Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/04/2026, 22:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SplitCamSetup_x64.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
SplitCamSetup_x64.msi
Resource
win11-20260130-en
windows11-21h2-x64
23 signatures
150 seconds
General
- Target SplitCamSetup_x64.msi
- Size 467.5MB
- Sample260429-2tkc5shs2v
- SHA256 090618c3913178419ba2008ad04b4a9451f28ed58f81e4b44763b37336ac2dc3
- MD5 f69f844f0c5edaf3fce109f9d0160cc2
- SHA1 5f71864957e99c07d1de48e7dde495281f10b91e
- SHA512 3f106e704918fd9786cc7252d0743f796f743c36df147ac1afe9dd3f8e665835a5c7c9cf3142e50985dc15cce6384afd69f4e3349985377cfdd48859acf03cf5
- SSDEEP 12582912:UQII0nsUYzQ0CUfW9fQOIYRX5Ggbgt+OHfUcU7Z5FezDlYRUhM:UQ5aYzt7ifQOFRYxcOTEZn4OUh
- TLSH T1A53933B6F5081F32F68B7AF925734B7986EE0D4103950D134252BB07B5BBBD26BA0781
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 8 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\SETF080.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETF080.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\scaudio.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\drmk.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\portcls.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\SETEE8C.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETEE8C.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\splitcam_hd_driver.sys DrvInst.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 8 IoCs
pid Process 2504 setup.exe 2140 devcon.exe 3956 devcon.exe 2168 devcon.exe 240 devcon.exe 4004 splitcam.exe 2108 splitcam.exe 2980 splitcam.exe - Loads dropped DLL 64 IoCs
pid Process 868 regsvr32.exe 972 regsvr32.exe 1256 regsvr32.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 4004 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2108 splitcam.exe 2980 splitcam.exe 2980 splitcam.exe 2980 splitcam.exe - Badlisted process makes network request 12 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 3584 msiexec.exe 9 3584 msiexec.exe 11 3584 msiexec.exe 13 3584 msiexec.exe 15 3584 msiexec.exe 17 3584 msiexec.exe 31 3584 msiexec.exe 34 3584 msiexec.exe 35 3584 msiexec.exe 39 3584 msiexec.exe 45 3584 msiexec.exe 47 3584 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{d8ed26eb-f127-354e-9a8b-d2a79c32c0d5}\splitcam_hd_driver.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{df59ce24-f863-2b49-b647-611e67a9fce2}\SETEFB5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{df59ce24-f863-2b49-b647-611e67a9fce2}\SETEFB6.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{df59ce24-f863-2b49-b647-611e67a9fce2}\SETEFB6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\scaudio.inf_amd64_6884fcd60fbab136\scaudio.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d8ed26eb-f127-354e-9a8b-d2a79c32c0d5}\SETEC4B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{df59ce24-f863-2b49-b647-611e67a9fce2}\scaudio.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\scaudio.inf_amd64_6884fcd60fbab136\scaudio.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{df59ce24-f863-2b49-b647-611e67a9fce2}\scaudio.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{df59ce24-f863-2b49-b647-611e67a9fce2}\SETEFB7.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\scaudio.inf_amd64_6884fcd60fbab136\scaudio.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\scaudio.inf_amd64_6884fcd60fbab136\scaudio.PNF devcon.exe File created C:\Windows\System32\DriverStore\Temp\{d8ed26eb-f127-354e-9a8b-d2a79c32c0d5}\SETEC5C.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{df59ce24-f863-2b49-b647-611e67a9fce2}\SETEFB5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{df59ce24-f863-2b49-b647-611e67a9fce2}\SETEFB7.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{d8ed26eb-f127-354e-9a8b-d2a79c32c0d5}\SETEC4A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d8ed26eb-f127-354e-9a8b-d2a79c32c0d5}\SETEC5C.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d8ed26eb-f127-354e-9a8b-d2a79c32c0d5}\SETEC4A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d8ed26eb-f127-354e-9a8b-d2a79c32c0d5} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d8ed26eb-f127-354e-9a8b-d2a79c32c0d5}\splitcam_hd_driver.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{d8ed26eb-f127-354e-9a8b-d2a79c32c0d5}\SETEC4B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d8ed26eb-f127-354e-9a8b-d2a79c32c0d5}\splitcam_hd_driver.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\splitcam_hd_driver.inf_amd64_bdd8124ee6f566f7\splitcam_hd_driver.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\splitcam_hd_driver.inf_amd64_bdd8124ee6f566f7\splitcam_hd_driver.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{df59ce24-f863-2b49-b647-611e67a9fce2}\scaudio.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\splitcam_hd_driver.inf_amd64_bdd8124ee6f566f7\splitcam_hd_driver.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\splitcam_hd_driver.inf_amd64_bdd8124ee6f566f7\splitcam_hd_driver.PNF devcon.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{df59ce24-f863-2b49-b647-611e67a9fce2} DrvInst.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\SplitCam\10\res\preview\artistic\{81056A51-AC39-487D-9E7C-B7AA0C52F8E8}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\libs\d3dcompiler_47.dll msiexec.exe File created C:\Program Files\SplitCam\10\license.txt msiexec.exe File created C:\Program Files\SplitCam\10\libiconv-2.dll msiexec.exe File created C:\Program Files\SplitCam\10\res\luts\Kodak.png msiexec.exe File created C:\Program Files\SplitCam\10\driver\audio\ARM64\Win10\scaudio.inf msiexec.exe File created C:\Program Files\SplitCam\10\libs\locales\et.pak msiexec.exe File created C:\Program Files\SplitCam\10\res\preview\color\{84C50DF4-237B-4F9D-801B-D2930C58341B}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\libs\locales\te.pak msiexec.exe File created C:\Program Files\SplitCam\10\res\preview\artistic\{57742971-3DE5-4A78-B4BF-8541BDBD7ABB}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\res\frames\Window.png msiexec.exe File created C:\Program Files\SplitCam\10\libs\libGLESv2.dll msiexec.exe File created C:\Program Files\SplitCam\10\res\preview\color\{34C4773A-FB9A-4E07-AF37-9519CCDB0843}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\res\preview\unsharp\{62F22768-DF8B-44AC-8B06-EE34807847BD}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\libs\locales\ms.pak msiexec.exe File created C:\Program Files\SplitCam\10\splitcam.exe msiexec.exe File created C:\Program Files\SplitCam\10\driver\audio\ARM64\Win10\scaudio.cat msiexec.exe File created C:\Program Files\SplitCam\10\res\preview\color\{9361BF7A-0042-4FAD-B3BC-43F7633A4E4E}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\res\bgmodel3_mv_fp32.onnx msiexec.exe File created C:\Program Files\SplitCam\10\res\preview\miscellaneous\{43419413-4844-4A72-9414-10FBC72FE193}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\Processing.NDI.Lib.x64.dll msiexec.exe File created C:\Program Files\SplitCam\10\libs\locales\tr.pak msiexec.exe File created C:\Program Files\SplitCam\10\res\jscode\myfreecams.js msiexec.exe File created C:\Program Files\SplitCam\10\res\jscode\jquery-3.5.1.min.js msiexec.exe File created C:\Program Files\SplitCam\10\res\bgra2yuva.cso msiexec.exe File created C:\Program Files\SplitCam\10\res\placeholder.png msiexec.exe File created C:\Program Files\SplitCam\10\res\preview\color\{CE3D6EF7-3EB3-43B9-B384-A215966EDC8C}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\res\luts\preview\Original.jpg msiexec.exe File created C:\Program Files\SplitCam\10\libs\locales\am.pak msiexec.exe File created C:\Program Files\SplitCam\10\OpenCL.dll msiexec.exe File created C:\Program Files\SplitCam\10\avfilter-10.dll msiexec.exe File created C:\Program Files\SplitCam\10\res\preview\mask\{998C0BEF-2876-4B10-97F4-999772902B5F}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\res\frames\Drapes.png msiexec.exe File created C:\Program Files\SplitCam\10\res\erodepart.cso msiexec.exe File created C:\Program Files\SplitCam\10\res\luts\Nature.png msiexec.exe File created C:\Program Files\SplitCam\10\res\preview\background\{ADEA39E0-B855-41F7-904F-2BE5EA12D529}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\res\facelndm.onnx msiexec.exe File opened for modification C:\Program Files\SplitCam\10\res\preview\miscellaneous\{64D8FF44-04D8-4BDE-BC6A-48B0BEAFAE51}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\libs\locales\th.pak msiexec.exe File created C:\Program Files\SplitCam\10\res\jscode\stripchat.js msiexec.exe File created C:\Program Files\SplitCam\10\res\erode.cso msiexec.exe File created C:\Program Files\SplitCam\10\libs\locales\uk.pak msiexec.exe File created C:\Program Files\SplitCam\10\libgcc_s_seh-1.dll msiexec.exe File created C:\Program Files\SplitCam\10\libs\libEGL.dll msiexec.exe File created C:\Program Files\SplitCam\10\libs\locales\da.pak msiexec.exe File created C:\Program Files\SplitCam\10\libwinpthread-1.dll msiexec.exe File created C:\Program Files\SplitCam\10\libvpx-1.dll msiexec.exe File created C:\Program Files\SplitCam\10\SoundTouchDLL_x64.dll msiexec.exe File created C:\Program Files\SplitCam\10\res\jscode\wsHook.js msiexec.exe File created C:\Program Files\SplitCam\10\libstdc++-6.dll msiexec.exe File created C:\Program Files\SplitCam\10\res\virtualcam.dll msiexec.exe File created C:\Program Files\SplitCam\10\vcomp140.dll msiexec.exe File created C:\Program Files\SplitCam\10\res\preview\color\{DF4D1795-C123-4727-A581-729481B84253}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\res\preview\frames\{6090A057-52C7-4156-85D6-893621054125}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\res\oauth.html msiexec.exe File created C:\Program Files\SplitCam\10\avdevice-61.dll msiexec.exe File opened for modification C:\Program Files\SplitCam\10\res\preview\miscellaneous\{E4F22DF0-BED9-4B8D-A9AD-137C5C7D53D0}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\res\staticflowdilate.cso msiexec.exe File created C:\Program Files\SplitCam\10\res\preview\background\{DCA7C01E-D48D-4209-9685-C82FA29236FD}.jpg msiexec.exe File opened for modification C:\Program Files\SplitCam\10\res\fusion.theme msiexec.exe File created C:\Program Files\SplitCam\10\vcruntime140.dll msiexec.exe File created C:\Program Files\SplitCam\10\res\preview\unsharp\{CD608611-7A92-423D-ADAB-0DFF4F67D4B3}.jpg msiexec.exe File created C:\Program Files\SplitCam\10\res\loc\ja\strings.txt msiexec.exe File created C:\Program Files\SplitCam\10\res\fusion.theme msiexec.exe - Drops file in Windows directory 20 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e59a464.msi msiexec.exe File created C:\Windows\Installer\e59a46a.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\SourceHash{30058EB0-CD50-4958-8B22-D1897E502994} msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log devcon.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIB78E.tmp msiexec.exe File created C:\Windows\INF\c_media.PNF devcon.exe File opened for modification C:\Windows\INF\setupapi.dev.log devcon.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File created C:\Windows\inf\oem4.inf DrvInst.exe File created C:\Windows\Installer\e59a464.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3584 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{da4e3da0-d07d-11d0-bd50-00a0c911ce86}\Instance\{A799A801-A46D-11d0-A18C-00A02401DCD4} DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96460-78F3-11d0-A18C-00A0C9118956} DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE41-6C63-11cf-8A03-00AA006ECB65}\InprocServer32\ = "%SystemRoot%\\System32\\kstvtune.ax" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96460-78F3-11d0-A18C-00A0C9118956}\InprocServer32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9F675A4-B126-4FFD-92DE-9FD9AD597E10}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9F675A4-B126-4FFD-92DE-9FD9AD597E10}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{D9F675A4-B126-4FFD-92DE-9FD9AD597E10}\CLSID = "{D9F675A4-B126-4FFD-92DE-9FD9AD597E10}" regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\SplitCam Project\shell\open\command\command = 4700520075004c00330039003800690058003f002c00550021004100540060004d005b005d0057003e00570069007e00460038004f007600410078003f003800630034004a003f00400040007900710079002000220025003100220000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{A799A800-A46D-11d0-A18C-00A02401DCD4}\FriendlyName = "WDM Streaming TV Tuner Devices" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{da4e3da0-d07d-11d0-bd50-00a0c911ce86}\Instance\{A799A802-A46D-11d0-A18C-00A02401DCD4} DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{A799A801-A46D-11d0-A18C-00A02401DCD4}\CLSID = "{A799A801-A46D-11d0-A18C-00A02401DCD4}" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9F675A4-B126-4FFD-92DE-9FD9AD597E10} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{D9F675A4-B126-4FFD-92DE-9FD9AD597E10} regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{D9F675A4-B126-4FFD-92DE-9FD9AD597E10}\FilterData = 02000000000020000100000000000000307069330800000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b714e56313200001000800000aa00389b71 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\.scproject\SplitCam Project msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE41-6C63-11cf-8A03-00AA006ECB65}\ = "TV Tuner Property Page" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96460-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}\InprocServer32 DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\{D9F675A4-B126-4FFD-92DE-9FD9AD597E10} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\SplitCam Project\ = "SplitCam project file" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{A799A801-A46D-11d0-A18C-00A02401DCD4}\FriendlyName = "WDM Streaming Crossbar Devices" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{19689BF6-C384-48FD-AD51-90E58C79F70B}\FriendlyName = "WDM Streaming Encoder Devices" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{da4e3da0-d07d-11d0-bd50-00a0c911ce86}\Instance\{7A5DE1D3-01A1-452C-B481-4FA2B96271E8} DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956} DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}\ = "TV Audio Property Page" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{D9F675A4-B126-4FFD-92DE-9FD9AD597E10}\FriendlyName = "SplitCam Virtual Camera" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\SplitCam Project\shell\open\command msiexec.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\.scproject\SplitCam Project\ShellNew msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{A799A800-A46D-11d0-A18C-00A02401DCD4}\CLSID = "{A799A800-A46D-11d0-A18C-00A02401DCD4}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9F675A4-B126-4FFD-92DE-9FD9AD597E10}\ = "SplitCam Virtual Camera" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9F675A4-B126-4FFD-92DE-9FD9AD597E10}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\SplitCam Project\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96460-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9F675A4-B126-4FFD-92DE-9FD9AD597E10}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\SplitCam Project\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{19689BF6-C384-48FD-AD51-90E58C79F70B}\CLSID = "{19689BF6-C384-48FD-AD51-90E58C79F70B}" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96462-78F3-11d0-A18C-00A0C9118956}\InprocServer32 DrvInst.exe Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\SplitCam Project\DefaultIcon\ = "%APPDATA%\\Microsoft\\Installer\\{30058EB0-CD50-4958-8B22-D1897E502994}\\_853F67D554F05449430E7E.exe,0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{7A5DE1D3-01A1-452C-B481-4FA2B96271E8}\CLSID = "{7A5DE1D3-01A1-452C-B481-4FA2B96271E8}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{7A5DE1D3-01A1-452C-B481-4FA2B96271E8}\FriendlyName = "WDM Streaming Multiplexer Devices" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{D9F675A4-B126-4FFD-92DE-9FD9AD597E10}\FriendlyName = "SplitCam Virtual Camera" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\SplitCam Project\shell\open\ = "&Open" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{A799A802-A46D-11d0-A18C-00A02401DCD4}\FriendlyName = "WDM Streaming TV Audio Devices" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\InprocServer32 DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE41-6C63-11cf-8A03-00AA006ECB65}\InprocServer32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}\ = "Analog Crossbar Property Page" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96462-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}\InprocServer32 DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\SplitCam Project msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\SplitCam Project\shell\ = "open" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\.scproject msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\ = "WDM TV Tuner" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE41-6C63-11cf-8A03-00AA006ECB65}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\.scproject\ = "SplitCam Project" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{D9F675A4-B126-4FFD-92DE-9FD9AD597E10}\CLSID = "{D9F675A4-B126-4FFD-92DE-9FD9AD597E10}" regsvr32.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2692 msiexec.exe 2692 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3584 msiexec.exe Token: SeIncreaseQuotaPrivilege 3584 msiexec.exe Token: SeSecurityPrivilege 2692 msiexec.exe Token: SeCreateTokenPrivilege 3584 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3584 msiexec.exe Token: SeLockMemoryPrivilege 3584 msiexec.exe Token: SeIncreaseQuotaPrivilege 3584 msiexec.exe Token: SeMachineAccountPrivilege 3584 msiexec.exe Token: SeTcbPrivilege 3584 msiexec.exe Token: SeSecurityPrivilege 3584 msiexec.exe Token: SeTakeOwnershipPrivilege 3584 msiexec.exe Token: SeLoadDriverPrivilege 3584 msiexec.exe Token: SeSystemProfilePrivilege 3584 msiexec.exe Token: SeSystemtimePrivilege 3584 msiexec.exe Token: SeProfSingleProcessPrivilege 3584 msiexec.exe Token: SeIncBasePriorityPrivilege 3584 msiexec.exe Token: SeCreatePagefilePrivilege 3584 msiexec.exe Token: SeCreatePermanentPrivilege 3584 msiexec.exe Token: SeBackupPrivilege 3584 msiexec.exe Token: SeRestorePrivilege 3584 msiexec.exe Token: SeShutdownPrivilege 3584 msiexec.exe Token: SeDebugPrivilege 3584 msiexec.exe Token: SeAuditPrivilege 3584 msiexec.exe Token: SeSystemEnvironmentPrivilege 3584 msiexec.exe Token: SeChangeNotifyPrivilege 3584 msiexec.exe Token: SeRemoteShutdownPrivilege 3584 msiexec.exe Token: SeUndockPrivilege 3584 msiexec.exe Token: SeSyncAgentPrivilege 3584 msiexec.exe Token: SeEnableDelegationPrivilege 3584 msiexec.exe Token: SeManageVolumePrivilege 3584 msiexec.exe Token: SeImpersonatePrivilege 3584 msiexec.exe Token: SeCreateGlobalPrivilege 3584 msiexec.exe Token: SeBackupPrivilege 204 vssvc.exe Token: SeRestorePrivilege 204 vssvc.exe Token: SeAuditPrivilege 204 vssvc.exe Token: SeBackupPrivilege 2692 msiexec.exe Token: SeRestorePrivilege 2692 msiexec.exe Token: SeRestorePrivilege 2692 msiexec.exe Token: SeTakeOwnershipPrivilege 2692 msiexec.exe Token: SeRestorePrivilege 2692 msiexec.exe Token: SeTakeOwnershipPrivilege 2692 msiexec.exe Token: SeRestorePrivilege 2692 msiexec.exe Token: SeTakeOwnershipPrivilege 2692 msiexec.exe Token: SeBackupPrivilege 572 srtasks.exe Token: SeRestorePrivilege 572 srtasks.exe Token: SeSecurityPrivilege 572 srtasks.exe Token: SeTakeOwnershipPrivilege 572 srtasks.exe Token: SeBackupPrivilege 572 srtasks.exe Token: SeRestorePrivilege 572 srtasks.exe Token: SeSecurityPrivilege 572 srtasks.exe Token: SeTakeOwnershipPrivilege 572 srtasks.exe Token: SeRestorePrivilege 2692 msiexec.exe Token: SeTakeOwnershipPrivilege 2692 msiexec.exe Token: SeRestorePrivilege 2692 msiexec.exe Token: SeTakeOwnershipPrivilege 2692 msiexec.exe Token: SeRestorePrivilege 2692 msiexec.exe Token: SeTakeOwnershipPrivilege 2692 msiexec.exe Token: SeRestorePrivilege 2692 msiexec.exe Token: SeTakeOwnershipPrivilege 2692 msiexec.exe Token: SeRestorePrivilege 2692 msiexec.exe Token: SeTakeOwnershipPrivilege 2692 msiexec.exe Token: SeRestorePrivilege 2692 msiexec.exe Token: SeTakeOwnershipPrivilege 2692 msiexec.exe Token: SeRestorePrivilege 2692 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3584 msiexec.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2692 wrote to memory of 572 2692 msiexec.exe 98 PID 2692 wrote to memory of 2504 2692 msiexec.exe 100 PID 2504 wrote to memory of 4960 2504 setup.exe 101 PID 4960 wrote to memory of 2140 4960 cmd.exe 103 PID 2504 wrote to memory of 2172 2504 setup.exe 104 PID 2172 wrote to memory of 3956 2172 cmd.exe 106 PID 2504 wrote to memory of 3912 2504 setup.exe 107 PID 3912 wrote to memory of 2168 3912 cmd.exe 109 PID 5084 wrote to memory of 5024 5084 svchost.exe 111 PID 5084 wrote to memory of 4632 5084 svchost.exe 113 PID 2504 wrote to memory of 1448 2504 setup.exe 114 PID 1448 wrote to memory of 240 1448 cmd.exe 116 PID 5084 wrote to memory of 4672 5084 svchost.exe 117 PID 5084 wrote to memory of 3044 5084 svchost.exe 118 PID 2504 wrote to memory of 3360 2504 setup.exe 119 PID 3360 wrote to memory of 868 3360 cmd.exe 121 PID 2504 wrote to memory of 4812 2504 setup.exe 124 PID 4812 wrote to memory of 972 4812 cmd.exe 126 PID 972 wrote to memory of 1256 972 regsvr32.exe 127 PID 2692 wrote to memory of 4004 2692 msiexec.exe 128 PID 2692 wrote to memory of 2980 2692 msiexec.exe 130 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SplitCamSetup_x64.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3584
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:572
-
-
C:\Program Files\SplitCam\10\setup.exe"C:\Program Files\SplitCam\10\setup.exe" /install2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplitCam\10\exe\x64\devcon.exe" remove *splitcam*"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Program Files\SplitCam\10\exe\x64\devcon.exe"C:\Program Files\SplitCam\10\exe\x64\devcon.exe" remove *splitcam*4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2140
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplitCam\10\exe\x64\devcon.exe" remove *scaudio*"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files\SplitCam\10\exe\x64\devcon.exe"C:\Program Files\SplitCam\10\exe\x64\devcon.exe" remove *scaudio*4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3956
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplitCam\10\exe\x64\devcon.exe" install "C:\Program Files\SplitCam\10\driver\video\x64\Win10\splitcam_hd_driver.inf" splitcam_hd_driver"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Program Files\SplitCam\10\exe\x64\devcon.exe"C:\Program Files\SplitCam\10\exe\x64\devcon.exe" install "C:\Program Files\SplitCam\10\driver\video\x64\Win10\splitcam_hd_driver.inf" splitcam_hd_driver4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2168
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SplitCam\10\exe\x64\devcon.exe" install "C:\Program Files\SplitCam\10\driver\audio\x64\Win10\scaudio.inf" Root\scaudio"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Program Files\SplitCam\10\exe\x64\devcon.exe"C:\Program Files\SplitCam\10\exe\x64\devcon.exe" install "C:\Program Files\SplitCam\10\driver\audio\x64\Win10\scaudio.inf" Root\scaudio4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:240
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "regsvr32.exe /s "C:\Program Files\SplitCam\10\res\virtualcam.dll""3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files\SplitCam\10\res\virtualcam.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:868
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "regsvr32.exe /s "C:\Program Files\SplitCam\10\res\virtualcam_x64.dll""3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files\SplitCam\10\res\virtualcam_x64.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\SplitCam\10\res\virtualcam_x64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
PID:1256
-
-
-
-
-
C:\Program Files\SplitCam\10\splitcam.exe"C:\Program Files\SplitCam\10\splitcam.exe" /run="C:\Program Files\SplitCam\10\splitcam.exe" /user="Admin"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4004
-
-
C:\Program Files\SplitCam\10\splitcam.exe"C:\Program Files\SplitCam\10\splitcam.exe" /initialize2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:204
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{a9530913-8e27-134a-9647-e831e67810fa}\splitcam_hd_driver.inf" "9" "451955273" "0000000000000104" "WinSta0\Default" "0000000000000150" "208" "c:\program files\splitcam\10\driver\video\x64\win10"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5024
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ac0d5538be381ad6:splitcam_hd_driver:18.17.41.776:splitcam_hd_driver," "451955273" "0000000000000104"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
PID:4632
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1157ebaa-6e06-b84e-a371-45f708676c13}\scaudio.inf" "9" "4f41fcc77" "000000000000015C" "WinSta0\Default" "0000000000000174" "208" "c:\program files\splitcam\10\driver\audio\x64\win10"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4672
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:f1d9700266dde071:scaudio_Device:16.10.24.612:root\scaudio," "4f41fcc77" "000000000000015C"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3044
-
-
C:\program files\splitcam\10\splitcam.exe"C:\program files\splitcam\10\splitcam.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59a465.rbs
- Size 183KB
- SHA256 9048779828f07bb9025b719221b0d0dc519347002a16cac2b21b9874f402ccd6
- MD5 3e1dc91f62c0f8a0c4c81dc7be8e92a2
- SHA1 a547a84aef9f3e7116a9d1bbd5724b2ffc84a062
- SHA512 be160f5815c2fd7489267874c2800f684be3fa9b99b3b0a9ed4f3390bc6f4159ba07a182c2575a7767a5494d02b21c41f29c0a8e7129c1772be715ad7f391cfe
- SSDEEP 1536:Tg/WoYrUCNpgUDHJa2F83vdfTmA3Hup4dcLsN0a5c6wt1QTEz2n1TWbTFhT3doaQ:R0YuvKoac/LXxqRAKTvnf6xQLc
- TLSH T1CE04B9504A67CBC6B35BA0D443CAA60EE760DC6C7B4907EE92DC5F2EA8156CB5738F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\OpenCL.dll
- Size 539KB
- SHA256 7837ff537a68f27dc0f50ea399b6befc012d29ed8eea178851c3b61838c81f69
- MD5 89c9f5e2d8d43f108b83c11f935dbb07
- SHA1 0552887e60055d4f8de939b936ddbab89f121db0
- SHA512 6f469fc2b2221c1ac55e0329d1d40b10c3b7249c9e5b91b552ae681ee7c113a654145c081b5c67f2a3ea124d4c347b66a7e4974522a930427fe9cae3a4a9289c
- SSDEEP 6144:I0HWVz8CIXMbleTEnjXsTeDvNjRCtzhvh+FoiSfvT2BAHq7N2HfiCPPKsTC2wOae:I0H5hXMleTwNjRCtzhvh+FoiSfvmcide
- TLSH T162C48DA57B6817D2D13BD13DCAC38B5AE87178114721A6CF01E942BE1E13BE46A3F721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\avcodec-61.dll
- Size 17.6MB
- SHA256 6a9c7f5372b98044659a97a6c242ad27eca50313841769bbd29a06825aab4481
- MD5 9a50f1ad4a3485c6c16bc0bf9c34c8aa
- SHA1 d89a7c37ed78a8f645c10d8661066ffadd0fa84d
- SHA512 fcd01022241ab9db58326d2bf603cabafc8b59ecc2205d307697100e06f53f40398cdada3ce2135d28f1c6cb38ee102e2faa7fe8004eb7243f331e01ffbc61f5
- SSDEEP 196608:cDnEAl37qPH9gqwQXbFdrf9OwTG2foZ/OoBT:GW9BwWJl9OwTG2GmmT
- TLSH T1CD178E46F29365EDD66BC1308657EB33F63438E842206F379A84DB702D62FC06E5AB54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\avformat-61.dll
- Size 3.2MB
- SHA256 e719e58c025321ddab1759248d570ce00ff858d46428f89b366a5c63bb2183c7
- MD5 16788186ae923bef088344ece09a5761
- SHA1 b0b5afdcefb6ec50b125d53b7067c44ef43c8557
- SHA512 16c16e6caea6b3aa94e46b40db5257b28cfa3446229bdc5d7a874ff436964fe1b3bafc22ccd7942445848bd80d86698859026f0514e771ebe53268378d254046
- SSDEEP 49152:3g9Hxv0cHo9tjGB5KcpszLMe0zVq1ZGal7BHHg1VNt1P5WkeT5oW8mxQumDB:KH2cHoMqPkuZGaJBHHg1vRDXmxQumDB
- TLSH T152F55B86F29228ACC66BC134435BDB72B734B8A40231BF7F5614DB352E12FD06B99719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\avutil-59.dll
- Size 1.7MB
- SHA256 efc21b241c5b39a5e59abba8e56c92dc6ff8c969c55833404aecd02d671a505d
- MD5 4f63c6eedeff0210fe04c48c42941fc8
- SHA1 0063854cab5d20e785f2bf09366f0131fc947ae0
- SHA512 25cf94c018cea90f9fa148f9f705b9308df527d6735cb98301e2ef9aa55e8f72052b9aa9ec545236c4286f8b5bb53056c92af811eda0690b367ee8b33b2d4b7d
- SSDEEP 49152:3DzBzObZndar9yZ9MD5PzYcZMXTba40e2:fBzOln79MtrUTba40e2
- TLSH T1D4858E41B5D26C9FC626513046DBA7677330709287A1BF2B1AA0AD342E25FD06DCBF36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\driver\audio\x64\Win10\scaudio.inf
- Size 5KB
- SHA256 698aa00020f85cd991d53676097069de8d15578efec07059a40fcc5b5d311c67
- MD5 b152504f2cd40022e424e47045fe966e
- SHA1 5ed34bf64f0f20c4bb99667f06697b208aaff456
- SHA512 8a6731b0177f0479b0492e1988d333b12750442402a6be4833fd60c129fcf88fd22524c8caa1a5b2e7a0e5e665bf7f52f89c943c6b754d35ab9d73c8536fe720
- SSDEEP 96:wGql8wDNdBpxrZuTZJOXrimW04ikEZuTZJXgg2Vgg2EgJgSquM02NIMFgWCXgGU4:wGgNNZiJ2iJXgzVgzH8CgGU4
- TLSH T13EB1DDEA4D5FAD028352C16CF5270FC9DD38A689118B0508B54DF68233EDAD89F5CFA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\driver\video\x64\Win10\splitcam_hd_driver.inf
- Size 4KB
- SHA256 ef0b04d25246467369fdd25414ce76ee1a6e1ac9ffa157f0469303577c5b7da2
- MD5 d9434379f31fd414d4337146e9d059ed
- SHA1 2b2e5921326c5d0a6463e8a1a5b2bc9b2fa13032
- SHA512 bf2559e8f0474b1d214ebaa92a30922026363caba6855670dd9477051905f1503b4b7548c0c5c419d1888b76e9e2cd71a0f7431898fe0f361583469eb7f4cd53
- SSDEEP 96:f4uSH+R2cr4qSZd4XJ7lg67sgO6WCaBPMUZ7tz:f4b3cr4qSZd4XJ7lg67VgPvFtz
- TLSH T19881BAEE2C0B0C74D322C3894D9B8653FB19960D7FEB842835DE441297ED9BD570E4A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\exe\x64\devcon.exe
- Size 79KB
- SHA256 2af417cc08ef6754c8d2f9d82f727e8215e49b5e9a224f32d2535f5b2ceff36e
- MD5 44fa0c8535225bed3b4c173fd9ca8b7d
- SHA1 0dab1bc67c8671fdd12f28e74959e378d19263ff
- SHA512 05bea7b9dbd4a52e5a01c620efa99b1369a3b3e9da36d99600aacc8a78f212ee457db375583a06c0f2c7430a6eaa2a712d5f34c120b26d60cb2c8b52ce68d484
- SSDEEP 1536:wZBiu1fRlQRDhJ2xSe9EejUFc5VdiPFMqO7W/:wrhlQ08wEuAcFiNM3W
- TLSH T18D83B40263E94659F2F37A3469B652355EB7BC91AE38C64D0298911D0FF3E80DC74BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\libaom.dll
- Size 8.3MB
- SHA256 7b1eb4a6a1fcd3a5841dfdbf24bfe2024e97180f997cb2d684ff7e07eebe8388
- MD5 ae4c0e56b514ee9f73c4f3a48b5d08da
- SHA1 cf1c852adbda4fb56484fd6b9f58da773aa4957d
- SHA512 1afd9627d9bf17b13ab38cd6f6753ae57eaa7035d7dfe3853bbc40bb6b545edfec95839ccd7873d2bca64cbaaa91e5be959e7313a2da9744cac6087254ebc7a8
- SSDEEP 98304:PomJgelY95cPInv4kNWlw3bdm2wQ1VPAVElbMTy5dhZdXIKiqXt3xgpZAm:gkgnv2lw3VzV4R/K/y
- TLSH T18F965BDDE2A351ACC617ECB0527DEF63BD28342D41145B6AA7EA4E301623BC06F29F54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\libfdk-aac-2.dll
- Size 1.3MB
- SHA256 a4a33655b52b9dac13e474a80d10874f178658ccb7aefa4236d07aa0b6fc807c
- MD5 3582329950d511a0da12d2423ef887ef
- SHA1 753d0eb1b7ad2f05f68f9085a770cbabb9c176b9
- SHA512 ed7dc850ab901f1d841fda20e8dd22c233c6faab8c111e3e66d69d51f92c4d51544eeafee597af160647754ed2e325ade413c79d6c14250f6c9d222296c5f40c
- SSDEEP 24576:AR4UivgCxii7dDDFLnKHjGK8Bw5h5J9Hllj9XJtcjMbMRcjTrDz8yv5vKyABZceQ:uiYCxii7dDkCK8m5XXHtHMUbz8yVYXck
- TLSH T108558B07E6A3A0ECC52BC170D62B9733F93178254221AD7B9794EB702D17E406B9DB78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\libiconv-2.dll
- Size 1.1MB
- SHA256 cff1653d6768a66b5186585d99b971c09615d5dd72f6526ebc35a8032b59b90a
- MD5 d5ac8eb776e6fef67729a681a0af6586
- SHA1 8cd51642f1f88f6f2df1d866effb7aed5e942e43
- SHA512 390a7bf4b844d363dbc29964678acb15fb537c0bff400d5ce038eace23f54e78a5f4e7558b97189ec79af33799011193f570381ef76df87ab66f4470937973d0
- SSDEEP 24576:3qMOaBAUZLY3wPKo6VbbTiZGavkg3NyeuQ6l9fH+fXFz7:3D/BAUZLYgio6EZGaXBuQQ9eXF
- TLSH T17D35CE51F3D2CB2BF2A3C6B4C9AA5B32E426EC212B0644373664B7BC5D33BA415C8157
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\liblzma-5.dll
- Size 193KB
- SHA256 c68fce4b29b80480fe1e001378a34dcce60c437fa71e96c3d2b6601a2773605c
- MD5 d281db686bb1c1266237b87856ba3472
- SHA1 87c7ad3be36253d803c000a4e7a6dcf097d3fe8b
- SHA512 a89cdf0d43622d8aae66b77963a56d3cb1aa050d2d2fb5fa03e7f7519b49570a4962720141f7ff06ed343cb5639d4b8fb3607b74a073da6e7c2d9edb4eff02e9
- SSDEEP 3072:+wg/Z9ScWpjGiue1DM72zsoRVzMhMndKwJqaf9mNoLfwIFUF35FPq71:8RTKGiuejKwrYOjwGUF35FC71
- TLSH T19A143952E692F4E9E76BC830D5A68F72B5F174150220AD3B5598D33C2E2BF70460DB2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\libva.dll
- Size 279KB
- SHA256 7c57590b235d3ea58c399e7c092ef68941ea96a26cc0bb0005c23331d16098f0
- MD5 981424e14f0ecb2228ebcecaff72ba2b
- SHA1 a0fbc53a6a05b1b584f96d83c9fa8ab08fa18962
- SHA512 46ea98bcbf2a4b99a18a52115702fce2a8721347cb68ec820ae27df2da593487848a867c4beb7593b95fb47d1b1e4afb7bc97bb3237aefbe9e0b6720d3fde0ae
- SSDEEP 6144:FNHFe6ZpTyDkFLy28YKUtwwR2y4sLG879YcjfNqR+i0Xtwj5C6FfN7B:FNYmzgm2D8y21qRUSC6FF7B
- TLSH T1C6543C23976325BAF6A7B37785C6D631743170018350FEAB3AE4CB388901D61DF69E29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\libvpl-2.dll
- Size 465KB
- SHA256 8410671fa0781948c4aa957230ee71bbcf7f71f28ac2ddab1a3a7fc3508905b0
- MD5 38406e92c4e5ead309f79ae5357cce51
- SHA1 1875b9a8ccb39a8e583665a91f5c5a202ae32688
- SHA512 a3e1c8b620ca50fd1e29b75dc5c08d248551c6ea536ab5eae64ba60db576e2b1b3adab6649d35a55fedad16cc4868d8644197cf7717368a9acbd02a2d9dad33a
- SSDEEP 12288:9//0LI9Ia5ttRBfeXTCtppyZzyX18ERfSgL7:h1l75pyEX18mfSgL7
- TLSH T10EA42817E16325FCC1BFD17582965777BA32B8184131BEAF63A4CB321B52FA09329718
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\libvpx-1.dll
- Size 3.8MB
- SHA256 33543a2948ac3ca1dccfae45e77ade2f2fb40fc92e033595d82fb32e97e1b26d
- MD5 73bce4115f541965563b12a0df1c57d9
- SHA1 e319f9746b52a61b68b1134161635f73508ee4fc
- SHA512 2762b490e9e68d1b72c4952875cd789b9632471ae82b7f46ea9ae25b649eb1d5f95472504c50689387e6b0b017f3655d87923e5b3e4cf7728f65f7df756aafc1
- SSDEEP 49152:ZlTVnBm164/dtEHuKD6uHcg06lD2XUvBjfmVBcco4fz2j80ToEs5nuSx:ZxeVdtCXBrmVwMvgSnuSx
- TLSH T1DE065CDDE27391B8C90BEC70563DAB63F92C345E40245B6A4BE98B700672FC46B19F64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\libx264-164.dll
- Size 1.9MB
- SHA256 cf3b8a332aebffe2f240ce9dcd2f50a379661c793bbfc01c7caa6bf9c91750aa
- MD5 65a765dda81dc61057a9453d68bc5f35
- SHA1 d32474a9ec1b0b6e9783f4966f2d251a361d5ac8
- SHA512 450057639221d6f12cebe4f90e93cde2ef01ffceb5428650ad2b56f1d73d2046c502496cb20c3800b37e78c16d4385e153b3f63dcef6f58aae0659bb5e3647b4
- SSDEEP 24576:81p6iwfKejw+FJMvEyCYApHqJ7X4SoGiZTzJvj+UmSrUPHQ+xMPRM5D6+fj7Z:Gp6ZVY/CYAZq7mnx+UmSrUPHQ+igDJfh
- TLSH T1CF959E5AE27361ECC66BC1708B5BEB37F674741841207D7B9A90C7306A72F50235AF2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\res\fusion.theme
- Size 9KB
- SHA256 998fe6c219b396fce7e4fc17204d13e0aaf4b70859ac0cc9335cfe3536e9eeef
- MD5 37a512ffec6edf9bed4bc2c9dbe5dfa5
- SHA1 e4458cd6d4eb799f94377a2f8c73d5a28389d4d8
- SHA512 dba679ff7a7c97d88005d52c5d4c96103e95ca4d8f685c5344b63ff7173cd0e7adbf0925f226dc05d1240af7a82d6c2023459f3daf2bd76f86a6b117a1dc0a97
- SSDEEP 192:CcF6Nd1qRyM77olknlUs1+7bazgGGxLKLaSKzU9ILon:CcF6Nd1qRywus1+7bazgGGZKLapiIcn
- TLSH T1A412F42ECDBB6EAF3BB0F826A5350B549744A30102C5951E72F8FC8ECA73991746103E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\res\preview\miscellaneous\{43419413-4844-4A72-9414-10FBC72FE193}.jpg
- Size 168KB
- SHA256 0db20f4623e3e07f233a6033483a7e1cfc3a40678aebfb57c763172026328a22
- MD5 e30397606667c7cf023efefb6d056c3d
- SHA1 2db7f806e6312be1c80086fbd5ab6d820307a03e
- SHA512 fef2571a30adecf5246e35eb9126369e4379638953d629f747315e44a9aaaab77fabeb1bae8c415bede8dd75c6db57f7ce2c855d5e66d098cc2a77ec5b44a848
- SSDEEP 3072:wRq3qwsLdMEyRhqmkxlZ5Wkf7waxGKc3KKdWiLcBxATuh5TMrp6/CBNdql6VwGYp:YG6qThkp51PxnyKCcp7Ql6/CBNdnK
- TLSH T101F3126ECF5C5B24E0EECB3907F0BF04CA5AAC61D3433686B1A6AD188BDD70658551CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\res\preview\miscellaneous\{64D8FF44-04D8-4BDE-BC6A-48B0BEAFAE51}.jpg
- Size 119KB
- SHA256 99fbbf274509a95e3e84c36dde61ef9fce5c417904adb57d299135e8d2dbabf1
- MD5 10814297dc8a1160c1ea3bec27fc2396
- SHA1 907861eb7fdc4ea824b5b451339f1693a89d2044
- SHA512 9decbf081dae2af1c1434a68e59591d328504d86df7d5bce131d2cd872344e66d0cf2ca6316e078445a72a15e3eb72935f742363c61c717b653afc3d62e6f5eb
- SSDEEP 3072:wx1RL2rytliIivhGd6sAZcATY0x0dOSDpGF:W2+xg4d6sA5Z4E
- TLSH T105C3021A7D5A1679C2BDF23024A2FF4C7AF6DB2AAE035389C2A0F15466274C5348F5D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\res\preview\miscellaneous\{E4F22DF0-BED9-4B8D-A9AD-137C5C7D53D0}.jpg
- Size 33KB
- SHA256 b6e897dbe8e8e1eae71e6036fa5bf757a1bf205e93f6164161538665307bc4af
- MD5 8d3df3dd169bc609cc9ae07a113aae47
- SHA1 4779e1cec862692afaf5e864b067f709402da11e
- SHA512 515e1ec0901e6f9d67127d210ae074f3bc32b18be8dca83b6d3ca0c67ca1cc9f727d30c3fedd5337e9d8afe9afe9868add03501e6d544734de4a00fa0ca22834
- SSDEEP 384:2JYRrrvOnug9Imf2rov+/TyfGkBI87ILs1zFXwY02zfz9ybkrk8xUYEuf7HEjik+:qqrv/eLWiI0zFAY02zb9U+k8xU3uzmUD
- TLSH T1BDE2BF33554B6ADAC2BDB1F304F74B705E2290505D7B5A03E2949C2EAFA97C62CB3C05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\res\virtualcam.dll
- Size 389KB
- SHA256 3a11ed3f402369876df45ecca63e4504be1069e1e8a2e7bc62f7ebbc44bbc07d
- MD5 a5e2ca325c8b5fb1d641103c13fb2802
- SHA1 ebe364c66cc3123651818f95a71b1fe24433a14b
- SHA512 d1553dcb79f696eb2944a466f02717891f520eaa63e2cc43ee9fb0b4b669e4589df55b63c3b1d3de7ce8494488bc8fe36aa8f8923b4792450c508dc18d2d167c
- SSDEEP 12288:bDojnupZ2/r1J+4ViEuMOmWSjUjAb2pEwGFdfV4:Qr1JnuMOB2UEb2pmVV4
- TLSH T1BE846C82F6E2D132D99F08306829DB7B59797A614B28C1F7B3D49E3F59312C15A30F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\res\virtualcam_x64.dll
- Size 520KB
- SHA256 9b50a9a8c497d094d513895b508286ee129eea6f34c5f5d827ed491f9add3673
- MD5 cba08372e79121d0b77e6e09e72c0d31
- SHA1 1aba72f5f513e115ddd88fb35292f166863a9beb
- SHA512 638b2cee8ba9a00591728c8a1d72aef7e6f0aa01f12fb50c1bba87bf4f01fc9cdfa77ce605f61e04c072edfff51779049559bd4bea122031efe8d4a66a35b3e8
- SSDEEP 12288:O0Uw3jZbl99hcvyCb55yCW27pZNNfoM3Vg:ZFcvyCXyn27ncqVg
- TLSH T191B47C57F2B523A8E1AB843486674707FB767C49532097EB13D087761F23BE09939B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\setup.exe
- Size 470KB
- SHA256 a41457cec3e5e168151fbeb36c90a103295f1f238d554dd1a22af5c1382c33ff
- MD5 20463ac95f5d53de56bcc29669bdac3f
- SHA1 eb345cef26616ff57ade152ad207afe050227418
- SHA512 b5f5e898f2c536e3c0d72e1c49d28b13b8964e6746990c527832c68fe7f20f20cc107147774d4462db9fd7b9171e4ca19554955b134e0269e883dc55e59d831e
- SSDEEP 6144:7m6WcfGPibGpb5DPYhmoKmph0lhSMXlBXBWHAQGHmx74olXVSq:775fGPiifDVoTph0lhSMXlCAQpdVSq
- TLSH T133A41513A6DDBCE2D07502B06BBB8BE4D72EED504791D5CF63D409A5893C1837632B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\swresample-5.dll
- Size 243KB
- SHA256 ef3f64365a5c4e4a1cb00393862b151e8f7cb9cf5dbed9f942499ea309aac987
- MD5 f7ee64f540276b20b3b4ac639a1b3111
- SHA1 4b8573483fbe29b2cb631adfe4f37cacacc8a2ea
- SHA512 feedac4d69cfcbdb72d247c23f23be6b93cef0d3fbbdf20efd7a4a6be3ab43437617b5ef15ff05e5ea93b81dd3b71c365c7f2f9619dbee185c8c9954287e477f
- SSDEEP 3072:a85lG9lHhvrkttjBQSIFl/o9ZMEVWst8cuAoHxtQ2F:a85lG9VhvQtX8QMCutHxtQ2F
- TLSH T1C0343B96F6826CAFC7275130859B9B317334B6E403E62F274CA496381C17BC0AE96F57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SplitCam\10\swscale-8.dll
- Size 910KB
- SHA256 b849cb4955e436bba8b3b8b22e2eec0287d77919a93664bc35caaa2b2cf2bbca
- MD5 fcba92f543a34936352e3ef16cf4e727
- SHA1 7a19974d36aecf3f5d50e0a4cc38e0fb20ecddd5
- SHA512 3520329dba8a1a1fed3394a1ec9b741e2ee6e53aaa640068bf8ae3af93bb3b2ec3086a85f0d6c5fbe7250780e63f0779360e054fe89e631dca9471db5272976a
- SSDEEP 24576:wDcRlDcHpYz/AmyfBesoQTIb+8nCP/yRqDY+QThuYXToW4z7FhmUzxNgcqFWNK:GP/yRqDY+QhuYXTX4z7FhmUzxNgcqFF
- TLSH T164154A97E2537DEECA5B46308196CF227634786402A64F2B9E80E6353C23FC05F5BB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_D1CDB3AB4B9AE970AA3A4BEBFD057F5A
- Size 1KB
- SHA256 7bddaf1d2e6f8ae903d5ee536b6692435fc315d3eb9e0d9cb526891cd7efb915
- MD5 213efe9f4299cf435767ad1b36a2367c
- SHA1 a7e1e930359e3a1ee72bdee0498284e6c75ee5ff
- SHA512 ad337726975fa51a2fa96a92c656fae98b73b48c8372e302b88cc3430717988796832d0b17065a4ce2ee4f6f325c1afddb0027fb88ce9b67708ba162952bc28b
- TLSH T14931FA99121C18D26AD68F544DCA95162D2971F12FAC906650378136B6003E36BB941E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 1KB
- SHA256 744e8c3d8ac7233db43733484a09d0b201233fc71e6825671f9b168fd228de99
- MD5 4e0ece9da3134b89711b8c18f1ff7600
- SHA1 92de8f2e0b0537fbb89ed0e37ece119b2c5e32f9
- SHA512 4f1035a9b73661207d44d961d557c67946b86bf9920d01326ff158bd5b07fe7dbb7413fc26137beef6f1f763eb151f14d41853c1b0a4383a0cfdc0d7e7eab11a
- TLSH T14D31B68B45241A1699119DE224D4C7377EF1D2A05E8E740076ABC15B688C7F73FA898D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_D1CDB3AB4B9AE970AA3A4BEBFD057F5A
- Size 536B
- SHA256 fbe1472fb91d222e5612f578ae4d84d281812e86c280307e4841fcf6fd5f0348
- MD5 02b00f1ed316f7cc13f8c3738f09f454
- SHA1 cb89a6350ba07ed4d7fe1f76a5641ce46003873f
- SHA512 768b851e6ddd756ff111c8b0368dbb398dd38fe44538b18a521cd1a402088448b6a776aa532db4e878d2210467b0405bec8424910d146f71a093a378bbd451d4
- TLSH T126F09E3416FA111FF232DB740EF071968D05FA131C369E4E09ED43057512E005D83A79
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 536B
- SHA256 ab14ae5d45acfd8016bb3405f42766f508857f3e0890487fdb4ac1977067f9b8
- MD5 393dcf5f1c144813dd5328433f6a6996
- SHA1 655b93537fc9da656b12df96daf4928dcd1502e9
- SHA512 4fface1f092dfc1378fe076c7d81e9a8a9db50843de1dc2319dab7f56580c9db31cf9323cae1494b4ffa671c8898bdf3ecc202299d623a5ce26113e41f81e170
- TLSH T114F0971C0EF9023DF0B1CE7C09F96552C929F8022C625B6A12950B5E2922F009C2342E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{30058EB0-CD50-4958-8B22-D1897E502994}\_EF06DBBE38DB1CC66298DE.exe
- Size 34KB
- SHA256 8cfa25fb8f1df5352923ac341ca8e2f9530081e8fd1c6aa333d97a43e73210f2
- MD5 4dc628cc7388d9dff9f16935edb4b2ed
- SHA1 d8f3b8ef6ad14bc159288102fde52a88c1c986ac
- SHA512 990e34e24aaf34f106d0263a68d5a7efa804fd065077a1932955220bfbae2a15376f7e9a3ade12505fbad40bd19c84616a05207bcbd90a6f161699284e0b7125
- SSDEEP 768:o1uus0ML5V/I+tWdgfzf0M/ezPp/iDTw/uv6h:og3NL57tWdgrfXWp/iDT4uyh
- TLSH T1F3F29327268ABB4DD64F39728AD50DB9C6D2ECB281D5114B1FC33B1F39712ADC305A89
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_media.PNF
- Size 12KB
- SHA256 feedfdacbcff878dd0f877736f880b045941e25cd3c4013357d4e2a293a1e7d8
- MD5 d6f787534eea52824abfef940379b071
- SHA1 b200fb5e314de41c743ac84fc973584dee668946
- SHA512 7ba2d3f0858a5aea61486ba8eb96fed621384258b5055e97a314d9cde71081545d881059d9bcd5bce4f5cb2d7cc341090d2cc419cac44302708b8bef17e4beca
- SSDEEP 96:QyOzh59kjf3WSkEFRcpXyY3q0xPOQlf88GcNy1/HC3T6gYq2hwyvVATCG5qylmqG:o0f3woapXQXQ1HNogE3lJSZmXx7p
- TLSH T197427C56B7D9C919F1BA8E70EDF851D948B57C821D01CE1F3168B34E1872E84EBB072A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 40KB
- SHA256 e3ca107e73e15a7348ca1dc74d8054e520c67c9ace21cf97c718285fd2e0ddeb
- MD5 7dad7565d8b541cb113c7f0f574206a6
- SHA1 dcaed70ec73282c1545a40ae91334a4adf763100
- SHA512 635c1ba082718de1b49d8b4a625bf143e78c281a14e7c5eaf0b883cd793682d25a354d8e1defee1a63a8227fb974edc02f44b35e61bd603a08ab8e40f8212aa0
- SSDEEP 768:++KndMzRkgirUcbUR9h4bIlLBFARbiNvOaw96g:++KndekgirUcbUR9hWUBFARbiNvOaw9H
- TLSH T1F9136A05D1E8C890C5F509727B7ADEB0C8DF85C6B70F6EE530AC63149ACBB042EB655A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 a102e533be589e7b2875030e74832443bebc33a1a9e1db48c38b6f601997df06
- MD5 4bca1d93e5dfb93679e3ad21e8486dae
- SHA1 8433b61f5be92a364ac9d856cafb37469bb3130f
- SHA512 e2a86bc4877677bb7d3fef02d163c50d8343206121b03a6ba545191d88d786dd53264aa974b8220a405a4f643bef80d37c1ab7dfecd078e3e9db659f1ada6dff
- SSDEEP 24576:Xu8m+1z7doO/vvTLbW0ORG6A1d0zMlUyYymt2r1VsUqVuzN54/19sSvBh:P
- TLSH T19047B62436F92101E7F7AE3CB8F0AA234D3A7D579C19DE8D45411B4E0921BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{1143f8f6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{365f5db1-ba5b-4596-97d4-7b0086ca39b6}_OnDiskSnapshotProp
- Size 6KB
- SHA256 0e68a1e33455979e86268d751544a9022366198e4e581942065d0af3f8357c76
- MD5 f5d6f7726d2c930c91a6057fd17dcbff
- SHA1 9358cb0df06d3878b0b23a9d61d425a3296f5623
- SHA512 042331276cc09831d4ca0adc8653c9cfe62bac680272643a3317b60b5d460b91d2ce652f55fc4c150aecbd6baf823e29f224ee0ed93932a7bd24d76b04009421
- SSDEEP 96:FcDqvvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Sib++ZVmN
- TLSH T15CD18A085AF54711E2B3AB7228F18557A877B911EF33CB8E0298238E6670910F975F5F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\PROGRA~1\splitcam\10\driver\audio\x64\win10\scaudio.sys
- Size 53KB
- SHA256 9da7de37a004c5c40869b999f571d1a53692db4f3e9b33361aad76e6b8e1f02c
- MD5 67ac706309f8b7e4547e66d63e61c32b
- SHA1 66d603a28fb1f36f1d2dfbb9ff301f41f21b5ea2
- SHA512 d84dd38a7690b6559310c4d3da6c481cbe56654820aa3b00a715b9826e28d0e59826d361744e79da4c78ca49e56efbfe8e707ebf12876fd79ed37c4fdc90ed4b
- SSDEEP 768:Us12UMoYjxiTXtcMc+f5Ri+T+R2nbF5AriXiROR3Ri/B3ic:hxFx6WXi8RhiV
- TLSH T11E336B976B7414C1DAA68574C2D9DA5BFFB4F1822B9203CF0125E29A1F537C1AE3832D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\PROGRA~1\splitcam\10\driver\video\x64\win10\splitcam_hd_driver.sys
- Size 48KB
- SHA256 191946f74e4cf34d04baa9a79f3a387eda13056123afe0c971a5409369c8fa77
- MD5 3fcbb009c8e021a340a4a7acc0cedfc8
- SHA1 3ac328f775993da508154d1b505c64c86bff640d
- SHA512 687b7988e787e1630857e1a0a1d9ca78f62825c43d8e2342840902b6fa54d1a98c4def27bb8aee4eaecd97d9668d429227f950cbd4e572048e08c2251e71d406
- SSDEEP 768:/GN66yHoMk1p2fA/i2lcm9p9E+8iROASt3+hQ:/GN66soMk1EmJt9Q+8iAAStR
- TLSH T1C0234B89BB8458D3CD765470C86D9796FE70F98A2F8187E32624E31D1E933C16B680B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files\splitcam\10\driver\audio\x64\win10\scaudio.cat
- Size 10KB
- SHA256 80533957e3ec48068887c2528213bbe4ff1e2fe35e53591886b546da2532ed57
- MD5 a6d915e269976a4364fdc38bc512c3eb
- SHA1 fc94a97a8673f7b6751438c385002107ca8d8dfa
- SHA512 8258b1aa3d91d2e91b14ea9ffc6213fecff9cf736f42db717ed96d7245bd8ed7d3879b46b68c1363ef144129073d6dc26c7bd5f3efbabe8ff3b6ec3c43dcb76f
- SSDEEP 192:agDg50g92g8JCIo2XKEwfVhYCz/nT5m2OzpqnajKo0:Fi2WVh3z/9mppluo0
- TLSH T1B4222AA149B84483E9A37C6053D4F9A37C3DB3CB1C6046AA259FF6590D8B3C4E70562E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files\splitcam\10\driver\video\x64\win10\splitcam_hd_driver.cat
- Size 10KB
- SHA256 4c1cadb66eb75a1d3c5bf2e3fad989d7974ba9febd5761f95e6b3417f5ee79d7
- MD5 de95a9da1f5d248b81e63fa11ac8ec91
- SHA1 f8b7454ea713d804c51bbb696260ae881811534e
- SHA512 736a76339e2d24296b2404f47aa96dc735880c426eb710c26f07fbbe5625327ba867d176e3f2835e38a78c85c3fcd8df87a9147ffaa8faac49ed68dabc382eb4
- SSDEEP 192:wuymIMJCSngEw9JPgXkhYCCgQLCamylqnajoUsXX:9/7uLh3CgQ3Jll83XX
- TLSH T11422F8A24A6C4083FEA3BC2047E8F8977D3CB3CB685045A9146FF6294DA37C5EB0552D
- MD5 SHA1 SHA512 SSDEEP TLSH