Kaynak: C:\Users\Medusa\Desktop\sonsa
Payload -> C:\ProgramData\vmstealth (whl: 3 dosya)
WHarden boot-gorevi kuruldu
===== 1/3 Registry cleanup =====
(guest_harden.log yazildi)
===== 2/3 Disk switch hazirlik (LSI SAS boot-start) =====
=== prep_switch 11:15:50 ===
boot-start OK LSI_SAS
boot-start OK storahci
boot-start OK stornvme
boot-start OK megasas
boot-start OK MegaSR
boot-start OK 3ware
boot-start OK amdsata
boot-start OK arcsas
boot-start OK HpSAMD
boot-start OK iaStorV
boot-start OK iaStorAV
boot-start OK nvraid
boot-start OK nvstor
boot-start OK vsmraid
boot-start OK atapi
boot-start OK intelide
boot-start OK pciide
boot-start OK vhdmp
boot-start OK SiSRaid2
boot-start OK SiSRaid4
boot-start OK uaspstor
boot-start OK mvumis
CDDB OK pci#ven_1000&dev_0054
CDDB OK pci#ven_1000&dev_0058
CDDB OK pci#ven_1000&dev_0056
CDDB OK pci#ven_1000&dev_0621
CDDB OK pci#ven_1000&dev_0622
>>> LSI_SAS hazir (Start=0). Disk lsisas1068'e guvenle gecebilir.
===== 3/3 VmwareHardenedLoader =====
kaynak: C:\ProgramData\vmstealth\whl
(kaynak = hedef, kopya atlandi)
kalici: C:\ProgramData\vmstealth\whl
cert olusturuldu: B98F654A8621DF4869750A35F5640F967720D25E
guven eklendi: Root
Import-Certificate : Erişim engellendi. (HRESULT özel durum döndürdü: 0x80070005 (E_ACCESSDENIED))
At C:\ProgramData\vmstealth\install_whl.ps1:36 char:5
+ Import-Certificate -FilePath $tmp -CertStoreLocation "Cert:\Local ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Import-Certificate], UnauthorizedAccessException
+ FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.CertificateServices.Commands.ImportCertificateCo
mmand
################## OZET ##################
>>> LSI_SAS hazir (Start=0). Disk lsisas1068'e guvenle gecebilir.
##########################################
[!] 'imza: Valid' + 'servis: vmloader' + 'LSI_SAS hazir' gordun mu?
TAMAMSA: VM'i KAPAT (shutdown /s /t 0) ve bana 'kapattim' yaz.
Press any key to continue . . .