Skip to content

Instantly share code, notes, and snippets.

@friuns2
Created July 23, 2018 16:22
Show Gist options
  • Save friuns2/9c5a72935972b291a82e93bff4cd7f70 to your computer and use it in GitHub Desktop.
Save friuns2/9c5a72935972b291a82e93bff4cd7f70 to your computer and use it in GitHub Desktop.
[Mon Jul 23 19:18:53 2018] [*] TLS process attach callback -> 0
[Mon Jul 23 19:18:55 2018] [*] TLS thread attach callback -> 1
[Mon Jul 23 19:18:55 2018] [*] Checking IsDebuggerPresent API -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking PEB.BeingDebugged -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking CheckRemoteDebuggerPresent API -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking PEB.NtGlobalFlag -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking ProcessHeap.Flags -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking ProcessHeap.ForceFlags -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking NtQueryInformationProcess with ProcessDebugPort -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking NtQueryInformationProcess with ProcessDebugFlags -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking NtQueryInformationProcess with ProcessDebugObject -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking NtSetInformationThread with ThreadHideFromDebugger -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking CloseHandle with an invalide handle -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking UnhandledExcepFilterTest -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking OutputDebugString -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking Hardware Breakpoints -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking Software Breakpoints -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking Interupt 0x2d -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking Interupt 1 -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking Memory Breakpoints PAGE GUARD -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking If Parent Process is explorer.exe -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking SeDebugPrivilege -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking NtQueryObject with ObjectTypeInformation -> 0
[Mon Jul 23 19:18:55 2018] [*] Checking NtQueryObject with ObjectAllTypesInformation -> 1
[Mon Jul 23 19:18:56 2018] [*] Checking NtYieldExecution -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking CloseHandle protected handle trick -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking NtQuerySystemInformation with SystemKernelDebuggerInformation -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking SharedUserData->KdDebuggerEnabled -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking if process in in a job -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking VirtualAlloc write watch (buffer only) -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking VirtualAlloc write watch (API calls) -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking VirtualAlloc write watch (IsDebuggerPresent) -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking VirtualAlloc write watch (code write) -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking if process loaded modules contains: avghookx.dll -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking if process loaded modules contains: avghooka.dll -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking if process loaded modules contains: snxhk.dll -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking if process loaded modules contains: sbiedll.dll -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking if process loaded modules contains: dbghelp.dll -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking if process loaded modules contains: api_log.dll -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking if process loaded modules contains: dir_watch.dll -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking if process loaded modules contains: pstorec.dll -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking if process loaded modules contains: vmcheck.dll -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking if process loaded modules contains: wpespy.dll -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking if process loaded modules contains: cmdvrt64.dll -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking if process loaded modules contains: cmdvrt32.dll -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking Number of processors in machine -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking Interupt Descriptor Table location -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking Local Descriptor Table location -> 1
[Mon Jul 23 19:18:56 2018] [*] Checking Global Descriptor Table location -> 0
[Mon Jul 23 19:18:56 2018] [*] Checking Global Descriptor Table location -> 0
[Mon Jul 23 19:18:57 2018] [*] Checking Number of cores in machine using WMI -> 0
[Mon Jul 23 19:18:57 2018] [*] Checking hard disk size using WMI -> 1
[Mon Jul 23 19:18:57 2018] [*] Checking hard disk size using DeviceIoControl -> 0
[Mon Jul 23 19:18:57 2018] [*] Checking SetupDi_diskdrive -> 0
[Mon Jul 23 19:19:02 2018] [*] Checking mouse movement -> 0
[Mon Jul 23 19:19:02 2018] [*] Checking memory space using GlobalMemoryStatusEx -> 0
[Mon Jul 23 19:19:02 2018] [*] Checking disk size using GetDiskFreeSpaceEx -> 0
[Mon Jul 23 19:19:02 2018] [*] Checking if CPU hypervisor field is set using cpuid(0x1) -> 0
[Mon Jul 23 19:19:02 2018] [*] Checking hypervisor vendor using cpuid(0x40000000) -> 0
[Mon Jul 23 19:20:02 2018] [*] Check if time has been accelerated -> 0
[Mon Jul 23 19:20:02 2018] [*] VM Driver Services -> 1
[Mon Jul 23 19:20:02 2018] [*] Checking SerialNumber from BIOS using WMI -> 0
[Mon Jul 23 19:20:02 2018] [*] Checking Model from ComputerSystem using WMI -> 0
[Mon Jul 23 19:20:02 2018] [*] Checking Manufacturer from ComputerSystem using WMI -> 0
[Mon Jul 23 19:20:02 2018] [*] Checking Current Temperature using WMI -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking ProcessId using WMI -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking power capabilities -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key HARDWARE\Description\System - Identifier is set to VBOX -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key HARDWARE\Description\System - SystemBiosVersion is set to VBOX -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key HARDWARE\Description\System - VideoBiosVersion is set to VIRTUALBOX -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key HARDWARE\Description\System - SystemBiosDate is set to 06/23/99 -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking VirtualBox Guest Additions directory -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\drivers\VBoxMouse.sys -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\drivers\VBoxGuest.sys -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\drivers\VBoxSF.sys -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\drivers\VBoxVideo.sys -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\vboxdisp.dll -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\vboxhook.dll -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\vboxmrxnp.dll -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\vboxogl.dll -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\vboxoglarrayspu.dll -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\vboxoglcrutil.dll -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\vboxoglerrorspu.dll -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\vboxoglfeedbackspu.dll -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\vboxoglpackspu.dll -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\vboxoglpassthroughspu.dll -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\vboxservice.exe -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\vboxtray.exe -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\VBoxControl.exe -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key HARDWARE\ACPI\DSDT\VBOX__ -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key HARDWARE\ACPI\FADT\VBOX__ -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key HARDWARE\ACPI\RSDT\VBOX__ -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key SOFTWARE\Oracle\VirtualBox Guest Additions -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key SYSTEM\ControlSet001\Services\VBoxGuest -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key SYSTEM\ControlSet001\Services\VBoxMouse -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key SYSTEM\ControlSet001\Services\VBoxService -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key SYSTEM\ControlSet001\Services\VBoxSF -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key SYSTEM\ControlSet001\Services\VBoxVideo -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking Mac Address start with 08:00:27 -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking device \\.\VBoxMiniRdrDN -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking device \\.\VBoxGuest -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking device \\.\pipe\VBoxMiniRdDN -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking device \\.\VBoxTrayIPC -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking device \\.\pipe\VBoxTrayIPC -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking VBoxTrayToolWndClass / VBoxTrayToolWnd -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking VirtualBox Shared Folders network provider -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking virtual box processe vboxservice.exe -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking virtual box processe vboxtray.exe -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking DeviceId from WMI -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking Mac address from WMI -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking NTEventLog from WMI -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking SMBIOS firmware -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking ACPI tables -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0 -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0 -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key SYSTEM\ControlSet001\Control\SystemInformation -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key SYSTEM\ControlSet001\Control\SystemInformation -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key SOFTWARE\VMware, Inc.\VMware Tools -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\drivers\vmmouse.sys -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\drivers\vmhgfs.sys -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\drivers\vm3dmp.sys -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\drivers\vmci.sys -> 1
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\drivers\vmhgfs.sys -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\drivers\vmmemctl.sys -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\drivers\vmmouse.sys -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\drivers\vmrawdsk.sys -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking file C:\Windows\system32\drivers\vmusbmouse.sys -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking MAC starting with 00:05:69 -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking MAC starting with 00:0c:29 -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking MAC starting with 00:1C:14 -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking MAC starting with 00:50:56 -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking VMWare network adapter name -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking device \\.\HGFS -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking device \\.\vmci -> 1
[Mon Jul 23 19:20:03 2018] [*] Checking VMWare directory -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking SMBIOS firmware -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking ACPI tables -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking Virtual PC processes VMSrvc.exe -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking Virtual PC processes VMUSrvc.exe -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key HARDWARE\Description\System -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking qemu processes qemu-ga.exe -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking SMBIOS firmware -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking ACPI tables -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking Citrix Xen process xenservice.exe -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking Mac Address start with 08:16:3E -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking Wine via dll exports -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking reg key SOFTWARE\Wine -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking Parallels processes: prl_cc.exe -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking Parallels processes: prl_tools.exe -> 0
[Mon Jul 23 19:20:03 2018] [*] Checking Mac Address start with 08:1C:42 -> 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment