8bbac5e3de2ff10e1b2742db24c8b3d5ca582b5c2335f197e313eb117762b5dc

Analysis

user interaction
yes
max time kernel
93s
max time network
89s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirtualTabletServer_v4.1.7_setup.exe
Size 18.6MB
Sample261022-sd8w5ads5t
SHA256 8bbac5e3de2ff10e1b2742db24c8b3d5ca582b5c2335f197e313eb117762b5dc
MD5 6b4dfad41cb6d26146d392c913313358
SHA1 48b99e36438e92778d74c334fec6e60f9f432caa
SHA512 8afc598e3508eee79a21f833b0564e53a043ce583c4d5cb4d19a94bfabb1d1b31a711f23535d910744ec0cd99951f8bbcd553692bcbd4ba534d24739853502c1
SSDEEP 393216:8BkPia9O9LrJ1lXW1jVCsPKLL+MUzfMc0cCNLyaj+WBWMZ:tPnQ9hDW1xzPK3+MU1MyalIMZ
TLSH
T1D717222E62A4D0A8C0A536F693D04131AE256C4B2F13536A85B7FD183A36717ED7B33D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\SETB31A.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SETB31A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\vmulti.sys	DrvInst.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\8413A7E1406922827469E153B915B332E9FC2E06\Blob = 0300000001000000140000008413a7e1406922827469e153b915b332e9fc2e066b0000000100000020000000ab0f32cc412a51a51919d764cf13c47e2cc474a4b0580c0ab2a720e5c555f0191400000001000000140000004b508e25d3731d883dfca45d431f8d8ce1fddf9e19000000010000001000000011b1abf10b57554ff3b4a994ab0ad2b40f000000010000001400000083bdcb43d4f1ce231ca1c6621d73d2652a666a96200000000100000067050000308205633082044ba003020102021051dae209b624c219e3438dd09ac9b6c3300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3132313032393030303030305a170d3133313032393233353935395a3081a8310b3009060355040613024b52311430120603550408130b4779656f6e6767692d646f311330110603550407130a53656f6e676e616d736931163014060355040a140d53756e6e7973696465536f6674313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e207632311630140603550403140d53756e6e7973696465536f667430820120300b06092a864886f70d0101010382010f003082010a02820101009e7805c520621f2cb8fd9c04715bd769e9e3ed2ea087b18f204460346a4623334dd9871f72ac49e2910a11cad2865b628ddff41f5853ac7ed4a3eb8c23153785fea1f7fa61a366bcadf0a9599dcd8706207f151e75c44df16096788a98b6dcd87f29caa45787422e8bad10c2657f548226b5df287563611933d2dbff14104194f65ce089a9921574e23afdd270d81f11e39f6f10e9e25369652ce74219a4e586b31fd227c993050553c4f66d38a61bec1eb6c466e834d35d9a79854d4121eccf5bee48a2d42f4367c111656162c829aa2f492dd0057d470d8ef12a2691a50c9f1551d66e0ca3f2c4503cdee49dfc1cc5c8213641e50387b92ad3a1970a126e710203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d01010505000382010100b35f570ff2b113bed0692d09a5494ea250170b8060fc3ed9195e9ee0fb6104a15929e1bdc5d48b6b68b6cd05d847a19d6f084d45ca5f29c50819a2d3d55ded68ccf443ab0880cc90f994559bc9b8031af0760de337bf5b602fece38b2912a08c144ea700dc41fd0865a2613b977fbde671091e07a185f27920332099ddb89a83bbc6ac6218806db9f02efd2549fd5e699edf5a1b90376fb3e4c12fa04d5e57661129f0cd48928075ca430e8162c7989c532493ae3d6738e4c152b260c69f4aafc7a74628c152dcba7a85fe7aee993c4dc2072e9dd7a8273edc6e8559bc575b753fea6c12ff71e04509dfab38d6af0329a9370b1c28f537b45f9347dbc7d7a423	DrvInst.exe

Executes dropped EXE 10 IoCs

pid	Process
1188	VirtualTabletServer_v4.1.7_setup.exe
2836	VirtualTabletServer_v4.1.7_setup.exe
5448	VirtualTabletServer_v4.1.7_setup.exe
1644	VirtualTabletServer_v4.1.7_setup.exe
4696	DrvInst.exe
5320	VirtualTabletServer_v4.1.7_setup.exe
1352	DrvInst.exe
4596	VirtualTabletServer.exe
2148	adb.exe
5680	adb.exe

Loads dropped DLL 22 IoCs

pid	Process
1188	VirtualTabletServer_v4.1.7_setup.exe
1644	VirtualTabletServer_v4.1.7_setup.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe
2148	adb.exe
2148	adb.exe
5680	adb.exe
5680	adb.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{B52B27EB-1475-462E-9302-77C271A77AD0} = "\"C:\\ProgramData\\Package Cache\\{B52B27EB-1475-462E-9302-77C271A77AD0}\\VirtualTabletServer_v4.1.7_setup.exe\" /burn.clean.room /burn.runonce"	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{B52B27EB-1475-462E-9302-77C271A77AD0} = "\"C:\\ProgramData\\Package Cache\\{B52B27EB-1475-462E-9302-77C271A77AD0}\\VirtualTabletServer_v4.1.7_setup.exe\" /burn.clean.room /burn.runonce"	VirtualTabletServer_v4.1.7_setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_8055adba11dd5eee.ini	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_8055adba11dd5eee\vmulti.PNF	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	rundll32.exe
File created	C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\SET9447.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	rundll32.exe
File created	C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\SET945A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\WdfCoInstaller01011.dll	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_8055adba11dd5eee\vmulti.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\SET9459.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\SET9459.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\vmulti.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\SETB31B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\vmulti.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\SET945A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\vmulti.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	rundll32.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	rundll32.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_8055adba11dd5eee\WdfCoInstaller01011.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_8055adba11dd5eee\vmulti.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}	DrvInst.exe
File opened for modification	C:\Windows\System32\WdfCoInstaller01011.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\SET9447.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\SET9448.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\SET9448.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	rundll32.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_8055adba11dd5eee\vmulti.sys	DrvInst.exe
File created	C:\Windows\System32\SETB31B.tmp	DrvInst.exe

Drops file in Program Files directory 41 IoCs

description	ioc	Process
File created	C:\Program Files\VirtualTablet Server\screen_retriever_windows_plugin.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\adb\adb.exe	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\assets\images\feature_image.png	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\Drivers\vmulti.inf	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\Drivers\vmulti.sys	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\VirtualTabletServer.lib	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\fmt.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\NativeAssetsManifest.json	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\assets\images\icon_round_margin.png	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\firebase_core_plugin.lib	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\msvcp140.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\assets\images\vt_icon_tray_linux.png	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\nsd_windows_plugin.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\vcruntime140_1.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\app.so	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\AssetManifest.bin	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\FontManifest.json	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\adb\AdbWinApi.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\fonts\MaterialIcons-Regular.otf	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\Drivers\DrvInst.exe	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\WinSparkle.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\window_manager_plugin.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\icudtl.dat	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\NOTICES.Z	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\assets\images\virtual_tablet_concept.png	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\assets\images\vt_icon.ico	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\assets\images\vt_icon_tray.png	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\shaders\ink_sparkle.frag	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\url_launcher_windows_plugin.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\connectivity_plus_plugin.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\flutter_windows.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\adb\AdbWinUsbApi.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\packages\cupertino_icons\assets\CupertinoIcons.ttf	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\tray_manager_plugin.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\data\flutter_assets\shaders\stretch_effect.frag	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\Drivers\WdfCoinstaller01011.dll	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\Drivers\vmulti.cat	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\VirtualTabletServer.exe	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\VirtualTabletServer.exp	msiexec.exe
File created	C:\Program Files\VirtualTablet Server\flutter_secure_storage_windows_plugin.dll	msiexec.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIBBB6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF05DF21D1C90E9723.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8860.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\{71634711-91AC-4FFC-B320-460E78E073A2}\vt_icon.ico	msiexec.exe
File created	C:\Windows\Installer\e598036.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8A0C7C71A2C5EB10.TMP	msiexec.exe
File created	C:\Windows\Installer\{71634711-91AC-4FFC-B320-460E78E073A2}\vt_icon.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\SystemTemp\~DF99E9DC0159F226CD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAA6902D2B7973DD7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCD63B5B027DFF71C.TMP	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\SystemTemp\~DF93BFDAC79E030CE7.TMP	msiexec.exe
File created	C:\Windows\Installer\e598032.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e598032.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{71634711-91AC-4FFC-B320-460E78E073A2}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9A6159ABEF42D782.TMP	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	VirtualTabletServer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	VirtualTabletServer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rundll32.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lighting	ctfmon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe

Modifies registry class 47 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{B52B27EB-1475-462E-9302-77C271A77AD0}	VirtualTabletServer_v4.1.7_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11743617CA19CFF43B0264E0870E372A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11743617CA19CFF43B0264E0870E372A\FT_VTServer = "FT_RootFeature"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B8B9969FDB3B8A245AB9A4DF17CFE5AE\11743617CA19CFF43B0264E0870E372A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B52B27EB-1475-462E-9302-77C271A77AD0}\ = "{B52B27EB-1475-462E-9302-77C271A77AD0}"	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B52B27EB-1475-462E-9302-77C271A77AD0}\Version = "4.1.7"	VirtualTabletServer_v4.1.7_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B52B27EB-1475-462E-9302-77C271A77AD0}\DisplayName = "VirtualTablet Server"	VirtualTabletServer_v4.1.7_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{71634711-91AC-4FFC-B320-460E78E073A2}_v4.1.7	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{71634711-91AC-4FFC-B320-460E78E073A2}_v4.1.7\ = "{71634711-91AC-4FFC-B320-460E78E073A2}"	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{71634711-91AC-4FFC-B320-460E78E073A2}_v4.1.7\Version = "4.1.7"	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11743617CA19CFF43B0264E0870E372A\FT_RootFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{71634711-91AC-4FFC-B320-460E78E073A2}v4.1.7\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{71634711-91AC-4FFC-B320-460E78E073A2}_v4.1.7\Dependents\{B52B27EB-1475-462E-9302-77C271A77AD0}	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B52B27EB-1475-462E-9302-77C271A77AD0}\Version = "4.1.7"	VirtualTabletServer_v4.1.7_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{71634711-91AC-4FFC-B320-460E78E073A2}_v4.1.7\Dependents\{B52B27EB-1475-462E-9302-77C271A77AD0}	VirtualTabletServer_v4.1.7_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B52B27EB-1475-462E-9302-77C271A77AD0}\Dependents	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{71634711-91AC-4FFC-B320-460E78E073A2}_v4.1.7\ = "{71634711-91AC-4FFC-B320-460E78E073A2}"	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\PackageCode = "318E694C8AB42F44CA2977E846187CF4"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\Version = "67174407"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B8B9969FDB3B8A245AB9A4DF17CFE5AE	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\SourceList\PackageName = "AppInstaller.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{B52B27EB-1475-462E-9302-77C271A77AD0}	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{71634711-91AC-4FFC-B320-460E78E073A2}_v4.1.7\DisplayName = "VirtualTablet Server"	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B52B27EB-1475-462E-9302-77C271A77AD0}\ = "{B52B27EB-1475-462E-9302-77C271A77AD0}"	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B52B27EB-1475-462E-9302-77C271A77AD0}\DisplayName = "VirtualTablet Server"	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{71634711-91AC-4FFC-B320-460E78E073A2}v4.1.7\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11743617CA19CFF43B0264E0870E372A\FT_DriverInst_x64 = "FT_Drivers"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{71634711-91AC-4FFC-B320-460E78E073A2}_v4.1.7\Dependents	VirtualTabletServer_v4.1.7_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B52B27EB-1475-462E-9302-77C271A77AD0}\Dependents\{B52B27EB-1475-462E-9302-77C271A77AD0}	VirtualTabletServer_v4.1.7_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{71634711-91AC-4FFC-B320-460E78E073A2}_v4.1.7	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{71634711-91AC-4FFC-B320-460E78E073A2}_v4.1.7\DisplayName = "VirtualTablet Server"	VirtualTabletServer_v4.1.7_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11743617CA19CFF43B0264E0870E372A\FT_Drivers = "FT_RootFeature"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\ProductName = "VirtualTablet Server"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\ProductIcon = "C:\\Windows\\Installer\\{71634711-91AC-4FFC-B320-460E78E073A2}\\vt_icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11743617CA19CFF43B0264E0870E372A\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{71634711-91AC-4FFC-B320-460E78E073A2}_v4.1.7\Version = "4.1.7"	VirtualTabletServer_v4.1.7_setup.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1060	msiexec.exe
1060	msiexec.exe
1060	msiexec.exe
1060	msiexec.exe
5080	TextInputHost.exe
5080	TextInputHost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	6124	vssvc.exe
Token: SeRestorePrivilege	6124	vssvc.exe
Token: SeAuditPrivilege	6124	vssvc.exe
Token: SeBackupPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeRestorePrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeShutdownPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeIncreaseQuotaPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeSecurityPrivilege	1060	msiexec.exe
Token: SeCreateTokenPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeAssignPrimaryTokenPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeLockMemoryPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeIncreaseQuotaPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeMachineAccountPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeTcbPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeSecurityPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeTakeOwnershipPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeLoadDriverPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeSystemProfilePrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeSystemtimePrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeProfSingleProcessPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeIncBasePriorityPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeCreatePagefilePrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeCreatePermanentPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeBackupPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeRestorePrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeShutdownPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeDebugPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeAuditPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeSystemEnvironmentPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeChangeNotifyPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeRemoteShutdownPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeUndockPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeSyncAgentPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeEnableDelegationPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeManageVolumePrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeImpersonatePrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeCreateGlobalPrivilege	2836	VirtualTabletServer_v4.1.7_setup.exe
Token: SeRestorePrivilege	1060	msiexec.exe
Token: SeTakeOwnershipPrivilege	1060	msiexec.exe
Token: SeRestorePrivilege	1060	msiexec.exe
Token: SeTakeOwnershipPrivilege	1060	msiexec.exe
Token: SeBackupPrivilege	1904	srtasks.exe
Token: SeRestorePrivilege	1904	srtasks.exe
Token: SeSecurityPrivilege	1904	srtasks.exe
Token: SeTakeOwnershipPrivilege	1904	srtasks.exe
Token: SeBackupPrivilege	1904	srtasks.exe
Token: SeRestorePrivilege	1904	srtasks.exe
Token: SeSecurityPrivilege	1904	srtasks.exe
Token: SeTakeOwnershipPrivilege	1904	srtasks.exe
Token: SeLoadDriverPrivilege	4696	DrvInst.exe
Token: SeRestorePrivilege	5692	DrvInst.exe
Token: SeBackupPrivilege	5692	DrvInst.exe
Token: SeRestorePrivilege	5692	DrvInst.exe
Token: SeBackupPrivilege	5692	DrvInst.exe
Token: SeLoadDriverPrivilege	5692	DrvInst.exe
Token: SeLoadDriverPrivilege	5692	DrvInst.exe
Token: SeLoadDriverPrivilege	5692	DrvInst.exe
Token: SeRestorePrivilege	1060	msiexec.exe
Token: SeTakeOwnershipPrivilege	1060	msiexec.exe
Token: SeRestorePrivilege	1060	msiexec.exe
Token: SeTakeOwnershipPrivilege	1060	msiexec.exe
Token: SeRestorePrivilege	1060	msiexec.exe
Token: SeTakeOwnershipPrivilege	1060	msiexec.exe
Token: SeRestorePrivilege	1060	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1188	VirtualTabletServer_v4.1.7_setup.exe
1644	VirtualTabletServer_v4.1.7_setup.exe
4228	TabTip.exe
4228	TabTip.exe
4228	TabTip.exe
4228	TabTip.exe
4228	TabTip.exe
5080	TextInputHost.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4228	TabTip.exe
4228	TabTip.exe
4228	TabTip.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1060	msiexec.exe
4228	TabTip.exe
5080	TextInputHost.exe
5080	TextInputHost.exe
5080	TextInputHost.exe
5080	TextInputHost.exe
5080	TextInputHost.exe
4596	VirtualTabletServer.exe
4596	VirtualTabletServer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5500 wrote to memory of 1188	5500	VirtualTabletServer_v4.1.7_setup.exe	89
PID 1188 wrote to memory of 2836	1188	VirtualTabletServer_v4.1.7_setup.exe	90
PID 2836 wrote to memory of 1904	2836	VirtualTabletServer_v4.1.7_setup.exe	95
PID 5448 wrote to memory of 1644	5448	VirtualTabletServer_v4.1.7_setup.exe	100
PID 1060 wrote to memory of 4696	1060	msiexec.exe	101
PID 1092 wrote to memory of 1984	1092	DrvInst.exe	104
PID 1644 wrote to memory of 5320	1644	VirtualTabletServer_v4.1.7_setup.exe	113
PID 1060 wrote to memory of 1352	1060	msiexec.exe	114
PID 4596 wrote to memory of 2148	4596	VirtualTabletServer.exe	122
PID 2148 wrote to memory of 5680	2148	adb.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirtualTabletServer_v4.1.7_setup.exe
"C:\Users\Admin\AppData\Local\Temp\VirtualTabletServer_v4.1.7_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Windows\TEMP\{CDB196BB-B859-4B0B-BC7E-5512C17B93F9}\.cr\VirtualTabletServer_v4.1.7_setup.exe
  "C:\Windows\TEMP\{CDB196BB-B859-4B0B-BC7E-5512C17B93F9}\.cr\VirtualTabletServer_v4.1.7_setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\VirtualTabletServer_v4.1.7_setup.exe" -burn.filehandle.attached=636 -burn.filehandle.self=696
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\TEMP\{2C19595B-F26A-4A3F-9463-8D62BEB83A33}\.be\VirtualTabletServer_v4.1.7_setup.exe
    "C:\Windows\TEMP\{2C19595B-F26A-4A3F-9463-8D62BEB83A33}\.be\VirtualTabletServer_v4.1.7_setup.exe" -q -burn.elevated BurnPipe.{58A210DE-09A2-460A-80DC-25385AFB2307} {D37FDFB9-8CC2-4530-80E1-15CA71821448} 1188
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:6124

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files\VirtualTablet Server\Drivers\DrvInst.exe
  "C:\Program Files\VirtualTablet Server\Drivers\DrvInst.exe" install vmulti.inf djpnewton\vmulti
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4696
- C:\Program Files\VirtualTablet Server\Drivers\DrvInst.exe
  "C:\Program Files\VirtualTablet Server\Drivers\DrvInst.exe" remove vmulti.inf djpnewton\vmulti
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:1352

C:\ProgramData\Package Cache\{B52B27EB-1475-462E-9302-77C271A77AD0}\VirtualTabletServer_v4.1.7_setup.exe
"C:\ProgramData\Package Cache\{B52B27EB-1475-462E-9302-77C271A77AD0}\VirtualTabletServer_v4.1.7_setup.exe" /burn.clean.room /burn.runonce
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448
- C:\ProgramData\Package Cache\{B52B27EB-1475-462E-9302-77C271A77AD0}\VirtualTabletServer_v4.1.7_setup.exe
  "C:\ProgramData\Package Cache\{B52B27EB-1475-462E-9302-77C271A77AD0}\VirtualTabletServer_v4.1.7_setup.exe" /burn.clean.room /burn.log.append "C:\Users\Admin\AppData\Local\Temp\VirtualTablet_Server_20261022160158.log"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\ProgramData\Package Cache\{B52B27EB-1475-462E-9302-77C271A77AD0}\VirtualTabletServer_v4.1.7_setup.exe
    "C:\ProgramData\Package Cache\{B52B27EB-1475-462E-9302-77C271A77AD0}\VirtualTabletServer_v4.1.7_setup.exe" -q -burn.elevated BurnPipe.{B3655F99-6C26-4AF8-82B2-23E264F7ADB3} {2030D7C8-8F0C-46C7-A106-0A3F66278CE5} 1644
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    PID:5320

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "c:\program files\virtualtablet server\drivers\vmulti.inf" "9" "4b03c492f" "0000000000000168" "WinSta0\Default" "0000000000000178" "208" "c:\program files\virtualtablet server\drivers"
1⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{2B9192A4-4577-48D5-BB3A-DA0151CB8B26} Global\{42669C8C-2FDA-4493-A04A-3504B5A865B6} C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\vmulti.inf C:\Windows\System32\DriverStore\Temp\{9cc8526a-2952-6847-a056-107d5a3d8986}\vmulti.cat
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1984

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_8055adba11dd5eee\vmulti.inf" "oem1.inf:c14ce884b67bbc5d:vmulti.Inst:16.53.52.383:djpnewton\vmulti," "4b03c492f" "0000000000000168" "4d3d"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PenService -s PenService
1⤵
PID:4972

C:\Windows\system32\ctfmon.exe
/QuitInfo:00000000000001FC;0000000000000208;
1⤵
- Modifies data under HKEY_USERS
PID:1672

C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
/QuitInfo:000000000000022C;00000000000001FC;
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4228

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5080

C:\Program Files\VirtualTablet Server\VirtualTabletServer.exe
"C:\Program Files\VirtualTablet Server\VirtualTabletServer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files\VirtualTablet Server\adb\adb.exe
  "C:\Program Files\VirtualTablet Server\adb\adb.exe" devices
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Program Files\VirtualTablet Server\adb\adb.exe
    adb -L tcp:5037 fork-server server --reply-fd 608
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e598035.rbs

Path C:\Config.Msi\e598035.rbs
Size 16KB
SHA256 2f3713173354b9866254fa72da9710afde4fb4148c90bb4a1a6fb3167e6116f4
MD5 65cecd45346b8697a5438efdbcea3118
SHA1 d5edfffa0648824e20f51d5a1a6dc0f4edabf1ed
SHA512 e3e0fc81201285e1835d54d490a820eafe19e965359f283676c69d5f1f4030021c861040e25cb347b50d9b5a9df79abb56c282f5f399140753e958bc1e13ef2a
SSDEEP 384:dw1ipjbJK3T3nD3NPJvWQlotgJaPEe5+nQp3ErpPx+bcjbw9jbw9L5R50P2K:dw1ipjbJK3T3nD3NPJvWQlotgJaPEe5L
TLSH
T1817254404F04FBE2F8524B35CB1397A9771BDEC85631C28F5A8C815BBD82BE44AAD197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e598039.rbs

Path C:\Config.Msi\e598039.rbs
Size 3KB
SHA256 888ee897b9a04fc663c793d86661a58d3d3a0fd1fa9dd2b1989754c5cfc10448
MD5 15befdd608fc96aca2a6b3bb65d5dbc3
SHA1 a7cda703f4d3d12de945763af9d17d591005c4c7
SHA512 c0d8cd780fa2718826feb34dffe3183e31048d3868616eef6a8a9da8cbf26e21ee3e8e2e567d9277a104a143fc897cdee75361fd0910c24fd4ef5c7e45b205bc
TLSH
T1347189029B00EBD3ECA21B31CE170725777BDAE987348387048C91B56E87BD55FDA18A
MD5 SHA1 SHA512 TLSH

Submit Download

DrvInst.exe

Path C:\Program Files\VirtualTablet Server\Drivers\DrvInst.exe
Size 554KB
SHA256 a5979e5320bc93e0c862b465b6442eae3a9bf93b46fdf196dde7909f331fe47c
MD5 4733136b4866c29a1f6cb077449917c3
SHA1 bf6eb11f32fefc93f4c5c6fece060aca18f38156
SHA512 4bc8f380c5328ddeee4a2b0f0dd8ec857ec14726764a8f03134f649ee0df07141f316162c1299fda8c35fb5181d8f264e159d2a6e9aa73e1198f51533542a202
SSDEEP 6144:6/CdvpME1WVdWXyTW75WPaffd5qpB/clorYb93Fh+F5k+B1:yCd6E1WVmCFP8dspB0loe5FMMK
TLSH
T1BEC45C4273E503E5F1B3A23889758A51EAB3BC544B34D78F03E895661F23B918D7E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmulti.inf

Path C:\Program Files\VirtualTablet Server\Drivers\vmulti.inf
Size 2KB
SHA256 a752ed816ab1259da2e3c9a1ccfd55af86b11c1638b7f8ed76b4c8749bccb07d
MD5 72f61f9b84dd54dc761d9a40c49ffdc3
SHA1 d97de8e3b2b7722009933fbf64a9376243bf7f22
SHA512 ca52bf508a445e4f1ebb8c8429db07f7aaf17b8445fe02604d6512e9daaf6aaceee713c7194891729d121291e140b6b93e8517cfe9c6e29ac34a34dc7b5f223b
TLSH
T124512F5D0F832BB4FAD3622D7B2324A3E21830104CE55D25F09EB24043EA69C973C6BB
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Program Files\VirtualTablet Server\VCRUNTIME140_1.dll
Size 48KB
SHA256 e4e85eea1106d361923995e53a0b961a28d4fb58555f40945003f35e5bf2c273
MD5 9410ee0771ff1c2007d9087a8c316a4b
SHA1 3f31b301b5a99a13486ddec08d25646d5ad510db
SHA512 434a32ca6c4fdd8ffeb45d1bdb4d9f3c1b1259a1260ae66eb241f8bd63524cd1a3ec29d5eefa2d2f266dd740273e69b6bb8a7771badb77e781dc789dc18de2c9
SSDEEP 768:GPIyGVrxmKqOnA4j3z6SCz7OezlC9znkwju9z6E:xBr87uWJvOezleznkwjqz6E
TLSH
T135235C9057788442E4AB86B0C1D6DE57BD7CFAA21B40968B07A0D14C2F63BC5FB3D21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VirtualTabletServer.exe

Path C:\Program Files\VirtualTablet Server\VirtualTabletServer.exe
Size 1.3MB
SHA256 0ad6ea0468896eec0766ecf884c1edd9aaa6175e282bfbe2652175deba0e81c8
MD5 78dfe90675ce670ec68e670cc4f8e197
SHA1 daab607fa96905a67a658e491d2279ddf2d0a1ec
SHA512 95d012798e31b2dd301143f128365a91c6fb1ef43154aa52a72da59599cfb0a6964fd7f69bf665a50c5ae7fe7feca433c7fbc12a6d6e0fe6a9016648c1ec2302
SSDEEP 24576:7KdkhM6t56HMdzUu+GoxOcPpQft/HTDmLQ9a5lbQADd0j12tN:edk3tgMNzbIp4HTSLQ9a5lbQAyj1
TLSH
T1BC555C27A25401FCD1ABC2B9CA968D12EB7174450371A7DF1BE49B622F676E04F3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinSparkle.dll

Path C:\Program Files\VirtualTablet Server\WinSparkle.dll
Size 2.7MB
SHA256 f3c86101e041db5476c4d491ab1175bfac22a26ce41046551b283ad74df27718
MD5 63ef89eaaeaa9fc7dc8207c080181b1b
SHA1 00b17c87f86857cde75f711849b892bdc6f77c75
SHA512 4924994a885ccdc05475c476245355bec8c659ac993a0514a4e97e126ba787cddcaa597f019f666ccad896f7b892010d3b833610a923393eaaad5b8288a376e7
SSDEEP 24576:Wbn+fbzelhSytKX9geCR4KpvSxVHxY81ciYxgFoOVU7DfyAed/jpmlM5D+3/il/N:Wbn+Iq9ge5KuVRY8KiY1+Aed/Qe5D+i
TLSH
T16ED59E1BB6A401BEE4EAD238C9175E57E3F1F8160630E74F12A4066E5FA77224F6E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdbWinApi.dll

Path C:\Program Files\VirtualTablet Server\adb\AdbWinApi.dll
Size 105KB
SHA256 689e4263252c734ee40d748f0e5a911801c6083a8e81b5040fd9c49dff3bfdce
MD5 7814766c7c6d8bfb09ad071512843556
SHA1 c7ceaa300f9bcc501606dac8cc0039fc18600b9d
SHA512 1904cbc41033cb7c9e9f4b27c12fe69ba449d630d5f95b769e2a8001a5de54eaf8e6ba4bd66d4cece7f2fe5a400c59bdf06c67253bd0c903dcc50faf30de1d28
SSDEEP 1536:nwqdq+3pvspmLh8SCykrpTG7kfGHuNezq02XJqo+iFi1yCPo7nxx47:nwqD3L8Tezq0et+ui1yJk7
TLSH
T10DB36B327891C072C8D761B919ECF76592BEF5A10B7489C3339803DACE653C26B7529B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdbWinUsbApi.dll

Path C:\Program Files\VirtualTablet Server\adb\AdbWinUsbApi.dll
Size 71KB
SHA256 e6141805bb19eeafac6ab2d0fb50aa098b8c27149dc8ed73739cc40436274748
MD5 d070bde6d02d13d0965313fdb7dfdfc3
SHA1 151867f1544085e40cc71ecf402a29df28f85aa1
SHA512 a163207c61ff8ac917d6b8246ce92d04fbc16915cb9f5bc309c1ee8f9c85a0926f9475c81e050d9d454f5d535085b5691a88b87b944472a99212bfbd30e6f37d
SSDEEP 1536:672doFmOiHizFbPlspcsbj5ZsP+YeTs1pc75WxdO:6SSfN9+YeTs1pcFB
TLSH
T1A4736C227990C472CC9655B818ECE621A57FBA511BB084D3779C03EBDE203D1BBB9397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adb.exe

Path C:\Program Files\VirtualTablet Server\adb\adb.exe
Size 5.6MB
SHA256 58765259a349cce392fbb2f15dab75fed3b7c0b40cc68a7653278b9850602a2f
MD5 cdde1e5edb57c8f82627a5bde94b0591
SHA1 34ccd60a84a419948e3f63f52d6a48754bdcf4c8
SHA512 57247413526b9532088a9912f2bad7eadf4194a8de51641ef2823e7a491088aa7fcade116b16084a2bca023f1e5aa48027988f323489367436fce34baf8791ee
SSDEEP 49152:LlcnzEo9cKh82qZClOHpKDa0BqCcgnu4ZmNpINFqb8Vm92zwzvvuY+rmFWZZhxL+:M1BflOHpKeMnu46pINw28QxXGLxcivL
TLSH
T12E568D49E693A1B9DE4314B0206FB33FAF344704C714CEF7C7E4DE746862A92293A659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

connectivity_plus_plugin.dll

Path C:\Program Files\VirtualTablet Server\connectivity_plus_plugin.dll
Size 97KB
SHA256 61c803f50d472eb92ad859af9bb210d7153f2b5aa7baa5ddbcf4cdd2f02aa3c3
MD5 0be2585fe87550efa2cc46b6aa3e695f
SHA1 a11793c8cff7b53a9e2def4eb2e7f77825df9cbc
SHA512 868737737191be11e457efc242897e568ba5c31775f1fb91fddb0ffe40674ffc9075b6bae0bb497f6fcdbf8c48a7bfb9d634593e611a22515ccfcc62895daa0f
SSDEEP 1536:zfifelyQfKRtxykA6Mo3rxbIfjk9gaa7266QjLO4Jvp0GOWB:in3RtxykA6dsjWAa66QPO4JvpfOW
TLSH
T156A32B3BBA6D50ABD259C47CCA574905DB72B8C54B91A7CF17900BDA0E67BE40F3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Program Files\VirtualTablet Server\data\app.so
Size 9.2MB
SHA256 2fadf764ff5adbca9fbef11fc1d0ad7c524a1d80b56ce9a9096c006d6775ccbe
MD5 5f65eef79f50f43cf96e10e3eb697743
SHA1 49eda75c69d93e92c6f341d1d6cbe116c0d71d78
SHA512 ab706ab3e15006c33bd695c31bbba926793c07bf72401f18fbef2d76c015c79a188612ff96821722f3459a3f404eefdd29fd93918d5756553ca1b23bd99da7de
SSDEEP 98304:CWmptYZB42SrdtTkh1OrGrZ4A8f0xTZHCKF:fQWZXSrdtTkh1OeZ58EHCKF
TLSH
T1B0A61A87E4A48360C463CB72BB5F62E29D247DCC4F71774A198856263E97DA04ECE732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FontManifest.json

Path C:\Program Files\VirtualTablet Server\data\flutter_assets\FontManifest.json
Size 208B
SHA256 cd7e03645bc44b2dd47b7cb626f51c4ecbf55a197ab77241628b47ac165fbe21
MD5 dc3d03800ccca4601324923c0b1d6d57
SHA1 bca264548730f8b1871672891b0ad0c02444bfaf
SHA512 eda04affa31ef1d3fe4b081762380a6a5a9364a48e7b6998e870c84495f51a9658724e3f496d90a574f7d5e13740dcf47ccc1c7914b77b6ef0826fe87379cdf8
TLSH
T106D0C74B581909F6458D9845F0E11253BC4429579E46DCCDE3A40E54D3A11641739213
MD5 SHA1 SHA512 TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Program Files\VirtualTablet Server\data\flutter_assets\NativeAssetsManifest.json
Size 45B
SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
MD5 f3a664e105b4f792c6c7fe4e4d22c398
SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
MD5 SHA1 SHA512

Submit Download

vt_icon.ico

Path C:\Program Files\VirtualTablet Server\data\flutter_assets\assets\images\vt_icon.ico
Size 361KB
SHA256 730feeed166fddbff0a2df6aaa3901c505b03f3b2d6f6ddbd2e83314afd44017
MD5 69e77e2bdc6c25eba26696bcbc1bf17a
SHA1 8a408140884c0c7f51dcd067abd1855908c8c400
SHA512 2dd9491917be439d19ab78864549b02f9c3e9af5c74a7ac02a2e30e932e6a620efc08c1f0dff307486245639db9be631ed25652197149ae0e352fb27fa81032e
SSDEEP 384:FoKFlrrRrCZQ6roJg0FKqH6hm6liu/uohEL+NBvZAjHb48vNV4Yxd4Fq4:XFpJDFKqH6hmSDuk8+TYb46S
TLSH
T13D74A98F2592C104E5997EF867E1157806579D5B8C03EB3A1073FE1AB2B0B5BDE0227E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MaterialIcons-Regular.otf

Path C:\Program Files\VirtualTablet Server\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 6KB
SHA256 98f44fe854b1d3e1ca368c87fef8e8c49c27c9f0b768e80f9849951309c13dc4
MD5 06d0a035b08f90f86b33822ac5e08ab1
SHA1 3af2c3999a1b2fdecea5edcaa0034a14fc1bc589
SHA512 7d9ccdebd42861c740251ff97f55be376a1c186b20063f056903e05cc440d1fe7df4e1237f0ea33f5d2616cb16bfad32fbadc07887c042b489dd99eb846cc189
SSDEEP 96:KFFgS+8dwxO6y1HEWuCJL5ixSbZf56qhTN5pJI5iCc7qGM:YuxgDkGZ5RNt3Cc73M
TLSH
T10FD1F711CCA907DED09791B5C3F24D2512F6E60B59668F49EFF23E10EC194A8B89BB07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files\VirtualTablet Server\data\icudtl.dat
Size 844KB
SHA256 325a86063d26334c2eabe1743cea073b612540fbf3d8fc2ef0b5708e3763a8c7
MD5 cee672a686e2d4b707d0f5cded0b7440
SHA1 4cf439c3e5cceb755618fe158648367596147b50
SHA512 8668ed087a6a36f2c69aa1172bb169421deb3a8bae50effeee7bc8443e5c7421a783aee588a15626448fdfa80242a7672ed998f0415437523de57928ffc0516f
SSDEEP 12288:0Mlhw771h0jM7ykPG07Tr4c8w0P4N48RkjtOdPHz982VVq:Rhw3zVtjbbGu4RjOPHzBq
TLSH
T17F055A13B0835F5FE0D981B2C652E7B65632834DAB7317DAB698B5993ECF0C60241BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_secure_storage_windows_plugin.dll

Path C:\Program Files\VirtualTablet Server\flutter_secure_storage_windows_plugin.dll
Size 158KB
SHA256 433a68aefe0650fdcbaba3184d9746519612c2a735e2a6991e9c9ba652279f34
MD5 d7ec4526b71f1abca42f45d05559ca37
SHA1 d649862d3ef849093434cf61fdb621db2de6d4fd
SHA512 15a1a591b2da12a5685ff8814345866aca8dae3c00fbaaf41b5417bb0e60e885c9aba3c4ca827618f1757a0ac1f0d197478e8927c8badeb5aadf96a05e3344ef
SSDEEP 3072:6pzUfqBKT8C4xeEUVzr2hhFE6T61qBuVdp84Wk94FQPbr64JI7ZD4:6pzeqB24xe/9rwhl61qmp84Wk94FQPqz
TLSH
T117F34B27B759007AE266D17CCA834A02E7727C460791A7CF07914BFA0F67BD86F3A611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Program Files\VirtualTablet Server\flutter_windows.dll
Size 20.3MB
SHA256 58aacd64492877c08a4b9566d2d9bd53cd475d31eb8d42b34f2a035e64a326e2
MD5 4448b9a608a6d092bd50566a2843617b
SHA1 d0bbdb5c7af54245ed1972b1e60c9d2f75b5b641
SHA512 bf10ad260566669cb338639367b282f4b9b64bc55e28648a5a537b2d44ae3df093e130df7a423e96fb490f13e3da43d46661220b46cba1857a3e9ffa1528a8f2
SSDEEP 196608:1PUC9sKXV8R5Omq2ZUNQ1A4kvW6xUx0TbhYZFp:1c+9VUOf2ZQR4kvW6003C7p
TLSH
T184275C03E29640EDC459E178971BAA27F670B84A0B24B6DF3B5C47213F66BE01B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fmt.dll

Path C:\Program Files\VirtualTablet Server\fmt.dll
Size 114KB
SHA256 5be27288ba635f983b21b49c884f0703fa04ac2867deac85194a9cbbf3226734
MD5 4e03cea1682abf503137471703fba78c
SHA1 959a9152be44f7280bd9505c010ee0fdcbc508fd
SHA512 29c3dae6d89888c7d69d8cb65630f5d5c36fb30c0043f4dd3a94e1b5862b5e8b668f0cc5a34e9393c67429dff46722dfd033d996ab2901fb0abc1a502626efa5
SSDEEP 3072:uY/Z/L7gvu7jV8rx76o0BegReG1Xri6jEdb4eX2djJviztpsXLVH0:uYa0IgYG1KdseX2dj4tpsXLVH0
TLSH
T12CB34929B79612E9D17EE1FDC552D442E3B238040B11ABDF07A28A895F177E97E7B300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\VirtualTablet Server\msvcp140.dll
Size 559KB
SHA256 a030dc2dfd2eca28a9375c92989adf4daf161f988db5e16b9e10678eb0dff4c7
MD5 ebf8072a3c5c586979313f76e503aabf
SHA1 2fd9609f099a8f42b1b7ae40ad35be1569c0390e
SHA512 438c2db953606818b843e42c04240d510b5e398617e8e5539498264f93cf1893ae9a6b6b02ee35b169ae60b0e3b5621d7d9f7e2945d0f1e7c2e7e0c1e9e3c1de
SSDEEP 12288:APeu+VwM4PRpJOc8hdGE0bphVSvefAJQEKZm+jWodEEVwDaS:yqwpzStJQEKZm+jWodEEqD
TLSH
T1B3C40923B75905A0E195E3B8A1834316D7F0BC4A8322A3C752FBD69D2F673D5A73B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsd_windows_plugin.dll

Path C:\Program Files\VirtualTablet Server\nsd_windows_plugin.dll
Size 140KB
SHA256 8c294180dea4ab7bee70be4821adca35bd10c7da653a94dc9b37e5e087442002
MD5 3dc425c09b4fa67c82dc6f68e3b4138d
SHA1 4aed2d0e46ad991dc682fd2e444e8492c81121f4
SHA512 05d08c9d822cabf56eda6d71d1fd0a1c9f63cdcfb5d0c223157dbbce5bab881e49472aa650282e91b647d1296dc06e245f5b2ce418edf69abe7657944b9b5c26
SSDEEP 3072:CYWfi/ZDxc7UH56EHX09PcDB4nQAeVkqdCKst:CYe6ZDDH56EHXUkDB8QAeVkqdCKs
TLSH
T16BE33B2FF61D00B6D26AC1BCCE835946EB727C8507A197CF17904AE60F17AE85E3E611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_windows_plugin.dll

Path C:\Program Files\VirtualTablet Server\screen_retriever_windows_plugin.dll
Size 115KB
SHA256 12e01347a8c460ee1dcfea5c2e85cc83a23cfe98cc0ec4d0c61e99f071048435
MD5 e2f49f4098c2d3746f3bf836511df155
SHA1 a566653ce238dd66d264ade6472afe76bfda46b0
SHA512 5caa383864a9ba50d96f6e560b01d0562815107395d8b08dbb9d49f50fbf8f793e4e656ce34e824283988e90b184876ef1179004a7ba0667066aa702bb039674
SSDEEP 1536:hwLdpl+bzR+s+gdZaY06PdxrXkKkYV5wIkeQd3WH48dA+CPLXl:hWUzfAz67TBkYVyIpQd3K48dA+Yrl
TLSH
T105C31A6BFB5940BBD15AD4B8C9474946DB62BC814B91A7CF17900A9A0F27FE84F3E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tray_manager_plugin.dll

Path C:\Program Files\VirtualTablet Server\tray_manager_plugin.dll
Size 105KB
SHA256 ae20c9497c790f295de40f437b1f3b1ca9c58a44fc076886dfb9ef108fcbe65f
MD5 b087b4ee0363b070dd13f09f1979ed81
SHA1 19fa7d6128c661c3029b4782acb7bec05d10e554
SHA512 fdee8120eddbc9e9ee53892251e6189a38a68d36c056f6ed51bec4a6271f25efb82cf05698b045c163c325b693e8cc0a5ed5098a74b72dcdaa01385e1c1847cb
SSDEEP 3072:iDwXeBz6CBaEXNNpArckfd1iQ4BdffoK:iDZZ6CBaECckfd1iQ4Bdff
TLSH
T1C8B34C2BFA6D40ABD279D4B9C9438905DB72BC854791A7CF17900ADA0F27FE44E3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Program Files\VirtualTablet Server\url_launcher_windows_plugin.dll
Size 95KB
SHA256 2c5a7e709163e06c2ea7d31b7d64e4115868b3c98148fb45b4abce9297eab05d
MD5 93be30f8cfadad1eac7614bd85f136bd
SHA1 3084fd4f381beca63a7dbfe92fa56aff7a209862
SHA512 bdc3a516257a0b97f2c61ba0f5ba061a7f9d0f51359e7d0131ceefec273c7b99408a3d59af1f10099a2823b3c7a616c81c30167ff1268ceb816662c0a805d66e
SSDEEP 1536:BuX+3WS+W1xAyLk6jmRD7A1yV8ZlNYwoIQAWXV/CCf5X:wu3H+ey687TFrIQAyV/CCfx
TLSH
T12C932A3BEB5D40ABE299C478CA474901DB71BC854B91A7CF57904AD60F27BE84F3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\VirtualTablet Server\vcruntime140.dll
Size 116KB
SHA256 f843cd00d9aff9a902dd7c98d6137639a10bd84904d81a085c28a3b29f8223c1
MD5 699dd61122d91e80abdfcc396ce0ec10
SHA1 7b23a6562e78e1d4be2a16fc7044bdcea724855e
SHA512 2517e52f7f03580afd8f928c767d264033a191e831a78eed454ea35c9514c0f0df127f49a306088d766908af7880f713f5009c31ce6b0b1e4d0b67e49447bfff
SSDEEP 1536:KqvQFDdwFBHKaPX8YKpWgeQqbekRG7MP4ddbsecbWcmpCGa3QFzFtjXzp:KqvQFDUXqWn7CkRG7YecbWb9a3kDX9
TLSH
T16AC37C4573A802B7D62EC274C1E25E46EB75B5418770ABCF03B589AA0F13BE1AE3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Program Files\VirtualTablet Server\window_manager_plugin.dll
Size 127KB
SHA256 88fdc747d4f84a72b8676e9811287c74ecfebd0958d38735cc841b422e57e404
MD5 dd4e97e343574bd5c1af96df16e5465b
SHA1 c6bbb0597e0b0debe5d2c8f68a376f014bed725a
SHA512 77db65f5839aca5e058aa10f5f013b3466ff158f5811102e5c9e9c8218b04acdb2010d83c3ffe3c0620fbd0d7bfede2dcd028b7004ddc2745756e6b691f71cb5
SSDEEP 3072:DiSW75zVL1S0B6CIqajjRBegICAfd1icVDAaM:JWtzV5T6NqShnAfd1icVDAaM
TLSH
T1E3D35D2BF75910ABD16AD4B8CD438942DBB2B8854791A7CF07940A9B1F63BF44E3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{B52B27EB-1475-462E-9302-77C271A77AD0}\state.rsm
Size 1KB
SHA256 a7693d68a551255589df47c9e6c3520c83e4d2b5a23a3836dc4f018d133c848a
MD5 f1d8814b92830b28f802aabc77e5c397
SHA1 91a1462e515d8b98418d0c8f169977cdee17d0ab
SHA512 910eb338dc4405f400d412b1c129e1a02b111d6ab5f7aa7ff9ea5d8bbb33bbf678e07bbe4af1452b7074c74b50152d3adf665d048bf2fa297385ded6fbfc16e4
TLSH
T1BC116D626BF51818F3B7BB74BDB9575409BFBC121C24D12E0001714A9E71BD0CEA0722
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{B52B27EB-1475-462E-9302-77C271A77AD0}\state.rsm
Size 1KB
SHA256 ef1477b0a6910b82af204cba06c54697c238077a212305b73fdd243c99d2cc37
MD5 294c6407e9e92599ffd1b5ea984e6459
SHA1 c42b0a41e25984354dfe4776e8762d60075a220e
SHA512 d033f8793e33f57228dd44f9e6f62f996fae840bcd3a4203bc58d2a4a6fffc56b229e140731829c91dfac549dfa3e014de9b8dd30cc9010dc752119e6216f198
TLSH
T141116D626BF51818F3B7BB74BDB9575409BFBC121C24D12E0101714A9E71BD0CEA0722
MD5 SHA1 SHA512 TLSH

Submit Download

VirtualTablet_Server_20261022160158_000_AppInstaller.msi.log

Path C:\Users\Admin\AppData\Local\Temp\VirtualTablet_Server_20261022160158_000_AppInstaller.msi.log
Size 1KB
SHA256 65a1453db8e178d46741022438b9e8e559d7870554113e9d190867779c257180
MD5 d4a3bdcc4894dbb05e52a2fa71b41aeb
SHA1 df11fd9304c536bff5d8df4df140dfd8318a0cb6
SHA512 5b13fc924cb2b574fb98cb54a8129a06de9606cac32d07d1190bac46fd9e430a50809e0ad827009e165bc7df5c68fc84057f6538807398b5bdbcff1842852959
TLSH
T14241056D1EE50D05F1B797079AF3C0626A73FDD5A8349F0C23C58219066B806796C7BE
MD5 SHA1 SHA512 TLSH

Submit Download

AppInstaller.msi

Path C:\Users\Admin\AppData\Local\Temp\{2C19595B-F26A-4A3F-9463-8D62BEB83A33}\AppInstaller.msi
Size 18.6MB
SHA256 a5fd37e3238d9892593333e2d212afefb18662a9a8cbf2d4a1a8561075dd8649
MD5 cf36f05c8c491d476cfafa17cc758d66
SHA1 3cd4bd7bc01b66f57ec611c4792eb0725ab53e35
SHA512 045ebaa0cb68925f4d9b6e9551680d095fbb7cff048c823082790996b244d80b8bb8219e1a1db8a7264e8400a28cc1dde5ddb7cd3f716292d80bbb2c98f743bd
SSDEEP 393216:e7PHCRTWNg61vzvAfupVQrTtGOoYwti2WvOSN2WN2HI:e7P4T7YzvzVQvtGOoiOS/UHI
TLSH
T15C17330D62A1D068D41571F583E24630AA263C4B6F239BAA0777FD183A72763ED7633D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmulti.inf_amd64_8055adba11dd5eee.ini

Path C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_8055adba11dd5eee.ini
Size 397B
SHA256 c93f9529547f302eb48e3bb5997bf1d04b5120882534d35e3f9a4f1badcf2837
MD5 4ed2b2a9c63441a4e33a7080356e5c28
SHA1 4b3c72f185ceee2049092900fdd8a1242036668b
SHA512 2cd05813efca4d71789c7f5dd18061d9d81498ad552e7ecf024d810fbc0e6dd4535f60475fc855903c879cfb477dd37903016c6c504fccb0c8537549d4a43ebc
TLSH
T1B0E0925BABFC91AAB8A09853663C1433DC1D77575E9A3B993481A4401BCF9A83D04A83
MD5 SHA1 SHA512 TLSH

Submit Download

vmulti.inf_amd64_8055adba11dd5eee.ini

Path C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_8055adba11dd5eee.ini
Size 537B
SHA256 98d89462e2dc9472c6e75062943dc734a5733006de79965cbc5492c5d43d5925
MD5 c039d5960a25009233559f4c32a035a3
SHA1 ef52fcc848eba397ae261d1d19e58a1c96e75a8d
SHA512 695a324bc7782ffaa0eeebc691d52ca2550c7cb81b59f2106ec9453988d1b3ed634cac81f912b9bb5e539fc9f1ac83fa0db70324d0379f05d1d519cc70cc01a6
TLSH
T161F0905BA7F8919AB8A09857673C0437D80D7797495A2AD93481A4800B9B8A83E08E83
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{2C19595B-F26A-4A3F-9463-8D62BEB83A33}\.ba\logo.png
Size 4KB
SHA256 05a28f83ccdd456177a35213a83a1d78a1fd563fa88eb4dd17f612fc32b92437
MD5 c4b419eb2db55b63793791f008996449
SHA1 8e3e3fd449dafe6231bfd2ca5a511e8a3a497b92
SHA512 0fe00d342f15ba5ed1636f56e5e20a936f5abe99d1ffae517922dbfdd6a662117f6d67ae801bc9a7058af5219daf5537fe7c324cd429e9a89fc1779c38f0c8e0
SSDEEP 96:WSK25eQkmfwk9Z3QvMhUmTuFoWgMZlWPba88PJolfDwTW:Vl9FQvDnFc0QbnDP
TLSH
T10D815D2EE20268C0E28FF9C57CE0D236EE5306C558C4A59366DEC02914258A56BD7FC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{2C19595B-F26A-4A3F-9463-8D62BEB83A33}\.ba\wixstdba.dll
Size 366KB
SHA256 64ae3ecfb170f00f83e7ca4dee61a23023d48b22b79d0a28f13c52c133172cca
MD5 ae30aef6b62a24b80c560773264c7f47
SHA1 fc1befa879bc5c1d43440830c7155f51103d7a59
SHA512 994e3052a30e91f6731a0bae3bd20395dd648cfa9bfcb4283c4c7bb4539161e3c8cb67f355cfef5c2172cb0c7692f8acfbdca1cb185ab20148120c67d89dd53c
SSDEEP 6144:NLrnWYsODQJAR72amTe0JtWeHdhjH2DoAAOKQ8xZnBZpSO:BrXDDnV2ZTektW+ddkAvQ4ZBCO
TLSH
T1DA847B3AA7F004BAD4B74235D5A38222EF72785D375186AF9264852D1F3BBA074BF305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VirtualTabletServer_v4.1.7_setup.exe

Path C:\Windows\Temp\{CDB196BB-B859-4B0B-BC7E-5512C17B93F9}\.cr\VirtualTabletServer_v4.1.7_setup.exe
Size 1.3MB
SHA256 6b1f2ef7e771cf6e4d52a21932b70dd669c2adec71607502712a825e2aa33758
MD5 1033f21e76053ecf0a3323ec0e4d6c5c
SHA1 f3a3bfb3c326f535af4509b967785ff77f1b1cc2
SHA512 d928310aa730143226be3b7d25b7924207b9ab5ea9251fc7e0ce46ae1585088b6d47e48bb5b8181485c5d09ea415b54fde6839dbaef2f7c41a29699eb74caa77
SSDEEP 12288:ngjzmiDFn/NuYJFBl/m/PNP6gHlWlKSobpbqlpZ/TaAD2:ngjzmiDx/NuYJFmtP6Ul0kOljGA2
TLSH
T1C655C26E22A4D0A9C0B576F693C08131AE256C4B2F1357698577FD183A3A717EC7B23C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{F53262E6-BA54-4CB0-A3D7-5414571977E6}\.ba\BootstrapperApplicationData.xml
Size 2KB
SHA256 e472da710e643848aa8ae07825a06adc4731e0b93abdcc09e6efe27a6da4032b
MD5 1e9f443ffa072f08a2004ae49fc11e7a
SHA1 2170a207a959daf57c770b025e89061028c69a9d
SHA512 c8790250fe45bab60b5288100db4b58f6a5203b26c902f3c6f125bfb953cabaf55a9dc5ca188fc525a4446c6ec7fbb7c5d79ed473bd533918477801cebfa3504
TLSH
T10351A2567BFD1218F0F34F88FEB664621A79BD612D38DC2D01641D0D4972E8194A2FA7
MD5 SHA1 SHA512 TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{F53262E6-BA54-4CB0-A3D7-5414571977E6}\.ba\thm.wxl
Size 5KB
SHA256 3a4fbb839544c4b4e80827fcb3aa91648bb73a1e84359f207264ec4bd468ee4f
MD5 f65abbbe0c427fb3bf79b893f02e5ad9
SHA1 f050535eb2f52e609afcd790d7dd884aee55e938
SHA512 d28cd76a0045a44f99f20d49d78a499f78fd1c055992c07c7837650c6a0b4457a682e7d91e57b7e1175a1e1f706f7007176911f1130de6482541b207e2b21982
SSDEEP 96:HL/vK0c0vMcivL5MQP1+XS/cEOYJA0SCwZQipCeyAC:rHEbdYuwYK0r
TLSH
T1CFC1D36B58CFEFE02A736654B5F3988A3518C1D6432B2CF1F86A454B876710163B3753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{F53262E6-BA54-4CB0-A3D7-5414571977E6}\.ba\thm.xml
Size 9KB
SHA256 f4d1a8f2c43d4e377046016a63e57d3ce43760510776231b5af713956ab8cfc3
MD5 2e27445cc789ef1750d119a08771b5fc
SHA1 4080570e9917b1e0be7e37070b74036320e85528
SHA512 499da5a88718d7be4c623cfea7fe204ffe1b37299cf77ce3ecca149e39375d6e3883993036aa8d9948e6cb4be18157315364a98c08aa989ac9a229f4616a4b10
SSDEEP 96:8La14y0LuPzHMLlh4Hsj4ByR4GQBEc4LbOXCdFpQ+l4roJu5p6Fpws4xM:hfr4Oc7ToGP
TLSH
T1F712CCB946DDBC01C233E71267E326C2BF126972C1C46959B84E26BB4FF211078B766D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 f383711b03691d009947d7e8bc169c906c7f3e3591fcc9924dcbfbeca21e879c
MD5 15b607521cf6b1fe136176e7e9afcbe4
SHA1 4b54d05e32916aad596cf49794c8bf6123500b2f
SHA512 e00032dbd98cc6effd69704aad8117807466c221ae3c8d7150fc8bba8fc052c12b4a3d6f1cc55f42acc3621f424e98d0e935b42a3047d7325007b92dea960ee0
SSDEEP 24576:TFo3DMPidoO/vvTL/igWWyFgPbuMdLxlULwEd7I+gDY65hX2cYBmWPMXyu4:YHA
TLSH
T11557901436F92150E7F79E3CA8F0AA2349397D5B9C1ADE8D05411F4E0861FB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{100f81c2-deca-4ac5-9eb2-958126c92e53}_OnDiskSnapshotProp

Path \??\Volume{f0fdc120-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{100f81c2-deca-4ac5-9eb2-958126c92e53}_OnDiskSnapshotProp
Size 6KB
SHA256 db5035224cc4f29cdc2e9dc9f8eb39f5cd7c0ab1cd27948b23f991711c75cf4c
MD5 5c32532580e1d309a92d8c7d29e1b692
SHA1 b388cb2952ac13cb239b7b26aa9da5824aa9a01a
SHA512 97feb4b6a2b2cc776ef0d0233d02f96343432e27643eb225c7af2f6bfdda9a848a9384ce8091b4b42fcfcfe275c718d354def99599882d38670a3ab67b286783
SSDEEP 96:FrL+hvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:tmb++uVm
TLSH
T195D1891C5AF54711E2B3AB3128F18557A877B911EF33CB8E0198238E2670910F836F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WdfCoInstaller01011.dll

Path \??\c:\PROGRA~1\VIRTUA~1\drivers\WdfCoInstaller01011.dll
Size 1.7MB
SHA256 f6fb39a8578f19616570d5a3dc7212c84a9da232b30a03376bbf08f4264fedf2
MD5 d10864c1730172780c2d4be633b9220a
SHA1 b85d02ba0e8de4aeded1a2f5679505cd403bd201
SHA512 c161bfa9118e04eb60a885bf99758843c4b1349ac58d2e501dabbd7efc0480ec902ac9a2be16f850b218e97b022a90fcc44925d7b6e5113766621f7ade38b040
SSDEEP 49152:jRUp077GQSph1DxQOzAFXEfEacq1XT7HM:jSoe1GEf5j7HM
TLSH
T1AE85235187FC4099F5B2BF7193BAC9436A3ABD861A30C29E1780D89E19B2780DD65733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmulti.sys

Path \??\c:\PROGRA~1\VIRTUA~1\drivers\vmulti.sys
Size 9KB
SHA256 73902926ef3ce9c8f6b337284c90956e2e4717309f8aef4d0c7ba0394eab3664
MD5 73f306df9e8525b23600b6f00cd41392
SHA1 4a5c5fc5da4857bbe0a2e9fe3ed41516b85ccba5
SHA512 a0018cef5bf77290a4b69a51939deab4a0f685a849b07b769d9fea43ebd9bb5eeffd7d8b8a7042d4436fe5ba6439e8ba8d33dd55d4257d15c19e3eb6f2aa8049
SSDEEP 96:xmU6xtrnZetlT6coEv9QSOC+85PC9yE0HInG30ftQJKxjph49Nn4UE1Q:xmU6jZetwYdOKC9l0HMeMt0KxjpMZE
TLSH
T19712D69E636495CDD7A2833AC6B21A67BEB4B40467439FCF422583472E03FC4267D786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmulti.cat

Path \??\c:\program files\virtualtablet server\drivers\vmulti.cat
Size 8KB
SHA256 77d6367bd52f307fdef58b7246c944423ef6c7d136676acc651d5bee0f3d7d1e
MD5 84977b85e9e1d90d5c9dc3dbca70a75b
SHA1 eb0b57fb397b557f2ef15893137632ebffe95fee
SHA512 5886c3570b55ebe874ce6c1cc6fc59241ae06f934ff26ad4c61a9e4d4197c4164d8ce78ea1ef7a72d37284ccbcfecd2ba35a6896dd0a34299dce95ab3b4cde27
SSDEEP 192:h6lCyum335/wJirNmL/LrAo+v1XjtlAur9ZCspE+TMcreN2FcTl:he3mirILIdUHeMrN1x
TLSH
T1D702F8970A2D2462DCC6CFA0DACAD07FAD30B39A6CC4956610B642947E877F03B5951F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2836-204-0x00007FF6AA570000-0x00007FF6AA691000-memory.dmp

Download

memory/4596-240-0x000001B1F0880000-0x000001B1F11BD000-memory.dmp

Download

memory/4596-241-0x000001B1F0880000-0x000001B1F11BD000-memory.dmp

Download

memory/4596-243-0x000001B1F0090000-0x000001B1F0091000-memory.dmp

Download

memory/4596-239-0x000001B1F0080000-0x000001B1F0081000-memory.dmp

Download

memory/4596-242-0x000001B1F0880000-0x000001B1F11BD000-memory.dmp

Download