hxxps://github[.]com/Batlez/CloakBox/releases/download/5/CloakBox[.]zip

Analysis

user interaction
yes
max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Batlez/CloakBox/releases/download/5/CloakBox.zip
Sample260820-ew6b3asvbw

Score

8^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Drops file in Drivers directory 18 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\SETFF17.tmp	DrvInst.exe
File created	C:\Windows\system32\DRIVERS\SET273.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET2F41.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxNetLwf.sys	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET31C3.tmp	MsiExec.exe
File opened for modification	C:\Windows\System32\drivers\AtdtSup.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETFA54.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETFA54.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\AtdtSup.sys	MsiExec.exe
File opened for modification	C:\Windows\System32\drivers\SETFF17.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\AtdtUSBMon.sys	MsiExec.exe
File created	C:\Windows\System32\drivers\SETF340.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\AtdtUSBMon.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET273.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET2F41.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET31C3.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxNetAdp6.sys	MsiExec.exe
File opened for modification	C:\Windows\System32\drivers\SETF340.tmp	DrvInst.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
5656	VBoxSDS.exe

Loads dropped DLL 22 IoCs

pid	Process
4260	MsiExec.exe
4260	MsiExec.exe
4260	MsiExec.exe
4260	MsiExec.exe
2396	MsiExec.exe
2396	MsiExec.exe
2396	MsiExec.exe
2396	MsiExec.exe
2396	MsiExec.exe
2112	MsiExec.exe
2112	MsiExec.exe
2112	MsiExec.exe
2112	MsiExec.exe
2112	MsiExec.exe
2112	MsiExec.exe
2112	MsiExec.exe
5656	VBoxSDS.exe
2112	MsiExec.exe
2112	MsiExec.exe
5656	VBoxSDS.exe
2112	MsiExec.exe
2396	MsiExec.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runas	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\ = "Run as Vektor T13"	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	CloakBox.exe
File opened (read-only)	\??\X:	CloakBox.exe
File opened (read-only)	\??\Z:	CloakBox.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	CloakBox.exe
File opened (read-only)	\??\H:	CloakBox.exe
File opened (read-only)	\??\L:	CloakBox.exe
File opened (read-only)	\??\N:	CloakBox.exe
File opened (read-only)	\??\Q:	CloakBox.exe
File opened (read-only)	\??\S:	CloakBox.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	CloakBox.exe
File opened (read-only)	\??\T:	CloakBox.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	CloakBox.exe
File opened (read-only)	\??\P:	CloakBox.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	CloakBox.exe
File opened (read-only)	\??\M:	CloakBox.exe
File opened (read-only)	\??\V:	CloakBox.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	CloakBox.exe
File opened (read-only)	\??\W:	CloakBox.exe
File opened (read-only)	\??\Y:	CloakBox.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	CloakBox.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	CloakBox.exe
File opened (read-only)	\??\K:	CloakBox.exe
File opened (read-only)	\??\U:	CloakBox.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{13626dc0-9636-c243-9cb4-a1a3c142d4b0}\AtdtUSBMon.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9855768fcc4a8263\VBoxNetLwf.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{f7e266d1-6862-324a-b94d-361c1466be69}\SETFC78.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f7e266d1-6862-324a-b94d-361c1466be69}\AtdtUSB.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{13626dc0-9636-c243-9cb4-a1a3c142d4b0}\AtdtUSBMon.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtusbmon.inf_amd64_72b98e32227e1b67\AtdtUSBMon.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ba56493e-bc4c-7f4a-aaed-e74ec06741c3}\VBoxNetLwf.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_15909adfa959bbd7\VBoxNetAdp6.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtsup.inf_amd64_c513e5dcdc45a303\AtdtSup.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtsup.inf_amd64_c513e5dcdc45a303\AtdtSup.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f7e266d1-6862-324a-b94d-361c1466be69}\SETFC89.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ba56493e-bc4c-7f4a-aaed-e74ec06741c3}\VBoxNetLwf.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_c5e19aab2305f37f\netvwififlt.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{667609d0-6515-db4f-a316-a734ed1fc745}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4d9a9943-2b49-0e4f-b274-24820c929958}\AtdtSup.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4d9a9943-2b49-0e4f-b274-24820c929958}\AtdtSup.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{f7e266d1-6862-324a-b94d-361c1466be69}\SETFC89.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ba56493e-bc4c-7f4a-aaed-e74ec06741c3}\SET2C13.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_0dc913ad00b14824\netnb.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\wfpcapture.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4d9a9943-2b49-0e4f-b274-24820c929958}\AtdtSup.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4d9a9943-2b49-0e4f-b274-24820c929958}\SETEF98.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f7e266d1-6862-324a-b94d-361c1466be69}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{13626dc0-9636-c243-9cb4-a1a3c142d4b0}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9855768fcc4a8263\VBoxNetLwf.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_a2bfd066656fe297\netnwifi.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{667609d0-6515-db4f-a316-a734ed1fc745}\SET3039.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{667609d0-6515-db4f-a316-a734ed1fc745}\VBoxNetAdp6.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4d9a9943-2b49-0e4f-b274-24820c929958}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f7e266d1-6862-324a-b94d-361c1466be69}\AtdtUSB.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{13626dc0-9636-c243-9cb4-a1a3c142d4b0}\SETFE0D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{13626dc0-9636-c243-9cb4-a1a3c142d4b0}\AtdtUSBMon.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{667609d0-6515-db4f-a316-a734ed1fc745}\SET303B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4d9a9943-2b49-0e4f-b274-24820c929958}\SETEF97.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{f7e266d1-6862-324a-b94d-361c1466be69}\SETFC77.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{13626dc0-9636-c243-9cb4-a1a3c142d4b0}\SETFE3E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{667609d0-6515-db4f-a316-a734ed1fc745}\SET303A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{667609d0-6515-db4f-a316-a734ed1fc745}\VBoxNetAdp6.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f7e266d1-6862-324a-b94d-361c1466be69}\AtdtUSB.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtusbmon.inf_amd64_72b98e32227e1b67\AtdtUSBMon.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ba56493e-bc4c-7f4a-aaed-e74ec06741c3}\SET2C12.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_7d294c7fa012d315\netpacer.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9855768fcc4a8263\vboxnetlwf.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_9ab9cf10857f7349\c_netservice.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_7f701cb29b5389d3\netrass.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_15909adfa959bbd7\VBoxNetAdp6.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ba56493e-bc4c-7f4a-aaed-e74ec06741c3}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\netbrdg.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtsup.inf_amd64_c513e5dcdc45a303\AtdtSup.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f7e266d1-6862-324a-b94d-361c1466be69}\SETFC77.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ba56493e-bc4c-7f4a-aaed-e74ec06741c3}\SET2C13.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ba56493e-bc4c-7f4a-aaed-e74ec06741c3}\SET2C14.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_a009d240f9b4a192\ndiscap.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_73adce5afe861093\netserv.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{667609d0-6515-db4f-a316-a734ed1fc745}\SET3039.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f7e266d1-6862-324a-b94d-361c1466be69}\SETFC78.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9855768fcc4a8263\VBoxNetLwf.inf	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_nl.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_da.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_es.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_hr_HR.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_sl.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_ko.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_lt.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_th.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\ol9_ks.cfg	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxNetNAT.exe	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_ca.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_da.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_es.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_fr.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_th.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_eu.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_el.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_tr.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_de.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_it.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\Qt6Sql.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxBugReport.exe	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxNetDHCP.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_cs.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_lt.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\redhat_postinstall.sh	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\drivers\USB\filter\AtdtUSBMon.sys	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxRT.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_fr.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\ol_postinstall.sh	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\ubuntu_preseed.cfg	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\drivers\network\netlwf\VBoxNetLwf.cat	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\License_en_US.rtf	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VirtualBox_70px.png	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_en.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_ru.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_tr.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\DriverUpdaterCD.iso	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxDD2.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\os2_util.exe	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\drivers\USB\filter\AtdtUSBMon.inf	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxNetNAT.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_pl.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\platforms\qminimal.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\platforms\qwindows.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\drivers\USB\device\AtdtUSB.cat	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxAuthSimple.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxHeadless.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\dtrace\lib\amd64\cpumctx.d	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\dtrace\testcase\amd64\vbox-vm-struct-test.d	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\win_postinstall.cmd	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\x86\VBoxCAPI-x86.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\drivers\atdtsup\AtdtSup.cat	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\Qt6PrintSupport.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxAutostartSvc.exe	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxDDU.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxSVC.exe	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\vbox-img.exe	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\debian_preseed.cfg	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_fa.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_ja.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxGuestControlSvc.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxDragAndDropSvc.dll	msiexec.exe

Drops file in Windows directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIFB87.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59acff.msi	msiexec.exe
File created	C:\Windows\INF\oem1.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIFD6C.tmp	msiexec.exe
File created	C:\Windows\inf\oem7.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI36F0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDEB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{562E2E1E-5C55-4502-B230-738EE218D753}	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIFACA.tmp	msiexec.exe
File created	C:\Windows\Installer\{562E2E1E-5C55-4502-B230-738EE218D753}\IconVirtualBox	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD10.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE174.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2EC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC33.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC92.tmp	msiexec.exe
File created	C:\Windows\INF\oem0.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIEDD9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{562E2E1E-5C55-4502-B230-738EE218D753}\IconVirtualBox	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B55.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem6.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem7.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3009.tmp	msiexec.exe
File created	C:\Windows\Installer\e59acff.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB86.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE106.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e59ad01.msi	msiexec.exe
File created	C:\Windows\inf\oem6.inf	DrvInst.exe
File created	C:\Windows\INF\oem6.PNF	MsiExec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\INF\oem4.PNF	MsiExec.exe
File opened for modification	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2B25.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC57E.tmp	msiexec.exe
File created	C:\Windows\INF\oem2.PNF	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CloakBox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5332	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000041efd9123c6b0a670000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000041efd9120000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090041efd912000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a41efd912000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d41efd912000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5094F67A-8084-11E9-B185-DBE296E54799}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{327E3C00-EE61-462F-AED3-0DFF6CBF9904}\NumMethods\ = "16"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\progId_VirtualBox.Shell.vbox\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6F302674-C927-11E7-B788-33C248E71FC7}\TypeLib	VBoxSDS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4376693C-CF37-453B-9289-3B0F521CAF27}\ = "IStateChangedEvent"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D7B98D2B-30E8-447E-99CB-E31BECAE6AE4}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{59A235AC-2F1A-4D6C-81FC-E3FA843F49AE}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{67099191-32E7-4F6C-85EE-422304C71B90}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6CC49055-DAD4-4496-85CF-3F76BCB3B5FA}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{86A98347-7619-41AA-AECE-B21AC5C1A7E6}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB3A9E6-7F29-4AAE-A627-5A282C83092C}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50C97996-9CF8-417F-BD79-1E0471367CD3}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{39B4E759-1EC0-4C0F-857F-FBE2A737A256}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEA3EF5C-DE2F-4B74-AA3A-15D6249371A0}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A06FD66A-3188-4C8C-8756-1395E8CB691C}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B14290AD-CD54-400C-B858-797BCB82570E}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD3E2654-A161-41F1-B583-4892F4A9D5D5}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C984D15F-E191-400B-840E-970F3DAD7296}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{CADEF0A2-A1A9-4AC2-8E80-C049AF69DAC8}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{4E774BBE-5285-4517-8D34-21260633C513}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DCC633F-7B03-4F0A-9F40-7A784DD0835A}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{A0BAD6DF-D612-47D3-89D4-DB3992533948}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DFE56449-6989-4002-80CF-3607F377D40C}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{890ED3DC-CC19-43FA-8EBF-BAECB6B9EC87}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.vdi	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5155BFD3-7BA7-45A8-B26D-C91AE3754E37}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A06253A7-DCD2-44E3-8689-9C9C4B6B6234}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B66349B5-3534-4239-B2DE-8E1535D94C0B}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2405F0E5-6588-40A3-9B0A-68C05BA52C4B}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{A3D2799E-D3AD-4F73-91EF-7D839689F6D6}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{714A3EEF-799A-4489-86CD-FE8E45B2FF8E}\NumMethods	VBoxSDS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5}\TypeLib	VBoxSDS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{806DA61B-6679-422A-B629-51B06B0C6D93}\TypeLib	VBoxSDS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E578BB9C-E88D-416B-BB45-08A4E7A5B463}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{081FC833-C6FA-430E-6020-6A505D086387}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{35CF4B3F-4453-4F3E-C9B8-5686939C80B6}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E578BB9C-E88D-416B-BB45-08A4E7A5B463}\NumMethods\ = "14"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{f05d7e60-1bcf-4218-9807-04e036cc70f1}	VBoxSDS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0447716-FF5A-4795-B57A-ECD5FFFA18A4}\TypeLib	VBoxSDS.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{69BFB134-80F6-4266-8E20-16371F68FA25}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83795A4C-FCE1-11EA-8A17-636028AE0BE2}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A5BBDB7D-8CE7-469F-A4C2-6476F581FF72}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B79DE686-EABD-4FA6-960A-F1756C99EA1C}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{806DA61B-6679-422A-B629-51B06B0C6D93}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{89A63ACE-0C65-11EA-AD23-0FF257C71A7F}\NumMethods\ = "16"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0447716-FF5A-4795-B57A-ECD5FFFA18A4}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D5ABC823-04D0-4DB6-8D66-DC2F033120E1}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0FE2DA40-5637-472A-9736-72019EABD7DE}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{13EE6EB4-06FE-406B-AD69-F6E08B0587A3}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52F40B16-520E-473F-9428-3E69B0D915C3}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CAC21692-7997-4595-A731-3A509DB604E5}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{081FC833-C6FA-430E-6020-6A505D086387}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CA2ADBA-8F30-401B-A8CD-FE31DBE839C0}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{788B87DF-7708-444B-9EEF-C116CE423D39}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DEDFB5D9-4C1B-EDF7-FDF3-C1BE6827DC28}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D510820-A678-4730-A862-818DCD3FBED0}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FB220201-2FD3-47E2-A5DC-2C2431D833CC}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D78374E9-486E-472F-481B-969746AF2480}\NumMethods	VBoxSDS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00F4A8DC-0002-4B81-0077-1DCB004571BA}\TypeLib	VBoxSDS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB000A0E-2079-4F47-BBCC-C6B28A4E50DF}\TypeLib	VBoxSDS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3890B2C8-604D-11E9-92D3-53CB473DB9FB}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\VirtualBox.VirtualBox\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32\ = "\"C:\\Program Files\\Vektor T13\\VirtualBox\\VBoxSVC.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4680B2DE-8690-11E9-B83D-5719E53CF1DE}\NumMethods\ = "52"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5228	msiexec.exe
5228	msiexec.exe
5424	msedge.exe
5424	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3532	CloakBox.exe
Token: SeIncreaseQuotaPrivilege	3532	CloakBox.exe
Token: SeSecurityPrivilege	5228	msiexec.exe
Token: SeCreateTokenPrivilege	3532	CloakBox.exe
Token: SeAssignPrimaryTokenPrivilege	3532	CloakBox.exe
Token: SeLockMemoryPrivilege	3532	CloakBox.exe
Token: SeIncreaseQuotaPrivilege	3532	CloakBox.exe
Token: SeMachineAccountPrivilege	3532	CloakBox.exe
Token: SeTcbPrivilege	3532	CloakBox.exe
Token: SeSecurityPrivilege	3532	CloakBox.exe
Token: SeTakeOwnershipPrivilege	3532	CloakBox.exe
Token: SeLoadDriverPrivilege	3532	CloakBox.exe
Token: SeSystemProfilePrivilege	3532	CloakBox.exe
Token: SeSystemtimePrivilege	3532	CloakBox.exe
Token: SeProfSingleProcessPrivilege	3532	CloakBox.exe
Token: SeIncBasePriorityPrivilege	3532	CloakBox.exe
Token: SeCreatePagefilePrivilege	3532	CloakBox.exe
Token: SeCreatePermanentPrivilege	3532	CloakBox.exe
Token: SeBackupPrivilege	3532	CloakBox.exe
Token: SeRestorePrivilege	3532	CloakBox.exe
Token: SeShutdownPrivilege	3532	CloakBox.exe
Token: SeDebugPrivilege	3532	CloakBox.exe
Token: SeAuditPrivilege	3532	CloakBox.exe
Token: SeSystemEnvironmentPrivilege	3532	CloakBox.exe
Token: SeChangeNotifyPrivilege	3532	CloakBox.exe
Token: SeRemoteShutdownPrivilege	3532	CloakBox.exe
Token: SeUndockPrivilege	3532	CloakBox.exe
Token: SeSyncAgentPrivilege	3532	CloakBox.exe
Token: SeEnableDelegationPrivilege	3532	CloakBox.exe
Token: SeManageVolumePrivilege	3532	CloakBox.exe
Token: SeImpersonatePrivilege	3532	CloakBox.exe
Token: SeCreateGlobalPrivilege	3532	CloakBox.exe
Token: SeCreateTokenPrivilege	3532	CloakBox.exe
Token: SeAssignPrimaryTokenPrivilege	3532	CloakBox.exe
Token: SeLockMemoryPrivilege	3532	CloakBox.exe
Token: SeIncreaseQuotaPrivilege	3532	CloakBox.exe
Token: SeMachineAccountPrivilege	3532	CloakBox.exe
Token: SeTcbPrivilege	3532	CloakBox.exe
Token: SeSecurityPrivilege	3532	CloakBox.exe
Token: SeTakeOwnershipPrivilege	3532	CloakBox.exe
Token: SeLoadDriverPrivilege	3532	CloakBox.exe
Token: SeSystemProfilePrivilege	3532	CloakBox.exe
Token: SeSystemtimePrivilege	3532	CloakBox.exe
Token: SeProfSingleProcessPrivilege	3532	CloakBox.exe
Token: SeIncBasePriorityPrivilege	3532	CloakBox.exe
Token: SeCreatePagefilePrivilege	3532	CloakBox.exe
Token: SeCreatePermanentPrivilege	3532	CloakBox.exe
Token: SeBackupPrivilege	3532	CloakBox.exe
Token: SeRestorePrivilege	3532	CloakBox.exe
Token: SeShutdownPrivilege	3532	CloakBox.exe
Token: SeDebugPrivilege	3532	CloakBox.exe
Token: SeAuditPrivilege	3532	CloakBox.exe
Token: SeSystemEnvironmentPrivilege	3532	CloakBox.exe
Token: SeChangeNotifyPrivilege	3532	CloakBox.exe
Token: SeRemoteShutdownPrivilege	3532	CloakBox.exe
Token: SeUndockPrivilege	3532	CloakBox.exe
Token: SeSyncAgentPrivilege	3532	CloakBox.exe
Token: SeEnableDelegationPrivilege	3532	CloakBox.exe
Token: SeManageVolumePrivilege	3532	CloakBox.exe
Token: SeImpersonatePrivilege	3532	CloakBox.exe
Token: SeCreateGlobalPrivilege	3532	CloakBox.exe
Token: SeCreateTokenPrivilege	3532	CloakBox.exe
Token: SeAssignPrimaryTokenPrivilege	3532	CloakBox.exe
Token: SeLockMemoryPrivilege	3532	CloakBox.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
3532	CloakBox.exe
3532	CloakBox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 5816	732	msedge.exe	86
PID 732 wrote to memory of 5332	732	msedge.exe	88
PID 732 wrote to memory of 4324	732	msedge.exe	89
PID 732 wrote to memory of 4324	732	msedge.exe	89
PID 732 wrote to memory of 4324	732	msedge.exe	89
PID 732 wrote to memory of 1280	732	msedge.exe	90
PID 732 wrote to memory of 1280	732	msedge.exe	90
PID 732 wrote to memory of 2484	732	msedge.exe	91
PID 732 wrote to memory of 2484	732	msedge.exe	91
PID 732 wrote to memory of 2484	732	msedge.exe	91
PID 732 wrote to memory of 5112	732	msedge.exe	92
PID 732 wrote to memory of 5112	732	msedge.exe	92
PID 732 wrote to memory of 5112	732	msedge.exe	92
PID 732 wrote to memory of 5512	732	msedge.exe	94
PID 732 wrote to memory of 5512	732	msedge.exe	94
PID 732 wrote to memory of 1128	732	msedge.exe	95
PID 732 wrote to memory of 1128	732	msedge.exe	95
PID 732 wrote to memory of 5008	732	msedge.exe	96
PID 732 wrote to memory of 3232	732	msedge.exe	97
PID 732 wrote to memory of 5008	732	msedge.exe	96
PID 732 wrote to memory of 3232	732	msedge.exe	97
PID 732 wrote to memory of 3232	732	msedge.exe	97
PID 732 wrote to memory of 4252	732	msedge.exe	99
PID 732 wrote to memory of 1512	732	msedge.exe	105
PID 732 wrote to memory of 4524	732	msedge.exe	106
PID 732 wrote to memory of 4240	732	msedge.exe	107
PID 732 wrote to memory of 436	732	msedge.exe	110
PID 732 wrote to memory of 436	732	msedge.exe	110
PID 732 wrote to memory of 436	732	msedge.exe	110
PID 732 wrote to memory of 2612	732	msedge.exe	111
PID 732 wrote to memory of 3480	732	msedge.exe	121
PID 732 wrote to memory of 3480	732	msedge.exe	121
PID 732 wrote to memory of 4400	732	msedge.exe	122
PID 732 wrote to memory of 4400	732	msedge.exe	122
PID 5228 wrote to memory of 4260	5228	msiexec.exe	127
PID 5228 wrote to memory of 2892	5228	msiexec.exe	132
PID 5228 wrote to memory of 2396	5228	msiexec.exe	134
PID 5228 wrote to memory of 2112	5228	msiexec.exe	135
PID 3844 wrote to memory of 3360	3844	svchost.exe	137
PID 3844 wrote to memory of 2168	3844	svchost.exe	138
PID 3844 wrote to memory of 3748	3844	svchost.exe	141
PID 3844 wrote to memory of 5220	3844	svchost.exe	142
PID 3844 wrote to memory of 4940	3844	svchost.exe	143
PID 5228 wrote to memory of 5856	5228	msiexec.exe	147
PID 3844 wrote to memory of 3132	3844	svchost.exe	151
PID 732 wrote to memory of 5424	732	msedge.exe	152
PID 3844 wrote to memory of 4612	3844	svchost.exe	153

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Batlez/CloakBox/releases/download/5/CloakBox.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff8c95ec188,0x7ff8c95ec194,0x7ff8c95ec1a0
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,7328756487042163433,4254305235309014991,524288 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,15641258842140545025,6626699027661970158,262144 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,16064092936914388020,422757605659780466,524288 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,11718855260617891414,6825171450762880710,2097152 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,8976674445112463610,9665211003826247995,2097152 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,8353884834993984520,6081019953950655352,524288 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,16765365888886982340,1673196461245135945,524288 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,4194737852851621863,9581863388343520700,524288 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5652,i,9858578343145197737,7527208620823373639,2097152 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,6367591765042064239,437421565203088715,524288 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,6367591765042064239,437421565203088715,524288 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,18413314420147082355,3740426832140667532,524288 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,9308128665625675824,17612980080216843592,524288 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,18266058495086650265,11538096181503797536,524288 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3540,i,12765729063061098822,13063875795769109541,2097152 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,12475556384465118887,8917798338156473667,524288 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,15155410725459544313,15300477959655407281,524288 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,13214999299192755884,11201505249528770895,524288 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2488,i,11066008963253497975,13556637073674602244,262144 --field-trial-handle=2960,i,9302342134780517737,14188516702963666405,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:704

C:\Users\Admin\AppData\Local\Temp\Temp1_CloakBox.zip\CloakBox\Installer\CloakBox.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_CloakBox.zip\CloakBox\Installer\CloakBox.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3532

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies system executable filetype association
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9BE6E6C1DB01C74596E39A08C85A85C9 C
  2⤵
  - Loads dropped DLL
  PID:4260
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2892
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7B16A2982E5796B236296899C94ADE12
  2⤵
  - Loads dropped DLL
  PID:2396
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E59B8EA17E38E558F9629B0EB32977BA E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:2112
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DBE9F23846406267B10864020FCE9573 M Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7df438cd-bdaf-fb44-a084-017655c3eff2}\AtdtSup.inf" "9" "414a5fe33" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\Vektor T13\VirtualBox\drivers\atdtsup"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3360
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "14" "C:\Windows\System32\DriverStore\FileRepository\atdtsup.inf_amd64_c513e5dcdc45a303\atdtsup.inf" "0" "414a5fe33" "0000000000000158" "WinSta0\Default"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  PID:2168
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6ce207a5-39df-ee4b-9775-e3b015796789}\AtdtUSB.inf" "9" "43db8d543" "000000000000016C" "WinSta0\Default" "0000000000000168" "208" "C:\Program Files\Vektor T13\VirtualBox\drivers\USB\device"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3748
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{08baca69-2393-7f46-93a2-0b2afede6af5}\AtdtUSBMon.inf" "9" "4f2a93517" "0000000000000168" "WinSta0\Default" "0000000000000148" "208" "C:\Program Files\Vektor T13\VirtualBox\drivers\USB\filter"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5220
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "14" "C:\Windows\System32\DriverStore\FileRepository\atdtusbmon.inf_amd64_72b98e32227e1b67\atdtusbmon.inf" "0" "4f2a93517" "0000000000000148" "WinSta0\Default"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  PID:4940
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Vektor T13\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf" "9" "442d4ec77" "0000000000000160" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files\Vektor T13\VirtualBox\drivers\network\netlwf"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3132
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Vektor T13\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf" "9" "414293377" "000000000000016C" "WinSta0\Default" "00000000000000B8" "208" "C:\Program Files\Vektor T13\VirtualBox\drivers\network\netadp6"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4612

C:\Program Files\Vektor T13\VirtualBox\VBoxSDS.exe
"C:\Program Files\Vektor T13\VirtualBox\VBoxSDS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59ad00.rbs

Path C:\Config.Msi\e59ad00.rbs
Size 749KB
SHA256 006d4b0c15d9bf543be42187a35063d6b9d9c5d5e9441dc5009c9fed5aa405fe
MD5 0adc7355b66071d0705cb318797afd3d
SHA1 b520494d6c9da5f0488972c770f81f06b31333bf
SHA512 beffe58658e92c83c26981d2d4e8f7e09193997918361c57d1dd0a4ebc0e95aa60be9b2c1427b824d21f5463c45e0265b866310754d21bbbd28699911206a3cb
SSDEEP 12288:Sns/xj7dMQBCZCywwvhLlHTlh2bnESXcGmEF/yE/AeA2u95n:pj7CqCZCywwvhhHTlh2bnYG9/+2E
TLSH
T12EF43952745A1AF7DA07517842A38D289FFAA08C0340C18F536D816D6DB7FDE2D78EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AtdtSup.cat

Path C:\PROGRA~1\VEKTOR~1\VIRTUA~1\drivers\atdtsup\AtdtSup.cat
Size 11KB
SHA256 a29dbb04b7ad1951d288ddab0e080b490a3a40f97123917bae683556521ea698
MD5 7210f738138126e1aafe68ac78b76d56
SHA1 563580ef2bc2902ef825323fa200a4a20de63cad
SHA512 6a68073aa476ddd6c61900d174beaab7e013b1b57ea0df836962c8949c76af7d48766fce807cdcd869834282860a821c68976e3bccb9076a6abe9615a754d1ad
SSDEEP 192:w54Uw0TkMbhJCePghXDEwXEhYCkMWXYz1X01k9z3AcWyl2TP2T:Arhiyh3aoJR9zbk0
TLSH
T1CB4218E6956C4082FDA77CA053E8F9933C3927CB9910606536EEE74C1DA33C9E72422D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AtdtSup.sys

Path C:\PROGRA~1\VEKTOR~1\VIRTUA~1\drivers\atdtsup\AtdtSup.sys
Size 1.0MB
SHA256 7ef6f19dc52316675655e66587f6cc3f65ef948ac1b6014ee08fea74170b9fdd
MD5 d30d5a7e6e459d19bc7dfc68a0af5d66
SHA1 0069d8ae93ebd28a2350a6694d9fd616b35e50db
SHA512 3623c25a0f4670ab434f8a2aa98f90df7175b13b29c93d8e17f98e09fa2228ec932bd6c6882b809b20415be44a36597a4a03b6795706bd8be4c8801ed0115676
SSDEEP 12288:3om+ljkJkxRfUnS3H1sHTQCtVektqfIeInBF7wNSAs5FtNy:YmujkJUunmH1fCreuaHInsTmy
TLSH
T150359F8EB6A409F6C5AB8138C2C14626D2B678011760C7EF06E697B51EB3FD61E3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VirtualBox.exe

Path C:\Program Files\Vektor T13\VirtualBox\VirtualBox.exe
Size 3.0MB
SHA256 467cc631d12c906b21578298de87c8152b42aa6c7a7b79b61292b7614f694860
MD5 a542977eae157c2a5d3e21015b49d3d4
SHA1 147e107e06f82cee96f145a88c86c96890d6245b
SHA512 329a71c394e899c356fd903af19340ddc9c2847a1651e21fbd2f5b3e766e481f55cd89a04317f7a4014fc3670443e64c9659973cd0319528b72be3cb9a1a87b3
SSDEEP 49152:bQtHPMaISOV9GepurE1AVUj8kIhqHpt0wauHG5hL12iQbg:IOxy2C
TLSH
T127E54A5BE39901E1F4F9C07DCA4B4617EA727006032357EB11668E2A6FB77E24E3D690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AtdtSup.inf

Path C:\Program Files\Vektor T13\VirtualBox\drivers\atdtsup\AtdtSup.inf
Size 1KB
SHA256 7c94022686475d0d2767a22973b75d19231382971b874617f99fb3bdab683bc8
MD5 2e2ecc213f81154f276ead823f7f02d1
SHA1 6de75a7c023372fe547f72800007c22f14cebc41
SHA512 3aef9d8392ad64ef57ef260c47bf87507b655f7ceaf2e8026960372784cede48841f10b16c630b42fc40c421e3a04cfdd2098f01e6b38f26639f12accc1d6d89
TLSH
T11621D0B2D84542B0786B2FD73E5BA182E3D4301128EA6D59F1DF8002D7E591C8F2D6E6
MD5 SHA1 SHA512 TLSH

Submit Download

03B6193231D6872FDA0CFE8EF2B47341_7C9B879D52D6918D5A01C326C7A6A2A6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\03B6193231D6872FDA0CFE8EF2B47341_7C9B879D52D6918D5A01C326C7A6A2A6
Size 727B
SHA256 e5fd0ba8fb2bd2d3d4a9e7a302d7e3b0a10025aeee50ee0c1b1de5ee17858357
MD5 5371bafe23887136d3dd6183eab6c450
SHA1 0800ee97e4aefb4fabca6e4d87ad7f37bdb9a80b
SHA512 7610dcb9427b18d66a22287ede7896c8d706b84981b073b4a0013c74d54ef086bbf4fec2986508c562e9e8301425729931edc843f438e47f79f15a257f36a81c
TLSH
T1860165011CBDD64EC3B2C9584090C5691688617268F8005B28387FB151C8A21A52ADB5
MD5 SHA1 SHA512 TLSH

Submit Download

2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A
Size 471B
SHA256 46a0ae47e2fd23b211971e84764037c4bc7b852a10300d259f66f6abd9555cff
MD5 d35d6e866e16a007e47b17a73f911ba1
SHA1 9a497a043fb8fb59a0ccc9be4aac81142e6e359c
SHA512 7bd815fdc17b68b26a5dedfc9887374c841d5e318ea157a289d5170aa000d1221619601e8070ace91e2662cd6bdd301bd0062871a5aeb36a6d8d3a0bc8d73812
TLSH
T172F09E935DDC0C47D451AC8DC894C17D3C86A786026C840A25EA5391DE0E7389541129
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 7035207346eb2eaa56217d264417f07f088775aa45c4708215dd3d47224a628a
MD5 583887a385c17600df9ac4988a6a9da4
SHA1 47d982670f2033202e18bd7c133e6ed02a2722ab
SHA512 29cdc7f9318e94eb66b1bba131b675419f990343dc0953477467b7a6613975aac369c7a79130294ea677ad6ba12c97df20c329409eb38a5aabd74a28e17ff5cd
TLSH
T15BF0976B90AA2DB05D0BC99D0AF4667630B0EEAB01C290AE283541F98687661F16E00A
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_B60E2B15CE7688A988CAACF7F569B2DE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_B60E2B15CE7688A988CAACF7F569B2DE
Size 727B
SHA256 6c0b8b560f1d1745083f0f64f2139c59a119b30e4f657dfef34e2a46523b8dc4
MD5 e122e5b28b64963e5c20f3c4e37160eb
SHA1 5652c4bb1c5361ebbb91b1fd99357fb4b2a23426
SHA512 0944ee8f2602c69a13732b2f95027ad5f72a216c07636a865385f3b915e3fbf8d93b3b06f9bdac65b0e1bacfe7a3b8ccc18055507058cc083a9c123a6f03b837
TLSH
T1B40165B28C4D5AD126128C0F0364143270B9F46E589A1037BB7810DB02D96F49F17565
MD5 SHA1 SHA512 TLSH

Submit Download

03B6193231D6872FDA0CFE8EF2B47341_7C9B879D52D6918D5A01C326C7A6A2A6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\03B6193231D6872FDA0CFE8EF2B47341_7C9B879D52D6918D5A01C326C7A6A2A6
Size 404B
SHA256 e61eb9ff532b9d4a821052bb8f3f7116e38c4bf9e6b4049c15abaa4ddd3a17e0
MD5 9d8abdd214c0b819c6216a0ca00173ab
SHA1 e1547f39c9ced7b97c7ac42456d30eca0232adfc
SHA512 505bc904a205fa7fa5d96b8c629a8c1d3f2853b18ff0bae2ff99c42bfc48a1836ad4d91ad95a5c2b40c2f940a48ff7c78a1111efe5c8242316f6e8779b9e829b
TLSH
T138E02038217E415DF071D97909DA69A69C9EE511586CD1B616E0170BDD02B805D12876
MD5 SHA1 SHA512 TLSH

Submit Download

2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A
Size 400B
SHA256 080a2325cc7c6400954c7e616abd90456d075a54773c8e3b2eac98395774d035
MD5 83201ee1ff950d1981a8da3146a3ad42
SHA1 19808b58ca009c934fd6539321b0536fdcd89965
SHA512 4ece4e495b610fba74852b6432ebedcda86596427d98f76b0400732d2b244c4d341773c4bb34e32fa2cc662e22e91610a48dee98fe92b554cd100e038e8dcc0a
TLSH
T1FCE0C03421F7411EF0F14A7E4ECAB2368D79F3350888563019500A04E605A81CC60832
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 105c113e2ec2c114938e8d1fa5b91875ae065610967989f56906a8007d57afd7
MD5 a6e08e2df9e2ec47dea23ec99f6e1c8a
SHA1 7b6fff0f15abefda170accb1fe61abb8b3e3e381
SHA512 fd4bd6ef99cc5d1fe4dd09a82de67de944f6491f8891c5fd9b6a933e3fd79f35035bdfbe7d5365e8a3d856a7e438926a0a32e5bd2e872f6862f2bd94253670ef
TLSH
T14CE0C02023FE112EF170DB7403C980D66F35F1022C4852FE0D82051D9C29D014C62C30
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_B60E2B15CE7688A988CAACF7F569B2DE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_B60E2B15CE7688A988CAACF7F569B2DE
Size 412B
SHA256 e8408f600d3558177f20258a7020454907175a91331d5379e481d6338c6f633b
MD5 d6af91fe5c1ea5b7d9b9bdd698fd6ba1
SHA1 9b01d947da1781b60fe2b92556757a94efb1fb99
SHA512 cf62eaffd3e478be147a9e62f50a294b35c188d811f5ccf3bd3d9c11fe110781beb9bcfa6979e89f11757c8a3d444872c9eb83b5ac232f6b3504568dd5bb8cc7
TLSH
T135E0C03C36FE511EF0505D3946F9F2755904F701000092BE1AE103587B0FF009C149F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b296f8c2cdb9fb5d555b24621bfa76764f5bac5c7606adfb902f33885ef7aec6
MD5 58ebee3384448e08ec5935c2ea87724f
SHA1 9cf953e8131b6df280437d6e1720599c5413c8c8
SHA512 195b694a490e402bcf65eb062b62cc857111d26f9898d17b2eb5bec5ecf436aa40a51bb650f474ce654f21a98208f3903b236106f55c09e55d44949b09d47bf0
TLSH
T1E5E022B6CC62FC2708FE0758A0498B4AE70517572A41894F3A3C820D8FB062A96C989C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 999451498cd977d52b06aee623d5b8541b1efa9ef70a528fca04d17028bc0862
MD5 73f27667b2442612552f56784b20922c
SHA1 7d27d7ccc7b4e7c61dd6cd8a46f97a1ad9317cf8
SHA512 7911581bb9ff2fd946d6d79e99a3b3628d3a042c6632821d05d6495958917f569fe52ed13be0a3fc69ce85bcae8ee9066c658868cd9db58ce05c579673841a9d
TLSH
T17841D1F743B4856E9A1196F0EA18BE2FCF2D0511531C7DAA85E0AE17D3E3471E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f2158d13-1a02-41d4-b736-7302960ed778.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f2158d13-1a02-41d4-b736-7302960ed778.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 93359e98ce47d9e3ba85f343316493c97a0b811b4ec3342758bc204b8a353189
MD5 d0a0c396fb2867ba6e5ff5f8fed1162b
SHA1 7caf418797c6bee3708a68c2d1d93a6020a2bdb5
SHA512 166f77a5f7056204a238c7699627a92e3c7f46fe72e953151d463bd5afb5c27d24412652002b9f01b8307bf9997a798a729806b4037b3e10c8b1107ecb23d31a
SSDEEP 192:sxZyR6yMqZjK1Ml8UQf9r/fbshwZdqzodpLHW6+WNGYvls0xdIg5wKJ:sxZyJq1r/fbshwzRLHbGETGG
TLSH
T1EB62E7166A385937CCDBD219F6557F93E7F80573A2904E44A9FC8A1C04E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 95b07a9545b83bfa60148b81698654bcdb3917e0c0e2e1088789a8c1f831421c
MD5 0aafdad7d48e9128b22f8dd8012c9954
SHA1 fbeb60ee1bdb89f53cbd99a873c2a4b96154e3c3
SHA512 6ff489361ba16b9469e10f4f96c2287fb6bf8632409e653a5af0fa6f6351ac89a9c5f7c8bbf68f02cbe5e6bf586e2deeb9145c5b91ab6ca38de0133af746fd60
SSDEEP 192:sxZyR6yMqZjK1Ml8M9r/fbssmkaZdqzodpLHW6+WNGYv0u7+xdIgjKJ:sxZyJ1r/fbssmkazRLHbGlTjG
TLSH
T1C362E8166A389977CCDBD219F6457F53E7F81563A2904E44A9FCCA0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 91d68c151deb96df512e1978fe8df5675e7469fc2344b19905a65d4f91f5d1b8
MD5 6f6eba35735578f85cd367247893fff3
SHA1 59ff400e935cabfe85c5b0d457457c799e94526b
SHA512 3f52381042938f3f4f7fd54fa7981f8ded32937486866ca3abfe5aaf09bda0fcfc019d8c3441891d61e9239216e549bb980fafce47ef553f91f55212e22ac3cf
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGD:05ppxnY753RNBvRJJdt7p5J9/nxLDH5
TLSH
T170C2765A713A02023D7E298CB29596365F4235A33058E4BF7FB804A24F67E125DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c7911a79a19c1f3839d1aa01d884d3431da1a001eac2ea1e9824f39caf431950
MD5 5e939822d26e9c48c703d64e8846c32e
SHA1 02a59a057de2746342976bfdcfd9c1ca0a4883fd
SHA512 bef49b997469f572c971c9510355552d21f301f362e85107dc02c1c42f9e1c6442a96d6e1d1f5a15f0f0e585f4073dbe9cc99c73c4317535d9a6716981e8e77c
SSDEEP 384:npKiF9CcmyWCs3sNR8TUNTUlI4UQckCrA0spvBfxGJWJ45Zcd2eRD9JivnU0ty/f:pBFccps3Uwgjk46DG045Zcd2w9JiK
TLSH
T19FC24A36EC98D9ABADE64B88B35A3A07EFE04267C6CC5AD4C9DC4D1C009B1DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 17513aee0931bb8d75c4e95ca84ad976a9f5e2b4ab92b63a7bb94df45a14ced1
MD5 f72a9c696341ed675ca3eab52fa58c28
SHA1 1d4794d0637f6bd379146a97c91b2c62127ddb50
SHA512 73bf8b0b5adb79f0631a01d780617052b3746ce03152af98945a1d2514a1f93ec98ffbcb6b71175bd1b47b86e94ddd688ef8e20b543d9505f45e8c4e19199d1c
SSDEEP 384:nviF0CcmyWCisNR8TUNTUlI4YQckCrQb0spvBfxGJWJ45Zcd2eRvv9JivnU0ty/f:6F/cpiUwgvkq6DG045Zcd2I9JiK
TLSH
T192C24A36EC98D9ABADE74B88B21A3907EFE44267C6CC5AD4D9DC4D1C019B1DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cc556f2412e67b741f1d33a58a12bb5b478e318eabdfa2613fae7a3e9f1b062c
MD5 c1318bc21d1e581fcd50d03de03561c9
SHA1 152cd6df1f9dea3a0a1058d0619af0157722348a
SHA512 29c11fc70395b7a47e66287ffb3f1ed0b77237047baba909f4f2806090ef701dbdd43f39c5acab6874b6ac574a2ad4689dc3c7b155b0c7c6bac24e0c73010d35
SSDEEP 384:nviFRCcmyWCBsNR8TUNTUlI4YQckCrF0spvBfxGJWJ45Zcd2eRvv9JivnU0ty/77:6FYcpBUwgvkz6DG045Zcd2I9JiK
TLSH
T1FBC24A36EC98D9ABADE74B88B21A3907EFE04267CACC5AD4D9DC4D1C019B1DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5a5f368822a561ca9af6af26836ad0f950198dbaddfa77be1d4d65974156570d
MD5 724e273563f0f6c50cc6d074106fdc44
SHA1 02409ffae62282234392fd38f14820a06e01821f
SHA512 aa4c1c387f28570006d68438eed8fb1557ba5ccc89056c2d98fffc8da5eac6bdd4eaf781f9df59e78de01c7a9d70f625999044c97436d6553a21bc08f0387e44
SSDEEP 384:naiFRCcmyWCesNR8TUNTUlI4YQckCrF0spvBfxGJWJ45Zcd2eRwz9JivnU0ty/77:RFYcpeUwgvkz6DG045Zcd2H9JiK
TLSH
T1B6C24A36ECA8D9ABADE74B88B31A3507EFE44267CACC59D4D9D84D1C009B1DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ffe32447caa9607d6b0719309e2c91eb55df99b1ed34d1c44fec01e6917e96d7
MD5 bfae35b1ee8c79f206be7cc7e4c36970
SHA1 073650eecf01e11dc63a52b59713581ee2493001
SHA512 e954c6bd57b0fc00861c189a94e5a6696b11a0abe2c2a4916b8a6a80c2292f8d52193e2f13d87454a66d7310d5016793415f59669a39ae16ab75e93d3a51cfc9
SSDEEP 768:pcFccps3GwgbkUkkDG045Zcd2ZyI8p0MLC:Gs3o1ycVI8p0MLC
TLSH
T1D5B25C36EC98DAB7EDE74F89B74A3A07DEE0126785D859D4CADC1D0D009719D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 dc9b08b52f22ea3d620012c178c28f023e4939248040b316675eaba5fa892d50
MD5 bbe0a11cd23ddb69845d3f992682dba6
SHA1 fc59d6fafef9c70db525efed21eff8d893c5981f
SHA512 aee6ceb1520b2c1f59047fee03498c08baeb07ecfd5c220aaa4e472cc5ababf1aa4121b6f49b440cbc2ff96c931869e3037fb2b9099c93fd9ebe61fa3e19d954
SSDEEP 768:p+Fccps3kwgbkU83DG045Zcd2T9JI8p0MLC:0s32iycqI8p0MLC
TLSH
T16CC25B36EC98D9ABEDE74B98B64A3503DEE04267C6CC9AD4D9DC5D0D009B1ED430BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 78cbd6279a492901f57c2d7e1fbae18265032973b876d610cb44e9ef2c6bf535
MD5 9a6591d3928104e327f8feea1072880e
SHA1 7793b77a5ccd510f9865c84faf7de3c35dbbbe99
SHA512 90beb431386177d4b54da758975f719288f31c5d83192c8cdc5a0300d091d98ea27ea0904721a386a378b08616402647b6db7df77ae62c4c890dff88d2b00a53
TLSH
T11D41D858B6EA1148B3B77E5AABF6686D887BB8732F06C45E10110D4F0662E41D8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5FF8.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5FF8.tmp
Size 499KB
SHA256 f9b11c9b1a23990d13820ec8a43702b9a06a70bb31f1bbd36fff547f7d10c0e5
MD5 44d9dc3f779f15187db98bc0e82dbb22
SHA1 e22f0205f36a21231e5f80e911accf327d032038
SHA512 907158b3ce94389093900bc239395328c905e005a46818b1c93a4f0e5328c1d55a6032a2e4c57106f7c1c611b816031a469daffe5fe3e0c67d5d6ff2b287f3ae
SSDEEP 12288:2/xj7dMQBCZCywwvhLlHTlh2bnESXcGmEF/yE/AeA2u99:4j7CqCZCywwvhhHTlh2bnYG9/+2a
TLSH
T1B3B4BE67B7D4167AD98B913D84538112E7B3B401030482EF23A6C26D4EB3FD69B3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI95692.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI95692.LOG
Size 104KB
SHA256 37b0f451a3f35d859a0d7c999796827beb318eb1ac17880bf7ed8be84c7ecccb
MD5 5218b416a47d3ca495ef4fa87fdc1288
SHA1 bcc907af806be784d40f60f3e1caf26a4428e152
SHA512 b8176453adcedeec736d4458515d081f50f357d86cded9084adc550bf4dce1f324340d569135e15618c9ca4649b7bf351175d347bf7fb1bc1c70f2e798c3198b
SSDEEP 1536:WpbPisKrYVD21M9xwlOYKcuA+p2EmQm8mQmoeKcuA+p2EmQm8mQmI+KcuA+p2Eml:XAO3lNmK1LPm+AmPgmXtCu
TLSH
T1D6A36B252FF50109F2F756CB9EF358258B77F9696936DA0D2081C20D05B3E0899AC7BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem0.PNF

Path C:\Windows\INF\oem0.PNF
Size 5KB
SHA256 7fcb1722acea0b4388044a604438d42a126a79a90e928c3fe0c2e5440ef13669
MD5 6af87d7ec9651ea680c3f486fe43e1c5
SHA1 6f688df500b225373aaf6f7cde78851b1e3507d1
SHA512 b73b2fd0f96698fafc88fc3f0a6c1b43fd5a58dd67f493dad2bc8aa308f88ad811f665e26db64042cca98e669781884be8ee698bef06a991b821b1307f06c024
SSDEEP 96:yUB4Aa5IjNAuLScz8Ui7cg06fXkRx1fsX+daDsu20:IIeuLSQ8Ui7cgZf0GXCkP7
TLSH
T102B1584577E98B15F0B68E742CF46AE66876BC526E12DB4F2250331C1C32F54DBB0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem1.PNF

Path C:\Windows\INF\oem1.PNF
Size 5KB
SHA256 4a4768bdf8739fabb661224dd9179bac7e469ebf4ffead8263813165b4ce081c
MD5 da64fd054a378a859f93fc0a6928a8a3
SHA1 663565c2e1d157cb0f63f55f74a3efe4015583e2
SHA512 1bde45808802ef3e202e0b847a3bbcf38bb4d70fbcca31e5cf202f3440cf85f09b078dda3768fe46b90ab2be485325b0d769bddc52b8e6ffd67d2141f11c8fd4
SSDEEP 96:T3wlh4C0VJTnNAw5nbbUD8F5DI6sXkRN1fsCY+M2sH:TZTaWbbI8F5Dts0CCYwe
TLSH
T1ECB1661677EA8B01F1BA8E742DF4A6E75471BC026C11CB9F2250731D5C72E509BB0B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem2.PNF

Path C:\Windows\INF\oem2.PNF
Size 6KB
SHA256 e53825f45c8baacfefc14c9bcf13241fa83c815c966ef28beefc15a7f82506b6
MD5 df73b15a07509b0b7f8e31e243f79155
SHA1 d164596c8c89912c7855397270d7db68ebfd7c84
SHA512 1ba80e5f8ee965aa1851952e9243741b9958a1f09659443ea65322e438073b35ffb603830177255ac7fe79c5fdd9b2be8c8ee80cf10c1d92608ebebf8bdfe2ef
SSDEEP 96:44rgQY2e/NI0IXSu6o4zvM181fQ1UvZUuQSCUJ:A2e/BfosxZUK/
TLSH
T107D13646B7F88B15F1BA9B306DB512E65436BC61AC12C65F3160334E0D72E949AB0B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem4.PNF

Path C:\Windows\INF\oem4.PNF
Size 7KB
SHA256 b2844a10eb6977b1ce9f1a613377cd2cd122bab76251a59598ee92d42e6dcfee
MD5 d4d39a7c0f8f3cbe8723bd03c818ebfe
SHA1 6c890f2503d87c79584e1fc1cd9b41f3721c821c
SHA512 114ac09ad506cac22f05c3d802a8d6c5bf58ccffd10f810d0eb2dfdd3bdb96698f1924e7336f3ff048602f662bb633c0312355f3e8b9b507308922f093fc8954
SSDEEP 96:kAKJi4T+7edYinxaWRUB3Jd1C36uGH5ivE4WIiIlY+Pn6ScCBTGxBQE3i:kTG74ZxdRUTNbo35lviOOBQES
TLSH
T1D2F1364273D98A14F1B69EB49EF491E58426BCD25C02D72F3569730E3873ED4DBB022A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETFE0D.tmp

Path C:\Windows\System32\DriverStore\Temp\{13626dc0-9636-c243-9cb4-a1a3c142d4b0}\SETFE0D.tmp
Size 11KB
SHA256 3dab50fee7493a35acceae5712d3f7e3207a81ef3b417b4c8dcb0197f574972e
MD5 5817700c4ccc1938b3aede3d3179b196
SHA1 906d0ffe59bf4a77d9023b63e103a7ae48ea7440
SHA512 38f8ad98420d024f7034282f8e01bd0a091ca8ad779bb635b52454207e1d371746f8acc53d637f6326e57b6f2a815a3d98d255bba348c8a06601c3aa21be33c2
SSDEEP 192:5REziquS3JCePghXDEwXEhYCr/8NunZMiuyCksX01k9z3A3EcHj12xp:5kiyh3rkNviCksR9zTcHh6p
TLSH
T1174209E2966C5083FD63ACA053ECE9937C3D23CB5900556A26DEF758095B3C8E71816D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETFE3D.tmp

Path C:\Windows\System32\DriverStore\Temp\{13626dc0-9636-c243-9cb4-a1a3c142d4b0}\SETFE3D.tmp
Size 1KB
SHA256 df0e2acb02d977c76087112d856c6e586c8999906ed3e6b67fa17fb03130513d
MD5 ab68139d6f498ebc838ba87625ddd6e1
SHA1 9fe896dfdb0ed9277fb44be66031d71998db0e99
SHA512 3048775e727f25a1048589710592c938f55b7ed47663890ca3a2dd3a7035ea2f5bbd136065cd086e01b1ee70ca1a1ec8de38a44f1f3f59a4f9e0bebef81f729a
TLSH
T17831A7B614020D7D35AB266726037B62F389300028A569CAF9CD48CFC7EC618C7685FE
MD5 SHA1 SHA512 TLSH

Submit Download

SETFE3E.tmp

Path C:\Windows\System32\DriverStore\Temp\{13626dc0-9636-c243-9cb4-a1a3c142d4b0}\SETFE3E.tmp
Size 209KB
SHA256 4bd11500444abf7ba3e1b114cc6b6af7cff3977fc170d1881cd90e8cf2d862f5
MD5 0229d695726a903e2d84b27723493f28
SHA1 f8a76275ceb14ab54d2e9a697bc756bec7c58f9d
SHA512 88498d9c9a52402ea13632a7e2bf11f86a84f187f31d69069ae0c915dcbad663e0a99494b7c3052d5ec71d5aae413d89fef4a2c597b42cf28e5b3b0a9d3bb9d4
SSDEEP 3072:iplqgzP0EPVisEn0Z1TJjZxjS/cmCC0HrgOXHwCkc4sLtZw5OmA1wNTU:ippe0PN9FrPrLRIsehNTU
TLSH
T16E248C9B77A828D6D9279438C5D5462BEBB378322B5087DF07A493760E237C62F36314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxNetAdp6.cat

Path C:\Windows\System32\DriverStore\Temp\{667609d0-6515-db4f-a316-a734ed1fc745}\VBoxNetAdp6.cat
Size 11KB
SHA256 f42b04be8a339a383dd01b640f0fa274e31c18a1c531287d5d9182b0dc56870b
MD5 0a751919ada4675a3347d8f45a174b77
SHA1 5ab33ad59706d0456a6396bbecbf5cab9e13138d
SHA512 aa3bb2b0a258e716ff975ae56e4dd0b14ca1bc1a0c8f56598d448ac2b78fe2b91d9ed4c109e04956860919f624c845d348a03f8ee223f6b8a776e3e33a69a2d2
SSDEEP 192:q1WB5JC6PghXDEwXEhYCDPJVXC4dlgX01k9z3AUjdeUh+t18BznF:PWyh3VVXC4deR9zVjQUUo5nF
TLSH
T198421AA2596C4082FD67AD6013F8F9973C3E67CB5800407A25EDF6585CA73C9F72852D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxNetAdp6.inf

Path C:\Windows\System32\DriverStore\Temp\{667609d0-6515-db4f-a316-a734ed1fc745}\VBoxNetAdp6.inf
Size 3KB
SHA256 c1af8774a2b6c246a31b8c3f5185fff67a856c4f96d55c21b4d0587b34e4611b
MD5 7bd5968035e290fc975a3655d2a30c08
SHA1 f07a370d4734c9b332b35d26b4d16d7ae1ec17b6
SHA512 2da219b9fc716499b2d8fa62084c5039d61660bf4ea26e48599eb4d10d95b4ba408e8415a092307b5731cc1de9201bb000848f68d7e79f6b03da453e223253ac
TLSH
T19E6185BA65B18737AD361149AE0A9DC3F61901833CDB1410359E8A7F434ED2C127D9F4
MD5 SHA1 SHA512 TLSH

Submit Download

VBoxNetAdp6.sys

Path C:\Windows\System32\DriverStore\Temp\{667609d0-6515-db4f-a316-a734ed1fc745}\VBoxNetAdp6.sys
Size 240KB
SHA256 755120e64cec6673bf8ad2ed0cfb031dd71a31ab8fc063c1b26cc3a8b9198857
MD5 bb13c7ae29af3d73e2e2326bd37ef752
SHA1 d2b5617fe2f2de0831d2ad0f6301e5cb88851261
SHA512 6aa2a7c483dd205a6d0f667a5249f7eb23b45ee760de009400c208e73c21feda8d94ca428e4922303727e735a0f6026ddfd02bc419f2f280e68f2b55a93acf82
SSDEEP 3072:JUMdswSSvVaSvJpLYd+Aisv5hRBQQzYePRKI9Y5tGp7mnpKx1z0xYvW8KZwew0qL:fzvVaSvJpMxzkI9Y/O7mn81dvZP
TLSH
T1E5348E96FAC429F6C45F413A89520665D6B7BC431310C2EF1791A6B5C9B3FE32EBA304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxNetLwf.cat

Path C:\Windows\System32\DriverStore\Temp\{ba56493e-bc4c-7f4a-aaed-e74ec06741c3}\VBoxNetLwf.cat
Size 11KB
SHA256 96eb758ee44b13d5df932e176addfd42bfd1eb27aa7ddec5801fae07e9797a65
MD5 18fd2f2ce49c749c0c8d4ea321661715
SHA1 af7f728e0403c4ba63480bc8ddd55cb3c4ac5f1e
SHA512 14be128511b33fefda28d2d98fc522f6c85230369b14cf78046a566e8df73734a6971208226523da3eb6445c32db4a805b4819cc315655d0e8dc4b547842575e
SSDEEP 192:etW7QTJJCsPghXDEwXEhYCbsYwcADB6ZX01k9z3Ad8LFIWoV:efwyh3bXwcTR9zw8CWW
TLSH
T18E421BA2856C4183F997ACA067FCF9877C3923CB681050A921EEF7180A673C5F32456E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxNetLwf.inf

Path C:\Windows\System32\DriverStore\Temp\{ba56493e-bc4c-7f4a-aaed-e74ec06741c3}\VBoxNetLwf.inf
Size 4KB
SHA256 aee3b03ca632f7985c71c56d747ed61d0a83e8250f72c4e3cecaca43d6262cdb
MD5 7da30975a6c38e9a0fe9676950f70033
SHA1 d0134da02edaf78b60143d9d6a310ab97137b709
SHA512 2ab29cfa41572e3b94680a298248d8d459da50d7f136ec1885a092f8c6550a6fbc5c0e256bdf42285cd7d9234f015d2a577e90989e8eeaa8f4a2780d69c87f01
SSDEEP 96:Cf99tdl+5NZIspvtxfkDmWoVZfoRE/jDpN:CF9tdl+5HIs5fkjoVZ1DpN
TLSH
T16081A36A49B19F721D05204ABF472E8AABED1003059E2818B19F89F703CDD1C36FD9F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxNetLwf.sys

Path C:\Windows\System32\DriverStore\Temp\{ba56493e-bc4c-7f4a-aaed-e74ec06741c3}\VBoxNetLwf.sys
Size 250KB
SHA256 b7d5361a58530add79cdce5544f41190196ea7b16b32c889627e8b5a61be8483
MD5 10ed4a0f400f1db09e258c99939f15c7
SHA1 4ed115fb4bece2aaf9b0d724330811cd2c7878b2
SHA512 a573233ca92ff878f79261bf7ebc10def90c0995c46527a2f5f3791f5e48cf54158c07af1e0d969ba4d196f182126ca2e4c9ab5a1464e6974b279a6038102a6b
SSDEEP 3072:S61RCx1tIIyjicxGisb8CQXdwKgpeZ/W3tdzkmnpKo1zn0SXHK9aZwu6HAT:914IIyjf1C5peZekmnl1EG
TLSH
T1AA448E97FAC42DB2C45F013688920655E6B7BC421710C7EF1795A6A589B3FE32EBE304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETFC77.tmp

Path C:\Windows\System32\DriverStore\Temp\{f7e266d1-6862-324a-b94d-361c1466be69}\SETFC77.tmp
Size 11KB
SHA256 4017af0c23fc9aeefca4c6bf07fed19c2bedf1ae9d1c3798c5795df40f2e56f3
MD5 10ba1532feeb255c998bc6e664cd43f0
SHA1 190bd83419d70a3aa07d78e89b46f471fcc86d02
SHA512 ad34f3e34ad95e2c9cf5c531c114bea8523ab371430f5daac46903667be6a307590689780236bd63bd0c5a9382a592bed5902a8de102afe49b5d9f10126bf9f1
SSDEEP 192:CvfP4UrSybfJCMcPghXDEwXEhYCnn+8NunZMiuyCksX01k9z3A3EcNo7K:eHVfLyh3VNviCksR9zTcNIK
TLSH
T1A04219A696AC5182FD63ACA053E8F9433C3D23CB5900546522DEF7591D9B3C8F72826E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETFC78.tmp

Path C:\Windows\System32\DriverStore\Temp\{f7e266d1-6862-324a-b94d-361c1466be69}\SETFC78.tmp
Size 1KB
SHA256 2412798e8570b11c23c107a489bbf745a06a011bcb6c5b08b56d53ba6c4e6199
MD5 dbc819c1882ac6468d99f7e36439e40c
SHA1 9a01578654a51da450c99cfc9d104046a014bcde
SHA512 1368954e4b599ba7b59766e6a06c7c42cfd8ee0ef85caf58d91276cbc59d0dabccb07f1250c1c86edf923eddc08cea879faa1bfbcaa030c61069e242cace9710
TLSH
T1A131CEB6124F0D6C596B174B2A47AAD3F384250028AA68C8BDCE80CDC7EC55D57285B6
MD5 SHA1 SHA512 TLSH

Submit Download

SETFC89.tmp

Path C:\Windows\System32\DriverStore\Temp\{f7e266d1-6862-324a-b94d-361c1466be69}\SETFC89.tmp
Size 195KB
SHA256 034c55c50d6d4b8b7ff61ca463d18982b5021d54885003a43cd60a53e041f9b7
MD5 95bca05b29ab0d31668d3d54d03492d0
SHA1 d4c00169dc31ddc23852a3f92436bc50d7681a0e
SHA512 ec425a97ee17972e7181d810a4a894ebf64263912b673dec60a251a13bdc6d91df8e1070347f441976818469060965d117678fbb15d65aaa75df65cf40c336f1
SSDEEP 3072:uhjbhWnUbnis3VUWyd/Q4Qol6zoCc0XmQEX8ur/0CZw5tWvi0UGhCX:+XVId/jl6HvPuzatOk
TLSH
T17C147CCB76583CD6C927847891D54A2AEBB2B8722B40D7DF07A4A3760E637C52F36314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 37KB
SHA256 154f936a5d443d97842c587c2538d7db249c6e2d2b36aed84e888871b0bd7f27
MD5 9d31c4a0bf39bce8348e43227e67718e
SHA1 de0e10c1ed034ecee6cff8e37a8ff30fff8fbaac
SHA512 53bcd18c0fb1877f6327dc389f1dc2eac28e73893d0148f11770436124dd77507bad2c427babe053f2ea1cd570753ea0e178157677e0cda931bcce9ada1a24f8
SSDEEP 768:n6e9lze3CCnLtdvoip4G+z0ha2ErzmmYB2ErA:n6e9c3CCnLtdvoip9Bha2ErzmmYB2Ek
TLSH
T16D035A0865D8C818C5F50966276FDE71C57BE5CAB30B0EE570BCA714A9C2B042EFA09F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 e23e52fe903dc7f87d3a8e03f12cb69567915874b1793e18a3676e13a093deed
MD5 99bc9e0dc2df4b716b69c8c1d65e6e51
SHA1 eb6029a025d6cd55e62a6c7fd3ab996c53aa5691
SHA512 97b9479ed426b8802d7666531e2bc28786ad36d547cb39a521003224ac80a241348b5658969a0bddb057ec0a316cfbcd6bae54c397bea59840a0188c882aa189
SSDEEP 24576:nu8m+1zpdoO/vvTL7WNeImKZc00jV1dShLmtPC8Vl0aMOqkAIv1UF7GRo:t
TLSH
T17A47C42437FD2210E7F79E3C68F06A27893A7D5B9C159E8D05411F8E0961BB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{b494e0d1-9253-4a35-a717-8de559881033}_OnDiskSnapshotProp

Path \??\Volume{12d9ef41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b494e0d1-9253-4a35-a717-8de559881033}_OnDiskSnapshotProp
Size 6KB
SHA256 bd16520b154981a16e9d623dd5cfd575a07940ac4fec62ca28e03aa97896566f
MD5 ddb51b3620360e1db0f3c74cc72f2e0f
SHA1 ee709a419cb864ae674b6532ac06424695f7ef96
SHA512 9ce06f40ddcde1102fcc8d025718db967f5836b5c95bca5d18cba794c8f1d21d91c1433730883d10d46bdf173bb6f0626c012ba13304f346dced6405c6db796f
SSDEEP 96:FnuUZfnwvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:luUZyb++ZVmN
TLSH
T13DD199085AE54311E2B3AB712DF18557A477B811EF33CB8E0198238E2670A10F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4252-194-0x0000012DED1B0000-0x0000012DEE1B0000-memory.dmp

Download