Analysis
-
max time kernel
245s -
max time network
252s -
platform
windows11-21h2_x64 -
resource
win11-20250313-es -
resource tags
arch:x64arch:x86image:win11-20250313-eslocale:es-esos:windows11-21h2-x64systemwindows -
submitted
04/04/2025, 05:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Antidetect Patreon Premium Edition/Antidetect Patreon Premium Edition 2022.exe
Resource
win11-20250313-es
windows11-21h2-x64
28 signatures
900 seconds
General
-
Target
Antidetect Patreon Premium Edition/Antidetect Patreon Premium Edition 2022.exe
-
Size
84.3MB
-
MD5
b4bceed650b2162007040ce71b3a94a6
-
SHA1
810bd44e0f3d3efdf1ec7923c54d5a86ecb5799a
-
SHA256
316e21b3e68b522fc33f29723770f031ca472f39c6b192f3e4534b5198652372
-
SHA512
3355173305b03120b4db20c92765c4c84db0ff75d0305e7a1192cea6a4c0ab64fbe9838c2c3185458eb5aed967347276b2d78cba0c55753694a21b9b04aa480c
-
SSDEEP
1572864:O96ytL1hdHOZJGF2qDdNy00uNhM/IiafGhoZyV4CSS17IAs7lZJbKpg4:ODBpOSFZRNy+NhM/2ZkP7RalZJ+pg
Malware Config
Extracted
Family
revengerat
Botnet
NYAN-CAT
C2
blog.capeturk.com:1111
Mutex
RV_MUTEX-FZMONFueOciq
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
resource yara_rule behavioral1/memory/5376-111-0x000000001BF50000-0x000000001BF5C000-memory.dmp revengerat -
Drops file in Drivers directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\SETB94.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SETCBE.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\SETCBE.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SET2373.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\SET2373.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\VBoxNetAdp6.sys MsiExec.exe File created C:\Windows\system32\DRIVERS\SET2AB8.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\VBoxNetLwf.sys MsiExec.exe File created C:\Windows\system32\DRIVERS\SETB94.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\VBoxDrv.sys MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\VBoxUSBMon.sys MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SET2AB8.tmp MsiExec.exe -
Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\75AD7D972188F002B967C87B080511B2205AFF43\Blob = 03000000010000001400000075ad7d972188f002b967c87b080511b2205aff43040000000100000010000000e3fb6bfd447eeaddeed61428be4ab43f19000000010000001000000052f9e490c74779ea3d3851bfa19522e6140000000100000014000000a59df3ec823840fc65dae9bc0d8461fca41c80310f0000000100000020000000f7c89b236ab679ac534f5121ea0beba9eb14dbc907f9e67b660fedc798edab532000000001000000f7070000308207f3308205dba003020102020c01d873d1332115b0ac96dae3300d06092a864886f70d01010b0500305c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613132303006035504031329476c6f62616c5369676e204743432052343520455620436f64655369676e696e672043412032303230301e170d3231313230363131353733395a170d3233303133303134313131305a30820133311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3111300f06035504051308343233353131363831133011060b2b0601040182373c02010313025541310b3009060355040613025541311730150603550408130e4b6861726b6976204f626c6173743110300e060355040713074b6861726b6976313e303c060355040913355345564552494e4120504f544f54534b4f474f205354524545542c206275696c64696e672033322c2061706172746d656e7420383531243022060355040a131b56454b544f522054313320544543484e4f4c4f47494553204c4c43312430220603550403131b56454b544f522054313320544543484e4f4c4f47494553204c4c433126302406092a864886f70d010901161776656b746f727431334070726f746f6e6d61696c2e636830820222300d06092a864886f70d01010105000382020f003082020a0282020100abcde511c878db1181c4631bb0da092f2dd805c128c54cbb586cfecaf2c7acbfe6813696520fbaeb3c2cdffec3a29f1820e141fd0eac286dfe10de47dd2dd9f97d4f7ee491de175cbcabb65de6124a09ab12e490bba734b4a31655885108902cae263600f0cd28a426be040eca67d5d0b72ad3f0f34dd84f7f0224f4afc666e17926a32cdef203a2627bc7e3dd07f719eeeaa9be31980617246ddbc6d5877dffdafdd2d3aa4bad57e9e70b04e63b847e0248b5a13d208739fc922c9ccc04cbbcd04fc31048f8d657df389c1cc56d7a2273cceefd06ff56decb0c32d62e5b5c66c726a3b6dc6e8fa98077a5eee5a880545d4782c4fa34e12f23be443f22d16fbaed72fa8edf9f7a2080fc6f4e70e1d4bb7341b4c67440582918c0d99a7e7324872cd29c7b6e427276f8976ce66dcbcbfc3076b9ac2f2b07016cd1133130709fe6dbfe1ee55e0cc8bbc2bd965e1bf63878994823b1dda029d08777defad7aba8852f8c8d9da6253bb02c2ffb7364765edbc85e62444b12fb6bbfac863c4c1f13b7d718faddc1504137294d890bbcfd210eb40f7d743c5237d94b5cda554cd4080ec072a7e3375be5e68c35e9dbea38efccbd8679f89194776d8fbe10ff5a9f57ef2e719e21065f6cb828be6379942c9cb3d779b3e394ddd8c844be80933029198aa350166f24d19511560cc1cbaf594bdf1df797fd923cffa18a516f09cec159850203010001a38201da308201d6300e0603551d0f0101ff04040302078030819f06082b0601050507010104819230818f304c06082b060105050730028640687474703a2f2f7365637572652e676c6f62616c7369676e2e636f6d2f6361636572742f67736763637234356576636f64657369676e6361323032302e637274303f06082b060105050730018633687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f67736763637234356576636f64657369676e63613230323030550603551d20044e304c304106092b06010401a03201023034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f3007060567810c010330090603551d130402300030470603551d1f0440303e303ca03aa0388636687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f67736763637234356576636f64657369676e6361323032302e63726c30220603551d11041b3019811776656b746f727431334070726f746f6e6d61696c2e636830130603551d25040c300a06082b06010505070303301f0603551d23041830168014259dd0fc59098663c5ecf3b1133b571c03923611301d0603551d0e04160414a59df3ec823840fc65dae9bc0d8461fca41c8031300d06092a864886f70d01010b050003820201001138cafda6093ce586fd1e4b78f6f40643051960eafbe3b58cd65ebae2b9f5d09b3c9f4879ace221880ca3f2dbc8f10a9abef3608ab527babcbfe499d234edf7530455aefe04310a07e535361bbca0c9dac48bcdc0e472cf616345adff3a850d6f663642d1c7598265716bf928b9e5eafcb7a4bec11fa76459981c33a4994141e21ea53a85f84dd2376d95fbf57aabd4a7f273b3f56442bfe667a1cd716f762194e84b1bf614168a29f1e886e231ca7bb99bc236f4f21c4b47ae76dee43714b9a385e9f53586e15b622ac8b35f81a13acafaf77176fe6d9d5d233a6a8e10ceeae5f3fad6c50d63791ad46c5fe957d35889e6c3a6b9ff4368efd6726eefc5d5936d479f183cd13e668079691b07a1ccbfde50cfdf3ffce05152849b722ca71f65c34d586feb1fd651d3aadd136f78cf0d678886fe7892ba54eb66ebeb912cccbb469a8e8d7530da03fa3a8df190ee3f54a199d4a78ac265f78140b23d85dfe34591034108c87906bd66f8d2985a85d339c07fd2db368f5b3e21a65b8632332fb75b379811a6f3c1e3556e02471393873583bde96d474118ea4e4943669f0ca9f7f42bd5db804694c731b2f78af94cb2f599ee2d883497e38aed178c0f3d0689ebd3210e98c7173a16d3dd558599b0118ed1d34319cde06e99f6512b7d0ad2b1d81ed2f4896d42dba963b456857e5f3568516a6c091c593f336300b0022f1501e0 DrvInst.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 12 IoCs
pid Process 4408 Setup.exe 5008 Setup.exe 2524 svchost.exe 928 svchost.exe 2736 svchost.exe 5268 svchost.exe 2844 Antidetect Patreon Premium Edition 2022 .exe 5376 explorer.exe 5160 explorer.exe 4792 VirtualBox.exe 1092 VBoxSVC.exe 5248 VBoxSDS.exe -
Loads dropped DLL 31 IoCs
pid Process 2684 MsiExec.exe 3900 MsiExec.exe 3900 MsiExec.exe 3900 MsiExec.exe 3900 MsiExec.exe 3900 MsiExec.exe 3900 MsiExec.exe 3900 MsiExec.exe 3900 MsiExec.exe 2684 MsiExec.exe 4792 VirtualBox.exe 4792 VirtualBox.exe 4792 VirtualBox.exe 4792 VirtualBox.exe 4792 VirtualBox.exe 4792 VirtualBox.exe 4792 VirtualBox.exe 4792 VirtualBox.exe 4792 VirtualBox.exe 4792 VirtualBox.exe 4792 VirtualBox.exe 4792 VirtualBox.exe 1092 VBoxSVC.exe 1092 VBoxSVC.exe 1092 VBoxSVC.exe 1092 VBoxSVC.exe 5248 VBoxSDS.exe 5248 VBoxSDS.exe 5248 VBoxSDS.exe 5248 VBoxSDS.exe 1092 VBoxSVC.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Intel Security Corporation = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe" Setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Intel Security Corporation = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe" Setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Explorer = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe" explorer.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini Setup.exe File opened for modification C:\Windows\assembly\Desktop.ini Setup.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\R: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\U: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\W: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\J: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\P: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\X: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\I: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\N: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\Q: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\L: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\M: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\Z: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\G: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\H: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\K: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\S: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\Y: Antidetect Patreon Premium Edition 2022 .exe File opened (read-only) \??\J: msiexec.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{68d08711-27f7-af49-98f5-ac5beb04da14}\VBoxUSB.inf DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db rundll32.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db rundll32.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db rundll32.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db rundll32.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1b8fad2d-5811-214b-9f35-20d2bb518eb0}\VBoxNetAdp6.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1b8fad2d-5811-214b-9f35-20d2bb518eb0}\SET224A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ac5b5d23-90a8-c143-8e5a-e3b2cbb0807e}\SET2901.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db rundll32.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db rundll32.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1b8fad2d-5811-214b-9f35-20d2bb518eb0}\SET2249.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ac5b5d23-90a8-c143-8e5a-e3b2cbb0807e}\VBoxNetLwf.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_52cd6779cf12d0c8\VBoxNetLwf.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_8074ac14f1ab2957\netpacer.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_52cd6779cf12d0c8\vboxnetlwf.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_e9194d6fe801980a\VBoxNetAdp6.inf DrvInst.exe File created C:\Windows\system32\DRVSTORE\VBoxDrv_256ADCB0C73AC91BD2ED7B3C97C603E386E609E4\VBoxDrv.sys MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db rundll32.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_52cd6779cf12d0c8\VBoxNetLwf.inf DrvInst.exe File created C:\Windows\system32\DRVSTORE\VBoxUSBMon_4E4DFAD311D140B5C1E14C2EC604833042CE3C58\VBoxUSBMon.sys MsiExec.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_52cd6779cf12d0c8\VBoxNetLwf.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_d34968d7b3e6da21\ndiscap.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_3debe5e78bab1bca\netbrdg.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_0525128a3d54207e\netnwifi.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{68d08711-27f7-af49-98f5-ac5beb04da14}\VBoxUSB.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{68d08711-27f7-af49-98f5-ac5beb04da14}\SETD6A.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db rundll32.exe File opened for modification C:\Windows\system32\DRVSTORE MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db rundll32.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{68d08711-27f7-af49-98f5-ac5beb04da14}\SETD69.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{68d08711-27f7-af49-98f5-ac5beb04da14}\SETD6A.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1b8fad2d-5811-214b-9f35-20d2bb518eb0}\SET2248.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ac5b5d23-90a8-c143-8e5a-e3b2cbb0807e}\SET28FF.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ac5b5d23-90a8-c143-8e5a-e3b2cbb0807e}\VBoxNetLwf.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_882899f2b1006416\netvwififlt.PNF MsiExec.exe File created C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_bc519c177a90877a\c_netservice.PNF MsiExec.exe File created C:\Windows\system32\DRVSTORE\VBoxUSBMon_4E4DFAD311D140B5C1E14C2EC604833042CE3C58\VBoxUSBMon.cat MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1b8fad2d-5811-214b-9f35-20d2bb518eb0} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ac5b5d23-90a8-c143-8e5a-e3b2cbb0807e}\VBoxNetLwf.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\wfpcapture.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_e9194d6fe801980a\VBoxNetAdp6.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_e9194d6fe801980a\VBoxNetAdp6.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db rundll32.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ac5b5d23-90a8-c143-8e5a-e3b2cbb0807e}\SET28FF.tmp DrvInst.exe File created C:\Windows\system32\DRVSTORE\VBoxDrv_256ADCB0C73AC91BD2ED7B3C97C603E386E609E4\VBoxDrv.inf MsiExec.exe File opened for modification C:\Windows\system32\DRVSTORE\VBoxDrv_256ADCB0C73AC91BD2ED7B3C97C603E386E609E4\VBoxDrv.inf MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{68d08711-27f7-af49-98f5-ac5beb04da14}\SETD6B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{68d08711-27f7-af49-98f5-ac5beb04da14}\SETD6B.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db rundll32.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db rundll32.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db rundll32.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_a1623fc1066c21c4\VBoxUSB.inf DrvInst.exe File created C:\Windows\system32\DRVSTORE\VBoxUSBMon_4E4DFAD311D140B5C1E14C2EC604833042CE3C58\VBoxUSBMon.inf MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db rundll32.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{68d08711-27f7-af49-98f5-ac5beb04da14} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_a1623fc1066c21c4\VBoxUSB.PNF MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1b8fad2d-5811-214b-9f35-20d2bb518eb0}\SET224A.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ac5b5d23-90a8-c143-8e5a-e3b2cbb0807e}\SET2900.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ac5b5d23-90a8-c143-8e5a-e3b2cbb0807e}\SET2901.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_10acfa4b924dd181\netnb.PNF MsiExec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Vektor T13\VirtualBox\SDL.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_pl.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\ol_ks.cfg msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\DriverUpdaterCD.iso msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\UICommon.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\drivers\vboxdrv\VBoxDrv.sys msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_lt.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\qt_pl.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxAuthSimple.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxAutostartSvc.exe msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_ko.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_sl.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_th.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\qt_th.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\sdk\install\vboxapi\__init__.py msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\drivers\vboxdrv\VBoxDrv.cat msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxRT.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxSDL.exe msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxSupLib.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\drivers\USB\filter\VBoxUSBMon.inf msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_fa.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_ja.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxDDR0.r0 msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxNetNAT.exe msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxSDL.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\rhel4_ks.cfg msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxC.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\IntelFirmwareInterfaceControlSvc.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\IntelFirmwareInterfacePropSvc.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxDDU.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\drivers\USB\device\VBoxUSB.inf msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VirtualBox.exe msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\qt_bg.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\qt_sl.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\Qt5PrintSupport.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_hu.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\qt_el.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\qt_zh_CN.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\redhat_postinstall.sh msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\Qt5Core.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxDragAndDropSvc.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VMMR0.r0 msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_ca.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_hr_HR.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\qt_hr_HR.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\Qt5Gui.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\drivers\network\netlwf\VBoxNetLwf.sys msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\qt_ko.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\vbox-img.exe msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxSharedFolders.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_bg.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\License_en_US.rtf msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\x86\msvcp100.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxDD2.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.sys msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\drivers\network\netlwf\VBoxNetLwf.cat msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxRes.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxTestOGL.exe msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\nls\qt_fa.qm msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxBugReport.exe msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\x86\VBoxClient-x86.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\platforms\qoffscreen.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\Qt5OpenGL.dll msiexec.exe File created C:\Program Files\Vektor T13\VirtualBox\VBoxAuth.dll msiexec.exe -
Drops file in Windows directory 43 IoCs
description ioc Process File created C:\Windows\INF\oem2.PNF MsiExec.exe File opened for modification C:\Windows\Installer\MSI2C16.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF909DBEE683D313F3.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIABC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC82.tmp msiexec.exe File created C:\Windows\Installer\e57f9f2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2899.tmp msiexec.exe File created C:\Windows\INF\oem0.PNF MsiExec.exe File created C:\Windows\INF\oem5.PNF MsiExec.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF17A209C1013F771F.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF58D6B74152B48772.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIFDE9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICE1.tmp msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\assembly\Desktop.ini Setup.exe File created C:\Windows\Installer\e57f9f0.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\Installer\{650FF4A9-7502-4AFB-8ACA-57414EC42BD1}\IconVirtualBox msiexec.exe File created C:\Windows\INF\oem1.PNF MsiExec.exe File opened for modification C:\Windows\Installer\MSI2B3B.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF4DDA5796E33A90F2.TMP msiexec.exe File created C:\Windows\assembly\Desktop.ini Setup.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\inf\oem5.inf DrvInst.exe File opened for modification C:\Windows\assembly Setup.exe File opened for modification C:\Windows\Installer\e57f9f0.msi msiexec.exe File created C:\Windows\Installer\SourceHash{650FF4A9-7502-4AFB-8ACA-57414EC42BD1} msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log MsiExec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI222F.tmp msiexec.exe File created C:\Windows\INF\oem3.PNF MsiExec.exe File opened for modification C:\Windows\inf\oem5.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI3C6.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\{650FF4A9-7502-4AFB-8ACA-57414EC42BD1}\IconVirtualBox msiexec.exe File opened for modification C:\Windows\Installer\MSIFD8A.tmp msiexec.exe File created C:\Windows\inf\oem4.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI28B9.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Antidetect Patreon Premium Edition 2022 .exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 MsiExec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000863705d3f43de89a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000863705d30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900863705d3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d863705d3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000863705d300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ MsiExec.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters MsiExec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D05C91E2-3E8A-11E9-8082-DB8AE479EF87}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{024F00CE-6E0B-492A-A8D0-968472A94DC7}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{455F8C45-44A0-A470-BA20-27890B96DBA9}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B2F98F8-9641-4397-854A-040439D0114B}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{758D7EAC-E4B1-486A-8F2E-747AE346C3E9}\NumMethods\ = "23" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{245D88BD-800A-40F8-87A6-170D02249A55}\ProxyStubClsid32 VirtualBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C48F3401-4A9E-43F4-B7A7-54BD285E22F4}\ProxyStubClsid32 VirtualBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BC68370C-8A02-45F3-A07D-A67AA72756AA}\NumMethods\ = "33" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{0075FD6C-00C2-4484-0077-C057003D9C90}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46735DE7-F4C4-4020-A185-0D2881BCFA8B}\NumMethods\ = "56" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{70401EEF-C8E9-466B-9660-45CB3E9979E4}\ProxyStubClsid32 msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\NodeSlot = "3" VirtualBox.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{081FC833-C6FA-430E-6020-6A505D086387} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5155BFD3-7BA7-45A8-B26D-C91AE3754E37}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C19073DD-CC7B-431B-98B2-951FDA8EAB89}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67099191-32E7-4F6C-85EE-422304C71B90}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{C19073DD-CC7B-431B-98B2-951FDA8EAB89}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1D978B8-F7B7-4B05-900E-2A9253C00F51}\NumMethods VirtualBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F25ACA3D-0B79-4350-BDD9-A0376CD6E6E3}\ = "IExtPackBase" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59A235AC-2F1A-4D6C-81FC-E3FA843F49AE}\ProxyStubClsid32 VirtualBox.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{11BE93C7-A862-4DC9-8C89-BF4BA74A886A}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20479EAF-D8ED-44CF-85AC-C83A26C95A4D}\ = "IToken" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{714A3EEF-799A-4489-86CD-FE8E45B2FF8E}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0447716-FF5A-4795-B57A-ECD5FFFA18A4}\NumMethods\ = "26" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14C2DB8A-3EE4-11E9-B872-CB9447AAD965}\ = "IVirtualSystemDescriptionForm" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{537707F7-EBF9-4D5C-7AEA-877BFC4256BA}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4132147B-42F8-CD96-7570-6A8800E3342C}\TypeLib\Version = "1.3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{6DC83C2C-81A9-4005-9D52-FC45A78BF3F5}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{714A3EEF-799A-4489-86CD-FE8E45B2FF8E}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8ADB7B0-057D-4391-B928-F14B06B710C5}\TypeLib VirtualBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86A98347-7619-41AA-AECE-B21AC5C1A7E6}\TypeLib VirtualBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD47AD09-787B-44AB-B343-A082A3F2DFB1}\ProxyStubClsid32 VirtualBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E253EE8-477A-2497-6759-88B8292A5AF0}\NumMethods\ = "18" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9709DB9B-3346-49D6-8F1C-41B0C4784FF2}\NumMethods\ = "15" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{22363cfc-07da-41ec-ac4a-3dd99db35594} VirtualBox.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D37FE88F-0979-486C-BAA1-3ABB144DC82D}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D88F2A5A-47C7-4A3F-AAE1-1B516817DB41}\ = "IRecordingSettings" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{4F4ADCF6-3E87-11E9-8AF2-576E84223953} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{DAAF9016-1F04-4191-AA2F-1FAC9646AE4C}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E7932CB8-F6D4-4AB6-9CBF-558EB8959A6A}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{245D88BD-800A-40F8-87A6-170D02249A55}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3890B2C8-604D-11E9-92D3-53CB473DB9FB}\TypeLib\Version = "1.3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{C8ADB7B0-057D-4391-B928-F14B06B710C5}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8E3496E-735F-4FDE-8A54-427D49409B5F}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DE887F2-B7DB-4616-AAC6-CFB94D89BA78}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3BA329DC-659C-488B-835C-4ECA7AE71C6C}\ = "ISerialPortChangedEvent" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{813C99FC-9849-4F47-813E-24A75DC85615} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\AppID = "{819B4D85-9CEE-493C-B6FC-64FFE759B3C9}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81314D14-FD1C-411A-95C5-E9BB1414E632}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD6A1080-E1B7-4339-A549-F0878115596E}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FE2DA40-5637-472A-9736-72019EABD7DE}\NumMethods VirtualBox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91F33D6F-E621-4F70-A77E-15F0E3C714D5}\TypeLib\Version = "1.3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{455F8C45-44A0-A470-BA20-27890B96DBA9}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6F89464F-7193-426C-A41F-522E8F537FA0}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C48F3401-4A9E-43F4-B7A7-54BD285E22F4}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{678FBD9A-93AF-42A7-7F13-79AD6EF1A18D}\ProxyStubClsid32 VirtualBox.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0B3CDEB2-808E-11E9-B773-133D9330F849} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B0A0904D-2F05-4D28-855F-488F96BAD2B2}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{9DB3A9E6-7F29-4AAE-A627-5A282C83092C} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{D7B98D2B-30E8-447E-99CB-E31BECAE6AE4}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E253EE8-477A-2497-6759-88B8292A5AF0}\TypeLib VirtualBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9B9E1CF-CB63-47A1-84FB-02C4894B89A9}\TypeLib VirtualBox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{872DA645-4A9B-1727-BEE2-5585105B9EED}\TypeLib VirtualBox.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4792 VirtualBox.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5612 msiexec.exe 5612 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4792 VirtualBox.exe -
Suspicious behavior: LoadsDriver 4 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2736 svchost.exe Token: SeDebugPrivilege 928 svchost.exe Token: SeDebugPrivilege 2524 svchost.exe Token: SeShutdownPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeIncreaseQuotaPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeDebugPrivilege 5268 svchost.exe Token: SeSecurityPrivilege 5612 msiexec.exe Token: SeCreateTokenPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeAssignPrimaryTokenPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeLockMemoryPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeIncreaseQuotaPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeMachineAccountPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeTcbPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeSecurityPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeTakeOwnershipPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeLoadDriverPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeSystemProfilePrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeSystemtimePrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeProfSingleProcessPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeIncBasePriorityPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeCreatePagefilePrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeCreatePermanentPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeBackupPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeRestorePrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeShutdownPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeDebugPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeAuditPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeSystemEnvironmentPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeChangeNotifyPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeRemoteShutdownPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeUndockPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeSyncAgentPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeEnableDelegationPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeManageVolumePrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeImpersonatePrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeCreateGlobalPrivilege 2844 Antidetect Patreon Premium Edition 2022 .exe Token: SeDebugPrivilege 5376 explorer.exe Token: SeDebugPrivilege 5160 explorer.exe Token: SeBackupPrivilege 5252 vssvc.exe Token: SeRestorePrivilege 5252 vssvc.exe Token: SeAuditPrivilege 5252 vssvc.exe Token: SeBackupPrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeBackupPrivilege 3500 srtasks.exe Token: SeRestorePrivilege 3500 srtasks.exe Token: SeSecurityPrivilege 3500 srtasks.exe Token: SeTakeOwnershipPrivilege 3500 srtasks.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeBackupPrivilege 3500 srtasks.exe Token: SeRestorePrivilege 3500 srtasks.exe Token: SeSecurityPrivilege 3500 srtasks.exe Token: SeTakeOwnershipPrivilege 3500 srtasks.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2844 Antidetect Patreon Premium Edition 2022 .exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4792 VirtualBox.exe 4792 VirtualBox.exe 4792 VirtualBox.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 480 wrote to memory of 4408 480 Antidetect Patreon Premium Edition 2022.exe 82 PID 480 wrote to memory of 4408 480 Antidetect Patreon Premium Edition 2022.exe 82 PID 480 wrote to memory of 5008 480 Antidetect Patreon Premium Edition 2022.exe 85 PID 480 wrote to memory of 5008 480 Antidetect Patreon Premium Edition 2022.exe 85 PID 5032 wrote to memory of 2524 5032 cmd.exe 86 PID 5032 wrote to memory of 2524 5032 cmd.exe 86 PID 4408 wrote to memory of 928 4408 Setup.exe 89 PID 4408 wrote to memory of 928 4408 Setup.exe 89 PID 1988 wrote to memory of 2736 1988 cmd.exe 91 PID 1988 wrote to memory of 2736 1988 cmd.exe 91 PID 5008 wrote to memory of 5268 5008 Setup.exe 92 PID 5008 wrote to memory of 5268 5008 Setup.exe 92 PID 480 wrote to memory of 2844 480 Antidetect Patreon Premium Edition 2022.exe 90 PID 480 wrote to memory of 2844 480 Antidetect Patreon Premium Edition 2022.exe 90 PID 480 wrote to memory of 2844 480 Antidetect Patreon Premium Edition 2022.exe 90 PID 928 wrote to memory of 5376 928 svchost.exe 93 PID 928 wrote to memory of 5376 928 svchost.exe 93 PID 2376 wrote to memory of 5160 2376 cmd.exe 99 PID 2376 wrote to memory of 5160 2376 cmd.exe 99 PID 5612 wrote to memory of 3500 5612 msiexec.exe 103 PID 5612 wrote to memory of 3500 5612 msiexec.exe 103 PID 5612 wrote to memory of 2684 5612 msiexec.exe 105 PID 5612 wrote to memory of 2684 5612 msiexec.exe 105 PID 5612 wrote to memory of 3900 5612 msiexec.exe 106 PID 5612 wrote to memory of 3900 5612 msiexec.exe 106 PID 3320 wrote to memory of 1912 3320 svchost.exe 108 PID 3320 wrote to memory of 1912 3320 svchost.exe 108 PID 1912 wrote to memory of 480 1912 DrvInst.exe 109 PID 1912 wrote to memory of 480 1912 DrvInst.exe 109 PID 5612 wrote to memory of 1408 5612 msiexec.exe 111 PID 5612 wrote to memory of 1408 5612 msiexec.exe 111 PID 5612 wrote to memory of 1408 5612 msiexec.exe 111 PID 3320 wrote to memory of 1984 3320 svchost.exe 112 PID 3320 wrote to memory of 1984 3320 svchost.exe 112 PID 3320 wrote to memory of 780 3320 svchost.exe 116 PID 3320 wrote to memory of 780 3320 svchost.exe 116 PID 2844 wrote to memory of 4792 2844 Antidetect Patreon Premium Edition 2022 .exe 117 PID 2844 wrote to memory of 4792 2844 Antidetect Patreon Premium Edition 2022 .exe 117 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Antidetect Patreon Premium Edition\Antidetect Patreon Premium Edition 2022.exe"C:\Users\Admin\AppData\Local\Temp\Antidetect Patreon Premium Edition\Antidetect Patreon Premium Edition 2022.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:5376
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5268
-
-
-
C:\Users\Admin\AppData\Local\Temp\Antidetect Patreon Premium Edition\Antidetect Patreon Premium Edition 2022 .exe"C:\Users\Admin\AppData\Local\Temp\Antidetect Patreon Premium Edition\Antidetect Patreon Premium Edition 2022 .exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Program Files\Vektor T13\VirtualBox\VirtualBox.exe"C:\Program Files\Vektor T13\VirtualBox\VirtualBox.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4792
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe1⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe1⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 580B86F78B071386285D22FBD04546AE2⤵
- Loads dropped DLL
PID:2684
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 30E7321624A9014B1B00918BFAF267D7 E Global\MSI00002⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3900
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9875F388C3C7596C7BFB8F19D275279A M Global\MSI00002⤵
- System Location Discovery: System Language Discovery
PID:1408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe1⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5160
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5252
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Vektor T13\VirtualBox\drivers\USB\device\VBoxUSB.inf" "9" "44c03ccb3" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\Vektor T13\VirtualBox\drivers\USB\device"2⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{924BCF1A-6316-4004-8CDE-88E401B5EB10} Global\{A5E228C4-F2DB-49DE-A77D-DA21DEC858E5} C:\Windows\System32\DriverStore\Temp\{68d08711-27f7-af49-98f5-ac5beb04da14}\VBoxUSB.inf C:\Windows\System32\DriverStore\Temp\{68d08711-27f7-af49-98f5-ac5beb04da14}\VBoxUSB.cat3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:480
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Vektor T13\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf" "9" "414293377" "0000000000000164" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\Vektor T13\VirtualBox\drivers\network\netadp6"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1984
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Vektor T13\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf" "9" "442d4ec77" "000000000000015C" "WinSta0\Default" "0000000000000170" "208" "C:\Program Files\Vektor T13\VirtualBox\drivers\network\netlwf"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:780
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:3452
-
C:\Program Files\Vektor T13\VirtualBox\VBoxSVC.exe"C:\Program Files\Vektor T13\VirtualBox\VBoxSVC.exe" -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092
-
C:\Program Files\Vektor T13\VirtualBox\VBoxSDS.exe"C:\Program Files\Vektor T13\VirtualBox\VBoxSDS.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5248
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD59f11fe2b3f9144474cad22bd4e3118c1
SHA192dcd730613d26d4893fbfd5b43baf999ffa687b
SHA256ff19b8160bb321dd3f88c4cb101957639b72cd0d9da95bc492d93c8e81bf9c94
SHA5124f9b0287dc4a68b65f4ea2cc4223c31a2a27c99ce80bb6125732e62087feeb362b3adef5b1cd7523512013185ee99016ff940e44e6adf5e2d77727ce3fb7a245
-
Filesize
24KB
MD58e879e3b069a863ea28cd8ccb102c3b8
SHA1385ee7ec19e2698e0d30f15182889b3e536c5e4d
SHA25610d8016a168c3c1fc756d716b02b400616d026a2a5b4cb143cd7a5f809b55516
SHA51299d7de7b95adb3509bae7a38c3625a7a9fee5e85112f5238c438c580d1118fa7d73dd42d73443dafe4e06e1989edc1c510a62d7e8db5ee13ff1d8ae21b45754a
-
Filesize
178KB
MD5066955d033308d27c08ddd9605ccfe7a
SHA11ee93f373c7ef8e17540ed56fcf2ce1541db5997
SHA256a0fc2ddcb775de51f992a5a49a9447b2722323948e576f84a8ba7d3ce06c31fe
SHA512822e488046c93b816c53c905d748e9864006bf6d7c169f68698cbaf35d580ddad65f1bf915648b73f8a2571e836a6c7c97bb0bd1a5f8864194219191341e0837
-
Filesize
241KB
MD5c6f08995f2d2c18caf8e91db9b1e2249
SHA1e03dad0181f930e320206f733306a4e9ca3fef8a
SHA256da3b498352c645db952878ba25975e9689d92840d7f77e6476a0463fe6f4d87d
SHA512a7c3d7c7f5dafd81f9737db5dfce03e52bf5fc9cd1e863f883dff86d0f90e9d66b726ea774f7ee15b073676fbbc8746167086f3721202085445259f925ec31c0
-
Filesize
973KB
MD5b2c2f48bd25fe77420b5363860fcd904
SHA142c5a4ee090f304e506472531e3b71acc91bcf2e
SHA256f1bb391a09870493a26066b531fb2d1969a9503037ebf6ba87a58e3268ea2ec6
SHA512b6c6c78ccceddaa39b2ee957dea931d1597d54ce3b8e29e6d051de7d54044ea5ff9dce5056de04fa7cecdc39c0c25c96b1b232894d3f270d5daca924207c0d98
-
Filesize
2.2MB
MD52f14a2853900e97f4943242b1b407c86
SHA1675ca10eea2eaac50674012fb0f9e4b2649faf2d
SHA25697c8a5a19486d8a8735ab787b4a4c587a4ae6909e1f992b10ac91cb2c09b1741
SHA5120498a503060908714bb61ea4931be28a0211ad64481220f6dec4024b7b49be5d33e8496d9906ddbdd8b251d6ddd31a8ab15c435632adb3a86012cc29991e6160
-
Filesize
2KB
MD565346b5991286bb6bbe4038768f7e245
SHA1d1a1f5cc3c1b9afacd4b9d65adcc58b2948a6f7f
SHA2565b9f9965e3b7a42f52a36df2b035523106863247010e122dab253e3107b70ce7
SHA512ed435b1c509361f4e6f9eef47f3a8ad980cbc8aaa84f27c9cb6b125a33d20034f0cc60a8a5679bc4bbcef2ef8f5bbea447b35d2c2d3047fab028db4b379af634
-
Filesize
24KB
MD52efae31236f042ce07eb23fcb562c630
SHA14e4dfad311d140b5c1e14c2ec604833042ce3c58
SHA2567326823e899a8e0a59f9d64d6164cc60267ea37a9c20842d85b60d91dcd1c0a6
SHA5121f7dfe83528b4230e555001ca8add6b5aabb6be99ffd2168861a008fbdacc33f21c5dba86fc992dede14bd7ffd5be765810d07f794e7f195e04dec5f88a43db5
-
Filesize
2KB
MD5ac4abd3f90352559932287fb97d527d1
SHA1276d8a42b659eafc5fed20406c17eed77c68530a
SHA256f66796576e7307da709aec482724b4af17c5ea59fd016df042819be9d7e6df9b
SHA51208940c1667debfa7039b91a09bd31ea5b6efc7f3002b8606e2d37f7d3700dcc10dccf2d681b70271bd95528875a7113530babc340240ce4b7f76f80a22cc2d83
-
Filesize
191KB
MD518f19e03735dc5a7e6476b36140232e6
SHA1ef1d3f764784499443088f6f32d3770c753c9036
SHA256f1b7ae6c62345d73069dc7b96f4a0ddb7303647863d58485a8627ba69f189ee6
SHA5126a10d971c19e6c7b9709a632b84cf3bf9284f976e8f1bcfbcc7d98ab5cd9ccdb748ccaee3d420f2dddcf8f41b56c437ff422ea126068cf49831462b478ee60a8
-
Filesize
3KB
MD5b12511df122f31364b87b071a62901e1
SHA19b81fe3af4c64748abff3964080e691ec25f02dc
SHA2561e3de2fe2bb1069091850d5307b0c869d7d802cf1ffb824e3f82057294a3f395
SHA5122aad66c44e8eda6797c1ab4143303ae3090ee9dac60633547ac9aeef60982a1f5df91e4ee7cabcb2d5dc63f029979f65225a1792c41c2bfaa31d5cde7fc273f0
-
Filesize
3KB
MD512663dbd027adc66ef1d9cdf59c0f8cf
SHA1667da2234c0613711920086a991328acfce58985
SHA256232fabfc5d2201eeaa9b32fce26903eda4d8519613e6ec8967fbf11935f135ac
SHA5127b3482f2d87c7de175964ec8a8cc0b4341e8782d3de44b6ea5eb9150c2e5b582a896a32609272fed3f26d7fa57cc8e6709d47708129b739d391364bbaae93d31
-
Filesize
24KB
MD5da6c40b2b2962b8b9eb21ef56b7b3dcf
SHA1256adcb0c73ac91bd2ed7b3c97c603e386e609e4
SHA256afe786fb69e3dba876abb3c49979a08b42270abbe7c37274955c013de3ef3670
SHA512084dff20aa145a12832020448172bffa2d3d4589e36d692e323bb0f6fce2eedb9eb87fbd28d21f16cfdfa93ee005c1311cac3917302235db29533b1d9dc14753
-
Filesize
2KB
MD52bb7330b6796d8018f50723b4300bce1
SHA1a268682f991c3ef8fed568e7213c146846819f18
SHA256a74ed746efd1b0713c0ec23171bc4311853936ff41dcd024e63ebf65bf5893ad
SHA512eed5a7ceb88fdbb4c9fa942d52d568e1a63214130f8525cccf6de3b0a3bac45e954ea1d6d6e184fc4cef51d2765fae548161b56b465be37d176d5d7129289a65
-
Filesize
1.0MB
MD553b6d078510da6f9da9de35fc286f6df
SHA126dbabf8a40d2203e745f6ea66b888794a23973c
SHA256bf083aba584e5cb31a26c4d7ae2bbf0f4dff3ae0d0f9bd8922203b463f59021b
SHA5124420be234eade61663e8bedc5f62878df5fa1764058f2ab0a0195f96ebfb228b450a58cdce2baaab8cf5694b7b059032d9fd440946b102569acb73878c657c2e
-
Filesize
588KB
MD5d48799db5ba631002258b5972b332e00
SHA1df6a04162e148eafa2e17442ae9c0a3b0ebc650d
SHA2563b78e45616ba825a508dec60d05f7909bc15a5d1f5029e4d04ca0d603f02f0fa
SHA51245a5b1710e2cee64e1b87b82fcbe8e8109cb580396a65dd53a8bca934ae2d525d967507f4807febf277b8aa8c50af1bcb0f00a8cbd0d40ef70bf6bb8b7649e70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize1KB
MD59c0d8d183bd332b6c3db08727f8ec95b
SHA1d3f7e47ef67eaff851b3bd3cd4097f7b749f81f7
SHA256d35f7bd9587b446a97d2e278f9ef7f8a2504362884910139289319d3af04a921
SHA512485b0fa7027e33a700ec9be243ca6541b20648a630ba2c450dedc2efa43971cd5d15c1d77c490d83564837c27a85e995c2bd48fb8c20a64ca51a9ef0510729eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_72694C6727E2E7C86AB39E0B21D2306A
Filesize1KB
MD5fd53a0c952ab0a6e3987f33f6ebe3f04
SHA1d89a95dca803109e5d8df34d1a02b030bbf9fe9a
SHA2560df3eaf4ca15f24674460501b9c873af7096b58ac48d47fc0374071bc394bfa0
SHA51218dddcd9b67e52d2f2482b7f7837193884f56f93df5d5b1ba41a2f3329bcb4b8c84b966228619160d77fa3d826d2b515be2dd80f9a5c55148762bfe8406cfa18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Filesize1KB
MD5a3adb759493eff3782a3124299a22b15
SHA1134175ca68ff9fd5ae9d16f8969f32b5d7294bba
SHA256458e1b0401d38d9a0f9f69d2e30b85fa58ea882857cbd5b41cd94cd55def0c6a
SHA512eb4e8ac77dfe0653bd0fa907f6a5607fa76e653d39c805bf2afa8d0696cffc41af30fdc0a199511250105f90ce9c5aac352d457ba8fe06fabcebef95be7c36db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Filesize1KB
MD554735f193ee919f88a9387e1f866c7fc
SHA1016d27453f12ae19dda1b6ee36995dca21b9ab49
SHA256fd87a6488927c0ee8cb7269025f5f4acfbe0ced334e96393535c72114e936551
SHA5122d1103d26acd6ee53e75cae9edc4b1572395d00ad60edcddbfb39f3c8a64fa01ae83190ea236ce9a2d8b9e6fed9efed4c4235c55dd850ce494c87d6b585e7024
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Filesize508B
MD5bbcc6e1e63fda62e32ccb82b72c3bf8f
SHA19efff7bae242925f92fe3906a60e88bc90dd13e8
SHA256d32e77eec794b20b5308fded5cccf5c7c66e59177e4787801bcbea3652ad2a9c
SHA5128e7aab424c604577804c44b48481df1530bac89e6ab556cfdec6194aeefc0ff747b9e55b3a7c4013c441a4c1df7e3092076d9c8dcd493b144f2539420718575c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_72694C6727E2E7C86AB39E0B21D2306A
Filesize536B
MD5f8b7d50ffb68f1c0fc0d1bfb9720b73f
SHA1bd4e866c376270c710ef9049f9833203a7ac8125
SHA256761139930e2f3fa3d5871fa2f2ba53c32301e1637391ba2299dc142fbc5583ae
SHA51276bbd1721d6168252db19911c46944d42bd946d77b97ee85c6bddf4e46536d692c7f3216859e95ab362efd7e526f9382755fbb32d3d95016cd5a98373c867da0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Filesize536B
MD50af341a9df2447eb54a3311b3ccbfd5a
SHA198ff57169f11a7ca700b21b6d972c3c1b7d8bbe7
SHA2560e4615545df60babdb834d9890f0878976d2cf0cdc3dd13dbed1930ac4d94030
SHA512160d3b957998a2f64928150f66f71777857465c305482d7c2868d44a1c4f93d840d74ca031fac80e87124254d2c965a33a85c8310049a55448501116ae717b30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Filesize508B
MD581021bb7062ec52b16b655164081a7f8
SHA14e8c387e92166532f57ee6ce86468e815aa18c59
SHA256dc01772cdd89e6444c973cb4bf10c512b7b4bd4ed0846fb37b0e99b24872f31e
SHA512bb61d69d1cc88a8816530f9de4c74ce23de241c41d03f56eb4dafd244d23665850f049262ee2e52b9e96966e7c8d3c8aad540ec72def62da8472c3ff01421a86
-
Filesize
408B
MD5252d820f60b1a8716c6ecf2a06f4efe1
SHA19be2566cf6aaf73ff7679db9cc2a6277b27a5896
SHA2563b1cc12b59dc1e8a72b957d9b9be782c0cbf2a6fed1305b339e55f4ee38efe91
SHA51249bc304d7454c112011474fdd557a3693fa7821b831d45fcea0cd2562cf23cad7b3512195054f7d90c7a8149f4c380cc8ab68131e7d5bc37066fbd0e0d580c39
-
Filesize
689B
MD5727ce971a2b7303de85961589f692a87
SHA14bce0760241cf7ca9ef2153f093f3c5a12bd7dc7
SHA25647a7897be2a7d9b5026c83d739ecc1f336f1591eaea8fbbd8da6a4850a5c764e
SHA51230c16977a41f85e19208282784301763857e7e3d8948e768519d929ba86e2917cd338af534ff7748c58a6c7890c15eed2878ce9fb79b4baad2707284d721ac85
-
Filesize
420KB
MD5ada0cbc54989b2cd2959601c7a5b8499
SHA19c8739d476016fe0a87b176bb95f3a5bcbeff0de
SHA256a19b89ddc700357e618934775fd1a412401b308a9ef6ae686d3f363622065c96
SHA512f9de42724ff8bc65841db07a0901b706cf5f44d6c1e09e34ea753f88ed9746a22898993e0afe2947f8b4aa28515b428bd320bedca471b04db171776e81c4558e
-
Filesize
73KB
MD58e3d99e6a1064f89744ccb24dc6802bb
SHA11b6c31ab4236538c8423c19575c1e19a031b3876
SHA256d21a23ffbdfe1bf8232a132b559c99b37f5825d816f83370684e67988b3162a8
SHA512f5f49c20c5d9a5a80e1d3a4540695fca4732755bc33c0ea61b8be582a2ab7d22305666caf4a3f09fc7c165b3ceadcc89aa4240edcf1f0daba8b0bb09ef720134
-
Filesize
293KB
MD51303779b354738a8c93cc522ffb21f11
SHA1ce29a26e1363ddfdc830e2934fed935f15032187
SHA2560a8e2fcc8c6393d2e97e6129e862a877a420a54f2530b4af5eb7f8e2a7a30af5
SHA512b5a612907d09200753d4b4770c90cde98d18eda7eacd15c8297582401b58f1a4a91c8553dea7640d03bcc6068bb2afa0b1ee46997653c839f2066f5ed050a66d
-
Filesize
1KB
MD5f15a310adc3e0c6c0cb44bbd65cc1d8c
SHA1374739e7d3f4cc7da69510368d1fcb5fa9af40b1
SHA256ebf1c8848195a7d85a4151627987a22faf2ac86deab6ba4fec3c1d696d1346ca
SHA5126a38890f895159c970d159804b8ec5b72e8596bfc9f64f645c81233ad651b49dc2c9bf8d4fee293b272acde004f9757b754e7dcbb2206755eb5fe19c1768bba8
-
Filesize
1KB
MD5c04a96c65844cf3c32b1fd830b580d11
SHA17b5aa071ce68cd63248acef0175853c48d97629f
SHA2562549bb2c5a235c23343905fe6015520cfdabc8363c02adc48237e37d195a85b3
SHA5122ac64fae37afab4847afb2eb3c80ce3dde56100fb13814fcb04a99b2764bc5c6f1404ade1d3e96a70b3c82e2d15fbf823b12dca65e6ed69692d7d6568b30f812
-
Filesize
199KB
MD5f97b9cde9f9de44a9de69363eb66dce5
SHA1846fb6f0ef3c704d97779034ac48464fd1bdb881
SHA256e67c83feb3a099f9908af211546b7471bc7b42fde80b11a7448ba5932b6c01b9
SHA5125c0749886aa240e010eaa078a7201b2a7d8caf9c1a6797b71499cd15012b19daed3cb51f1602cf82600e298f4e5e9a9667b9412e25d6256f077f00dcb9d18ce1
-
Filesize
690KB
MD58deb7d2f91c7392925718b3ba0aade22
SHA1fc8e9b10c83e16eb0af1b6f10128f5c37b389682
SHA256cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4
SHA51237f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c
-
Filesize
149KB
MD5418322f7be2b68e88a93a048ac75a757
SHA109739792ff1c30f73dacafbe503630615922b561
SHA256ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b
SHA512253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef
-
Filesize
104KB
MD5774f076b5cac12548979a1f076382522
SHA13be5b615c1e559e11b758be602fadb0cbc35b0d2
SHA256704fe2e8979609a6833e4fe8c87ffdad4a4393aac6665eed17d59c0813f2b021
SHA512e5b3d5896728c2df3c10ca136c3a8662d52243f1afb1def726d9b2d8e56ecb65b2a3135e6930b4c3cc1596d61c86533fd43308eda675d0bee8ef468e9b1ce116
-
Filesize
104KB
MD521eba4fdd2870c55c2ec4a15ed4b8673
SHA1380d0115602c325ba0a43a384a294688db1b0592
SHA256481b913e174c134d5c7fd5483c7899899ad2a1004821d0e1919bd72e80c4e5f3
SHA512009c578cb9ec1bd71c751d4cf7385f412a85a16372b1947d6fd251489c7c6e534c7cb7d538c7ffecb4059ab3fd1db5e3ad8f56e65eb635ea9aaee880979d6f2b
-
Filesize
104KB
MD5d24e85faa5646d90a626500cc2890a6a
SHA128eace153aae28b10e48f4ffd23f0634b6d03df6
SHA256f2359f90e918837c74851467495cb055ed984f9f248d7915fcbfd2502b0cd3ed
SHA5123785860a2a199561301078e24460382a329cde46c04d1a2a0ec15ec7a3de9aa4728a0b1d0d3bf1f252a4bac14a1574b59c30f7f282d1216909f74703121e0769
-
Filesize
24KB
MD576db37d9887f6424687a2cea966678ce
SHA13ad513cc7694a1811a3c86db74c27e0fdde56a5d
SHA2560edc02470245df9811ff1cf69aa47ce0b3e70cb0beac2349f54176fa08f992c6
SHA5121b269a569f16b9296a9660d4655478bddc659a39bf3a5fb51b9011e4f6bcd6382e1023f7ee2b3d8c63e814e68e062af47eb5d26f404038cba3b79775e4272313
-
Filesize
24KB
MD54a8db3582e8ce1687b107db4eac1f1b5
SHA117a401cc2bc872e3299ddde2fdd153c624a9f666
SHA256b792e5e904dd4c75433e9f6fd9e5b81f8274c7b8580f174fea124b97ef11d90e
SHA512cbb299247dc8e41b9d45d488f164937781a51762337d7f4fc82af82829c3529f8906ab55a9eb0aa19a0d74b18f542f22f3434a6ebe061a6d21be3d1f16c9f84d
-
Filesize
251KB
MD5be2d61e34859a88ab785b1579767488a
SHA155eed9cfecb2a77299528abd5503916dad342c6e
SHA256fc4d51468f49dfcb2be252670a32be264e8e5e570172c431bd8010fbebcf7e82
SHA5128f17ed77cbace1b8f9ea25b91d298edf51fe6af2e0086eca0e47a3ce639994afa47e8f0e223ebdb1abfbb8940415e1e57caaf6d1b5b817333893c3cb1480fc22
-
Filesize
24.6MB
MD5ebea736d31c8f70481ec3554988fd21e
SHA18420cc1301b0cc99b099991b9170a00eef701f59
SHA25648e3b70a3f3b037eece9c81f94a16e055e10ebef01627609aa0d34853e436516
SHA512317b1ab21cbe73b9f6e9f5ec31df3581ec200835d120628cde840c26012f1a9487a76ae1103248202d8c5190e6f1d564a4c3f2054a3f33ea2f572b7954e99a1f
-
\??\Volume{d3053786-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{28067d3d-d029-48bb-b9f7-48cc97f0f8b6}_OnDiskSnapshotProp
Filesize6KB
MD5172002fdd77fbe3fec850393baa2af90
SHA1b5b9b3d0251c01c54c9723505cff555fba3785ee
SHA2569b94599a2438abe1090e7b71007132fe845af7eec80ea3c38f06295df4a8cce6
SHA5125ac494c2aac98523efc827ab96b7c42b5ebe6cbca5214d25925973fa0065494f0fb8cd8dba3974399859e73c4932ee8662c418cfb5d39e9adfea0bf5b83e2adb