Kaynak: C:\Users\Medusa\Desktop\ggg

Payload -> C:\ProgramData\vmstealth (whl: 3 dosya)

WHarden boot-gorevi kuruldu

===== 1/3 Registry cleanup =====

(guest_harden.log yazildi)

===== 2/3 Disk switch hazirlik (LSI SAS boot-start) =====

=== prep_switch 11:19:26 ===

boot-start OK LSI_SAS

boot-start OK storahci

boot-start OK stornvme

boot-start OK megasas

boot-start OK MegaSR

boot-start OK 3ware

boot-start OK amdsata

boot-start OK arcsas

boot-start OK HpSAMD

boot-start OK iaStorV

boot-start OK iaStorAV

boot-start OK nvraid

boot-start OK nvstor

boot-start OK vsmraid

boot-start OK atapi

boot-start OK intelide

boot-start OK pciide

boot-start OK vhdmp

boot-start OK SiSRaid2

boot-start OK SiSRaid4

boot-start OK uaspstor

boot-start OK mvumis

CDDB OK pci#ven_1000&dev_0054

CDDB OK pci#ven_1000&dev_0058

CDDB OK pci#ven_1000&dev_0056

CDDB OK pci#ven_1000&dev_0621

CDDB OK pci#ven_1000&dev_0622

>>> LSI_SAS hazir (Start=0). Disk lsisas1068'e guvenle gecebilir.

===== 3/3 VmwareHardenedLoader =====

kaynak: C:\ProgramData\vmstealth\whl

(kaynak = hedef, kopya atlandi)

kalici: C:\ProgramData\vmstealth\whl

cert mevcut: B98F654A8621DF4869750A35F5640F967720D25E

guven zaten var: Root

guven eklendi: TrustedPublisher

imza: Valid

servis: vmloader (type=kernel start=system)

DynDataDirectory = C:\ProgramData\vmstealth\whl

>>> vmloader YUKLENDI (calisiyor).

=== install_whl 11:19:28 ===

kaynak: C:\ProgramData\vmstealth\whl

(kaynak = hedef, kopya atlandi)

kalici: C:\ProgramData\vmstealth\whl

cert mevcut: B98F654A8621DF4869750A35F5640F967720D25E

guven zaten var: Root

guven eklendi: TrustedPublisher

imza: Valid

servis: vmloader (type=kernel start=system)

DynDataDirectory = C:\ProgramData\vmstealth\whl

>>> vmloader YUKLENDI (calisiyor).

################## OZET ##################

>>> LSI_SAS hazir (Start=0). Disk lsisas1068'e guvenle gecebilir.

imza: Valid

servis: vmloader (type=kernel start=system)

DynDataDirectory = C:\ProgramData\vmstealth\whl

>>> vmloader YUKLENDI (calisiyor).

##########################################

[!] 'imza: Valid' + 'servis: vmloader' + 'LSI_SAS hazir' gordun mu?

TAMAMSA: VM'i KAPAT (shutdown /s /t 0) ve bana 'kapattim' yaz.

Press any key to continue . . .