0x0000000004881000-memory.dmp
memory/2288-1112-0x00000170DF600000-0x00000170DF700000-memory.dmp
memory/2288-1117-0x00000170E0670000-0x00000170E0690000-memory.dmp
memory/2288-1138-0x00000170E0A40000-0x00000170E0A60000-memory.dmp
memory/2288-1126-0x00000170E0630000-0x00000170E0650000-memory.dmp
memory/4080-1256-0x0000000009DE0000-0x000000000A191000-memory.dmp
memory/2600-1258-0x0000000004A40000-0x0000000004A41000-memory.dmp
memory/2124-1261-0x0000021453B00000-0x0000021453C00000-memory.dmp
memory/2124-1260-0x0000021453B00000-0x0000021453C00000-memory.dmp
memory/2124-1265-0x0000021454C00000-0x0000021454C20000-memory.dmp
memory/2124-1273-0x00000214549C0000-0x00000214549E0000-memory.dmp
memory/2124-1296-0x0000021454FD0000-0x0000021454FF0000-memory.dmp
memory/2600-1395-0x000000000A250000-0x000000000A601000-memory.dmp
memory/228-1397-0x0000000009510000-0x00000000098C1000-memory.dmp
memory/4932-1399-0x00000000045F0000-0x00000000045F1000-memory.dmp
memory/5788-1401-0x00000212E0900000-0x00000212E0A00000-memory.dmp
memory/5788-1402-0x00000212E0900000-0x00000212E0A00000-memory.dmp
memory/5788-1428-0x00000212E1DE0000-0x00000212E1E00000-memory.dmp
memory/5788-1406-0x00000212E1A20000-0x00000212E1A40000-memory.dmp
memory/5788-1417-0x00000212E17D0000-0x00000212E17F0000-memory.dmp
memory/5788-1403-0x00000212E0900000-0x00000212E0A00000-memory.dmp
memory/5788-1535-0x0000020AE0000000-0x0000020AE0348000-memory.dmp
memory/1160-1540-0x0000000004EE0000-0x0000000004EE1000-memory.dmp
memory/3712-1542-0x0000020772390000-0x0000020772490000-memory.dmp
memory/3712-1543-0x0000020772390000-0x0000020772490000-memory.dmp
memory/3712-1547-0x0000020773500000-0x0000020773520000-memory.dmp
memory/3712-1570-0x00000207738C0000-0x00000207738E0000-memory.dmp
memory/3712-1558-0x00000207731B0000-0x00000207731D0000-memory.dmp
memory/3712-1686-0x000001FF72000000-0x000001FF72348000-memory.dmp
memory/4696-1689-0x0000000003050000-0x0000000003051000-memory.dmp