34d727e0ea42190f49af34b0326f7f8c86144b2fb6ea8854cc617e28dc81f6fb

Analysis

max time kernel
149s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup Ozone 8 v8.0.2.msi
Size 789.6MB
Sample260922-vna4ysbb49
SHA256 34d727e0ea42190f49af34b0326f7f8c86144b2fb6ea8854cc617e28dc81f6fb
MD5 9deeeeeb08305a7d088ab6ef845135c3
SHA1 83617f0b71fe7ee75c4f5870ef8de0f0c0a8348c
SHA512 5d4a31d333964e408689a559ffe9b8a66a64dd2c107bf2b5b033590466bd506a3195c9d988bfdb9fff5484a5d63f10401dcd8d9c8ecbcda47de0acbdabe04648
SSDEEP 25165824:WWvFXeTD0q4QyBsZg+Yle4NBiDT7LGBXttYNU:WcXeTg6dile7KBdtYNU
TLSH
T13689332BF4592F2EC65BA8FAD13A4A36047E3A430B255C42332D6B217AD76B317F0751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\VBoxUSBMon.sys	msiexec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET2C9F.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET2C9F.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxDrv.sys	MsiExec.exe
File created	C:\Windows\system32\drivers\VBoxDrv.sys	msiexec.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5BDEFE580A816661CDB57A57107BF4187486EFCC\Blob = 0300000001000000140000005bdefe580a816661cdb57a57107bf4187486efcc040000000100000010000000a37a95a484b2e073c28a473a479c86cc140000000100000014000000eca03bfeb314734af1b86400574aca7a3b79af3d1900000001000000100000001f24a0b333c7ca26d6ee9b1b348160e40f0000000100000014000000f7c4b6949aa82630fc59593e9f20865e3e8dd17320000000010000001705000030820513308203fba003020102021065d365a24ee7e137105bbac2335816d8300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3136313231343030303030305a170d3139303331353233353935395a3075310b30090603550406130255533113301106035504080c0a43616c69666f726e69613117301506035504070c0e526564776f6f642053686f726573311b3019060355040a0c124f7261636c6520436f72706f726174696f6e311b301906035504030c124f7261636c6520436f72706f726174696f6e30820122300d06092a864886f70d01010105000382010f003082010a0282010100979a1345945d4cc20eee7f9380e71ec7e1ed679703a4fdbc5344f5c74748ccdebed121aeca6a637c9311ec68645a2faf9458f20022ac3f2a3c1d18b7483a8108fdd0de5c44cea23466f7cdf9585bc316c6b6ee91385282d65722b26601ff43fd31accda01b14e4abafef5942d6aad08d62fd0accd836177c4c26dab27d83c6a0a9dd493bf74caefd6a0b1a84c7ee40aa4e16335e9492f23ca023ebdb45e316c8c367bb76d07778f6d590a26ef007afb6d6911669a34bd38f1025a38c0587d1842f405d31be2b05123f782ead22a08c528e63a86ac8bb8d06efae2405d32d6c58da9c83fd39b04dd08da52bde3744d034aaca55ea3581eea30ab7d300e6aee8010203010001a382015d3082015930090603551d1304023000300e0603551d0f0101ff040403020780302b0603551d1f042430223020a01ea01c861a687474703a2f2f73662e73796d63622e636f6d2f73662e63726c30610603551d20045a30583056060667810c010401304c302306082b06010505070201161768747470733a2f2f642e73796d63622e636f6d2f637073302506082b0601050507020230190c1768747470733a2f2f642e73796d63622e636f6d2f72706130130603551d25040c300a06082b06010505070303305706082b06010505070101044b3049301f06082b060105050730018613687474703a2f2f73662e73796d63642e636f6d302606082b06010505073002861a687474703a2f2f73662e73796d63622e636f6d2f73662e637274301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301d0603551d0e04160414eca03bfeb314734af1b86400574aca7a3b79af3d300d06092a864886f70d01010505000382010100d8e900efe4dd37ed9b23ba73edb93b2a4cea4e8f02cca9ce5075906742fb5b092131e3f027b8574ea91fde7ac36f6809386e7f671853e569848c4682e681e2fd79244a113907e8a10c81fb68923bb85666c9c0db73b83f1f8a5ebaece61be3eb5d25ae90c0d8ff489c411c8f45ffa97b7e659e9b701533ec195de9d25af0e5f0306f0beecb848ae44928645829c808a7a50e765e4181717d0fe2b2b9220bd82a65b2eeae9c226178c02b272dbd6d5ddd3746fef0e74b552616da11bd266ed865258e074f224d21b619f0d6c1a5a14a2ea99b65ee9f1bfe7651bcc973cacd90e03dab24233243e7cfd9ae751b7c12c25e35bf9b11835c36fda6a0e3ebbc764850	DrvInst.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5064	attrib.exe
4916	attrib.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxDrv\ImagePath = "\\SystemRoot\\system32\\DRIVERS\\VBoxDrv.sys"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxNetLwf\ImagePath = "\\SystemRoot\\system32\\DRIVERS\\VBoxNetLwf.sys"	msiexec.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 9 IoCs

pid	Process
4504	MSIA30E.tmp
3308	MSI41AC.tmp
4492	VBoxManage.exe
2084	VBoxSVC.exe
1196	VBoxManage.exe
2996	VmServiceControl.exe
4164	MSI4B13.tmp
2160	MSI4CCA.tmp
116	VBoxVmService64.exe

Loads dropped DLL 38 IoCs

pid	Process
4976	MsiExec.exe
4976	MsiExec.exe
4976	MsiExec.exe
4976	MsiExec.exe
4976	MsiExec.exe
1028	MsiExec.exe
1028	MsiExec.exe
1028	MsiExec.exe
1028	MsiExec.exe
1028	MsiExec.exe
1028	MsiExec.exe
1028	MsiExec.exe
2420	MsiExec.exe
4808	MsiExec.exe
4808	MsiExec.exe
4808	MsiExec.exe
4492	VBoxManage.exe
4492	VBoxManage.exe
4492	VBoxManage.exe
4492	VBoxManage.exe
4492	VBoxManage.exe
4492	VBoxManage.exe
2084	VBoxSVC.exe
2084	VBoxSVC.exe
2084	VBoxSVC.exe
2084	VBoxSVC.exe
2084	VBoxSVC.exe
1196	VBoxManage.exe
1196	VBoxManage.exe
1196	VBoxManage.exe
1196	VBoxManage.exe
1196	VBoxManage.exe
1196	VBoxManage.exe
2084	VBoxSVC.exe
2420	MsiExec.exe
4808	MsiExec.exe
4808	MsiExec.exe
4808	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	MSIA30E.tmp
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	MSIA30E.tmp
File opened (read-only)	\??\U:	MSIA30E.tmp
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	MSIA30E.tmp
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	MSIA30E.tmp
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	MSIA30E.tmp
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	MSIA30E.tmp
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	MSIA30E.tmp
File opened (read-only)	\??\B:	MSIA30E.tmp
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	MSIA30E.tmp
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	MSIA30E.tmp
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	MSIA30E.tmp
File opened (read-only)	\??\J:	MSIA30E.tmp
File opened (read-only)	\??\P:	MSIA30E.tmp
File opened (read-only)	\??\Z:	MSIA30E.tmp
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	MSIA30E.tmp
File opened (read-only)	\??\M:	MSIA30E.tmp
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	MSIA30E.tmp
File opened (read-only)	\??\S:	MSIA30E.tmp
File opened (read-only)	\??\V:	MSIA30E.tmp

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_f0c7ebe4311c787f\VBoxNetAdp6.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8bd8f698-ce75-9943-ba71-3be6b4ca6a99}\VBoxNetAdp6.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cb76540e-908d-e045-9246-6b8aa6c8c3b7}\VBoxNetLwf.sys	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_7FEC5776E5FF8B91C624DB61FDAA648A05638EB8\VBoxDrv.cat	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{8bd8f698-ce75-9943-ba71-3be6b4ca6a99}\SET18AB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8bd8f698-ce75-9943-ba71-3be6b4ca6a99}\VBoxNetAdp6.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9574bab5159a1997\VBoxNetLwf.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9574bab5159a1997\VBoxNetLwf.inf	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_7FEC5776E5FF8B91C624DB61FDAA648A05638EB8\VBoxDrv.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\.VirtualBox	VBoxSVC.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8bd8f698-ce75-9943-ba71-3be6b4ca6a99}\SET18AC.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_f0c7ebe4311c787f\VBoxNetAdp6.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8bd8f698-ce75-9943-ba71-3be6b4ca6a99}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cb76540e-908d-e045-9246-6b8aa6c8c3b7}\SET2A40.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9574bab5159a1997\VBoxNetLwf.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\DRVSTORE	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8bd8f698-ce75-9943-ba71-3be6b4ca6a99}\VBoxNetAdp6.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cb76540e-908d-e045-9246-6b8aa6c8c3b7}\VBoxNetLwf.cat	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\.VirtualBox\VBoxSVC.log	VBoxSVC.exe
File created	C:\Windows\system32\config\systemprofile\.VirtualBox\VirtualBox.xml-tmp	VBoxSVC.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8bd8f698-ce75-9943-ba71-3be6b4ca6a99}\SET18AB.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8bd8f698-ce75-9943-ba71-3be6b4ca6a99}\SET18AC.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	rundll32.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_f0c7ebe4311c787f\VBoxNetAdp6.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cb76540e-908d-e045-9246-6b8aa6c8c3b7}\SET2A2E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{cb76540e-908d-e045-9246-6b8aa6c8c3b7}\SET2A2E.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	rundll32.exe
File created	C:\Windows\System32\DriverStore\Temp\{cb76540e-908d-e045-9246-6b8aa6c8c3b7}\SET2A3F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cb76540e-908d-e045-9246-6b8aa6c8c3b7}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_9574bab5159a1997\VBoxNetLwf.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\DRVSTORE\VBoxDrv_7FEC5776E5FF8B91C624DB61FDAA648A05638EB8\VBoxDrv.inf	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	rundll32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cb76540e-908d-e045-9246-6b8aa6c8c3b7}\VBoxNetLwf.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{cb76540e-908d-e045-9246-6b8aa6c8c3b7}\SET2A40.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_7FEC5776E5FF8B91C624DB61FDAA648A05638EB8\VBoxDrv.inf	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8bd8f698-ce75-9943-ba71-3be6b4ca6a99}\SET189A.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8bd8f698-ce75-9943-ba71-3be6b4ca6a99}\SET189A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_f0c7ebe4311c787f\VBoxNetAdp6.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cb76540e-908d-e045-9246-6b8aa6c8c3b7}\SET2A3F.tmp	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\VST3\iZotope\iZOzone8SpectralShaper.dll	msiexec.exe
File created	C:\Program Files\Common Files\VST3\iZotope\Ozone 8 Vintage Compressor.vst3	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-triode-96000.000000.dat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel5_ks.cfg	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VST3\iZotope\Ozone 8 Vintage EQ.vst3	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qminimal.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VST3\iZotope\iZOzone8Dynamics.dll	msiexec.exe
File created	C:\Program Files\Steinberg\VSTPlugins\iZotope\Ozone 8 Dynamic EQ.dll	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\unins000.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_nl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_lt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxBugReport.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VST3\iZotope\Ozone 8 Vintage Limiter.vst3	msiexec.exe
File created	C:\Program Files\Steinberg\VSTPlugins\iZotope\Ozone 8 Spectral Shaper.dll	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-triode-48000.000000.dat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_de.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxWebSrv.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\msvcp100.dll	msiexec.exe
File created	C:\Program Files\Steinberg\VSTPlugins\iZotope\iZOzone8VintageLimiter.dll	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-dualtriode-768000.000000.dat	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-triode-512000.000000.dat	msiexec.exe
File created	C:\Program Files (x86)\VSTPlugIns\iZotope\iZOzone8DynEq.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDDR0.r0	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSharedCrOpenGL.dll	msiexec.exe
File opened for modification	C:\Program Files\Oracle	attrib.exe
File created	C:\Program Files\Steinberg\VSTPlugins\iZotope\iZOzone8DynEq.dll	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-triode-256000.000000.dat	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\License\license.txt	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5WinExtrasVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ol_ks.cfg	msiexec.exe
File created	C:\Program Files\Common Files\VST3\iZotope\iZOzone8DynEq.dll	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-triode-384000.000000.dat	msiexec.exe
File created	C:\Program Files (x86)\VSTPlugIns\iZotope\iZOzone8Exciter.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_sl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxEFI32.fd	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VST3\iZotope\iZOzone8VintageEQ.dll	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\Exciter Cache\exciter-dualtriode-352800.000000.dat	msiexec.exe
File created	C:\Program Files (x86)\VSTPlugIns\iZotope\iZOzone8.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_th.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel3_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxEFI64.fd	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxClient-x86.dll	msiexec.exe
File created	C:\Program Files\Common Files\VST3\iZotope\iZOzone8VintageCompressor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VST3\iZotope\Ozone 8 Equalizer.vst3	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VST3\iZotope\Ozone 8 Vintage Tape.vst3	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAuth.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetNAT.exe	msiexec.exe
File created	C:\Program Files (x86)\iZotope\iZotope Ozone 8\oz8_session_folder.ico	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_fa.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_fr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ru.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDD2R0.r0	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.inf	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VST3\iZotope\iZOzone8SpectralShaper.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\install\vboxapi\__init__.py	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\win_nt6_unattended.xml	msiexec.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\iZotope\iZOzone8VintageTapeAAXHook.aaxplugin\Contents\x64\iZOzone8VintageTapeAAXHook.aaxplugin	msiexec.exe
File created	C:\Program Files\Steinberg\VSTPlugins\iZotope\iZOzone8VintageTape.dll	msiexec.exe

Drops file in Windows directory 59 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\termmou.PNF	msiexec.exe
File created	C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\iZotopeOzone8_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\INF\termmou.PNF	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\MSI4B13.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB0DC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59940c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCBE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI297F.tmp	msiexec.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI4EAF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A72.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAEF6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\iZotopeOzone8.exe	msiexec.exe
File created	C:\Windows\Installer\e59940c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4CCA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF18F.tmp	msiexec.exe
File created	C:\Windows\INF\cpu.PNF	msiexec.exe
File created	C:\Windows\INF\termkbd.PNF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI41AC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e599409.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI99C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\iZotopeOzone8_1.exe	msiexec.exe
File opened for modification	C:\Windows\INF\disk.PNF	msiexec.exe
File created	C:\Windows\INF\oem12.inf	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI5EFE.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF22E.tmp	msiexec.exe
File created	C:\Windows\INF\oem12.PNF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B45.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\unins000.exe	msiexec.exe
File created	C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\iZotopeOzone8.exe	msiexec.exe
File created	C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\unins000.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI179B.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\	msiexec.exe
File created	C:\Windows\Installer\e59940b.msi	msiexec.exe
File created	C:\Windows\INF\oem11.inf	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A265742B-FABD-4816-A8BE-8C40F5642200}	msiexec.exe
File created	C:\Windows\INF\oem11.PNF	msiexec.exe
File created	C:\Windows\INF\oem3.inf	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e599409.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF1B0.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA30E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\INF\disk.PNF	msiexec.exe
File created	C:\Windows\INF\oem3.PNF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5E9E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5ECE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF1A0.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\cpu.PNF	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2844	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIA30E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VmServiceControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI4CCA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI4B13.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Checks SCSI registry key(s) 3 TTPs 63 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c311d2c4ba4812b50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c311d2c40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900c311d2c4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ac311d2c4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc311d2c4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MSI4B13.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MSI4CCA.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MSI4B13.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MSI4CCA.tmp
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MSI41AC.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF5BEFC3-4BA3-7903-2AA4-43988BA11554}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8E667B2-4234-1F9C-6508-AFA9CEA4EFA1}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9C0F5269-47AE-EE34-C2FE-53A16E388925}\ = "IMachineDebugger"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4BBC405D-F268-4483-9A52-F43FFDBF67F8}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48C7F4C0-C9D6-4742-957C-A6FD52E8C4AE}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B55CF856-1F8B-4692-ABB4-462429FAE5E9}\TypeLib	VBoxManage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4BD17415-4438-8657-E78E-80A40713A23C}\TypeLib	VBoxManage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE8A0EB5-F4F4-4DD0-9D30-C89B873247EC}\ = "IGuestMultiTouchEvent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBC59DF-4F4D-4CF2-809C-917601355AFC}\NumMethods\ = "26"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F73650F4-4506-50CA-045A-23A0E32EA508}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85CD948E-A71F-4289-281E-0CA7AD48CD89}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAAF9016-1F04-4191-AA2F-1FAC9646AE4C}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E20707D-4325-9A83-83CF-3FAF5B97457C}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1CDB6BF-44CB-E334-66FA-469A17FD09DF}\NumMethods\ = "36"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C19073DD-CC7B-431B-98B2-951FDA8EAB89}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8A0EB5-F4F4-4DD0-9D30-C89B873247EC}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{883DD18B-0721-4CDE-867C-1A82ABAF914C}\ = "IRuntimeErrorEvent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{334DF94A-7556-4CBC-8C04-043096B02D82}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F2F7FAE4-4A06-81FC-A916-78B2DA1FA0E5}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49B19D41-4A75-7BD5-C124-259ACBA3C41D}\ProxyStubClsid32	VBoxManage.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4EE3CBCB-486F-40DB-9150-DEEE3FD24189}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{14C66B23-404C-F24A-3CC1-EE9501D44F2A}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39B4E759-1EC0-4C0F-857F-FBE2A737A256}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8ADB7B0-057D-4391-B928-F14B06B710C5}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0026DC0-0C55-47B1-AA64-D340A396B418}\NumMethods\ = "34"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFCA788C-4477-787D-60B2-3FA70E56FBBC}\ = "IHost"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE35ADB0-4748-3E12-E7FD-5AAD957BBA0F}\ = "IMouse"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B14290AD-CD54-400C-B858-797BCB82570E}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1CDB6BF-44CB-E334-66FA-469A17FD09DF}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91F33D6F-E621-4F70-A77E-15F0E3C714D5}\NumMethods	VBoxManage.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31587F93-2D12-4D7C-BA6D-CE51D0D5B265}\NumMethods	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00C8F974-92C5-44A1-8F3F-702469FDD04B}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{92ED7B1A-0D96-40ED-AE46-A564D484325E}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8F79A21-1207-4179-94CF-CA250036308F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35CF4B3F-4453-4F3E-C9B8-5686939C80B6}\NumMethods\ = "27"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01ADB2D6-AEDF-461C-BE2C-99E91BDAD8A1}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF5BEFC3-4BA3-7903-2AA4-43988BA11554}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92F21DC0-44DE-1653-B717-2EBF0CA9B664}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91F33D6F-E621-4F70-A77E-15F0E3C714D5}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{69BFB134-80F6-4266-8E20-16371F68FA25}\ProxyStubClsid32	VBoxManage.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{269D8F6B-FA1E-4CEE-91C7-6D8496BEA3C1}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{788B87DF-7708-444B-9EEF-C116CE423D39}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{69BFB134-80F6-4266-8E20-16371F68FA25}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{fb220201-2fd3-47e2-a5dc-2c2431d833cc}	VBoxManage.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{232E9151-AE84-4B8E-B0F3-5C20C35CAAC9}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{334df94a-7556-4cbc-8c04-043096b02d82}	VBoxManage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{245D88BD-800A-40F8-87A6-170D02249A55}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8E667B2-4234-1F9C-6508-AFA9CEA4EFA1}\TypeLib	VBoxManage.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E8D3F27-B45C-48AE-8B36-D35E83D207AA}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F13F667D-3624-4AC5-99C1-3D982EBD8D98}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2514881B-23D0-430A-A7FF-7ED7F05534BC}\ = "INATNetworkPortForwardEvent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADF292B0-92C9-4A77-9D35-E058B39FE0B9}\ = "ICanShowWindowEvent"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{327E3C00-EE61-462F-AED3-0DFF6CBF9904}\ProxyStubClsid32	VBoxManage.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{883DD18B-0721-4CDE-867C-1A82ABAF914C}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\AppID = "{819B4D85-9CEE-493C-B6FC-64FFE759B3C9}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AFCA788C-4477-787D-60B2-3FA70E56FBBC}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B78DAEB-F52F-43B9-99E8-4A3C226CBE2D}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CDBC59DF-4F4D-4CF2-809C-917601355AFC}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DA91D4C9-4C02-FDB1-C5AC-D89E22E81302}\NumMethods\ = "16"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C48F3401-4A9E-43F4-B7A7-54BD285E22F4}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A51D9B0-0306-471C-81DB-EEC9D86846F6}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D23A9CA3-42DA-C94B-8AEC-21968E08355D}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3368	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3368	msiexec.exe
Token: SeSecurityPrivilege	4740	msiexec.exe
Token: SeCreateTokenPrivilege	3368	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3368	msiexec.exe
Token: SeLockMemoryPrivilege	3368	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3368	msiexec.exe
Token: SeMachineAccountPrivilege	3368	msiexec.exe
Token: SeTcbPrivilege	3368	msiexec.exe
Token: SeSecurityPrivilege	3368	msiexec.exe
Token: SeTakeOwnershipPrivilege	3368	msiexec.exe
Token: SeLoadDriverPrivilege	3368	msiexec.exe
Token: SeSystemProfilePrivilege	3368	msiexec.exe
Token: SeSystemtimePrivilege	3368	msiexec.exe
Token: SeProfSingleProcessPrivilege	3368	msiexec.exe
Token: SeIncBasePriorityPrivilege	3368	msiexec.exe
Token: SeCreatePagefilePrivilege	3368	msiexec.exe
Token: SeCreatePermanentPrivilege	3368	msiexec.exe
Token: SeBackupPrivilege	3368	msiexec.exe
Token: SeRestorePrivilege	3368	msiexec.exe
Token: SeShutdownPrivilege	3368	msiexec.exe
Token: SeDebugPrivilege	3368	msiexec.exe
Token: SeAuditPrivilege	3368	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3368	msiexec.exe
Token: SeChangeNotifyPrivilege	3368	msiexec.exe
Token: SeRemoteShutdownPrivilege	3368	msiexec.exe
Token: SeUndockPrivilege	3368	msiexec.exe
Token: SeSyncAgentPrivilege	3368	msiexec.exe
Token: SeEnableDelegationPrivilege	3368	msiexec.exe
Token: SeManageVolumePrivilege	3368	msiexec.exe
Token: SeImpersonatePrivilege	3368	msiexec.exe
Token: SeCreateGlobalPrivilege	3368	msiexec.exe
Token: SeCreateTokenPrivilege	3368	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3368	msiexec.exe
Token: SeLockMemoryPrivilege	3368	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3368	msiexec.exe
Token: SeMachineAccountPrivilege	3368	msiexec.exe
Token: SeTcbPrivilege	3368	msiexec.exe
Token: SeSecurityPrivilege	3368	msiexec.exe
Token: SeTakeOwnershipPrivilege	3368	msiexec.exe
Token: SeLoadDriverPrivilege	3368	msiexec.exe
Token: SeSystemProfilePrivilege	3368	msiexec.exe
Token: SeSystemtimePrivilege	3368	msiexec.exe
Token: SeProfSingleProcessPrivilege	3368	msiexec.exe
Token: SeIncBasePriorityPrivilege	3368	msiexec.exe
Token: SeCreatePagefilePrivilege	3368	msiexec.exe
Token: SeCreatePermanentPrivilege	3368	msiexec.exe
Token: SeBackupPrivilege	3368	msiexec.exe
Token: SeRestorePrivilege	3368	msiexec.exe
Token: SeShutdownPrivilege	3368	msiexec.exe
Token: SeDebugPrivilege	3368	msiexec.exe
Token: SeAuditPrivilege	3368	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3368	msiexec.exe
Token: SeChangeNotifyPrivilege	3368	msiexec.exe
Token: SeRemoteShutdownPrivilege	3368	msiexec.exe
Token: SeUndockPrivilege	3368	msiexec.exe
Token: SeSyncAgentPrivilege	3368	msiexec.exe
Token: SeEnableDelegationPrivilege	3368	msiexec.exe
Token: SeManageVolumePrivilege	3368	msiexec.exe
Token: SeImpersonatePrivilege	3368	msiexec.exe
Token: SeCreateGlobalPrivilege	3368	msiexec.exe
Token: SeCreateTokenPrivilege	3368	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3368	msiexec.exe
Token: SeLockMemoryPrivilege	3368	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3368	msiexec.exe
3368	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4976	4740	msiexec.exe	92
PID 4740 wrote to memory of 3988	4740	msiexec.exe	105
PID 4740 wrote to memory of 1028	4740	msiexec.exe	107
PID 4740 wrote to memory of 4504	4740	msiexec.exe	111
PID 4740 wrote to memory of 2420	4740	msiexec.exe	113
PID 4740 wrote to memory of 4808	4740	msiexec.exe	114
PID 3772 wrote to memory of 2940	3772	svchost.exe	116
PID 2940 wrote to memory of 1648	2940	DrvInst.exe	117
PID 3772 wrote to memory of 5068	3772	svchost.exe	118
PID 4740 wrote to memory of 3308	4740	msiexec.exe	120
PID 3308 wrote to memory of 2844	3308	MSI41AC.tmp	121
PID 2844 wrote to memory of 4492	2844	cmd.exe	123
PID 2844 wrote to memory of 1196	2844	cmd.exe	126
PID 2844 wrote to memory of 1464	2844	cmd.exe	127
PID 2844 wrote to memory of 2996	2844	cmd.exe	128
PID 4740 wrote to memory of 4164	4740	msiexec.exe	129
PID 4164 wrote to memory of 5064	4164	MSI4B13.tmp	130
PID 4740 wrote to memory of 2160	4740	msiexec.exe	132
PID 2160 wrote to memory of 4916	2160	MSI4CCA.tmp	134

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5064	attrib.exe
4916	attrib.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Setup Ozone 8 v8.0.2.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3368

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A7BB43E0816AC2E1121E434D3A271802 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4976
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3988
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2D560F29751BE48084E5C6D1D883C753
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1028
- C:\Windows\Installer\MSIA30E.tmp
  "C:\Windows\Installer\MSIA30E.tmp" 19 IC:\Users\Admin\AppData\Local\Temp\plugins_tool.msiNV
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:4504
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0018BAED3C0021C3CB64C1A1298576F1
  2⤵
  - Loads dropped DLL
  PID:2420
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CDB99FACE6ACD3469FA7E37AB158BC97 E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4808
- C:\Windows\Installer\MSI41AC.tmp
  "C:\Windows\Installer\MSI41AC.tmp"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\41CD.tmp\41CE.tmp\41CF.bat C:\Windows\Installer\MSI41AC.tmp"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - \??\c:\Program Files\Oracle\VirtualBox\VBoxManage.exe
      "c:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setproperty machinefolder "C:\Users\Admin\appdata\roaming"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:4492
  - - \??\c:\Program Files\Oracle\VirtualBox\VBoxManage.exe
      "c:\Program Files\Oracle\VirtualBox\vboxmanage.exe" import "c:\vms\tmp\sys00_1.ova"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1196
  - - C:\Windows\system32\xcopy.exe
      xcopy /Y "C:\Windows\System32\Config\systemprofile\.VirtualBox" "C:\vms\.VirtualBox\"
      4⤵
      PID:1464
  - - C:\vms\VmServiceControl.exe
      "C:\vms\VmServiceControl.exe" -i
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2996
- C:\Windows\Installer\MSI4B13.tmp
  "C:\Windows\Installer\MSI4B13.tmp" /RunAsAdmin /HideWindow c:\windows\system32\attrib.exe +s +h "C:\Program Files\Oracle"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\windows\SysWOW64\attrib.exe
    "C:\windows\system32\attrib.exe" +s +h "C:\Program Files\Oracle"
    3⤵
    - Sets file to hidden
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5064
- C:\Windows\Installer\MSI4CCA.tmp
  "C:\Windows\Installer\MSI4CCA.tmp" /RunAsAdmin /HideWindow c:\windows\system32\attrib.exe +s +h c:\vms
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\windows\SysWOW64\attrib.exe
    "C:\windows\system32\attrib.exe" +s +h c:\vms
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf" "9" "4e41c48b3" "0000000000000138" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6"
  2⤵
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{5081c081-8d7f-ec43-adda-b212883f983d} Global\{0669fecf-5792-7849-8be1-e98a9ff7c81b} C:\Windows\System32\DriverStore\Temp\{8bd8f698-ce75-9943-ba71-3be6b4ca6a99}\VBoxNetAdp6.inf C:\Windows\System32\DriverStore\Temp\{8bd8f698-ce75-9943-ba71-3be6b4ca6a99}\VBoxNetAdp6.cat
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:1648
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf" "9" "42c633047" "0000000000000158" "WinSta0\Default" "00000000000000BC" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5068

\??\c:\Program Files\Oracle\VirtualBox\VBoxSVC.exe
"c:\Program Files\Oracle\VirtualBox\VBoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2084

C:\vms\VBoxVmService64.exe
C:\vms\VBoxVmService64.exe
1⤵
- Executes dropped EXE
PID:116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBoxNetAdp6.cat

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\network\netadp6\VBoxNetAdp6.cat
Size 16KB
SHA256 5ce0e441c1af1fd6cb78d0a1a2f18c329be171c0f15f15bdcabf685bbc762549
MD5 ad3a6e2d0ada67d8253e802ab3514e5a
SHA1 53503dd37277f3432760e91742502a76319bdc9a
SHA512 7513e98b15f44086f0c4a1fdc65dbd82a579ecbd02eab28debcedbb434f4b7fbe5e351232db1cb3ed245c6b6ecb5c245cd35c7fdc55d44eada9429aeb18dd32e
SSDEEP 384:gnYPLdUHeMDIIIJOUyDD5JNNzFwhhim6I:g2IIJGp3whT6I
TLSH
T1C072F8DB0E2D6452EECBDE9191C5D26B9C30B7E26DC458AB107AD2815EC2FE13B4D40E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxNetAdp6.sys

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\network\netadp6\VBoxNetAdp6.sys
Size 208KB
SHA256 1b00cdcc40fc1edff68df26a062469a41f0048e148cc3b73d791bfe6e124bca2
MD5 8df0fb7a43e52dd313b340f8a25bcfd1
SHA1 cd7abd30a2312ab2921f4efe003ed170901f10ac
SHA512 44a81cc9ab23b7f8c1b9d4a3a2c81a546d8980f6d31af5977eaa3e9e6362be482b229a84233ba57b230dea636800663049da61a3cfef0c4c787efbaecb02447a
SSDEEP 3072:fcO+Xf78l7WAfejQfnC+C9tfivasmnpKw1zOEP4vBq+IfZwNCVkW692xJh:fcOq9fjsmnR1qEgpzsVyaz
TLSH
T1B8246B53BAC839B6D59F523688924A4AD277B8920310C2EF175162E6CDD3FE31EBD704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxNetLwf.cat

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\network\netlwf\VBoxNetLwf.cat
Size 16KB
SHA256 3374c60dcc434438a3f3d717cd71dd13a1218b93b9f0449aaa24bacd3c7fc0b2
MD5 5c610c4f3541fe5450e23dae1f1c307b
SHA1 c64b99204476dd10db05bbd246ae634491e74900
SHA512 039d409a0b61f69cd5e059f99454527b90c7a09161ce96c62046b0b3d622a55d749e102e0185fb9ae19b2219533b41b82bacb976eab51ba04938028178ab9269
SSDEEP 192:Y9jy8znnYe+PjP6rr8JjtlAur9ZCspE+TMwrm6Z1QGnKy9cclPJwBjtlA8wH0JOQ:QnYPLdUHeMD6ZqzIJOU85JNNzFwhhi/P
TLSH
T12172F9CB0E2D6452EECBDE9591C5E16BDC30B7E1ADC498AB10B6D2815EC2FD13B0941E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxNetLwf.sys

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\network\netlwf\VBoxNetLwf.sys
Size 217KB
SHA256 c0803ab53637fd9f391d488a9a67efc308ebd0e179a93cbc3cd4d9e27beb9cca
MD5 abb7120fd153f484ea1fcd4ec35907bb
SHA1 b721aa821a13fba9380d4cef21107cd9f9e73500
SHA512 4b2896c0b4fc599c3616c8c26a053ce4972c60e33de574f3523410e73414e5473f523aa729150d23f68c7aee90150da9849342abf5401fca0c80df941c7907e9
SSDEEP 3072:YjqVoIgoCfFSjIfnLXZr7M+cct7E4mnpKz1zHCpmjVZwreWopXrJo:Hv47xE4mna1upmjT1rC
TLSH
T1DB247C57BAC439B6C59F82364852468AC3B7B8660310C2EF1351A2B59DD3FE32DBE714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ozone 8 Vintage Tape.vst3

Path C:\Program Files (x86)\Common Files\VST3\iZotope\Ozone 8 Vintage Tape.vst3
Size 2.3MB
SHA256 4532be392ce0d77fb0a2e53995acdf80a0b03079f7adf8f5444cddf124060153
MD5 586b1ffe1c8aa03fb849acc9d62115b0
SHA1 1e1c430f5ac89d094b6a26104b3d5c72d4bf0335
SHA512 8aa08e4092392e646cfe99f0534bd33f3595e3d937dd11cb2b171864c72cf86dea3b8c1e26a12b08c5f50f7f75dd82db4e6237568bf433f24189c4d363f9ef7f
SSDEEP 24576:I9kns9qZqinFaDHutJwuhKFvaKFvwKFv/vaJZhRxf3ti0Jgyzan5wwm5wwm5wwmv:SHumnyMf0RdTDrPWjBs7wU3m8
TLSH
T1A3B59D81E4D3D7B0C59809B0293F7BDA59345E9D4BAC4BF392D03D2D8CBB9C016A3A56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ozone 8 Exciter.dll

Path C:\Program Files (x86)\VSTPlugIns\iZotope\Ozone 8 Exciter.dll
Size 2.3MB
SHA256 57a8d859686511e1a1e80da9dad892a4c692d5e73304342075e550dff2626a90
MD5 112ab9d3b32363cf893bfc41489da832
SHA1 6d108af0ba19818dc233b7abd4a9e35e7d1a7388
SHA512 45ff27b0c86b6b18013b8da834ed77dd5e9c03b41a29c1ece85e3d7814422504ed09325d3a1e015c02641ab07d09d885f7509fd58cdfb818fb819b789bedbb79
SSDEEP 24576:Q9kns9qZqinFaDHutJwuhKFvaKFvwKFv/vaJZhRxf3ti0Jgyzan5wwm5wwm5wwmd:6HumnyMf0RdTDrPWjBs7wURm8
TLSH
T1C5B59D81E4D3D7B0C59809B0293F7BDA59345E9D4BAC4BF392D03D2D8CBB9C016A3A56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ozone 8 Vintage Tape.vst3

Path C:\Program Files\Common Files\VST3\iZotope\Ozone 8 Vintage Tape.vst3
Size 3.0MB
SHA256 87486edf1cabd66676e27b276fbe08b5f097f163d65d066a45022e5558c8b0b7
MD5 f0a60150be7b30ca65036358f28d3484
SHA1 1cb902894182fa9196bbda02ae79467f945494e7
SHA512 810cb37e38a55ef88be4313cf9d02663a13c76d8ea4c5c889890dd6de19eb856670bea312769c5d19321254d1d22fb2852743e075029d02d71a920a47445011f
SSDEEP 49152:rIqXOXmPqYCQCVCpGzGsCouebAnQiP0N7FT0+BgreVJNIY:rYdAnqfBuU
TLSH
T177E59D86E4F6A1E9C512807556BF3646BD23384C076C2EF341E676381E7FAC02A77E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxManage.exe

Path C:\Program Files\Oracle\VirtualBox\VBoxManage.exe
Size 1.1MB
SHA256 1501aa7411b32e9cc68aff391e7ff81ec515182456edf0d1999ef1633c64fdbb
MD5 44157a6d6548989c1255b08c85393641
SHA1 bdae3dcc5c4a1b5b657fa6f8af856f70fe2112b0
SHA512 63fde9f6af8f17d00859d9e3f24c7e1192a5fce1f9cc01832ead0e367b67345ca2980358ba4fbc9b7ec6a42206f54586f3ef3fb8e16974d8a392113d783005d8
SSDEEP 12288:25mRjk2aj9nnfC3I5jq+EsTpFq1vThYZ9bxTo4cNdJF53MQ0/mfzq2wid:25IklfEI5LTzqNhY7bxToTdJF539pd
TLSH
T154356C27AF784190D475C03A8DB66213FBB23449173097E7798D9E2B0F27AB69D39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxNetAdp6.inf

Path C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf
Size 3KB
SHA256 e8d0afbfa64f52384af95a632e35b002cede1d84dc8bea42daff3942e0f3b391
MD5 5a4247dadcd00874c579d605ce64219e
SHA1 33949ad3f41b72140097b78e0d21903c2c28a8b4
SHA512 1ce707b4796e93c532be5b660f42fe7341639b83bcd1a7599e3fdbdab677fcb8d45ef748f97aae1d4436b6baa1ab4c387c4f21401ed8149f1b838c5abc43af10
TLSH
T1A26130BA64B11733DE33144A9F4A59C3B724008738AB182575AEC97F538ED1C537E9E4
MD5 SHA1 SHA512 TLSH

Submit Download

VBoxNetLwf.inf

Path C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf
Size 3KB
SHA256 9f0536e1002f5b7bd12946dfbea065d6a141061518ef0c6e25c6c9b65c6e4cf6
MD5 ca51d8c7d4fbebf19726f0e8a25ba85e
SHA1 58857f2c6256b005b348972022d3b23fc1398b2f
SHA512 c853c981eac5e79551f11c29f74b06f99a4f00fa259aef709f41bec26e4ebdd5c80c20d55158bca784a34dae8c2740f1d9707a95f1fbd73193d5a932e71ff4b7
TLSH
T11481855A45B12F711D42644AAF461E86BBF9004305AA2868B5EF89F743CED0C32FDDF4
MD5 SHA1 SHA512 TLSH

Submit Download

VBoxDrv.cat

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.cat
Size 16KB
SHA256 d78734d7fd3e50166dfb02a71f87e6171d6a29c530ea731c8940fca789f14b94
MD5 c77e30b8e9c1c58199f31b483847c1c9
SHA1 7fec5776e5ff8b91c624db61fdaa648a05638eb8
SHA512 510bc6652d0da32460e232935b625c94fde6c96093b2dcbe049ba916a977bec86f9cac1e637b8845991e993f2fcec0a8d48562a77dd234baca892311e7117838
SSDEEP 384:mgnYPLdUHeMDB7oWIJOUSTR5JNNzFwhhi2Z:mgvIJi3wh7
TLSH
T1A97208CB0A2C6453EECBCD9192C5D26BDC34B7E1ADC448AB50BAD2815EC2FD13B4940E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxDrv.inf

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.inf
Size 2KB
SHA256 69acdf87395b541c113337b2658b6047ffcdab462f2287ac88441312ed2fbe96
MD5 10ea8fc160345326b48af0b6a2cbbc04
SHA1 f9c435d557ae6e53a27ae62dbdc1c1b4e3fe5c74
SHA512 b75700148420698fb34a2c445116c9255799f77b9b81e1f4d2cead5b6e9d41ad35f759f5c5f7212bbf949ba40654659b079fa3c2d8c5db508c857748068402d3
TLSH
T1BF51628981C0477179375956178F9AC3F3E5122418EB902071EED834535EF2CC3B19FA
MD5 SHA1 SHA512 TLSH

Submit Download

VBoxDrv.sys

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.sys
Size 961KB
SHA256 0a889cbdf5e35ac3f02342d89ab812b82fa1660f55b2af0d08724337db0526ce
MD5 f2b8d6914a4f1edded7dd49d66afce7f
SHA1 d3339203528fa272f010b0c8746162062f7bcb4a
SHA512 a12b7ce774e0566b0dea70adc816e80fb7becc774ca5925b8fd5aa43a1bf0f3d97e0ba4b35f65a9aae3b7bbeb05d029cebd68f30c9936ce221023ba4f90c6f6c
SSDEEP 12288:1npzwQTdZ/QkGapOwtDDDqnp6F0SMcLnKDoEeAyI:fwQTQZaDDDDqp6F0iLnKDWI
TLSH
T111259DA6B69819F5CAAF9239C6915607D2F234410720D7EF0AE086B53D97FDA0F7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Program Files\Oracle\VirtualBox\msvcr100.dll
Size 832KB
SHA256 cc2c2848bc601170539e579de62575546bddec5dfa600aa0b32eedb7d664de20
MD5 63519a5664d75ab339fcd7e20e102a28
SHA1 60f13c73418532fa4bff24984f741b46a9d6dc49
SHA512 9ebe85096ab93e7f91ee910a6568278658acdb7b85837db5841a63b157f06dda4fd5edafc84a25e05dbff354d4640c5ce2a7b8b9db7ce06176cfe60a9e6934ae
SSDEEP 12288:NgzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGoko+/Q:azJetPMw9HfBCrMb2Kc6ymyyKWewGz8
TLSH
T184059D9536A906F6D137D63DC996C606E2B2741517315BEB01A04BAB2F23FE09B3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ozone 8 Exciter.dll

Path C:\Program Files\Steinberg\VSTPlugins\iZotope\Ozone 8 Exciter.dll
Size 3.0MB
SHA256 55bec231b7c22f3b787e54918201dbaf2ffcada9f21cff7887131631eb219fc2
MD5 e977e41c909e59ed523898cd6d5677ab
SHA1 183b964aafa6d2be9662ebf19ac440cba9c72b02
SHA512 25e0e8f96df3207559040e43fbb9524f00ed7ec837bff284cfc3401dda961d5ecbd0cf656df6f36c41da9926fe5dcba2f7a3060132237d9fa74c602ee13530cc
SSDEEP 49152:bIqXOXmPqYCQCVCpGzGsCouebAnQiP0N7FT0+BgreVJNIY:bYdAnqfBuU
TLSH
T1BAE59D86E4F6A1E9C512807556BF3646BD23384C076C2EF341E676381E7FAC02A77E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41CF.bat

Path C:\Users\Admin\AppData\Local\Temp\41CD.tmp\41CE.tmp\41CF.bat
Size 431B
SHA256 b6d34fc405916c01e421bd4e624d5130b5a3174d98641ac0f3bb479a9cd43ab9
MD5 e3bcfb80776891be0a67ae07c1f29005
SHA1 b307f35e42072ccf20e51b265f739712474dd673
SHA512 b424f3764bfeaf597d4abfa86e451ce6fe5264f78743ffa8149fa5503f07f3290ea4e1fa236aac41a5af536d962cf08e861b4d25a5afcfbfbd81cba4734349a3
TLSH
T15AE0A34A5251BE011047ECDEBBF55EC2D837D2493BC54B513390064DB65649D24C6C1F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI594.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI594.tmp
Size 337KB
SHA256 1cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d
MD5 dfe7442a09a0809f22e0806040a0202e
SHA1 e6f76a86fa46e8e2c659c1c326457e6eb6b253f6
SHA512 331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197
SSDEEP 6144:XRk+8r6fC+fXQMpCNZABJsRrD6ZAOXtAQgxDVkQ:K+8r6ZQMpsZwLNtODVkQ
TLSH
T1CF747C2176D6C837D6BF0DB03A38DA9A402D7E649BF1D4EB43E80D5E09724C35639E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpu.PNF

Path C:\Windows\INF\cpu.PNF
Size 18KB
SHA256 29549d08eb8bc57a5feebd9b73900fdc05187f182aff2f32c712ecf728d2ed24
MD5 731107570a877a40f1d2d8e6e34e5de5
SHA1 4c05509fae5825c41ba0b8380f422156605e487e
SHA512 c365d5544dab8718f87d0912524daa2c7b26e8e40d48b8a38734b6b87262b8c4e448b35ad8c4a9396889b011626cf13e776baff4018d24d50713c51860ba55df
SSDEEP 384:9iF5rs1w0jZysKo7/ZFaruCpwmWuoBVd1aTA+Zrq9D1GD7oiYI62kYuptzyShf2v:0jr+LCGMfqppX6tSW6PvPQwhBhiCif7x
TLSH
T19C82AB4172EC4F25F1B60E706EBAA0E5886ABED16C12C71F2160735C1872FD5EEB1726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disk.PNF

Path C:\Windows\INF\disk.PNF
Size 16KB
SHA256 9c23b378297326de5b1c2977f0c2a09c494c9eb25c2e66ee3dc8fcc03905b8cd
MD5 86bf7bcd60c5b1c2b0b0a2486ae72f59
SHA1 7a2a6ed1bc36a0824e4c71e51785d759e3e91850
SHA512 0974115068807bef45edeb7eaa99d2217d3d0fe096b5a7ead92c0ce2726d8ec6eed6da4652965ad15d7db3f304fcec3ce71d64514ae52da91a1794838ec8854b
SSDEEP 192:Dz2n//uIsmr+orMYzR7QN8kNWcY9WugffZw1jt2Asqr3RqTT9M4IA2uhULOt:3tId+oXzR7QN8kNKgBP9I1uhULOt
TLSH
T10F7223A17BD9CA14F4F2AE7AAEF551D644257CC19C02DA8F6460731E4C33BC0D6E1B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

termmou.PNF

Path C:\Windows\INF\termmou.PNF
Size 7KB
SHA256 0a696749dbf402a2a3f87ebd71caa9c9beea3238b4b883f6c2d0992ac4106300
MD5 5e8aeff2e5d275aba999bec0e7f989ee
SHA1 87e14b8946e5b5cf90e0f452561c65277a9b631a
SHA512 74f9312e8867950a804818b04651b7b7b63eff69946defec6a067690bc76ec64c198e1e8224436e2b3aaec732494cc66c32bea4174474a049571676c38d64e86
SSDEEP 96:btjxAkMoktxFol/ne66ymciR/uwST0I90Bh0FzXy1bmzPVq0UT:Z/ktbolPi1cidu5T0200bVq04
TLSH
T143E1124973E98F15F1B56E705CF064E64866BC929C11CB1F3264B35E5832AC4DBF0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI179B.tmp

Path C:\Windows\Installer\MSI179B.tmp
Size 650KB
SHA256 07694439a93f220f5e9f46ac3ceb0b22fe1dadb3ed9bf18a9f2835be7a5c3bc6
MD5 6aa987dbea3f424fa44cd541dbae7368
SHA1 47ba276719f0a3e25e24fb546ecad8b97b6ebe67
SHA512 c5c5901bcdfdb413cb679d39c90a4fa64e96ad10d25476c62e2d2276bdc1cf8a5b4d987f881acb701ffaaa22662b64442e399f1aa8cb6ff5c761e03c474756a2
SSDEEP 6144:R11HMbt9eFVmIGccehSleghteGzRSDWFQ//fo4CyRg5Sy3rRsaCUhsm27QE:w5cceNKt7zRy/zCyas8ROUOVb
TLSH
T185E46514F9B80525E163997FA2A29E5DD17239861731CACF0302DBF61D3B5DA8632F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI41AC.tmp

Path C:\Windows\Installer\MSI41AC.tmp
Size 120KB
SHA256 bc6009a3a842c5782135822defe5f81cd93228ac91bf44041eb01683b6611b49
MD5 311c52c61e1b78c8a91e578318409da2
SHA1 f4897cb778779e21f1bbb6416f1387458401afa3
SHA512 c99970e9854bc5c7cca946af538f38e63c6496d4de7500c94e21b4349bc79ec605d34ec3516f944f7850b698276379be639a4a7965c1d53ed8b71135bdca7239
SSDEEP 3072:+2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcXKJ:/bJhs7QW69hd1MMdxPe9N9uA0hu9TBLJ
TLSH
T13CC3396AB2E01198DBB581F6D9921706EB7074321B15A3DB5BB853B31B2B4C68F3C3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA30E.tmp

Path C:\Windows\Installer\MSIA30E.tmp
Size 195KB
SHA256 e8d7e531c82777c8d5df06f1620abe6553e162b82332198a2854c576993ca12c
MD5 df08a8afe035f33067d1eb34c1a055a0
SHA1 72a707e305d40e8dcde9c31a9ab36297238aeb64
SHA512 87dd3bdf99d497126e6ea8647d2fac18ba6277b69e696465e4382f27ee8b790ac05a2ed704a5defbd56aed011d3105bef4d016803feea862732d6983399370b1
SSDEEP 3072:CBWSL1NOrQsUNEbdzorgK5n4aqcgxfPJ4ecOOwxwZOAg0Fub6RpI1Ubs/7BFNis:CISL1NswEbdbagx6CAO+bRg/F3t
TLSH
T19514592039E3C472D4B2093119F89A76596DFF700FB159FB13D8872D5EA42D20635EB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB0DC.tmp

Path C:\Windows\Installer\MSIB0DC.tmp
Size 246KB
SHA256 43d37b1804e16196f3d7fc69646cc78d6dc30253a51b9296d86d123c8d8a6172
MD5 84df8f04cafbe1e18b46d4c8729b15eb
SHA1 3c0225aa16161ccfe207fe3ba985a0ba9c9dd2a4
SHA512 a0255830f5cc9ace1e91b968c85cf7e3e322ebdaa27598403008abf01527a58d0bce79857db81702133f8b9582d7dd31c5f675108e48771561ae3c43f63c9ed1
SSDEEP 3072:A8bYc9TDBWFG2HWDUvYHdQLM1IYSAPCQuKLzVkYNDRt4qb/IOAg0FuboibZyf1Hp:ZYjpLwIYZCQu6nAOcXlkiZC2
TLSH
T13B347C507592C136D5BF46710A799F6A84BCBA648FB0C8EB23D40E6E9D319C31A31E37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC7.tmp

Path C:\Windows\Installer\MSIC7.tmp
Size 107KB
SHA256 16c4cf37242385f27d2625ee8b660b745342ef8340541e6c7e4673522ed13956
MD5 cf6354b5789cb6b9691b8896e255a378
SHA1 e9429ffa42b00f45073fa1989f92c2c27d7aad86
SHA512 7ba049a5ec80d94763d44c7cdc85d2e94b4edfe5db2ce575d594e4914f321bbb730f60b33f2ff9f58f359ce4f4b35dd5efbaad670c30c31dd836735110776202
SSDEEP 1536:zCDvWcAQcnkygLVSA10DUXqUWqJ76Yjfx6Luy/ViX:DkyASA1CUdRLTy/QX
TLSH
T115B3F915BFBC0029F1716A3E95E25528E1753D822B3187EF2D02A7DA1E37AD58436F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iZotopeOzone8_1.exe

Path C:\Windows\Installer\{F1AB2AA7-2F1A-41F4-A610-47AEE35AE6D9}\iZotopeOzone8_1.exe
Size 373KB
SHA256 7cba1c990bd8533351be471f59223bf25754170aee77797c598db0d6baf95725
MD5 eae615d3da6b59e28d9fc2a41b0f426e
SHA1 a204d55f0496a1d04b3a8380d00cfff70ab605ad
SHA512 dffdd5cde7ac9eaa72d3a3344ae80b3424e34080e0113374fae2740f254507cefba2927b328f24226c692ffed3e4335a23463c814de97ebd0502a54ee940d10a
SSDEEP 6144:kbLXuPumdJCkIDZbIj8GZe/1MocnS1AJwFVerzoVP+mNg5iUcHxWZ5sJwO:kPX25dIkI1kj9KVcnSRSIVpNJUKWZ5w/
TLSH
T1CB84234EF669C873FD8372750B45CE303BB96D53A130587940C86863BD8A676A4E163F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 37KB
SHA256 a5a032f725ea793bd634e514772fb56675f4f15d4d7f89c4bad5d4a7e2bcd9f2
MD5 927c8ffe7be435409b4b24c89aca9d74
SHA1 9f10ae44467d15e86cc0cd65c468d29ab168246d
SHA512 ffa99012758db962226ef624aa5f6c25c10839008eed0a5e1e7be60857d685d21b86ca154ef50d54c8646ce3d4cfea38ffc35dd9c7bd42712a53218847df3414
SSDEEP 768:sX+Qat/xDuUdbUOh9JUM90gw9WYvYURJcS2B1r0h3XGPCLzWALt2j4V3xLU+/6a5:sX+QmxDug/3peZtIJnkhY0SLhJakDYEO
TLSH
T12503EA0461E88514C6F509623676EE70C5BB95DBB71B1EEF30AC6718D9C2F042FBA06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 37KB
SHA256 0aca685b979420baddaaa1643036a515480fa448e27b70866b01f0b1d6b6cd2f
MD5 0f6312eb86719274f346084e816de4f7
SHA1 f0152580d317fed0ddff0987fedea0073ca37af2
SHA512 b5a828b10f569c1fadb244e62f09cb80e1cb09a88796f2348689a0e3d454a8b544ea86db931f5dbce84d20e270815c9edf4eed185241b54200e0e9c2d1f62bd3
SSDEEP 768:sX+Qat/xDuUdbUOh9JUM90gw9WYvYURJcS2B1r0h3XGPCLzWALt2j4V3xLU+/6aj:sX+QmxDug/3peZtIJnkhY0SLhJakDYEe
TLSH
T12C03EA0461E88514C6F509623676EE70C5BB95DBB71B1EEF30AC6718D9C2F042FBA06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 37KB
SHA256 7050e0ebff2235166454153be2e6ce9c45f85a484848bd069edb34f41829313e
MD5 bec23601d48f7e11832b07c63a858f09
SHA1 62ee6a4512347ede8f7adf23411bffb2345ffdaa
SHA512 c34b31a2c4467f01d9107b5e93b8412642005c4c36e861bee9bf56921a440dea68cfcf6bcfe06bb760b06a3ab22db3809c2584e1be9ab2183e7c6c9efdccca66
SSDEEP 768:sX+Qat/xDuUdbUOh9JUM90gw9WYvYURJcS2B1r0h3XGPCLzWALt2j4V3xLU+/6af:sX+QmxDug/3peZtIJnkhY0SLhJakDYEu
TLSH
T13703EA0461E88514C6F509623666EE70C5BB95DBB71B1EEF30AC6718D9C2F042FBA06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 37KB
SHA256 0abfa53920f2f31bb344a2802589621b9f1bc97e3748b0a03f19b12f606369b6
MD5 ce3af9ecf1275fab227cd5f347067735
SHA1 66dce8989c35193c80fab9fba58ab8c1e31b5532
SHA512 b47b8547f9f4082805073156faaac54ebe145dfbc67aa1b5e2d79f6301caba21b34f25c6fbe834481ccaede702e50fed525ee9eda264dab36c57008fbef4de05
SSDEEP 768:sX+Qat/xDuUdbUOh9JUM90gw9WYvYURJcS2B1r0h3XGPCLzWALt2j4V3xLU+/6aX:sX+QmxDug/3peZtIJnkhY0SLhJakDYEm
TLSH
T1C603EA0461E88514C6F509623666EE70C5BB95DBB71F1EEF30AC6718D9C2F042FBA06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VirtualBox.xml

Path C:\vms\.VirtualBox\VirtualBox.xml
Size 1KB
SHA256 5fe152a7c5958e936cd0062c732faa008a0b4eb682d2191dac14ddd9e927f5b9
MD5 4f449193addfb673eda6ac6eacebdfe1
SHA1 94d2dd7c3b27a79d26ad808f169b9e0f01598a1a
SHA512 2055245c2d7b8f1645e8789981be8ec03f19c81f29e3bbce4f019d96ffe01979b3aa3e657c03888dbcadf277ec2f321f2094a028c1def85b099140ef1e82c252
TLSH
T1BD11420D82F0A92501C0094F1F008680BF13059F8C5B4039F3FF3DD51796ACF526266A
MD5 SHA1 SHA512 TLSH

Submit Download

VirtualBox.xml-prev

Path C:\vms\.VirtualBox\VirtualBox.xml-prev
Size 949B
SHA256 82e73076661b0803aeeb03d255d1531b0ba1627e7bd58249fd38d42fc2158319
MD5 5a0c4440e23a542ccf3117aa9be3cd5e
SHA1 732fe477cb49d619b956eddac874319e729b8d70
SHA512 00b940789c226cb804afd0d987e32a772051ed0ef8c998499fdbb908aa69563638dc1d491cd4269668784bbcadefdcb200debb82d52f9a51332e5b9bd61f125d
TLSH
T15C11D00ED2B4A92545C1094F1F018681AF13459F889B4029F3FE79A61769ACF1366A66
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 cdd310344192ec5b9eee23318f3706c8db54d84a056e6757511b789b395b8a24
MD5 55a83b92b86654990d480c1667dfdbbb
SHA1 2e53a662af8c4d082e6ae3c9251b8ee655f1da93
SHA512 fc984cf428e971ef9d57ed476f7cef88b2d8708f07d5b0baaf9654289e70933545bc4d995b62e1d503dbfb83162f5793fab4e1ab39203ff35a7168b6c1d0036c
SSDEEP 24576:ou8m+1zBdoO/vvTLr28epm649lUTE1MCQKGN+Ttl00aNOrFhIvVlk63xJ:u
TLSH
T11E47902837F92200E7F79E3D68F06A234D3A7D5B9C199E8D45451B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{82de581e-fe2c-4fd6-b9ff-390fbac76d92}_OnDiskSnapshotProp

Path \??\Volume{c4d211c3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{82de581e-fe2c-4fd6-b9ff-390fbac76d92}_OnDiskSnapshotProp
Size 6KB
SHA256 8d4356af62fed5b734a862a5173e09c63319cff26bd6505183e69ce1820fbcdd
MD5 79988b8bc5de73b66d07285fd6175c60
SHA1 2139abf1b828489472d94eaa4b111c0499572898
SHA512 2f4ae563bb90645a47a57f3af2497e51ad5afaca035705f4c5001532c833bcfd673dceeb7d8841a0da3f42e348ca1c11b9473804c1acdcebb748aa17a9abf734
SSDEEP 96:FAtX6n0vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Styub++ZVm
TLSH
T1DED177085AE54311E2F3AB3229F14557A877B911EF33CB8E0198638E6661A10F936F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP100.dll

Path \??\c:\Program Files\Oracle\VirtualBox\MSVCP100.dll
Size 612KB
SHA256 4406a2d05ed77d581784daf1aca549ad1507184b49fe6d869a77c8e0990d08ee
MD5 c9e7658434cc2562124a63c679157c69
SHA1 7a8d9f2d0585655dcf7558b40ba5e6a37a1e0447
SHA512 0d04fcc80ef9629baa4c2605b8c821056bc4645c5197be0e3a07f65a2e336341ccafeb0c483f2dd81ce69aa518b517ee934449b3c8bd5e930162208996166e68
SSDEEP 12288:foBFUsQ1H5FH3YUTd/dfePA7XrNvEKZm+aWodEEGblHG+:MFUsQ1H5FHdggrNvEKZm+aWodEEIHX
TLSH
T1FED42B23FB2906B0E162D37C64C6C341D7F13C8A4B22A7C752ABD52D2F67AD9563B121
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download