fafd93cb12b8a5df2668d3459d8b5589e7195a28424f9a40e16b50f462cf8fab

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
virtio-win-gt-x64.msi
Size 4.2MB
Sample260930-sy2njsv17p
SHA256 fafd93cb12b8a5df2668d3459d8b5589e7195a28424f9a40e16b50f462cf8fab
MD5 4b48421925f6f3b59bb687392f524ff0
SHA1 47a004c17ff7be78abe2a62c81412f058a88793d
SHA512 026d7845e8813778f7e8574a41771f744c186d6250d624282bf5fd3acc980c8b96a4d584997781dda727d426d9316ac5a8d345b9f2bd08d70350c3eaee77dfd1
SSDEEP 98304:AS3p5p0jF+rDqWsRKe0qaRETG9mCBycByv:D55OB+rDpsRXjaaKwCBycByv
TLSH
T1BA161225BAC5017AE0AB4A35F9574957D7727C190B309DCB3360367A2F33BA08B39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5532	blnsvr.exe
5440	virtiofs.exe

Loads dropped DLL 3 IoCs

pid	Process
4252	MsiExec.exe
3460	MsiExec.exe
3460	MsiExec.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\viogpudo.inf_amd64_d1816df2ef9c583c\viogpudo.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d4de6bbd-53d1-ff4a-867f-4e8736c84977}\vioscsi.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ca1c9ee5-b71d-2844-84ea-69ef864d12cd}\fwcfg.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d3e140e5-e370-a544-b40d-4a44e74a5d4a}\viogpudo.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\viogpudo.inf_amd64_d1816df2ef9c583c.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\viomem.inf_amd64_a2830ae0e9bc5caa.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{76bef93e-e604-cd46-a347-6ef036ff5849}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\balloon.inf_amd64_b624a3307b73acf3\balloon.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ca1c9ee5-b71d-2844-84ea-69ef864d12cd}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0efe2503-5831-2345-bc1b-4c62d1c7d138}\SET6F36.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\viofs.inf_amd64_60034dd27c706087\viofs.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{537586ee-069d-3240-b513-b347c3346224}\SET7199.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{76bef93e-e604-cd46-a347-6ef036ff5849}\SET733D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{76bef93e-e604-cd46-a347-6ef036ff5849}\SET733D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\viorng.inf_amd64_605e90aa654bcbb6\viorng.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e868f5d-c15f-2844-ac84-c6091d0b0c77}\netkvm.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{d3e140e5-e370-a544-b40d-4a44e74a5d4a}\SET70CC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d3e140e5-e370-a544-b40d-4a44e74a5d4a}\SET70CD.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\viogpudo.inf_amd64_d1816df2ef9c583c\viogpudo.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\viostor.inf_amd64_92d16130a01291fb\viostor.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{89c24578-18b5-1b44-8323-ff0ef7619788}\SET6A92.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{89c24578-18b5-1b44-8323-ff0ef7619788}\SET6A93.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ca1c9ee5-b71d-2844-84ea-69ef864d12cd}\fwcfg.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fwcfg.inf_amd64_21edb5d97e83b551\fwcfg.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9251b242-5251-944b-8178-4550ec00c6bf}\SET7012.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vioinput.inf_amd64_05905547bfcff1b1\vioinput.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2fd3e391-1b61-f849-b15c-e7b12ce66e14}\SET7283.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{89c24578-18b5-1b44-8323-ff0ef7619788}\Balloon.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{89c24578-18b5-1b44-8323-ff0ef7619788}\SET6A94.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fwcfg.inf_amd64_21edb5d97e83b551\fwcfg.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netkvm.inf_amd64_9549f21367c38756\netkvm.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d3e140e5-e370-a544-b40d-4a44e74a5d4a}\SET70CC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{537586ee-069d-3240-b513-b347c3346224}\vioinput.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{537586ee-069d-3240-b513-b347c3346224}\vioinput.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e868f5d-c15f-2844-ac84-c6091d0b0c77}\netkvmp.exe	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f5e6c32b-ac7e-b14e-8f26-85fe34278a91}\SET6E4C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ca1c9ee5-b71d-2844-84ea-69ef864d12cd}\SET6C38.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{ca1c9ee5-b71d-2844-84ea-69ef864d12cd}\SET6C4A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\balloon.inf_amd64_b624a3307b73acf3\Balloon.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{89c24578-18b5-1b44-8323-ff0ef7619788}\balloon.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f5e6c32b-ac7e-b14e-8f26-85fe34278a91}\pvpanic.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4e868f5d-c15f-2844-ac84-c6091d0b0c77}\SET6D55.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netkvm.inf_amd64_9549f21367c38756.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\qemupciserial.inf_amd64_1c232c0b9627cd6f\qemupciserial.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{d4de6bbd-53d1-ff4a-867f-4e8736c84977}\SET7429.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6c3e5637-6436-e449-bf35-ebc2cc45ed92}\SET75EE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e868f5d-c15f-2844-ac84-c6091d0b0c77}\SET6D55.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{537586ee-069d-3240-b513-b347c3346224}\SET7199.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vioinput.inf_amd64_05905547bfcff1b1\viohidkmdf.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e868f5d-c15f-2844-ac84-c6091d0b0c77}\netkvm.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0efe2503-5831-2345-bc1b-4c62d1c7d138}\SET6F47.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{537586ee-069d-3240-b513-b347c3346224}\SET7198.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{609fffb2-94a8-0c4f-b81b-f68f79a02b29}\SET7513.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{609fffb2-94a8-0c4f-b81b-f68f79a02b29}\SET7514.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{609fffb2-94a8-0c4f-b81b-f68f79a02b29}\vioser.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vioser.inf_amd64_5b2f5a60c17d1ff5\vioser.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e868f5d-c15f-2844-ac84-c6091d0b0c77}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe

Drops file in Program Files directory 46 IoCs

description	ioc	Process
File created	C:\Program Files\Virtio-Win\Balloon\balloon.inf	msiexec.exe
File created	C:\Program Files\Virtio-Win\Balloon\blnsvr.exe	msiexec.exe
File created	C:\Program Files\Virtio-Win\Network\netkvm.sys	msiexec.exe
File created	C:\Program Files\Virtio-Win\Vioinput\vioinput.sys	msiexec.exe
File created	C:\Program Files\Virtio-Win\Vioscsi\vioscsi.inf	msiexec.exe
File created	C:\Program Files\Virtio-Win\VioFS\virtiofs.exe	msiexec.exe
File created	C:\Program Files\Virtio-Win\Vioinput\vioinput.cat	msiexec.exe
File created	C:\Program Files\Virtio-Win\Network\netkvmco.exe	msiexec.exe
File created	C:\Program Files\Virtio-Win\Network\Readme.md	msiexec.exe
File created	C:\Program Files\Virtio-Win\Network\netkvm.cat	msiexec.exe
File created	C:\Program Files\Virtio-Win\Pvpanic\pvpanic.cat	msiexec.exe
File created	C:\Program Files\Virtio-Win\VioFS\viofs.cat	msiexec.exe
File created	C:\Program Files\Virtio-Win\Vioinput\viohidkmdf.sys	msiexec.exe
File created	C:\Program Files\Virtio-Win\Viomem\viomem.cat	msiexec.exe
File created	C:\Program Files\Virtio-Win\Balloon\balloon.cat	msiexec.exe
File created	C:\Program Files\Virtio-Win\Balloon\balloon.sys	msiexec.exe
File created	C:\Program Files\Virtio-Win\Viogpudo\viogpudo.inf	msiexec.exe
File created	C:\Program Files\Virtio-Win\Viomem\viomem.sys	msiexec.exe
File created	C:\Program Files\Virtio-Win\Viorng\viorngum.dll	msiexec.exe
File created	C:\Program Files\Virtio-Win\Viorng\viorng.cat	msiexec.exe
File created	C:\Program Files\Virtio-Win\Viorng\viorng.inf	msiexec.exe
File created	C:\Program Files\Virtio-Win\Viorng\viorng.sys	msiexec.exe
File created	C:\Program Files\Virtio-Win\VioFS\viofs.sys	msiexec.exe
File created	C:\Program Files\Virtio-Win\Vioserial\vioser.sys	msiexec.exe
File created	C:\Program Files\Virtio-Win\Viostor\viostor.inf	msiexec.exe
File created	C:\Program Files\Virtio-Win\Network\virtio-win_license.txt	msiexec.exe
File created	C:\Program Files\Virtio-Win\Fwcfg\fwcfg.inf	msiexec.exe
File created	C:\Program Files\Virtio-Win\Fwcfg\fwcfg.sys	msiexec.exe
File created	C:\Program Files\Virtio-Win\Qemupciserial\qemupciserial.cat	msiexec.exe
File created	C:\Program Files\Virtio-Win\Vioinput\vioinput.inf	msiexec.exe
File created	C:\Program Files\Virtio-Win\Vioserial\vioser.cat	msiexec.exe
File created	C:\Program Files\Virtio-Win\Viostor\viostor.cat	msiexec.exe
File created	C:\Program Files\Virtio-Win\Network\netkvm.inf	msiexec.exe
File created	C:\Program Files\Virtio-Win\VioFS\viofs.inf	msiexec.exe
File created	C:\Program Files\Virtio-Win\Vioscsi\vioscsi.cat	msiexec.exe
File created	C:\Program Files\Virtio-Win\Fwcfg\fwcfg.cat	msiexec.exe
File created	C:\Program Files\Virtio-Win\Network\netkvmp.exe	msiexec.exe
File created	C:\Program Files\Virtio-Win\Qemupciserial\qemupciserial.inf	msiexec.exe
File created	C:\Program Files\Virtio-Win\Pvpanic\pvpanic.inf	msiexec.exe
File created	C:\Program Files\Virtio-Win\Pvpanic\pvpanic.sys	msiexec.exe
File created	C:\Program Files\Virtio-Win\Viogpudo\viogpudo.cat	msiexec.exe
File created	C:\Program Files\Virtio-Win\Viogpudo\viogpudo.sys	msiexec.exe
File created	C:\Program Files\Virtio-Win\Viomem\viomem.inf	msiexec.exe
File created	C:\Program Files\Virtio-Win\Vioscsi\vioscsi.sys	msiexec.exe
File created	C:\Program Files\Virtio-Win\Vioserial\vioser.inf	msiexec.exe
File created	C:\Program Files\Virtio-Win\Viostor\viostor.sys	msiexec.exe

Drops file in Windows directory 57 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF88D17A4A2F793C08.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0E3A4C01F482F80C.TMP	msiexec.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{70392078-7A59-4DF6-BA2E-64B44FD0709F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI63AE.tmp	msiexec.exe
File created	C:\Windows\inf\oem10.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\e5a5dc1.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem6.inf	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6320.tmp	msiexec.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem10.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem7.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem12.inf	DrvInst.exe
File created	C:\Windows\Installer\e5a5dc3.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI7CE5.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a5dc1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A08.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem8.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem9.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\{70392078-7A59-4DF6-BA2E-64B44FD0709F}\icon.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAF907E8053FD5312.TMP	msiexec.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem5.inf	DrvInst.exe
File created	C:\Windows\inf\oem7.inf	DrvInst.exe
File created	C:\Windows\inf\oem8.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem13.inf	DrvInst.exe
File created	C:\Windows\inf\oem13.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\{70392078-7A59-4DF6-BA2E-64B44FD0709F}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem6.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem9.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem11.inf	DrvInst.exe
File created	C:\Windows\inf\oem11.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem12.inf	DrvInst.exe
File created	C:\Windows\SystemTemp\~DF525486E38FC94297.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4148	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	blnsvr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	blnsvr.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9\FE_vioserial_driver	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\Version = "65821"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9\FE_balloon_driver	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9\FE_vioscsi_driver	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9\FE_network_driver	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9\FE_fwcfg_driver	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9\FE_vioinput_driver	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\PackageCode = "A3E23CFCD24BF0C43BBDDA99CAA11FE3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F2E49250877764E42B3AFC30D975768C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F2E49250877764E42B3AFC30D975768C\8702930795A76FD4ABE2464BF40D07F9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9\FE_qemupciserial_driver	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9\FE_viogpudo_driver	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\ProductName = "Virtio-win-driver-installer"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\ProductIcon = "C:\\Windows\\Installer\\{70392078-7A59-4DF6-BA2E-64B44FD0709F}\\icon.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9\FE_pvpanic_driver	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9\FE_viorng_driver	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9\FE_viofs_driver	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9\FE_viomem_driver	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\SourceList\PackageName = "virtio-win-gt-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8702930795A76FD4ABE2464BF40D07F9\FE_viostor_driver	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8702930795A76FD4ABE2464BF40D07F9\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4504	msiexec.exe
4504	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4148	msiexec.exe
Token: SeSecurityPrivilege	4504	msiexec.exe
Token: SeCreateTokenPrivilege	4148	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4148	msiexec.exe
Token: SeLockMemoryPrivilege	4148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4148	msiexec.exe
Token: SeMachineAccountPrivilege	4148	msiexec.exe
Token: SeTcbPrivilege	4148	msiexec.exe
Token: SeSecurityPrivilege	4148	msiexec.exe
Token: SeTakeOwnershipPrivilege	4148	msiexec.exe
Token: SeLoadDriverPrivilege	4148	msiexec.exe
Token: SeSystemProfilePrivilege	4148	msiexec.exe
Token: SeSystemtimePrivilege	4148	msiexec.exe
Token: SeProfSingleProcessPrivilege	4148	msiexec.exe
Token: SeIncBasePriorityPrivilege	4148	msiexec.exe
Token: SeCreatePagefilePrivilege	4148	msiexec.exe
Token: SeCreatePermanentPrivilege	4148	msiexec.exe
Token: SeBackupPrivilege	4148	msiexec.exe
Token: SeRestorePrivilege	4148	msiexec.exe
Token: SeShutdownPrivilege	4148	msiexec.exe
Token: SeDebugPrivilege	4148	msiexec.exe
Token: SeAuditPrivilege	4148	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4148	msiexec.exe
Token: SeChangeNotifyPrivilege	4148	msiexec.exe
Token: SeRemoteShutdownPrivilege	4148	msiexec.exe
Token: SeUndockPrivilege	4148	msiexec.exe
Token: SeSyncAgentPrivilege	4148	msiexec.exe
Token: SeEnableDelegationPrivilege	4148	msiexec.exe
Token: SeManageVolumePrivilege	4148	msiexec.exe
Token: SeImpersonatePrivilege	4148	msiexec.exe
Token: SeCreateGlobalPrivilege	4148	msiexec.exe
Token: SeBackupPrivilege	4920	vssvc.exe
Token: SeRestorePrivilege	4920	vssvc.exe
Token: SeAuditPrivilege	4920	vssvc.exe
Token: SeBackupPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeLoadDriverPrivilege	3460	MsiExec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe
Token: SeRestorePrivilege	4504	msiexec.exe
Token: SeTakeOwnershipPrivilege	4504	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4148	msiexec.exe
4148	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4148	msiexec.exe
4504	msiexec.exe
4252	MsiExec.exe
3460	MsiExec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 1572	4504	msiexec.exe	94
PID 4504 wrote to memory of 4252	4504	msiexec.exe	96
PID 4504 wrote to memory of 3460	4504	msiexec.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\virtio-win-gt-x64.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1572
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 331193D98818C37DF249FA1F71D89497
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4252
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 66945311AE4CD7BB7B656617EBFADEBA E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3460

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Virtio-Win\Balloon\balloon.inf" "9" "45996e0c3" "00000000000000E4" "WinSta0\Default" "00000000000000E8" "208" "C:\Program Files\Virtio-Win\Balloon"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5760

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Virtio-Win\Fwcfg\fwcfg.inf" "9" "44f08891b" "0000000000000178" "WinSta0\Default" "00000000000000E8" "208" "C:\Program Files\Virtio-Win\Fwcfg"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3208

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Virtio-Win\Network\netkvm.inf" "9" "4f96f2483" "0000000000000198" "WinSta0\Default" "00000000000000E8" "208" "C:\Program Files\Virtio-Win\Network"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1268

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Virtio-Win\Pvpanic\pvpanic.inf" "9" "49e811c1f" "0000000000000190" "WinSta0\Default" "00000000000000E4" "208" "C:\Program Files\Virtio-Win\Pvpanic"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1056

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Virtio-Win\Qemupciserial\qemupciserial.inf" "9" "4dfbc92c7" "00000000000000E4" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\Virtio-Win\Qemupciserial"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4876

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Virtio-Win\VioFS\viofs.inf" "9" "4386f790f" "000000000000017C" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files\Virtio-Win\VioFS"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1036

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Virtio-Win\Viogpudo\viogpudo.inf" "9" "4cf8e1463" "0000000000000178" "WinSta0\Default" "0000000000000190" "208" "C:\Program Files\Virtio-Win\Viogpudo"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3152

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Virtio-Win\Vioinput\vioinput.inf" "9" "4cacd0aab" "0000000000000190" "WinSta0\Default" "00000000000000E4" "208" "C:\Program Files\Virtio-Win\Vioinput"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4012

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Virtio-Win\Viomem\viomem.inf" "9" "47ad17fc3" "0000000000000198" "WinSta0\Default" "0000000000000174" "208" "C:\Program Files\Virtio-Win\Viomem"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4824

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Virtio-Win\Viorng\viorng.inf" "9" "4e0f29773" "0000000000000174" "WinSta0\Default" "00000000000000E4" "208" "C:\Program Files\Virtio-Win\Viorng"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3956

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Virtio-Win\Vioscsi\vioscsi.inf" "9" "40f51305f" "000000000000017C" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files\Virtio-Win\Vioscsi"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4628

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Virtio-Win\Vioserial\vioser.inf" "9" "4a8a820a7" "0000000000000178" "WinSta0\Default" "00000000000000E8" "208" "C:\Program Files\Virtio-Win\Vioserial"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:988

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Virtio-Win\Viostor\viostor.inf" "9" "454216b23" "00000000000000E8" "WinSta0\Default" "0000000000000194" "208" "C:\Program Files\Virtio-Win\Viostor"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2064

C:\Program Files\Virtio-Win\Balloon\blnsvr.exe
"C:\Program Files\Virtio-Win\Balloon\blnsvr.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5532

C:\Program Files\Virtio-Win\VioFS\virtiofs.exe
"C:\Program Files\Virtio-Win\VioFS\virtiofs.exe"
1⤵
- Executes dropped EXE
PID:5440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a5dc2.rbs

Path C:\Config.Msi\e5a5dc2.rbs
Size 680KB
SHA256 fbb379817dcc1dccc51ff9852ef4d3f9c24b7b0cf152dfe9e3e57a01a25bff42
MD5 336572f4714107b3cf108bd55c336b36
SHA1 6f77a1346e6a474b3a86ed337c1793a180132db3
SHA512 6572e123b72e734a7db1993388210df53ec6ef7c567e61415373b2d9355e930c1c0595ae1f4fe004675bd57d36d17f56c8376a829da8ca884c128fcec5d84d69
SSDEEP 12288:uDBUo24yA8ZUc+zdO2TOhsDBUo24yA8ZUc+zdO2TOhT:uBymzI6OeBymzI6O1
TLSH
T147E46D15E7A401BDE17B8679C9A78905EBB27C0507B09ADF13A04AB66F33FD04A3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Balloon.cat

Path C:\PROGRA~1\VIRTIO~1\Balloon\Balloon.cat
Size 11KB
SHA256 8036b8031f90b357962e0052ccb04c615dc697463d4e7b0a4ce2ceb21f531c9b
MD5 dcce7b1f5ec50b72607f49dd174e6258
SHA1 89b0fe2d2da09035220e2a3db3c2561d37215ffa
SHA512 5eea2be3048eeab2bb9da62d8693a6b4c32b2482a6f2b3cb39ef89e9d0cefe05a9328b41ce75bd8347cdb270c5ab7200754267907cf895a0fca3052435c9c44d
SSDEEP 192:8ngn/S35FJCFRPghXDEwXEhYC1KO+Y8u27X01k9z3AilSaOKxj:8/Pyh31KMo7R9zHlxOKxj
TLSH
T14B4219A2496841C2E8A79CA066FCF9433C3D27CB1D10607A26EBFA541D973C4F72817D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon.sys

Path C:\PROGRA~1\VIRTIO~1\Balloon\balloon.sys
Size 64KB
SHA256 9f1fedb8e940c527857678be84a0eb5190ed841d561e286145a20b6126da281c
MD5 30050e74bae707baa98e4e7c232b3cc4
SHA1 c4cec0b3e2b6b8f1a5807d70d141003e33c92a7b
SHA512 50b138ad3cb2f1bc133b028a491f9a1202aed1c05e868fc5f1b3352306aae7ac2fc4a9314f3673e9cb2198cbec42986c5f223fc7a99aee3df6dd7dfbb722d90c
SSDEEP 768:+GFiGFsbD4QHCQw66uIL8KGEw701mPBWRFcRmDhRlA5lGLPwq35VI/suJo6GC1AW:UETcK7wZEhDzc7q3TO/orPGzugAT8z9L
TLSH
T1A3537D9A527811E5D97A84B9D9F78607D6F5B4C12B318BDF0260C15A0F37BD08E3E32A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fwcfg.cat

Path C:\PROGRA~1\VIRTIO~1\Fwcfg\fwcfg.cat
Size 11KB
SHA256 5e4b16bec7510120ad1572ed64685b5550a7bebb3532d95fb13734f1e2e7219c
MD5 2ab6fc740eeebaf7315098ff8efc7081
SHA1 0cd98c6edb2fe619e4f9376c0685f6710007fd06
SHA512 3ab9bcc97465733eec8ba65ff752abf49da564120039d84bd1c8f4ac9be19c441449ffabf2b4aae6e7bf52c5774d5cb587e1e264da378f917be498ff406a419a
SSDEEP 192:ugjfsJOfJCuPghXDEwXEhYC6nf5AdxP3NGmVX01k9z3AEe/dE9:6iiyh36huP3U0R9zne1e
TLSH
T1B03228A2457C4182ED9B7C7096ECFE833C3D27CB5940542A36AAEA581DA73C5FB2406D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fwcfg.sys

Path C:\PROGRA~1\VIRTIO~1\Fwcfg\fwcfg.sys
Size 27KB
SHA256 65905e93e6a7442b94538801d1a3d69bc57518de3481ec3b81d0188ef4b66b46
MD5 65018c4283eb8b38d2cbcc059fde9cf8
SHA1 d2a84c34db43b71bf5136a6950b3dff81bb4e313
SHA512 6db33c06d66e7828e706ab8698ee0331cc172f372d66a575871248f405f383e44a8b3af4dba2ef9a839df9761657f480be3d891cd8b1c2e797c75e36440efe30
SSDEEP 384:RHoszpnVxfNjope5w0rSvfOtUnJC3l8rbffs+uiyiyh31+1o7R9zHHb9+:RIsNNjemofnJC8fXs+wl3z9zbQ
TLSH
T1F5D28D82536020E3E4AB89B195F5D9037DBDB2821B3285DF15A4D1261FA77C5EF3832E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netkvm.cat

Path C:\PROGRA~1\VIRTIO~1\Network\netkvm.cat
Size 12KB
SHA256 680fc6e8df33941c0506a0d4f93833609ef12ca104d2933b6a1309655b4c8dd6
MD5 47e13e87012e1270c109d8d515355a9c
SHA1 0509731b9b4b9cadddd888b5497853524be965f3
SHA512 2d8bb5bf05e043007f6cb2211185e306ab29257ce0d7c3321538124f3abe73ecee696706ab8ac499634c03c86722cc2608fb3bb3ed7a623f0cabb275859a1812
SSDEEP 192:wW9pUF7CJCFtPghXDEwXEhYCA9lXefqg7i1X01k9z3Aq9S:wITyh3ZR7i1R9z/o
TLSH
T15142F9A256AC41C2EAA7AC7052F8E9872C3C33CF581051AD36AFFB241D673D5E72416D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netkvm.sys

Path C:\PROGRA~1\VIRTIO~1\Network\netkvm.sys
Size 190KB
SHA256 2bf6982234a3923082434b2b6a5a1ba228b76abe625a6ab5130701667e75ec63
MD5 74aa970c2fa54dcd373e42f0a8e74647
SHA1 6fc60b1766e82f0c626eaea57ae12d4a51b15cea
SHA512 e261a4e27c7561fce0f72938bb8acc80a91f3225c15abe84f28781226ce4dab2fa285a88f21076ff97bd5c78af6e54a58168ba0cb3b904b512491133cd41d0ab
SSDEEP 3072:6qfYGJnBzaEGK7V0gjtSzvi/y4iYg3QvazBoF1EreDGUMDNv9T:FfYGJnBzaEGK7V0gj8zx4iYggvfGUMD
TLSH
T1DE147D5A727410E9D46FC0F8CA42491BE7F278461B6267CF07B4C6A62F1B7D0D93A31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netkvmp.exe

Path C:\PROGRA~1\VIRTIO~1\Network\netkvmp.exe
Size 196KB
SHA256 adb3e0b3e15bb114c0e049d517a28cb7904c80d1c2a8b0287c1f8c2639347220
MD5 d18937987aab402922217dd81eddeda4
SHA1 f81e71acdd0bdd75819b20871b6fdd90d3836a32
SHA512 7398b9da38fa45d6e6e01840b7427a6e26c8502c182c8fbeb3c5669a76d9a7f2785cede96f37b185d193237a7246efd18e9d67a90c6178e2f364eebb8f4fa92f
SSDEEP 3072:XO0ZDg3zHRStH0w4wsBwwQ3NwbNg2T8Xzy/UiZ7YQC:XOCDg3zxwUw4wawwowbNg2T6pv
TLSH
T1CF145B4632D906F6E13BD13AC9820A46F5B374005722DACF07B4477A1F27BD1BA7939A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pvpanic.cat

Path C:\PROGRA~1\VIRTIO~1\Pvpanic\pvpanic.cat
Size 11KB
SHA256 d13c1557d084ff2f298d55bf4ca2e06cee4a0bfef9d5c33fb8213583052dc4d4
MD5 3e01bfb5a1d7916673ff568f7ac141d6
SHA1 2e1af010755909f2cd7604c1a39d534190da5d2e
SHA512 5407f4e43423349288df27ff6864413bb1685c7777824842a10739ba0d798fdadde63e58f23954200a84a1fcec6159d5319574dd77155c5fabb0987cb754d638
SSDEEP 192:jBTh5DniJCDPghXDEwXEhYCTWt81BHX01k9z3AfO3Rf5Opf7A:AXyh3qtIBHR9z8O3jas
TLSH
T1023219A195AC4181EEA76CA053E8FA973C3D37CB5D4050A537AFFA541DA33C8E72406E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pvpanic.sys

Path C:\PROGRA~1\VIRTIO~1\Pvpanic\pvpanic.sys
Size 26KB
SHA256 fa0534916aa9f5fe1a7f9897ad7f76ee9bd642450fe7aacbffde03b23b4a1cbf
MD5 0021d4c05d3063094f2d7bde424099fd
SHA1 2eeb23f63355971c989bb868f604f45e474a2a69
SHA512 56d6f6e27068e9d2a462b4cbcbc079700a05011c4f63417303da21e6f8583c8fd4f1d403fddf89ecc5e8faaaa4449b08eba732093f737e789b4a3d1c11b89ac5
SSDEEP 384:ZjuHxdIi5A7GtqBMkRouNCU/fJFlxKgyh31oJR9zdj9q1:de/IffxNCU3DPKD3y9z99o
TLSH
T177C27D91639029D2E9A79871C1F9DA1338B8B9421F32D5DF04E4D1162FA7BC8DA3472F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qemupciserial.cat

Path C:\PROGRA~1\VIRTIO~1\QEMUPC~1\qemupciserial.cat
Size 11KB
SHA256 d450c8e0eacd2ddac4fe41d45d5162ce840e22d5d7463c0de6d9f2c8671c6c37
MD5 e114fa4800d87190330271fd1a959753
SHA1 bf1fa723ee43a06d74ead34f204e387530ce248c
SHA512 ac78bbe961ceb172b1bcf1df239d1a2522368b1d5308b1f6e9482096aa534f154719e841a6b80d6637586805b47e4155585a7f624f8786970847063a5b1e6de2
SSDEEP 192:LjMawGF1agjEwOXP6hYCUXAjQBYIN5vCX01k9z3AVIbHAyj:sE/k6h3pESUJCR9zOsH
TLSH
T1A43219E2896880C6FCA7F96043F8F9873C3923C71814546A269FFB590C933D5EB1816E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vioser.cat

Path C:\PROGRA~1\VIRTIO~1\VIOSER~1\vioser.cat
Size 11KB
SHA256 755a517a5befa55444ec8bb5587ff19ec621b74969fb1d6289070f26ede0d5b8
MD5 d4a6d6ff731ca7a2123df3ba89fc38c5
SHA1 deebb9bebbe32105f248bbbf513b00c97c0354fe
SHA512 ac920a918a01fa44ac21a55cd822d2c28c76b9d43a673fb48002878f2921c8eebd9258303239aea27f6bdfd657ed4461a6e201af7fa3998ab5b6567a8f82ec91
SSDEEP 192:sFfJa4X2JCFrPghXDEwXEhYCTINFPKBWX01k9z3A9FGePnRU:zdyh3T8KER9zgFdU
TLSH
T113422AE656AD0182EEA7ACB003B8E9533C3977CB1C5054A522EFFB691D533C4E72416E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vioser.sys

Path C:\PROGRA~1\VIRTIO~1\VIOSER~1\vioser.sys
Size 91KB
SHA256 7787cacb111a3f325c0b23738e288b45c657c6600eabf1087d5bcf6f5420f22b
MD5 0a5ab770f18a20d39ad7a167d5688d96
SHA1 89ce44a8df0d8c30f919441ff919ec09a51da70a
SHA512 51a7bc379f79fe2ad69089e5c4cbdbef1120166d0c318eac36f71806a33b138f480c49b08d86e5a607656de58ba24d7563211fa254215afa9082bc4f56f3f3dd
SSDEEP 1536:ePZqkkgiCrnrFDNNxVCE94vEza7Ujv7tNHtR+vIOX2jr+Rp8FdXeZQzE:0EkkEnrFDNNnCxvEzaavBNH+vIOX4+kk
TLSH
T190936A8862A411B5D5BA95F9D9F38A23E3F1B8851F3187DF02A4C0560F2B7D49E3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viofs.cat

Path C:\PROGRA~1\VIRTIO~1\VioFS\viofs.cat
Size 11KB
SHA256 3b976006f70a42e20df4bcdfe357ef86dd3d1cbaff77c622881afd78ea50c4f4
MD5 cdd70900ff3cbb0e5bb156d219e2dadc
SHA1 0d6c0a1d89b669bcff4aa5688e8f53b5de40789a
SHA512 e1763352e790404de0d0dc1a168827e1ff087c3cc91b5a2286cbb711126211e3467096bf8303983fbd6856db9981d2beea1472b1fd8c314756ee97d607585457
SSDEEP 192:fTgOFOi4JCJPghXDEwXEhYCsrB8NunZMiuyCksX01k9z3ALaS40h:f41yh3sr2NviCksR9zuV40h
TLSH
T1213239E28A6C4083ED63ACA053E8F9833C3967CB5D10556A23DFF65449873C8F72816E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viofs.sys

Path C:\PROGRA~1\VIRTIO~1\VioFS\viofs.sys
Size 60KB
SHA256 d4c7719ee4de608ddc12fdceecf1289bac549041f12e16d3185e37c06b6aa48a
MD5 bc3290f467385d0a9bb10902f187b789
SHA1 930354dc527e7446b46c33b9d742bf33533a47ae
SHA512 b6d78d8cd742778f707330194b93981532a56b0790a52850fac54a59e5047522122ce9b70840a2a2fd07207dbc83b7c361503d3d6a8b6633caf659ea8abd1ad3
SSDEEP 1536:gYH/YNLemM5TwHzNmCOWDRuu4fd2+rxzb5:D/kLemiTWzN/Nr4fd2+N5
TLSH
T1F8535C5D62A510F4E9BB81B9EAB3D513E6F174811B31DACF00A4C14B1F27BD4AA3D329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viogpudo.cat

Path C:\PROGRA~1\VIRTIO~1\Viogpudo\viogpudo.cat
Size 11KB
SHA256 383bb48ec6271de34a82def8b613ee2a3fd7800363f0cf752a6b01ce31f501bf
MD5 ff5114256335a194a07f354d7a0918a7
SHA1 0e885010bf78a2f387780df1673ce24bd97ce98c
SHA512 4724a3db09c27b0b491c64639fd2f21e3c4e247b19cd470e740c6e3a8fdba81d1bd22209d31dad3dcc7bdb6234884bf70e61011e1b500ece5098573ae5c0ba18
SSDEEP 192:3f4lV6pE1JCZPghXDEwXEhYCIRYU8wZNU6nq9bFs0X01k9z3AbttPvd5ItjG:3felyh35uA9bFs0R9zutJajG
TLSH
T19D322AD19A780082EDA7AC6057BCFA573C3D23CB5850956A32AEFA144DA33C5F72427D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viogpudo.sys

Path C:\PROGRA~1\VIRTIO~1\Viogpudo\viogpudo.sys
Size 107KB
SHA256 1aed7d611203fdedc6cd6abe390451bea6e95aab0464964898776796f8edcb53
MD5 7a5fb036b159375f119864c7fbee82f8
SHA1 fcd2854d62e6956331f5d68ebdc179a18a2416e8
SHA512 bcda54d30144aa7e54310371014c7e46d25a1b7537846e52bc1adc8641d3256e30446e7b535260859bab60c4c110f97412aeb17ca3de6a979a59d5ac62388743
SSDEEP 3072:lbqZYYrHruMd68hXlxiICdUwgHbsdA1wFt:lbvYrHruMd6ElUUw8ses
TLSH
T18BB34B41761400B9C97B85BAADF14067A3B6B8CA0B30D7EF15A481578B577C8AE7C33E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viohidkmdf.sys

Path C:\PROGRA~1\VIRTIO~1\Vioinput\viohidkmdf.sys
Size 16KB
SHA256 b5940d565e25fa18b10ab62d697900e7c436170ebb954f0b8adc6d0329761253
MD5 4225c640759cdd706dcf042165dd0829
SHA1 f45866308c0ffdfac08595b2dbcdb8099cef580a
SHA512 5ad61745ef89e05a56f1fe73c8fa8c3d82ca19940bd1dfb9d1adeb7b0d7df21ed59339b12f48d2407a81ebe57656c701af5da8f4ee0520a752eb09de6ef4ced3
SSDEEP 192:RcvhPQA6nkWPghXDEwXEhYCL4tWINFPKBWX01k9z3A9FG2g:2RQRkJyh3L408KER9zgFW
TLSH
T105723B9393AC50C2E96B6DB043ADE6037C3CB7C35B2199E31299E5851D933C4EA3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vioinput.cat

Path C:\PROGRA~1\VIRTIO~1\Vioinput\vioinput.cat
Size 12KB
SHA256 c0a1bbdacd0fcff8e5b657724fe4aaffe9c6ae4d3a5986fe72985236ad657d10
MD5 2d58ef55e48f633d5510421ec5ce5b06
SHA1 c6dcc5503c4370616daa8eedc65b8c7f76cf363a
SHA512 f79fe32212b6696b03930e991aca418492aa4576abc851aa9c1c88d7877c8e23e3301ec798a3ea1e940593dacafe9922220fb0b451faf10f576ace06b64e3307
SSDEEP 192:t7YqR1MiJCyPghXDEwXEhYCzINFPKBWX01k9z3A9FGk8O:pOyh3z8KER9zgFP
TLSH
T1D64229A265AD0182ED976CB052A8EA936C3D37CB5C10947532EFFB580D533C4F72416E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vioinput.sys

Path C:\PROGRA~1\VIRTIO~1\Vioinput\vioinput.sys
Size 90KB
SHA256 9934970c03d9c868d25433419c6e828877ff20204c0e8e27decec8ba9c93b8d1
MD5 dfeb55f73974613594b2aa9c610feab6
SHA1 bd9ad491fca42866d66db13c1b7f627268d0158a
SHA512 c09542e84241dd9e68dd829d3bcacb4a2c96469fd132aa7ba90d731ac41c7d4b28fd8ce206eef6cbdaa596c9e03c63ba340d9a21fac61958778dc2b2e84de0d1
SSDEEP 1536:eDGumu9frghZgtuho5jO2ZA6ChsoBDpeRfsQAJWQzdd:eD99khZg4hIRZv2soxK6bRd
TLSH
T118936C59A2A802F5D5AA85B5C5F5C417D3F0B8C50B7247EF03A4C16A2F277E09E3D32A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viomem.cat

Path C:\PROGRA~1\VIRTIO~1\Viomem\viomem.cat
Size 11KB
SHA256 cebaa8211678becf3e9413f5eaa823894b866220e9b27ffaadc5b6e559850823
MD5 12ca0a6f6e4404f206cdd66989945676
SHA1 2cfce77c2ca37bf09c03c1ebc65b279749de6cd0
SHA512 8fbcaf4c3be75e7d5dabd87b6d7ee8d0b3c8e2d4cc41947c2f3bd487be435c904279f5e9471e2da5cc8938091dcc1b7916c609e77856f6458ca39513a82b7c35
SSDEEP 192:g8C+hFJCpPghXDEwXEhYCNEgiZTOebR5X01k9z3AqJiWw7yQT3Bx:Tlyh3u9bt5R9zVJiWCT3j
TLSH
T127321BA244AC0182ED9BADA053B8FA573C3D37CF5C1055B922EEF6540D973C9E72816E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viomem.sys

Path C:\PROGRA~1\VIRTIO~1\Viomem\viomem.sys
Size 55KB
SHA256 1854f1c559e4a34a100f5f61d4b92a708a628f14e19c960ac0476397ee78a761
MD5 e6c607483760a2a09df80cf024ae1f15
SHA1 4f862dc673f0d0af5c953d16901084725dfd0fed
SHA512 adf8e9f55804ac6b4b745bcddf66227ded710d5e135ca833c118c7019f04433b1fae04b71fe7aa8239c5d0f67587a0d0a1cd18a7c5f954f2bbc6a5434cd7eeae
SSDEEP 768:SLeFwYjS2x28TmWjynTb37m7vGnJsmL/cAcfLSzRvThBTItJ33ds9z7sW:Wc6Li7OJRTcfuzFT3YJHdkzYW
TLSH
T1DA436BAE42A810D1DE6655B5E3B3C907EAF0B8D117215ACF0160C15B0F3BBD49A3F76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viorng.cat

Path C:\PROGRA~1\VIRTIO~1\Viorng\viorng.cat
Size 12KB
SHA256 f4804d247362244941eb60813f4193c11e8eea2693efb29cafd41eb2e1a1eb11
MD5 814ccc7be1176763369e41c9ec017f75
SHA1 b3b4ca6e499b0f193bcf425298cdce36b96cb459
SHA512 bbc19034700dec982c5b73db08ae3e02a2c4653feda98f8ce332b04a537eb5d7e82013f7d51b34991e43a1d624f7efe39ee06b5932fe8572f235a43e4b0813ed
SSDEEP 192:heMYP/8WqJCFcPghXDEwXEhYCAw3QlXefqg7i1X01k9z3Aq9IAqZ/:eg2yh3AaR7i1R9z/yAy/
TLSH
T1DF421AA256AC40C2F9A76C7053E8E9577C3D37CF581054A932ABFB244DA73C4EB2416E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viorng.sys

Path C:\PROGRA~1\VIRTIO~1\Viorng\viorng.sys
Size 52KB
SHA256 1fe84d32dda9f70cf2d78fcba7a218fb4085da7b2a8680e84d37e1fdd2313f7d
MD5 3a4286247b99b0799355b2027cddcf93
SHA1 102f03a43c8b09486adc57488d8c123995bd45f2
SHA512 461b133a5db07761dd476b5f24c8384f2fc0d7da741876bc4301878ca011bb74206b626f876309bf17a8a2ae3743c32c5e501aa530b0cb8a726583c07da08723
SSDEEP 768:2/wMDQUl2Rr24vmvcPQBJBLxHwOH/chiEFbA7fP2BRzvH3w3y2io9zVd:TkQUIK4uv0yqO+iIbA7fPqXwOgzVd
TLSH
T18C337D5D126800D5E9B784B9E5F7D917E9F474852B319ACF01A0C21B1F2BBC0EA3E369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viorngum.dll

Path C:\PROGRA~1\VIRTIO~1\Viorng\viorngum.dll
Size 118KB
SHA256 b9582bddedffa569d27e986b5ddbebc3f3dfcc5cca9de0417efe528eb7949d8d
MD5 255be5e944d6a3f033ff3fd5e7b0d4a7
SHA1 c0ab3f7850242f273bc17d255854e5f153c9d103
SHA512 3be39bbab35142b810cf69de756a7b24072c789c3738ee8cd5ba22f6b64a7cb36cfa5e7f1dd9bca0558c8b13af1445e48e0c161d8be201bc6c35a744e4435893
SSDEEP 3072:A1ycb5bYfgro+8Rpofx6Kwr3NbSoKJMblIV02gl0Gcy+hkG:sr5bYfgro5ROkKi3N24or
TLSH
T177C34A1772FA40BBE1778734C4A38E45A776B8414760ABAF03A4429A1F537D08E3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vioscsi.cat

Path C:\PROGRA~1\VIRTIO~1\Vioscsi\vioscsi.cat
Size 11KB
SHA256 24ab0bb12348e4ede5804da32a640fe291553895191fb2fc8a1f2c4c77ec2e81
MD5 cd64cb739ac225df171e92c2cf8011e4
SHA1 be9e207eb34034f791b73f4decaec1ae884b377b
SHA512 1f8a92e15b727850f609e1718af7495f7f9e7907ded7ee2e02c4211e3d33213173f4c04aeb7aab9419c7bc7b83833e427939c68d4323b01f4d57db8eecbdfb2c
SSDEEP 192:iKXrzqnsfJCFQPghXDEwXEhYCyMDtagQ5X01k9z3AiknvTJPK:isiyh3yMDtdQ5R9z3kbs
TLSH
T11E4209A649AC4582EAA7AC7053E8FA837C3D37CB5C105476329EFB141D923C9E73416D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vioscsi.sys

Path C:\PROGRA~1\VIRTIO~1\Vioscsi\vioscsi.sys
Size 76KB
SHA256 d370210aa2b51ea7a7b17a9752bf47241cbf8d1124e169f7d250e301cbad2925
MD5 bba7fc3e11514250d11fb779951a61c5
SHA1 5c75f9e798234452f76dec1e3b64ba741f619b2d
SHA512 b3768db653ccf6cdd4bd371f8158639092a4d739a594de6246f5a29999696e5f38f695460aab529d8b8706772f12604b58fb02ebc80912ac454f5f442e3ed678
SSDEEP 768:g1icFAvEhHZY0RP8QFh6K1kkT3Vk4a2eoZqcekkhF4rVgt0pZfkbmKKGUuaS5q4N:IHZckQ29S4rgWnK7hYWdCX9QEpagzEN
TLSH
T1A4736BCAE5B845EAD856D078CB6FA903D775FC561360ABCF4240C0299F077D0A93A23E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viostor.cat

Path C:\PROGRA~1\VIRTIO~1\Viostor\viostor.cat
Size 11KB
SHA256 c75734178fb2363f1aff96f8f7dea023c34a57e34bb0f23627de0f7b6350027f
MD5 e3af66bf775b559df0d551609a7ae792
SHA1 b57e3008d42c20a7d9df3d82ae1e59b10e3062f2
SHA512 7b8baacc2869806cb62c69f6e7153b0db677b879f061de90f2481d1f5080ddee8d45c48445f59dcab1ac52a0b364710957ed9db3a87e76a2bba32336b1944e4c
SSDEEP 192:i/N7BFRJCFOPghXDEwXEhYCbHBDtagQ5X01k9z3AiDsnvIs:izMyh3bHBDtdQ5R9z3Dsd
TLSH
T10D422AA2956C4182EDA7ACB053E8F9437C3D27CB5C50547A32DFFA1819923C4F72416E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viostor.sys

Path C:\PROGRA~1\VIRTIO~1\Viostor\viostor.sys
Size 63KB
SHA256 9f4a313ef9f5834c66cd8067c955fe9bd6f190bcf34a6fc0d534293498d444d5
MD5 372b9840b4d4210a566d20048b7fca68
SHA1 4666c3d5b21f1fa8e0d1de0d0c024ef3299545d0
SHA512 6c8e2f88bd3d1b4cc4416220243bc50b8c3d77d772839d18acc473fdd4bb0687dc12d8ebc3d229cba6cb7a7b36686ce02f9bd459d04d27baa0274713c9d76a3b
SSDEEP 1536:FzWOtEu9IJdaPjCuxZCsw0n9HvOWu2Oz/ess2mXzb:Fz9iH2hZCsXn9rbOz/3s2mH
TLSH
T10D538D49919860F6D9DBC574D7AAAA0BE7B5B8811B109FDF02E0D1091F0B7E07E7823D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon.inf

Path C:\Program Files\Virtio-Win\Balloon\balloon.inf
Size 2KB
SHA256 4063df706c5d1ea8ea18ff297551709f7dad7f7d5879aef5b07ee308280a6831
MD5 bfe1357c44b63d2afb582cf670ca3029
SHA1 cc4b78ac0519df11adadbe31902b0b93cefae5a2
SHA512 ba3b93dff604a9434dd75d63530e7b760566087105dc4183bd0d336e552c4bd99447d93439d003cfec5ceb7af9689b914b9e23a77af3b407e90a6bfd6fd3f7f7
TLSH
T1845110014D570FFF5F63A627E78B16C2FD2070046454850AB6CFF5049B8CD9C567E256
MD5 SHA1 SHA512 TLSH

Submit Download

blnsvr.exe

Path C:\Program Files\Virtio-Win\Balloon\blnsvr.exe
Size 194KB
SHA256 1d2fc6c84880aa3d863d36a1c146cda3839638d494b90e285499866cde74aac1
MD5 a38d8995e6565c61ce1878a5470a0b85
SHA1 3134e1099997d69752fbbf1aa44dce2582632898
SHA512 fe80a714fa8774efb5f4279b334ec357fb0166c2f632582a9592401cf051ee4c4c777471435db965e34a1efc8fe72d088a9d6698f2f5ec362672afeadd118c17
SSDEEP 3072:eJ5HxLNecSheZ47KA/dzrn7bRuLxOVLKtigqUjC21J7AKSVZe:ebRLNecFnEdzfVaAMCGSVI
TLSH
T15F147C5172E440FAE0778279C9954A16FAB3B8110760ABDF03A4477AEF237D16D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fwcfg.inf

Path C:\Program Files\Virtio-Win\Fwcfg\fwcfg.inf
Size 1KB
SHA256 73c19dc189493e4cac5745d642f32e2396dd6501925aa9de1a4288ecbbb52f20
MD5 29606d5f2a8c1629086350603e6124b8
SHA1 104469a5298665378a4b41c70dcd6c24964fac64
SHA512 d789855691b113df123b5d2a52c9cc6a8c68f6c396316e944af7a4bcac1233cb3ed081e8af8c378a6bceb93d37248f883506b14510731caaf242477c355c9fa4
TLSH
T1F1412E0A4D578F6C99B3E22B738719DAFB38610868D44408B28CF065D7FDF28931F25A
MD5 SHA1 SHA512 TLSH

Submit Download

netkvm.inf

Path C:\Program Files\Virtio-Win\Network\netkvm.inf
Size 17KB
SHA256 1f3d96f255fd38efd0ec6c0474f1d14a82d3ded8a326d5d2383e97e26ccfc3e7
MD5 c2815957a7f283fc33f8b6654662ac6e
SHA1 566c8ac7578fd8a0c3bf74d966766d216d2838b0
SHA512 32140f9b0de6ffc2a373858b50324d9f6bd967292cfee7aa133c5286531aeb9eb2d2c595c65246ae78b62526402b03c43b7bb03ebaaff1869eb508963ab0631a
SSDEEP 384:Djo2BR/O9c4HUPYMeOgnRvKbrPLJ/4b7H4hPRk0sG8eNojKykejM9VLI1R6SF2YX:TnQ2yOVIeF+
TLSH
T194824796ECB5FBA232CDE061A5449C13C6AC1156396F2C91394CC4E8872EDDF39ECE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pvpanic.inf

Path C:\Program Files\Virtio-Win\Pvpanic\pvpanic.inf
Size 1KB
SHA256 bc2af3bb5c7bcdd4f54b95cfba603908b9e49d92a38f38b8f7cbcac327c6b0ef
MD5 cb7c406d324803abf1afcc3579097a3b
SHA1 bb035085f58b5901db002272d5b67859533ab3ba
SHA512 d547a8d1caa8b9d5b10f3dadd980af316c6864e9bbe6fefd8f835ed0e4bb2d4c9337bd68107569858987c045e82d2699c16b999974a118b1930b18aaef520caa
TLSH
T1A9315326CF5183B916D3E1396B4B1C8BF974210420E5E81972CDCC019BE2E5DB77D2AA
MD5 SHA1 SHA512 TLSH

Submit Download

qemupciserial.inf

Path C:\Program Files\Virtio-Win\Qemupciserial\qemupciserial.inf
Size 3KB
SHA256 ba60a0408d0aff9936eb96f1e2cdc3bb3307d6bd14d74477a810af3e81b42d7e
MD5 ebf13d5e7306cd512edf2f620cd218eb
SHA1 e04060cb84608512828c3ba02546b7b35613c1ba
SHA512 09390b42958c3ae7b32479d20612af92640951851d656c256b15db03b703801972295682f2e9766f6cc87a6892a0a8f180a47e28e67801441a219f7ed7a83c90
TLSH
T1C061CD43C18D076E843524990E62B8A312CCE262D1F6541C1DF005AED6DDF9F9A9FE1F
MD5 SHA1 SHA512 TLSH

Submit Download

viofs.inf

Path C:\Program Files\Virtio-Win\VioFS\viofs.inf
Size 2KB
SHA256 197c718d92e1547931ca754fe6220f641e0b06e8b56cc47958a7d9c2ee9e9846
MD5 1045451a3097249fcf0c02705017fd9e
SHA1 4da15bbcfba51e71c04c447782555c3e8516d38c
SHA512 005d195028d88f7be5627a0e2702396ba7e50c3c13beeff65eec6e6f231c9ea5f9f18a5f5fba6066d8ed54d218e4803608fc669d972ef4548cce188937450344
TLSH
T1DB413E598D2B4778A2BBED07FE862B87EA10708790E5201C3ACD9025C3D0C5857AF67B
MD5 SHA1 SHA512 TLSH

Submit Download

virtiofs.exe

Path C:\Program Files\Virtio-Win\VioFS\virtiofs.exe
Size 235KB
SHA256 5351c9d131410442dec9f9dbc2be37876e0a531c3dd92547d4fdaa919901b6da
MD5 39e883464775351b0da5456ebc9fb33c
SHA1 632bc841342248a11611aeb619a51b534369b1a0
SHA512 4af6d7a466c7594fd76e0fefe40f96c5b0ccfce86dbdeba1ca1348dd8b396374b92d6c513ef1e9498ad9ee5ec096b03a0cec9bf60717170faa4a9dfc9a7f5e3c
SSDEEP 6144:lTBeaiGQn9yMV9KMqlkmD0DHV+zKsOak+:NoaiGCvV9KMna0D11sOj+
TLSH
T100348D45B3E50CF9E97BD23989938512E6727C410760DADF03A4427AAF23BD09E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viogpudo.inf

Path C:\Program Files\Virtio-Win\Viogpudo\viogpudo.inf
Size 2KB
SHA256 13dfe19ce5864a2ec7f0a50e5d1fc27dfe751199692673dbfc71550022b044de
MD5 f2a9f3dab42836ee1e462aa4d820fa49
SHA1 7cf0aae6d5750b844eb2565521b6e7651a839ae2
SHA512 7106b02e1d05aba197181905116b986058db779cdc843ed4ac25a4f03c92f5535dcd3788f387420540cdd5424d9d80386ccd54fd904468a65210e6da7893890b
TLSH
T1AF514725AE4F0E28AE0B2255F352F99FBD653187D0E51500729C6021CBAFCDC1F5DE4A
MD5 SHA1 SHA512 TLSH

Submit Download

vioinput.inf

Path C:\Program Files\Virtio-Win\Vioinput\vioinput.inf
Size 3KB
SHA256 861b1adb658b16f9316c61ec465da0cd1794fd50a8d2f79ca29b8c14aec2a466
MD5 4b32eb95cf55a266c1f28960b3c4bde4
SHA1 67cc770b0b4b515fb630671cbd4e4ab2c0ffa0b6
SHA512 982493d2daff57f26ec8c31ae17fa386a33ebd29d8d216a4b2a05e65cc83733f84241eaac731f4cc689f1f9ec1a3f13be46a55f760c6e2680da840042765806c
TLSH
T141610F3D495B0E7CB59F6D267AD326CAA620206090E5DC0D77ACB104C3CDE68176F77A
MD5 SHA1 SHA512 TLSH

Submit Download

viomem.inf

Path C:\Program Files\Virtio-Win\Viomem\viomem.inf
Size 2KB
SHA256 2b1935e17f9b7fc7a5e9a24bf1a0b5da20982e3234e276696398ad0fecf2a14f
MD5 7e4b07ec4f25aa367f0b43239b1af4c8
SHA1 c1b7a4ea82f27301597e71994ac9372a8a6e99b2
SHA512 b7514893d172de6a84c24bbc54f509e1f9f4b4f128b8f48f3d41a57db8ef59f492c2d5a606c122711e614c1aa59bc508f4c4631337550e6f48d30bba7e738ff0
TLSH
T1394142294D2B0F345E97E23AE7BF3AC2FD606068D294054872DEF5018B8CD6D732E54A
MD5 SHA1 SHA512 TLSH

Submit Download

viorng.inf

Path C:\Program Files\Virtio-Win\Viorng\viorng.inf
Size 3KB
SHA256 f5c0236a6fe69ca5bd9e13bc6c69b1ccfe9a2b070298014713da17b1b0665b6a
MD5 366c5d2dcfb0fe490f120f25a78815eb
SHA1 acdcc64dde9953e7587995d17a0cac39c02395e3
SHA512 f5cadc6f6b4d143fa6682643f820b7ff3c8340cc93df5b245eb4b61f702b1d579410951ab0e888a63fa3960a8029acf994aeb32e815017fd79a80cae32e2c780
TLSH
T1377143498C624338E15BDE2AFF8A7F46D5157048E8D514197BCF8C2457C3CE80A7E7AA
MD5 SHA1 SHA512 TLSH

Submit Download

vioscsi.inf

Path C:\Program Files\Virtio-Win\Vioscsi\vioscsi.inf
Size 3KB
SHA256 f305bbd371c3bd6df5504b97b88dd88aa79ab6cca962cb6ced0ba7545e6f3621
MD5 0a19cdba3042bc448ac512ff2f0672ac
SHA1 51b1438deeee3d17cda53b9f201d8ff9de5097a6
SHA512 886e47b9bca838317e693a3df34b4d7a7590e51c38580a3e5238c23744e4a259e9fa109a793a14c3dababfb018b2fce49a859e2df7e5519cd6c195d7c92d2940
TLSH
T1496153B94D1F0B38667316167BC37697AD28309684F50048B79C81D5C3CFC2C6A62BAF
MD5 SHA1 SHA512 TLSH

Submit Download

vioser.inf

Path C:\Program Files\Virtio-Win\Vioserial\vioser.inf
Size 2KB
SHA256 1091990dd4d124b247e87f5516a966a21b66e7f12dc8ec5cecc30f083bea165b
MD5 da7f59436060769f92d6861c9c960084
SHA1 49f112993a839a44b257156faf7448a94f138b2a
SHA512 f1aa081bbc03609d914b41167d59d6bb55fae49fdd04daaa6c539a2ef94ba74bd5ce71cf0c0b5d8a4748fc330f148b1bd1ea59c960b77323a91a19b832e03e4c
TLSH
T153511C99495B0E3881ABB956BAC217E6AD10704398E3008C76AD7090C3CDC3CB76F23E
MD5 SHA1 SHA512 TLSH

Submit Download

viostor.inf

Path C:\Program Files\Virtio-Win\Viostor\viostor.inf
Size 2KB
SHA256 55d8f499c2be12a17dd7424b9643f9347bc2fadaebf5eec8730dfeec787a2d3d
MD5 9739f52682fee0d52a99a44df98aa1f3
SHA1 15534c1f3fa9a2e6e1c3714bdc1a4689365b71d5
SHA512 64729dcc6137be8a621ac35bcfd52265af07c8f86efd6435f156ba8ce9ef98bdfbdafb44e54524abd68c4a1f9734384de1fc2b20d5dff6dadbdc7239852c02d9
TLSH
T1B951457D4A1B4A386F531216BBC27943AD283096C4E10444B65C819987DFC6C7B56B9F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI63AE.tmp

Path C:\Windows\Installer\MSI63AE.tmp
Size 324KB
SHA256 4a913affce6cf192b34dcdb8109548ada79768f0447bdbfcebe40cd68bb2eda6
MD5 16895c96910d7115655216c6bf3687a6
SHA1 9f700d9d8c352140a738d64bf2d3116cf5411a90
SHA512 3017c735fa68d8f47d541cdd09f2c66b0611956be95f75917870cc8d4facd3856a8072466177b26a75ee069692769c6fdad056161717af3b0dde9ab525279e39
SSDEEP 6144:YDAbUUo25GyA8ZUEV1zAZzdVwlivTBCfRYJ3tgA6h:YDBUo24yA8ZUc+zdO2TOh
TLSH
T1F8647D19E7A501BDE17B8279C9A78905DBB27C0607B0AADF139046B62F33FD05A3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5dc1.msi

Path C:\Windows\Installer\e5a5dc1.msi
Size 4.2MB
SHA256 fafd93cb12b8a5df2668d3459d8b5589e7195a28424f9a40e16b50f462cf8fab
MD5 4b48421925f6f3b59bb687392f524ff0
SHA1 47a004c17ff7be78abe2a62c81412f058a88793d
SHA512 026d7845e8813778f7e8574a41771f744c186d6250d624282bf5fd3acc980c8b96a4d584997781dda727d426d9316ac5a8d345b9f2bd08d70350c3eaee77dfd1
SSDEEP 98304:AS3p5p0jF+rDqWsRKe0qaRETG9mCBycByv:D55OB+rDpsRXjaaKwCBycByv
TLSH
T1BA161225BAC5017AE0AB4A35F9574957D7727C190B309DCB3360367A2F33BA08B39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 69KB
SHA256 5c5225f4bba9f4cfbe4c6cab9ac292f81a797a7f6f4e79457e76509f87970ddb
MD5 b9de25a163b7be244ccee913eab98283
SHA1 2215d9d3ebe8afe3f4032d2d7a05e4b0accaa9f5
SHA512 7007c8201d4ec5cb751dc66123609004a4ae318d0dcea26b72c768c3e2fa39d4154a659461ad48cc8dc811123fa0b6cf2df6f27499cfc66777bd73968e12cf31
SSDEEP 1536:5dLAGlAJNMrzVF2AYDV5C9+hZ8Gcb0kfZBRyPzZQLT9wDT3TkqouH83+HeQ7Fqpz:HGAz
TLSH
T12D63FB0580D8C609C9B609A27277EDB2D57A65EE771F0EE730AD6300D9C2F053FBA469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 69KB
SHA256 c2e557d93b76cbbd0ad7ce78050f85f5d07fbbc8ce94d46341f4cff928d2de95
MD5 b8bee306f2520985efbf6220fac19f18
SHA1 e81485484d58eb851dfed51292a9114b6980a422
SHA512 2049233fae731ad9d3dc1544f6f74e695997884f34ddb4cd99fa736424abccd0736dd1b35e707b362bc59e221d5dd2f193d282da50ae0bc314e079f91d602c24
SSDEEP 1536:5dLAGlAJNMrzVF2AYDV5C9+hZ8Gcb0kfZBRyPzZQLT9wDT3TkqouH83+HeQ7Fqpv:HGAv
TLSH
T17163FB0580D8C609C9B609A27277EDB2D57A65EE771F0EE730AD6300D9C2F053FBA469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 69KB
SHA256 2215943543be5688724da80379b151f3f48043452dc90a781caeffd312641771
MD5 aaef226237b4ec186d5c5272802a7125
SHA1 1239cb3e35d22fb35c3818b3bbfe4036c975d192
SHA512 d87a4e71a1e4c31d698e6c0ea9785d28e20603e9ed99b47a226c03ac624f75e87907e9230a1ab8f4297cf62f6b1277aaf7b2a0ff59c75364ccf0c992fba77a42
SSDEEP 1536:5dLAGlAJNMrzVF2AYDV5C9+hZ8Gcb0kfZBRyPzZQLT9wDT3TkqouH83+HeQ7Fqpv:HGAv
TLSH
T1AC63FB0580D8C609C9B609A27277EDB2D57A65DE771F0EE730AD6300D9C2F053FBA469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 70KB
SHA256 f17bb80bd77140bd7096c33b915872800bd1d6fa2e40979a16de8bdcd6ca32f7
MD5 dcb4a1c21a3dd9021cc039075a203f9d
SHA1 b5d775c20edd00aa41d4fc3f0aea3c51ae900b08
SHA512 f1a6d96410acfe876de5687db40a30d51a68b4093072213618b5befb98a435c0dc61d9c7b9eb20a62e775b1a0c5e2390a62beb6b7230021ca85165135d6499bd
SSDEEP 1536:5dLAGlAJNMrzVF2AYDV5C9+hZ8Gcb0kfZBRyPzZQLT9wDT3TkqouH83+HeQ7Fqpd:HGAd
TLSH
T14663FB0580D8C609C9B609A27277EDB2D57A65DE771F0EE730AD6300D9C2F053FBA46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 70KB
SHA256 9b2b157960a664c93dfed84386216909bf2b00a91d8882f9edc0d6daa7d90392
MD5 e71c4d3e7e3b94cfc415fc360a4cf068
SHA1 9450dc5b9d7f31c30b2f876d6dcaa8c02c1bd5b3
SHA512 d5b07bbe1a25be6dd93b04dc6e18b50d04bcff35054fde2b76ca9b9cc43685ef99b58e8f91cb7238505723385a4162b13b48e5177f84f4276e96d996f8290835
SSDEEP 1536:5dLAGlAJNMrzVF2AYDV5C9+hZ8Gcb0kfZBRyPzZQLT9wDT3TkqouH83+HeQ7Fqp6:HGA6
TLSH
T16463FB0580D8C609C9B609A26277EDB2D57A65DE771F0EE730AD6300D9C2F053FBA46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 70KB
SHA256 49317026af1a2026d020ec2c3261c86f8b3890841f58650eda502e3221569e9d
MD5 8f0d873612379eceb4159c9870002aff
SHA1 cb9e62620f3b157089ce058c89c49c565be82b49
SHA512 c9c3ba0d4c7897d4fa1327192ba99c4e7436d8f71a3d22a671fe75632d3c262feb797baaf931cce8ed294b7b41c14589e6d3064d101899e79fd6b032aa1df082
SSDEEP 1536:5dLAGlAJNMrzVF2AYDV5C9+hZ8Gcb0kfZBRyPzZQLT9wDT3TkqouH83+HeQ7FqpL:HGAL
TLSH
T17363FB0580D8C609C9B609A26277EDB2D57A65DE771F0EE730AD6300D9C2F053FBA46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 70KB
SHA256 229fca966775f806b6bf95eacdf43249668a79e98c283fe01762f83694ee110d
MD5 193c41737ab1fc0e718eba28d03f5204
SHA1 145b59f11162aef2a45d8dac6e4b69dc88a7b6cf
SHA512 2d5bb2afedb27870fe47ed8bfd7018e922cfc08317f9f566a2fb352eac487e9d24f2428bfa72c87ce175e5ede87fb5d23f2d4b5a6639afb7b754e335f37928b6
SSDEEP 1536:5dLAGlAJNMrzVF2AYDV5C9+hZ8Gcb0kfZBRyPzZQLT9wDT3TkqouH83+HeQ7FqpW:HGAW
TLSH
T1AA63FB0580D8C609C9B609A26277EDB2D57A65DE771F0EE730AD6300D9C2F053FBA46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 70KB
SHA256 e82e6913958186b73697197e0772ac5b64e29a193a5c32ff66e3c91632debddf
MD5 173fdbcbdaf364c4b7dcb0e357692062
SHA1 4d2e7ddd43f4d68cf064c0fbda57afa32ae40d5b
SHA512 aa3267e230d26ad44a8af755acf3883f4f339eb29e25c3a87c21fa98d67834b8725cc77d277a0ebb7826fbe96472bb13b07622b36ed2adf8418074d7971672f8
SSDEEP 1536:5dLAGlAJNMrzVF2AYDV5C9+hZ8Gcb0kfZBRyPzZQLT9wDT3TkqouH83+HeQ7Fqpb:HGAb
TLSH
T14463FB0580D8C609C9B609A26277EDB2D57A65DE771F0EE730AD6300D9C3F053FBA46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 70KB
SHA256 804dd1437cefac3a997de5880ae912a94c9b9e1b277fb9b220dba4b4b78eb798
MD5 331be5f07277a41870480cba7a31b543
SHA1 667a19c9a87d3b0057f2e62f4834fc52cc15cd27
SHA512 43aa89986616827eea03522480bcd38927711a1c5844b38f89157cbfe57129c879da94209aa24e80747c1307530e10bb225c663b9f5eda53d1b35524771361a1
SSDEEP 1536:5dLAGlAJNMrzVF2AYDV5C9+hZ8Gcb0kfZBRyPzZQLT9wDT3TkqouH83+HeQ7FqpB:HGAB
TLSH
T1BE63FB0580D8C609C9B609A26277EDB2D57A65DE771F0EE730AD6300D9C3F053FBA46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 70KB
SHA256 0f4884b300d8492fe735799282ea50afd33dc5bef4e7bfcf0277ec8293123daa
MD5 f844285aeb9ac5fb4d6e0969e847a1da
SHA1 10fe04edb198378e7ca883de9b81a5c91a5697f9
SHA512 c83ae9ccfe263ce1a1f6a6df2f1faec30d6bf608c2e2d5d17692030e3bc49de1c8b5fef30a6f7dfbd1955e5611b7336945bbcc2cc376b97b8ce34d67cfe6693a
SSDEEP 1536:5dLAGlAJNMrzVF2AYDV5C9+hZ8Gcb0kfZBRyPzZQLT9wDT3TkqouH83+HeQ7Fqpu:HGAu
TLSH
T1DB63FB0580D8C609C9B609A26277EDB2D57A65DE771F0EE730AD6300D9C3F053FBA46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

balloon.inf_amd64_b624a3307b73acf3.ini

Path C:\Windows\System32\DriverStore\FileRepository\balloon.inf_amd64_b624a3307b73acf3.ini
Size 416B
SHA256 6d0c087f06df727242bd345b1400c8380aba63a2da0e5861bebff865c7e85eaf
MD5 9c02e7b87001fea3836596c3c7b1e8f5
SHA1 baf29a781d97c9520c7f3a54a688539797c945a7
SHA512 4e2bf006c25a12bdc7d39899ff229121ca1d4972679801cc94747567ca3024b45ef9ef4d0da05f76b3451915216335916fbd4a9e5b90701b93d5293ddee40b53
TLSH
T1F8E0222720B8C1CDE508560A390A2E78E84AE75239E81ED47225C0A9FFD8C37DD8831F
MD5 SHA1 SHA512 TLSH

Submit Download

fwcfg.inf_amd64_21edb5d97e83b551.ini

Path C:\Windows\System32\DriverStore\FileRepository\fwcfg.inf_amd64_21edb5d97e83b551.ini
Size 408B
SHA256 cf5d898902ceec5fa6a37663df9787c508d08dc37c62ab7e9919d3b149eb62e4
MD5 032b83011fd27eeb8fb0d8a294bb1cb7
SHA1 70d54273143c06008f5b01238a779f64056dd5e1
SHA512 22915b69a4ef9569e3d41e8f11cf1400fa665270cc60f4403df40950bf0c5fa9ec195540e4e908ebe2c149aa1c640455f334f278a61dba64c5f65e76b43b938f
TLSH
T182E0E5236575D7C908896086221D0E7AE404737A9E592CD63098E0A1CF288738C1A30F
MD5 SHA1 SHA512 TLSH

Submit Download

netkvm.inf_amd64_9549f21367c38756.ini

Path C:\Windows\System32\DriverStore\FileRepository\netkvm.inf_amd64_9549f21367c38756.ini
Size 528B
SHA256 8b039f07db7f5c539e5c8af7384ceff88fb39218da523f90e8107482dd8ec923
MD5 62a11b1bf2912860ef378aee03c47476
SHA1 8b05372e27857e04d7ca0361a2cf1d57954ea66b
SHA512 e41ea31bf46f114b8e2246ba5540457c8427cb4d89397849db9f0b3dee5d3dd164d9e61d2215c0be580f057dfdca9519ba1048f9e4a60ac0e689b732b0d1df8a
TLSH
T14AF0592242F4D2DDEE5B54D5162D7B32F111E50B759E2CC47258C820CF6583358487AF
MD5 SHA1 SHA512 TLSH

Submit Download

pvpanic.inf_amd64_8a24925b36a10eec.ini

Path C:\Windows\System32\DriverStore\FileRepository\pvpanic.inf_amd64_8a24925b36a10eec.ini
Size 416B
SHA256 960a36a3da4ae3208f986541c039bb729e11cd5058211b5661813eceac530f36
MD5 eebc4a412da80bc6568974a486fcf91e
SHA1 a90a571fcb38377b6f94c3a32677a768c81369c0
SHA512 0183d435a88d70f53ebbd856aba680b1ff85a5997896b47b0c9db1d4607f53763e4cc3e3bf03aa4dff51f5fb9cbd5a77db6581bb5a360613d63498217cb049eb
TLSH
T1F3E0E53201B8C0EA25046C06222C3BBDF025A175243618FA7044C9649F49D37B8DAE4F
MD5 SHA1 SHA512 TLSH

Submit Download

qemupciserial.inf_amd64_1c232c0b9627cd6f.ini

Path C:\Windows\System32\DriverStore\FileRepository\qemupciserial.inf_amd64_1c232c0b9627cd6f.ini
Size 321B
SHA256 bfcc18f76a45fc6d2fba5450a5991bc979ea3ffc302cb9bdc809054ba521e9dc
MD5 c9139811aaa5c5c30ea37b9cead8a0f4
SHA1 3367a996d0af64abb0081446e7e9e65fc9e56894
SHA512 6aa4ec2cbf1bbf62762e023e48adae7c94e21392413e9ee2d347023480069cfb6488b5c15be0ee5f9744b9e8c6710c612f6ed9cac6f58c10ddb5d478403b7194
TLSH
T155E0CD035B7986DA78056523519DB37BC859A05709633C9431D5C5D09E41C924DFEF0F
MD5 SHA1 SHA512 TLSH

Submit Download

viofs.inf_amd64_60034dd27c706087.ini

Path C:\Windows\System32\DriverStore\FileRepository\viofs.inf_amd64_60034dd27c706087.ini
Size 408B
SHA256 74f535ab36ab4dd49b17c2a9bf2861d9342d68b521fe05205527fcc9de260719
MD5 4fb8d7a3cfc515e75c3e853cfe66c82e
SHA1 0278fa5788a03da1ef3b256e000401ea19ddf0a6
SHA512 c94590000653f6fd1bb9688f5098dbbb90e559fad5d5bc74ccfe7a3d4e7fe3cb94011609c320b93f4e4aabb28985d752d36826476da0dc9cc7816766e8a6b386
TLSH
T1B1E0E52398F882EC560EE815626C67B6C404A02614467CAD3154D530DF80C375DE4A6F
MD5 SHA1 SHA512 TLSH

Submit Download

viogpudo.inf_amd64_d1816df2ef9c583c.ini

Path C:\Windows\System32\DriverStore\FileRepository\viogpudo.inf_amd64_d1816df2ef9c583c.ini
Size 421B
SHA256 0fd7dbf8586919b4872512053f9bd63e2f3f5896b06f6d65a4d5221734ae5ba7
MD5 c5af9e2ddfa2780e0cff8381ea37d9da
SHA1 33615cfa37b9eb64c2d8f1670364bd8003cb0ffd
SHA512 d43b85d4e18921e3804e5f5513c4c5ef14d2186c04f5994e40f6111a7b0bde53a371a1d11f023e3a133ff7314eac99f09f228bfa9309119c3f3a95f46d51288b
TLSH
T1E0E0E5334CB5C1DD9A0978495A9DDB3AE041E10B54961CFA728EC831DF46CB68D8470F
MD5 SHA1 SHA512 TLSH

Submit Download

vioinput.inf_amd64_05905547bfcff1b1.ini

Path C:\Windows\System32\DriverStore\FileRepository\vioinput.inf_amd64_05905547bfcff1b1.ini
Size 536B
SHA256 4b3c8ae81ec33018d970220f5f17e379a901338c610f246c545372df75e0916c
MD5 a4d1546753be70f3245080e4f5689dc0
SHA1 9513e1b0a8a0666d6b1afb4e70af38154f513f44
SHA512 c53aa9e4f68f1bf5b947e6a4ecc00324df69e0c26d18215d59acf3f4e066e11690bcad9c8a24b25d87cf8db96268a1e82c06b55689e810381957d4351ff621d4
TLSH
T137F0F66758A2C0D915090C2A739C8A36E011910968E3ACE93019DC70DF8A5765EA8F4F
MD5 SHA1 SHA512 TLSH

Submit Download

viomem.inf_amd64_a2830ae0e9bc5caa.ini

Path C:\Windows\System32\DriverStore\FileRepository\viomem.inf_amd64_a2830ae0e9bc5caa.ini
Size 412B
SHA256 20f0877388a977d9f03a22fea0b372cedd3b3ef7027b87a6567a19fd48ac7950
MD5 72f1ede514431f8f98bd56e626191df9
SHA1 74a99ea552304edeb59d5d31a39bcd60bd98b39a
SHA512 220d83fb94ad0b4f4e06156dfc9a1f204fc7f0522b144b781152d931afb15fbc94139410388aacdb2d07f9a9dd2107b7b2f8bcb891d2aff1229614b73413d2d5
TLSH
T131E0E53354EAC19C094A487C021C0B77C4826B6864666CE930C2D9719F4B8B3AA56A5F
MD5 SHA1 SHA512 TLSH

Submit Download

viorng.inf_amd64_605e90aa654bcbb6.ini

Path C:\Windows\System32\DriverStore\FileRepository\viorng.inf_amd64_605e90aa654bcbb6.ini
Size 527B
SHA256 21145fa211642da22209634bd1b4777223351e063464dfde47641d1da8ce6a72
MD5 3f411c9d598ed74323f3171ea0bcf138
SHA1 163105094481e6dc476ec1af1181d50a73a3f261
SHA512 829197f901a3171cde9e3b34453c05cfd37caf392fb86033ae90e83e00849395a31befe1f54a6a429c9c3c7e117a028a483ef4cb9b1baa7eb63d2fb57706ac43
TLSH
T1A7F0242310B980CEA90AC829070C2F3ED013F09721DA2DE93249CD60CF9187749457AF
MD5 SHA1 SHA512 TLSH

Submit Download

vioscsi.inf_amd64_24727626b1893093.ini

Path C:\Windows\System32\DriverStore\FileRepository\vioscsi.inf_amd64_24727626b1893093.ini
Size 416B
SHA256 9740c419f6a433dca1bbd8a2ea3942d6d938697090a497a5ca1c044a853acb36
MD5 fee21f62dcd17e39cb2b10fd7e68b20c
SHA1 fe9c9bfc1d65ddfdcf9f42665d8b86bdf6a7a300
SHA512 6c8e96581cf24610af3ffc5506099e99f0bdee2d3d5b69444a1f9927ad7e643ecdae5adc575f282ce43cbe2b407c3dc906fb06b0b1601a013ea3998fd0fbdc41
TLSH
T108E0E523186C81D9541A5816127CAABAD404E11AA86238E93388D8A4CF85433FCD074F
MD5 SHA1 SHA512 TLSH

Submit Download

vioser.inf_amd64_5b2f5a60c17d1ff5.ini

Path C:\Windows\System32\DriverStore\FileRepository\vioser.inf_amd64_5b2f5a60c17d1ff5.ini
Size 412B
SHA256 d12a086d18220f70fd18e6a15b604748ff2ad034c75af4d30263aba4ec9cab9c
MD5 441801d302c9e1ec32d9d4c901fa9989
SHA1 910d74265f1b6c9193d53d799876c8042cbecdac
SHA512 b7e3bde1ab255fc8c9ff4cffc7d2b633606106fe944d310c2fbcf2ce99925f66a83def0ff2fff2cdce523f701b75185efa926d629a1e68474be9146654c55930
TLSH
T14AE02B2326B9D1EC16494C19233C9630D00DE003AC932AE93154E860DF48C33F9DA78F
MD5 SHA1 SHA512 TLSH

Submit Download

viostor.inf_amd64_92d16130a01291fb.ini

Path C:\Windows\System32\DriverStore\FileRepository\viostor.inf_amd64_92d16130a01291fb.ini
Size 416B
SHA256 7c09d5a948ca966a8f0f940a3ed7411899ad2bb5b93d80d402b9a5d99739b48c
MD5 9b7faeb9b61309bc55e759b774eedda2
SHA1 4b72d75c920750cfa524a7daf8df2c886a43ceae
SHA512 540dff4805599a945060eedf91bcbffbde783e292c1b538f12ab01e5725850b61c890432da7f027d627dcf13dfc7bed47ea7d5b585ae2fedc6cd3c2510fe5262
TLSH
T11BE02B37157481EB4D099805101C1F72D492E00638AA9CD97354ECA8DF46822EEF9F2F
MD5 SHA1 SHA512 TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 70KB
SHA256 076edda00a91410ae20ee554f76b1243db078898752cef4cf98dbccb291af491
MD5 a31a0dbf7855dc4ae1ad084c3ec7e8b5
SHA1 b0724703710bbd524fb5ba537fe4f6734458857d
SHA512 167a2172849a6e108289c6735e51999be5d5d5a381e7076fab7d851f3d1041bea3b7eeb6834efd9b3f3fea7fb1f8bfae9953b794b89784019300dc674cdf48c8
SSDEEP 1536:5dLAGlAJNMrzVF2AYDV5C9+hZ8Gcb0kfZBRyPzZQLT9wDT3TkqouH83+HeQ7FqpX:HGAX
TLSH
T14D63FB0580D8C609C9B609A27277EDB2D57A65DE771F0EE730AD6300D9C2F053FBA46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a2ec1ddf-3737-4bc8-88c0-4f4bdd70f023}_OnDiskSnapshotProp

Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a2ec1ddf-3737-4bc8-88c0-4f4bdd70f023}_OnDiskSnapshotProp
Size 6KB
SHA256 b0e63949b387084846a875e01a2d687a3a8b5cd6b3327e71d7175ae83a2dab45
MD5 9d255c17804f073a10ead546a59d6550
SHA1 79648233c89911cde65701e0926cda786171d801
SHA512 48a4662b09c15348ba9b28c8b4bc5679ed5db2fd1aecfa41ec7a067f25782552c448f4316a2c06080a973716dae910cb3bac2b66fe39a712be346e3322f3ba67
SSDEEP 96:FuPjFvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:4db++uVm
TLSH
T1DDD189184AF54711E2F3AB3129F18557A877B811EF33CB8E0198238E6671A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download